software_malware_execution.json

{
    "name": "Software (malware) Execution",
    "description": "All techniques that can be executed by software of subtype malware, where the score is the count of malware using the technique",
    "version": "3.0",
    "domain": "mitre-enterprise",
    "techniques": [
        {
            "techniqueID": "T1070.006",
            "comment": "executed by 3PARA RAT, Attor, Bankshot, China Chopper, Derusbi, Elise, FALLCHILL, Gazer, InvisiMole, KeyBoy, Misdat, OwaAuth, POSHSPY, PowerStallion, Psylo, SEASHARPEE, Shamoon, TDTESS, USBStealer",
            "score": 19
        },
        {
            "techniqueID": "T1071.001",
            "comment": "executed by 3PARA RAT, 4H RAT, ABK, ADVSTORESHELL, Agent Tesla, Aria-body, Avenger, BACKSPACE, BADNEWS, BBK, BBSRAT, BUBBLEWRAP, BackConfig, BadPatch, Bankshot, Bisonal, BlackEnergy, Bundlore, CHOPSTICK, CORESHELL, Carbanak, Cardinal RAT, ChChes, China Chopper, CloudDuke, ComRAT, Comnie, CosmicDuke, CozyCar, DarkComet, Daserf, DealersChoice, Dipsind, DownPaper, Dridex, DustySky, Dyre, ELMER, Elise, Emissary, Epic, EvilBunny, Exaramel for Linux, FELIXROOT, Felismus, Final1stspy, FlawedAmmyy, Gazer, GeminiDuke, Get2, Gold Dragon, Goopy, GravityRAT, GreyEnergy, HAMMERTOSS, HAWKBALL, HTTPBrowser, Helminth, Hi-Zor, Hikit, HyperBro, InvisiMole, Ixeshe, JHUHUGIT, KONNI, Kazuar, Keydnap, Komplex, LOWBALL, Lokibot, MAZE, MacSpy, Machete, MechaFlounder, Metamorfo, Micropsia, MiniDuke, Mis-Type, More_eggs, NETEAGLE, NOKKI, OLDBAIT, Octopus, Okrum, OnionDuke, OopsIE, OwaAuth, PLEAD, POWERTON, POWRUNER, PUNCHBUGGY, PinchDuke, PlugX, Pony, PowerShower, Proxysvc, Psylo, Pteranodon, QUADAGENT, RATANKBA, RGDoor, RIPTIDE, ROKRAT, RTM, Reaver, RedLeaves, Regin, Remexi, Remsec, Rising Sun, S-Type, SNUGRIDE, Sakula, SeaDuke, Seasalt, ServHelper, Shamoon, ShimRat, Smoke Loader, SpeakUp, Sys10, TSCookie, TrickBot, UBoatRAT, UPPERCUT, Ursnif, VBShower, VERMIN, Valak, Vasport, WinMM, WindTail, Winnti for Linux, Xbash, YAHOYAH, ZLib, Zebrocy, ZeroT, Zeus Panda, ZxShell, down_new, httpclient, pngdowner",
            "score": 143
        },
        {
            "techniqueID": "T1083",
            "comment": "executed by 3PARA RAT, 4H RAT, ADVSTORESHELL, Aria-body, Attor, AuditCred, AutoIt backdoor, Avenger, Azorult, BACKSPACE, BADNEWS, BBSRAT, BLACKCOFFEE, BabyShark, BackConfig, Backdoor.Oldrea, BadPatch, Bankshot, BlackEnergy, Brave Prince, CHOPSTICK, CORALDECK, Cannon, Cardinal RAT, ChChes, China Chopper, CosmicDuke, Crimson, CrossRAT, DDKONG, Denis, Derusbi, DustySky, ELMER, Elise, Epic, FALLCHILL, FLASHFLOOD, FinFisher, FruitFly, Fysbis, GeminiDuke, Gold Dragon, GravityRAT, HOPLIGHT, HTTPBrowser, HotCroissant, Hydraq, InnaputRAT, InvisiMole, Ixeshe, JPIN, KEYMARBLE, KONNI, Kasidet, Kazuar, KeyBoy, Kivars, Kwampirs, Linfo, MESSAGETAP, Machete, Metamorfo, Micropsia, Misdat, MobileOrder, MoonWind, NDiskMonitor, NETEAGLE, OceanSalt, Octopus, Okrum, Orz, OwaAuth, PLEAD, POORAIM, POWRUNER, Pasam, PinchDuke, Pisloader, PlugX, PoetRAT, PowerDuke, Prikormka, Proxysvc, Psylo, Pteranodon, RARSTONE, ROKRAT, RTM, Ramsay, RedLeaves, Remexi, Remsec, Rising Sun, Rover, Ryuk, SDBot, SHOTPUT, SOUNDBITE, SPACESHIP, Seasalt, ShimRat, Skidmap, Smoke Loader, StreamEx, SynAck, TINYTYPHON, TSCookie, TYPEFRAME, TajMahal, TrickBot, UPPERCUT, USBStealer, USBferry, Volgmer, WINERACK, WannaCry, WinMM, WindTail, XAgentOSX, ZLib, Zebrocy, Zeus Panda, ZxShell, down_new, jRAT, njRAT, yty, zwShell",
            "score": 130
        },
        {
            "techniqueID": "T1573.001",
            "comment": "executed by 3PARA RAT, 4H RAT, ADVSTORESHELL, Attor, Azorult, BADCALL, BADNEWS, BBSRAT, Bisonal, CHOPSTICK, CORESHELL, CallMe, Carbanak, Cardinal RAT, ChChes, Chaos, Comnie, CosmicDuke, Daserf, Derusbi, Dipsind, Downdelph, Dridex, Duqu, Ebury, Elise, Emissary, Epic, FALLCHILL, FakeM, Felismus, FlawedAmmyy, Gazer, GreyEnergy, H1N1, HAMMERTOSS, Helminth, Hi-Zor, HiddenWasp, Hikit, HotCroissant, Hydraq, InvisiMole, KEYMARBLE, Komplex, LightNeuron, Lurid, MoonWind, More_eggs, Mosquito, NDiskMonitor, NETEAGLE, NanoCore, Okrum, PLAINTEE, PLEAD, POWERTON, PoisonIvy, Prikormka, RIPTIDE, RTM, RedLeaves, Rifdoor, SNUGRIDE, Sakula, SeaDuke, Sys10, TSCookie, Taidoor, TrickBot, UPPERCUT, Volgmer, Winnti for Linux, ZeroT, down_new, gh0st RAT, httpclient",
            "score": 77
        },
        {
            "techniqueID": "T1082",
            "comment": "executed by 4H RAT, ADVSTORESHELL, Agent Tesla, Aria-body, Astaroth, Attor, Avenger, Azorult, BACKSPACE, BADCALL, BISCUIT, BUBBLEWRAP, BabyShark, BackConfig, Backdoor.Oldrea, BadPatch, Bankshot, Bisonal, BlackEnergy, Brave Prince, Bundlore, CARROTBAT, CORESHELL, Cadelspy, Cannon, Cardinal RAT, ChChes, Comnie, CozyCar, Crimson, DarkComet, Denis, Derusbi, DownPaper, DustySky, Dyre, Elise, Emissary, Epic, FALLCHILL, FELIXROOT, Felismus, FinFisher, Final1stspy, FlawedAmmyy, Fysbis, GRIFFON, Get2, Gold Dragon, GravityRAT, HALFBAKED, HAPPYWORK, HAWKBALL, HOPLIGHT, HotCroissant, Hydraq, InnaputRAT, InvisiMole, Ixeshe, JHUHUGIT, JPIN, KARAE, KEYMARBLE, KOMPROGO, KONNI, Kasidet, Kazuar, KeyBoy, Kwampirs, LightNeuron, Linfo, Lokibot, LoudMiner, MAZE, MURKYTOP, Machete, Micropsia, MirageFox, Mis-Type, Misdat, MobileOrder, MoonWind, More_eggs, NDiskMonitor, NETWIRE, NOKKI, Naid, NanHaiShu, NavRAT, Netwalker, OSInfo, OSX/Shlayer, OSX_OCEANLOTUS.D, OceanSalt, Octopus, Okrum, OopsIE, Orz, PLAINTEE, POORAIM, POWERSTATS, POWRUNER, PUNCHBUGGY, Pasam, PinchDuke, Pisloader, PoetRAT, Pony, PowerDuke, PowerShower, Prikormka, Proxysvc, RATANKBA, ROKRAT, RTM, Ramsay, Reaver, RedLeaves, Remsec, Revenge RAT, Rifdoor, Rising Sun, RogueRobin, RunningRAT, S-Type, SDBot, SHARPSTATS, SHUTTERSPEED, SLOWDRIFT, SOUNDBITE, SYSCON, ServHelper, Shamoon, Skidmap, SpeakUp, SslMM, StoneDrill, StreamEx, SynAck, Sys10, T9000, TURNEDUP, TYPEFRAME, TajMahal, TrickBot, UPPERCUT, Unknown Logger, Ursnif, VERMIN, Valak, Volgmer, WINDSHIELD, WINERACK, WinMM, Wingbird, XAgentOSX, YAHOYAH, ZLib, Zebrocy, ZeroT, Zeus Panda, ZxShell, build_downer, down_new, jRAT, njRAT, yty, zwShell",
            "score": 168
        },
        {
            "techniqueID": "T1057",
            "comment": "executed by 4H RAT, ADVSTORESHELL, Agent Tesla, Aria-body, Astaroth, Avenger, Azorult, BACKSPACE, BBSRAT, BISCUIT, BLACKCOFFEE, BabyShark, Backdoor.Oldrea, Bankshot, Bisonal, BlackEnergy, Brave Prince, Bundlore, Cannon, Carbanak, Carbon, Cardinal RAT, ChChes, Comnie, Crimson, DarkComet, Derusbi, Duqu, DustySky, ELMER, Elise, Emotet, Epic, EvilBunny, FELIXROOT, FinFisher, Final1stspy, FruitFly, Fysbis, GeminiDuke, Get2, Gold Dragon, Goopy, GravityRAT, HALFBAKED, Helminth, HotCroissant, Hydraq, InvisiMole, Ixeshe, JHUHUGIT, JPIN, KEYMARBLE, KONNI, Kasidet, Kazuar, Komplex, Kwampirs, Linfo, LoudMiner, MAZE, Machete, Metamorfo, MobileOrder, MoonWind, Mosquito, NETEAGLE, NavRAT, OceanSalt, Orz, PLAINTEE, PLEAD, POORAIM, POWERSTATS, POWRUNER, Pasam, PlugX, PoetRAT, PowerDuke, PowerShower, PowerStallion, Proxysvc, RATANKBA, ROKRAT, RTM, Remsec, Rising Sun, RogueRobin, Ryuk, SHOTPUT, SYSCON, Seasalt, Skidmap, Socksbot, StreamEx, Sykipot, SynAck, TSCookie, TajMahal, Trojan.Karagany, UBoatRAT, USBferry, Ursnif, VERMIN, Valak, Volgmer, WINERACK, WinMM, XAgentOSX, Zebrocy, Zeus Panda, ZxShell, down_new, gh0st RAT, iKitten, jRAT, yty",
            "score": 117
        },
        {
            "techniqueID": "T1059.003",
            "comment": "executed by 4H RAT, ABK, ADVSTORESHELL, Astaroth, AuditCred, BACKSPACE, BADNEWS, BBK, BISCUIT, BLACKCOFFEE, BONDUPDATER, BabyShark, BackConfig, Bandook, Bankshot, Bisonal, CALENDAR, CARROTBAT, Carbanak, Cardinal RAT, China Chopper, Cobian RAT, CoinTicker, ComRAT, Comnie, CozyCar, DarkComet, Daserf, DealersChoice, Denis, Dipsind, DownPaper, Emissary, Emotet, EvilBunny, Exaramel for Windows, FELIXROOT, Felismus, Gold Dragon, Goopy, GravityRAT, GreyEnergy, H1N1, HARDRAIN, HAWKBALL, HOMEFRY, HOPLIGHT, HTTPBrowser, Helminth, Hi-Zor, HiddenWasp, Hikit, HotCroissant, InnaputRAT, InvisiMole, Ixeshe, JCry, JHUHUGIT, JPIN, KEYMARBLE, KOMPROGO, KONNI, Kasidet, Kazuar, KeyBoy, LightNeuron, Linfo, LoudMiner, MAZE, MURKYTOP, MechaFlounder, Metamorfo, Micropsia, MirageFox, Mis-Type, Misdat, Mivast, MoonWind, More_eggs, Mosquito, NETEAGLE, NanoCore, NavRAT, Netwalker, OceanSalt, Okrum, OopsIE, Orz, PHOREAL, PLAINTEE, PLEAD, POWRUNER, Pisloader, PlugX, PoisonIvy, Pony, PowerDuke, Proxysvc, Pteranodon, QUADAGENT, RATANKBA, RGDoor, RTM, Ragnar Locker, RedLeaves, Remexi, Revenge RAT, Rising Sun, RobbinHood, RogueRobin, RunningRAT, Ryuk, SDBot, SEASHARPEE, SNUGRIDE, SQLRat, SYSCON, Sakula, SamSam, SeaDuke, Seasalt, ServHelper, ShimRat, StreamEx, TDTESS, TEXTMATE, TSCookie, TURNEDUP, TYPEFRAME, TinyZBot, TrickBot, UBoatRAT, UPPERCUT, USBferry, Umbreon, Volgmer, WEBC2, Wiarp, XTunnel, ZLib, Zebrocy, Zeus Panda, ZxShell, adbupd, hcdLoader, httpclient, jRAT, njRAT, zwShell",
            "score": 149
        },
        {
            "techniqueID": "T1518.001",
            "comment": "executed by ABK, Astaroth, Avenger, BadPatch, CHOPSTICK, Comnie, CozyCar, Crimson, DustySky, Epic, EvilBunny, FELIXROOT, Felismus, FinFisher, Flame, FlawedAmmyy, Gold Dragon, JPIN, Kasidet, Micropsia, More_eggs, Mosquito, Netwalker, POWERSTATS, POWRUNER, PUNCHBUGGY, Prikormka, ROKRAT, RTM, Remsec, RogueRobin, Skidmap, StoneDrill, StreamEx, T9000, TajMahal, VERMIN, Valak, Wingbird, YAHOYAH, Zeus Panda, build_downer, down_new, jRAT",
            "score": 44
        },
        {
            "techniqueID": "T1055",
            "comment": "executed by ABK, Attor, AuditCred, Avenger, BBK, Backdoor.Oldrea, Cardinal RAT, Dyre, Gazer, HOPLIGHT, HyperBro, JHUHUGIT, JPIN, NavRAT, Ryuk, Smoke Loader, StoneDrill, TSCookie, Taidoor, Wiarp, Wingbird",
            "score": 21
        },
        {
            "techniqueID": "T1140",
            "comment": "executed by ABK, Agent Tesla, Aria-body, Astaroth, AuditCred, Avenger, Azorult, BBK, BBSRAT, BOOSTWRITE, BackConfig, Bankshot, Bisonal, Bundlore, Carbon, Cardinal RAT, CoinTicker, ComRAT, DDKONG, Denis, Dyre, FinFisher, Final1stspy, Goopy, HiddenWasp, ISMInjector, InvisiMole, KONNI, Kwampirs, LightNeuron, MESSAGETAP, Machete, Metamorfo, MirageFox, More_eggs, NOKKI, Netwalker, OSX/Shlayer, Okrum, OopsIE, POWERSTATS, PUNCHBUGGY, PlugX, Proton, QUADAGENT, RGDoor, Ramsay, Remexi, Rising Sun, RogueRobin, SDBot, SQLRat, Shamoon, ShimRat, Skidmap, Smoke Loader, Starloader, TSCookie, TYPEFRAME, TrickBot, Ursnif, VERMIN, Valak, Volgmer, WindTail, Winnti for Linux, YAHOYAH, Zebrocy, ZeroT, Zeus Panda",
            "score": 70
        },
        {
            "techniqueID": "T1105",
            "comment": "executed by ABK, Agent Tesla, Agent.btz, Aria-body, Astaroth, Attor, AuditCred, Avenger, Azorult, BADNEWS, BBK, BISCUIT, BONDUPDATER, BabyShark, BackConfig, BadPatch, Bankshot, Bisonal, Briba, Bundlore, CARROTBAT, CHOPSTICK, CORESHELL, Calisto, CallMe, Cannon, Cardinal RAT, ChChes, China Chopper, CloudDuke, CoinTicker, Crimson, DDKONG, DOGCALL, DarkComet, Daserf, Denis, Dipsind, Downdelph, Dyre, Elise, Emissary, EvilBunny, Exaramel for Linux, FELIXROOT, Felismus, Gazer, Gold Dragon, GreyEnergy, H1N1, HAPPYWORK, HOPLIGHT, HTTPBrowser, Helminth, Hi-Zor, HiddenWasp, HotCroissant, Hydraq, HyperBro, InvisiMole, Ixeshe, JHUHUGIT, JPIN, KARAE, KEYMARBLE, KONNI, Kasidet, Kazuar, KeyBoy, Kivars, Kwampirs, LOWBALL, LightNeuron, Linfo, LoudMiner, Machete, MechaFlounder, Metamorfo, Micropsia, MiniDuke, Misdat, Mivast, MobileOrder, More_eggs, Mosquito, NDiskMonitor, NOKKI, NanHaiShu, NanoCore, NavRAT, Nerex, Netwalker, Nidiran, OSX_OCEANLOTUS.D, Octopus, Okrum, OopsIE, Orz, PLAINTEE, PLEAD, POSHSPY, POWERSOURCE, POWERSTATS, POWRUNER, PUNCHBUGGY, Pasam, Pisloader, PlugX, PoetRAT, PoisonIvy, Pony, PowerDuke, Psylo, Pteranodon, RARSTONE, RATANKBA, RGDoor, ROKRAT, RTM, RedLeaves, RemoteCMD, Remsec, Revenge RAT, RogueRobin, SDBot, SEASHARPEE, SHARPSTATS, SHUTTERSPEED, SLOWDRIFT, SQLRat, Sakula, SeaDuke, Seasalt, ServHelper, Shamoon, ShimRat, Skidmap, Smoke Loader, SpeakUp, StoneDrill, TDTESS, TSCookie, TURNEDUP, TYPEFRAME, TrickBot, Trojan.Karagany, UBoatRAT, UPPERCUT, Unknown Logger, Ursnif, VBShower, VERMIN, Valak, Vasport, Volgmer, WEBC2, Wiarp, Winnti for Linux, Xbash, YAHOYAH, ZLib, Zebrocy, ZeroT, Zeus Panda, ZxShell, build_downer, down_new, gh0st RAT, jRAT, njRAT",
            "score": 170
        },
        {
            "techniqueID": "T1027.003",
            "comment": "executed by ABK, Avenger, BBK, Okrum, PowerDuke, build_downer",
            "score": 6
        },
        {
            "techniqueID": "T1106",
            "comment": "executed by ADVSTORESHELL, Aria-body, Attor, BADNEWS, BBK, BackConfig, Bankshot, ComRAT, Denis, Goopy, HAWKBALL, HotCroissant, HyperBro, InnaputRAT, LightNeuron, MAZE, Metamorfo, Mosquito, Netwalker, PlugX, Pony, RDFSNIFFER, RTM, Ramsay, Rising Sun, Ryuk, ShimRat, SynAck, TrickBot, Ursnif, Volgmer, WindTail, XAgentOSX, build_downer",
            "score": 34
        },
        {
            "techniqueID": "T1027",
            "comment": "executed by ADVSTORESHELL, Agent Tesla, Aria-body, Astaroth, Attor, AuditCred, Avenger, BOOSTWRITE, BackConfig, Bisonal, Bundlore, CARROTBAT, CORESHELL, Carbanak, Carbon, Cardinal RAT, CoinTicker, ComRAT, Comnie, CozyCar, DOGCALL, Daserf, Denis, DustySky, Ebury, Elise, Emissary, Emotet, Epic, Exaramel for Linux, FELIXROOT, FinFisher, Final1stspy, FlawedGrace, FruitFly, Fysbis, Gazer, Goopy, GravityRAT, GreyEnergy, H1N1, HAWKBALL, HOMEFRY, HTTPBrowser, Helminth, Hi-Zor, HiddenWasp, HotCroissant, Hydraq, ISMInjector, InnaputRAT, InvisiMole, JHUHUGIT, JPIN, Kazuar, KeyBoy, Kwampirs, LightNeuron, Lokibot, LoudMiner, MAZE, Machete, Matroyshka, Metamorfo, Micropsia, Mosquito, NOKKI, NanHaiShu, NanoCore, Netwalker, OLDBAIT, OSX_OCEANLOTUS.D, OopsIE, Orz, POSHSPY, POWERSTATS, PUNCHBUGGY, PUNCHTRACK, Pisloader, PoetRAT, PoisonIvy, Pony, PowerStallion, Prikormka, QUADAGENT, RTM, Ramsay, Reaver, RedLeaves, Remexi, Remsec, Rifdoor, Rising Sun, RogueRobin, SDBot, SHARPSTATS, SHOTPUT, SQLRat, Sakula, SamSam, Seasalt, Shamoon, ShimRat, Skidmap, Smoke Loader, SpeakUp, StoneDrill, StreamEx, SynAck, TINYTYPHON, TYPEFRAME, TajMahal, TrickBot, UBoatRAT, USBStealer, Ursnif, VERMIN, Valak, Volgmer, WindTail, Winnti for Linux, XTunnel, YAHOYAH, ZeroT, Zeus Panda, jRAT",
            "score": 126
        },
        {
            "techniqueID": "T1056.001",
            "comment": "executed by ADVSTORESHELL, Agent Tesla, Astaroth, Attor, BADNEWS, BISCUIT, BabyShark, BadPatch, Bandook, BlackEnergy, CHOPSTICK, Cadelspy, Carbanak, Cardinal RAT, Catchamas, Cobian RAT, CosmicDuke, DOGCALL, DarkComet, Daserf, Derusbi, Duqu, DustySky, EvilGrab, FakeM, Fysbis, GreyEnergy, HTTPBrowser, Helminth, JPIN, KONNI, Kasidet, KeyBoy, Kivars, Lokibot, MacSpy, Machete, Matroyshka, Micropsia, MoonWind, NETWIRE, NanoCore, NavRAT, NetTraveler, Okrum, OwaAuth, PlugX, PoetRAT, PoisonIvy, Prikormka, Proton, ROKRAT, RTM, Regin, Remexi, Remsec, Revenge RAT, Rover, RunningRAT, SslMM, Sykipot, TajMahal, TinyZBot, Unknown Logger, VERMIN, XAgentOSX, Zeus Panda, ZxShell, gh0st RAT, jRAT, njRAT, yty",
            "score": 72
        },
        {
            "techniqueID": "T1120",
            "comment": "executed by ADVSTORESHELL, Attor, BADNEWS, BlackEnergy, Cadelspy, DustySky, FlawedAmmyy, Machete, MoonWind, Prikormka, RTM, Ragnar Locker, Ramsay, T9000, TajMahal, USBStealer, USBferry, WannaCry, Zebrocy, jRAT, njRAT",
            "score": 21
        },
        {
            "techniqueID": "T1070.004",
            "comment": "executed by ADVSTORESHELL, Aria-body, Attor, AuditCred, Azorult, BBSRAT, BLACKCOFFEE, BabyShark, BackConfig, Backdoor.Oldrea, Bankshot, Bisonal, CARROTBAT, Calisto, Carbanak, Cardinal RAT, Cherry Picker, Denis, Derusbi, DustySky, Elise, Epic, EvilBunny, FALLCHILL, FELIXROOT, FruitFly, Fysbis, Gazer, Gold Dragon, GreyEnergy, HALFBAKED, HAWKBALL, HTTPBrowser, Hi-Zor, HotCroissant, Hydraq, HyperBro, InnaputRAT, InvisiMole, Ixeshe, JHUHUGIT, JPIN, KEYMARBLE, KONNI, Kazuar, Kivars, Komplex, LightNeuron, Linfo, LockerGoga, LoudMiner, MESSAGETAP, MURKYTOP, MacSpy, Machete, Metamorfo, Misdat, MoonWind, More_eggs, Mosquito, NOKKI, NanHaiShu, OSX_OCEANLOTUS.D, OceanSalt, Okrum, OopsIE, PLEAD, POWERSTATS, PUNCHBUGGY, Pasam, Pony, PowerDuke, PowerShower, Proton, Proxysvc, Pteranodon, QUADAGENT, RDFSNIFFER, ROKRAT, RTM, Reaver, RedLeaves, Remsec, Rising Sun, RunningRAT, SDBot, SQLRat, Sakula, SamSam, SeaDuke, Seasalt, ServHelper, ShimRat, SpeakUp, StoneDrill, TDTESS, TYPEFRAME, USBStealer, Ursnif, VBShower, VERMIN, Volgmer, WINDSHIELD, WindTail, Wingbird, XAgentOSX, Zebrocy, Zeus Panda, ZxShell, gh0st RAT, jRAT, njRAT, pngdowner, zwShell",
            "score": 114
        },
        {
            "techniqueID": "T1546.015",
            "comment": "executed by ADVSTORESHELL, BBSRAT, ComRAT, JHUHUGIT, KONNI, Mosquito",
            "score": 6
        },
        {
            "techniqueID": "T1112",
            "comment": "executed by ADVSTORESHELL, Attor, BACKSPACE, BADCALL, Bankshot, CHOPSTICK, Cardinal RAT, Catchamas, ComRAT, DarkComet, Exaramel for Windows, FELIXROOT, GreyEnergy, HOPLIGHT, Hydraq, InvisiMole, KEYMARBLE, KONNI, LoJax, Metamorfo, Mosquito, Naid, NanoCore, Nerex, Netwalker, PHOREAL, PLAINTEE, PlugX, PoetRAT, PoisonIvy, PowerShower, QUADAGENT, RTM, Regin, Rover, SOUNDBITE, Shamoon, ShimRat, StreamEx, SynAck, TYPEFRAME, TajMahal, TrickBot, Ursnif, Valak, Volgmer, Zeus Panda, njRAT, zwShell",
            "score": 49
        },
        {
            "techniqueID": "T1029",
            "comment": "executed by ADVSTORESHELL, ComRAT, Dipsind, Kazuar, LightNeuron, Linfo, Machete, POWERSTATS, ShimRat, jRAT",
            "score": 10
        },
        {
            "techniqueID": "T1012",
            "comment": "executed by ADVSTORESHELL, Attor, Azorult, BACKSPACE, BabyShark, Bankshot, Brave Prince, CHOPSTICK, Carbanak, Carbon, Cardinal RAT, ComRAT, Denis, Derusbi, DownPaper, Epic, FELIXROOT, FinFisher, Gold Dragon, HOPLIGHT, Hydraq, InvisiMole, JPIN, OSInfo, POWERSOURCE, POWRUNER, PlugX, Proxysvc, QUADAGENT, RATANKBA, ROKRAT, Reaver, Shamoon, StoneDrill, SynAck, Ursnif, Volgmer, WINDSHIELD, Zebrocy, Zeus Panda, ZxShell",
            "score": 41
        },
        {
            "techniqueID": "T1041",
            "comment": "executed by ADVSTORESHELL, Astaroth, Attor, BACKSPACE, Bankshot, CallMe, Cannon, DustySky, Dyre, Emotet, Goopy, HAWKBALL, HOPLIGHT, HotCroissant, LightNeuron, Lokibot, Machete, MechaFlounder, MobileOrder, NETEAGLE, Okrum, OopsIE, PowerShower, Proxysvc, Psylo, Pteranodon, ROKRAT, Remexi, Rising Sun, TajMahal, Ursnif, Valak, Zebrocy",
            "score": 33
        },
        {
            "techniqueID": "T1560.003",
            "comment": "executed by ADVSTORESHELL, Agent.btz, Attor, Duqu, FLASHFLOOD, HAWKBALL, InvisiMole, MESSAGETAP, Machete, Okrum, OopsIE, OwaAuth, RGDoor, Ramsay, RawPOS, Reaver, Rising Sun, SPACESHIP, T9000",
            "score": 19
        },
        {
            "techniqueID": "T1074.001",
            "comment": "executed by ADVSTORESHELL, Astaroth, Attor, BADNEWS, BadPatch, Calisto, Carbon, Catchamas, Duqu, DustySky, Dyre, Elise, Exaramel for Windows, FLASHFLOOD, Gold Dragon, Helminth, InvisiMole, Kazuar, LightNeuron, MESSAGETAP, Machete, MoonWind, NOKKI, NavRAT, OopsIE, PUNCHBUGGY, PUNCHTRACK, PoisonIvy, Prikormka, Pteranodon, Ramsay, RawPOS, Rover, SPACESHIP, Trojan.Karagany, USBStealer, Ursnif, Zebrocy",
            "score": 38
        },
        {
            "techniqueID": "T1547.001",
            "comment": "executed by ADVSTORESHELL, Agent Tesla, Aria-body, Astaroth, BACKSPACE, BADNEWS, BBSRAT, BabyShark, Backdoor.Oldrea, BadPatch, Bisonal, BlackEnergy, Briba, CORESHELL, Carbanak, Cardinal RAT, ChChes, Cobian RAT, Comnie, CozyCar, CrossRAT, DarkComet, DownPaper, DustySky, Elise, Emissary, Emotet, EvilBunny, EvilGrab, FELIXROOT, FLASHFLOOD, FinFisher, Final1stspy, GRIFFON, Gazer, Gold Dragon, HTTPBrowser, Helminth, Hi-Zor, InnaputRAT, Ixeshe, JCry, JHUHUGIT, KONNI, Kasidet, Kazuar, LoJax, Matroyshka, Metamorfo, Mivast, Mosquito, NETEAGLE, NETWIRE, NOKKI, NanHaiShu, NanoCore, NavRAT, Okrum, PLAINTEE, POWERSOURCE, POWERTON, PUNCHBUGGY, Pisloader, PlugX, PoetRAT, PoisonIvy, PowerDuke, PowerShower, Prikormka, Pteranodon, RTM, Reaver, RedLeaves, Remexi, Revenge RAT, Rifdoor, RogueRobin, Rover, RunningRAT, Ryuk, S-Type, SDBot, SHIPSHAPE, SNUGRIDE, SPACESHIP, Sakula, SeaDuke, Seasalt, ServHelper, ShimRat, Smoke Loader, SslMM, Sykipot, TINYTYPHON, TURNEDUP, TinyZBot, TrickBot, Trojan.Karagany, Truvasys, USBStealer, Ursnif, VBShower, Vasport, Xbash, Zebrocy, Zeus Panda, build_downer, gh0st RAT, njRAT",
            "score": 109
        },
        {
            "techniqueID": "T1560",
            "comment": "executed by ADVSTORESHELL, Agent Tesla, Aria-body, Backdoor.Oldrea, Cadelspy, Daserf, Emotet, Epic, Exaramel for Windows, FELIXROOT, Gold Dragon, LightNeuron, Lurid, Machete, OSX_OCEANLOTUS.D, Prikormka, Proton, Remexi, RunningRAT, VERMIN, Zebrocy",
            "score": 21
        },
        {
            "techniqueID": "T1132.001",
            "comment": "executed by ADVSTORESHELL, Astaroth, AutoIt backdoor, BADNEWS, BS2005, BabyShark, Backdoor.Oldrea, CORESHELL, Carbanak, ChChes, Cobian RAT, Daserf, Denis, Dipsind, Ebury, Elise, Felismus, Fysbis, HOPLIGHT, Helminth, Ixeshe, JHUHUGIT, KONNI, Kazuar, MechaFlounder, Mis-Type, Misdat, More_eggs, Octopus, Okrum, OopsIE, POWERSTATS, POWRUNER, Pisloader, PowerShower, Prikormka, QUADAGENT, Revenge RAT, RogueRobin, S-Type, SeaDuke, SpeakUp, Zebrocy, down_new, njRAT",
            "score": 45
        },
        {
            "techniqueID": "T1218.011",
            "comment": "executed by ADVSTORESHELL, Attor, Bisonal, Briba, CORESHELL, Comnie, CozyCar, DDKONG, Elise, Emissary, FELIXROOT, Flame, GreyEnergy, JHUHUGIT, KONNI, Kwampirs, Matroyshka, Mosquito, NOKKI, NotPetya, PUNCHBUGGY, PowerDuke, Prikormka, Pteranodon, RTM, Ragnar Locker, Sakula, ServHelper, StreamEx, USBferry, Winnti for Windows, ZxShell, gh0st RAT",
            "score": 33
        },
        {
            "techniqueID": "T1573.002",
            "comment": "executed by ADVSTORESHELL, Attor, BISCUIT, CHOPSTICK, ComRAT, Dridex, Emotet, Gazer, GreyEnergy, Hi-Zor, Metamorfo, POSHSPY, POWERSTATS, PoetRAT, ServHelper, Sykipot, Volgmer, WannaCry, XTunnel, Zebrocy, adbupd",
            "score": 21
        },
        {
            "techniqueID": "T1505.003",
            "comment": "executed by ASPXSpy, China Chopper, OwaAuth, SEASHARPEE",
            "score": 4
        },
        {
            "techniqueID": "T1124",
            "comment": "executed by Agent Tesla, Astaroth, Azorult, Cannon, Carbon, Epic, EvilBunny, FELIXROOT, GRIFFON, GravityRAT, HOPLIGHT, InvisiMole, Metamorfo, MoonWind, NOKKI, Okrum, OopsIE, PowerDuke, Proxysvc, RTM, SHARPSTATS, Shamoon, StoneDrill, T9000, TajMahal, UPPERCUT, WindTail, Zebrocy, Zeus Panda, build_downer",
            "score": 30
        },
        {
            "techniqueID": "T1115",
            "comment": "executed by Agent Tesla, Astaroth, Attor, Cadelspy, Catchamas, CosmicDuke, DarkComet, Helminth, JHUHUGIT, KONNI, MacSpy, Machete, RTM, Remexi, RunningRAT, TajMahal, TinyZBot, VERMIN, Zeus Panda, jRAT",
            "score": 20
        },
        {
            "techniqueID": "T1033",
            "comment": "executed by Agent Tesla, Agent.btz, Aria-body, Azorult, BISCUIT, BabyShark, Backdoor.Oldrea, Cannon, Cardinal RAT, DarkComet, Denis, Derusbi, DownPaper, Dyre, Epic, FELIXROOT, Felismus, FlawedAmmyy, Gazer, Get2, Gold Dragon, Goopy, GravityRAT, HAPPYWORK, HAWKBALL, HotCroissant, InvisiMole, Ixeshe, JPIN, KONNI, Kazuar, Komplex, Kwampirs, Linux Rabbit, Lokibot, MechaFlounder, Micropsia, MirageFox, Mis-Type, MoonWind, More_eggs, Mosquito, NDiskMonitor, NOKKI, NanHaiShu, Octopus, Okrum, POWERSTATS, POWRUNER, PoetRAT, PowerDuke, PowerShower, Prikormka, QUADAGENT, RATANKBA, RGDoor, RTM, Reaver, RedLeaves, Remsec, Revenge RAT, Rifdoor, Rising Sun, RogueRobin, SDBot, SHARPSTATS, ServHelper, SpeakUp, SslMM, SynAck, Sys10, T9000, UPPERCUT, Unknown Logger, VERMIN, Valak, WINDSHIELD, WINERACK, WinMM, XAgentOSX, Zebrocy, ZxShell, njRAT, yty, zwShell",
            "score": 85
        },
        {
            "techniqueID": "T1562.001",
            "comment": "executed by Agent Tesla, Brave Prince, Bundlore, ChChes, DarkComet, Gold Dragon, Goopy, H1N1, HDoor, JPIN, LockerGoga, MAZE, NanHaiShu, NanoCore, Netwalker, OSX/Shlayer, POWERSTATS, Proton, Ragnar Locker, RobbinHood, RunningRAT, Ryuk, Skidmap, SslMM, TinyZBot, TrickBot, Unknown Logger, ZxShell",
            "score": 28
        },
        {
            "techniqueID": "T1087.001",
            "comment": "executed by Agent Tesla, Bankshot, Carbon, Comnie, Duqu, Elise, Epic, GeminiDuke, InvisiMole, Kazuar, Kwampirs, MURKYTOP, Mis-Type, OSInfo, POWERSTATS, PUNCHBUGGY, Pony, RATANKBA, Remsec, S-Type, SHOTPUT, TrickBot, USBferry, Valak",
            "score": 24
        },
        {
            "techniqueID": "T1048.003",
            "comment": "executed by Agent Tesla, Brave Prince, CORALDECK, Carbon, Cherry Picker, CosmicDuke, KONNI, PoetRAT, Remsec, WindTail",
            "score": 10
        },
        {
            "techniqueID": "T1113",
            "comment": "executed by Agent Tesla, Aria-body, Attor, Azorult, BADNEWS, BISCUIT, BadPatch, Bandook, BlackEnergy, CHOPSTICK, Cadelspy, Cannon, Carbanak, Cardinal RAT, Catchamas, Cobian RAT, CosmicDuke, Crimson, CrossRAT, DOGCALL, Daserf, Derusbi, DustySky, EvilGrab, FinFisher, Flame, FruitFly, GRIFFON, HALFBAKED, HotCroissant, Hydraq, HyperBro, InvisiMole, JHUHUGIT, Janicab, KEYMARBLE, KONNI, Kasidet, Kazuar, KeyBoy, Kivars, MacSpy, Machete, Matroyshka, Micropsia, NETWIRE, Octopus, POORAIM, POWERSTATS, POWRUNER, PlugX, PoetRAT, Prikormka, Proton, Pteranodon, ROKRAT, RTM, RedLeaves, Remexi, Revenge RAT, RogueRobin, Rover, SHUTTERSPEED, Socksbot, StoneDrill, T9000, TURNEDUP, TajMahal, TinyZBot, Trojan.Karagany, UPPERCUT, Ursnif, VERMIN, Valak, XAgentOSX, ZLib, Zebrocy, Zeus Panda, ZxShell, gh0st RAT, jRAT, njRAT, yty",
            "score": 83
        },
        {
            "techniqueID": "T1016",
            "comment": "executed by Agent Tesla, Agent.btz, Aria-body, Astaroth, Avenger, Azorult, BADCALL, BabyShark, Backdoor.Oldrea, Bisonal, BlackEnergy, Brave Prince, Calisto, Carbon, Catchamas, Comnie, Crimson, Denis, Duqu, Dyre, Elise, Emissary, Epic, FALLCHILL, FELIXROOT, Felismus, GeminiDuke, GravityRAT, HotCroissant, Hydraq, InvisiMole, Ixeshe, JHUHUGIT, JPIN, KEYMARBLE, KONNI, Kazuar, KeyBoy, Kwampirs, LightNeuron, Lokibot, LoudMiner, Machete, Mis-Type, MoonWind, More_eggs, Mosquito, NOKKI, Naid, NanHaiShu, NanoCore, OSInfo, OceanSalt, Octopus, Okrum, Olympic Destroyer, Orz, PLAINTEE, POWERSTATS, POWRUNER, Pisloader, PowerDuke, PowerShower, Prikormka, Proxysvc, QUADAGENT, RATANKBA, Reaver, RedLeaves, Remsec, Revenge RAT, Rifdoor, Rising Sun, RogueRobin, Ryuk, SDBot, SHARPSTATS, Shamoon, SpeakUp, Sykipot, Sys10, T9000, TSCookie, TajMahal, TrickBot, UPPERCUT, USBferry, Unknown Logger, VERMIN, Valak, Volgmer, WannaCry, Xbash, Zebrocy, ZeroT, down_new, iKitten, jRAT, yty, zwShell",
            "score": 100
        },
        {
            "techniqueID": "T1125",
            "comment": "executed by Agent Tesla, Bandook, Cobian RAT, DarkComet, Derusbi, EvilGrab, InvisiMole, Kazuar, Machete, NanoCore, PoetRAT, Revenge RAT, SDBot, T9000, TajMahal, ZxShell, jRAT, njRAT",
            "score": 18
        },
        {
            "techniqueID": "T1071.003",
            "comment": "executed by Agent Tesla, BadPatch, CHOPSTICK, CORESHELL, Cannon, ComRAT, Goopy, JPIN, LightNeuron, NavRAT, OLDBAIT, Remsec, Zebrocy",
            "score": 13
        },
        {
            "techniqueID": "T1555",
            "comment": "executed by Agent Tesla, Astaroth, CosmicDuke, Lokibot, Matroyshka, OLDBAIT, PLEAD, PinchDuke, Prikormka, Proton, ROKRAT",
            "score": 11
        },
        {
            "techniqueID": "T1564.003",
            "comment": "executed by Agent Tesla, Astaroth, BONDUPDATER, HAMMERTOSS, HotCroissant, KeyBoy, Kivars, Metamorfo, PowerShower, Ursnif, WindTail",
            "score": 11
        },
        {
            "techniqueID": "T1497",
            "comment": "executed by Agent Tesla, CHOPSTICK, CozyCar, Metamorfo, RTM, StoneDrill",
            "score": 6
        },
        {
            "techniqueID": "T1185",
            "comment": "executed by Agent Tesla, Dridex, TrickBot, Ursnif",
            "score": 4
        },
        {
            "techniqueID": "T1204.002",
            "comment": "executed by Agent Tesla, Bundlore, Cardinal RAT, Emotet, JCry, Lokibot, OSX/Shlayer, PLEAD, PoetRAT, Pony, RTM, Rifdoor, SQLRat, SYSCON, TYPEFRAME, TrickBot, Valak",
            "score": 17
        },
        {
            "techniqueID": "T1091",
            "comment": "executed by Agent.btz, CHOPSTICK, DustySky, Flame, H1N1, Ramsay, SHIPSHAPE, USBStealer, USBferry, Unknown Logger, Ursnif, njRAT",
            "score": 12
        },
        {
            "techniqueID": "T1052.001",
            "comment": "executed by Agent.btz, Machete, Remsec, SPACESHIP, USBStealer",
            "score": 5
        },
        {
            "techniqueID": "T1055.001",
            "comment": "executed by Aria-body, BlackEnergy, Carbon, ComRAT, Derusbi, Duqu, Dyre, Elise, Emissary, Emotet, FinFisher, Get2, HIDEDRV, Kazuar, MAZE, Matroyshka, Metamorfo, Netwalker, PoisonIvy, RARSTONE, RATANKBA, Ramsay, Remsec, SDBot, Socksbot, Sykipot, TajMahal, ZxShell",
            "score": 28
        },
        {
            "techniqueID": "T1568.002",
            "comment": "executed by Aria-body, BONDUPDATER, CCBkdr, CHOPSTICK, Ebury, POSHSPY, Ursnif",
            "score": 7
        },
        {
            "techniqueID": "T1049",
            "comment": "executed by Aria-body, BlackEnergy, Carbon, Comnie, Duqu, Epic, GravityRAT, Kwampirs, MAZE, MESSAGETAP, Machete, OSInfo, Okrum, POWRUNER, PlugX, RATANKBA, RedLeaves, Remsec, SHOTPUT, SpeakUp, Sykipot, USBferry, Volgmer, Zebrocy, jRAT",
            "score": 25
        },
        {
            "techniqueID": "T1095",
            "comment": "executed by Aria-body, BUBBLEWRAP, Carbon, Crimson, Derusbi, FakeM, HiddenWasp, Mis-Type, Misdat, MoonWind, NETEAGLE, PHOREAL, PlugX, RARSTONE, Reaver, Regin, Remsec, SDBot, TSCookie, Umbreon, WINDSHIELD, Winnti for Linux",
            "score": 22
        },
        {
            "techniqueID": "T1025",
            "comment": "executed by Aria-body, BADNEWS, CosmicDuke, Crimson, FLASHFLOOD, GravityRAT, Machete, Prikormka, Ramsay, Remsec, Rover, TajMahal, USBStealer",
            "score": 13
        },
        {
            "techniqueID": "T1090",
            "comment": "executed by Aria-body, AuditCred, BADCALL, Cardinal RAT, Dridex, HARDRAIN, HOPLIGHT, PLEAD, SDBot, Socksbot, TSCookie, TYPEFRAME, Ursnif, Vasport, XTunnel, ZxShell, jRAT",
            "score": 17
        },
        {
            "techniqueID": "T1134.001",
            "comment": "executed by Aria-body, FinFisher, Okrum, Shamoon",
            "score": 4
        },
        {
            "techniqueID": "T1134.002",
            "comment": "executed by Aria-body, Azorult, Bankshot, KONNI, ZxShell",
            "score": 5
        },
        {
            "techniqueID": "T1010",
            "comment": "executed by Aria-body, Attor, Cadelspy, Catchamas, Duqu, HotCroissant, Kazuar, Machete, NetTraveler, PLEAD, PoisonIvy, PowerDuke, Remexi, SOUNDBITE, WINERACK, njRAT",
            "score": 16
        },
        {
            "techniqueID": "T1027.002",
            "comment": "executed by Astaroth, China Chopper, DarkComet, Daserf, Dyre, Emotet, FinFisher, GreyEnergy, H1N1, HotCroissant, Lokibot, Machete, OSX_OCEANLOTUS.D, OopsIE, SDBot, SeaDuke, ShimRat, TrickBot, Trojan.Karagany, Uroburos, VERMIN, Zebrocy, ZeroT, jRAT, yty",
            "score": 25
        },
        {
            "techniqueID": "T1220",
            "comment": "executed by Astaroth",
            "score": 1
        },
        {
            "techniqueID": "T1218.001",
            "comment": "executed by Astaroth",
            "score": 1
        },
        {
            "techniqueID": "T1047",
            "comment": "executed by Astaroth, BlackEnergy, DustySky, Emotet, EvilBunny, FELIXROOT, FlawedAmmyy, GravityRAT, HALFBAKED, HOPLIGHT, KOMPROGO, Kazuar, MAZE, Micropsia, Mosquito, Netwalker, NotPetya, Octopus, Olympic Destroyer, OopsIE, POWERSTATS, POWRUNER, RATANKBA, Remexi, RogueRobin, StoneDrill, Ursnif, WannaCry, Zebrocy, jRAT",
            "score": 30
        },
        {
            "techniqueID": "T1059.007",
            "comment": "executed by Astaroth, Bundlore, GRIFFON, Metamorfo, NanHaiShu, POWERSTATS, Xbash, jRAT",
            "score": 8
        },
        {
            "techniqueID": "T1547.009",
            "comment": "executed by Astaroth, BACKSPACE, BlackEnergy, Comnie, FELIXROOT, Gazer, Helminth, KONNI, Kazuar, Micropsia, Okrum, Reaver, RedLeaves, RogueRobin, S-Type, SHIPSHAPE, SPACESHIP, SeaDuke, SslMM, TinyZBot",
            "score": 20
        },
        {
            "techniqueID": "T1129",
            "comment": "executed by Astaroth, Attor, BOOSTWRITE, Hydraq, PUNCHBUGGY, TajMahal",
            "score": 6
        },
        {
            "techniqueID": "T1218.010",
            "comment": "executed by Astaroth, Derusbi, Hi-Zor, More_eggs, Orz, Ragnar Locker, RogueRobin, Valak, Xbash",
            "score": 9
        },
        {
            "techniqueID": "T1055.012",
            "comment": "executed by Astaroth, Azorult, BADNEWS, BBSRAT, Bandook, Denis, Duqu, ISMInjector, Lokibot, Orz, Smoke Loader, TrickBot, Ursnif",
            "score": 13
        },
        {
            "techniqueID": "T1552",
            "comment": "executed by Astaroth",
            "score": 1
        },
        {
            "techniqueID": "T1564.001",
            "comment": "executed by Attor, BackConfig, Calisto, CoinTicker, FruitFly, Ixeshe, Komplex, Lokibot, LoudMiner, MacSpy, Machete, Micropsia, OSX/Shlayer, OSX_OCEANLOTUS.D, Okrum, PoetRAT, Rising Sun, WannaCry, iKitten",
            "score": 19
        },
        {
            "techniqueID": "T1119",
            "comment": "executed by Attor, BADNEWS, Bankshot, Comnie, Helminth, InvisiMole, LightNeuron, MESSAGETAP, Micropsia, PoetRAT, Proxysvc, RTM, Ramsay, Rover, T9000, TajMahal, USBStealer, VERMIN, WindTail, Zebrocy",
            "score": 20
        },
        {
            "techniqueID": "T1569.002",
            "comment": "executed by Attor, BBSRAT, HOPLIGHT, Hydraq, HyperBro, LoudMiner, Net Crawler, Netwalker, NotPetya, Okrum, Olympic Destroyer, Proxysvc, Ragnar Locker, RemoteCMD, Shamoon, Wingbird",
            "score": 16
        },
        {
            "techniqueID": "T1037.001",
            "comment": "executed by Attor, JHUHUGIT, Zebrocy",
            "score": 3
        },
        {
            "techniqueID": "T1053.005",
            "comment": "executed by Attor, BADNEWS, BONDUPDATER, BackConfig, Carbon, ComRAT, CosmicDuke, CozyCar, Duqu, Dyre, Emotet, EvilBunny, GRIFFON, Gazer, Goopy, GravityRAT, Helminth, HotCroissant, ISMInjector, JHUHUGIT, Machete, Matroyshka, NotPetya, Okrum, OopsIE, POWERSTATS, POWRUNER, Pteranodon, QUADAGENT, RTM, Ramsay, Remexi, RemoteCMD, Revenge RAT, SQLRat, ServHelper, Shamoon, Smoke Loader, TrickBot, Valak, yty, zwShell",
            "score": 42
        },
        {
            "techniqueID": "T1497.001",
            "comment": "executed by Attor, BadPatch, Denis, Dyre, EvilBunny, FinFisher, GravityRAT, OSX_OCEANLOTUS.D, Okrum, OopsIE, PlugX, PoetRAT, ROKRAT, RogueRobin, Smoke Loader, SynAck, UBoatRAT, yty",
            "score": 18
        },
        {
            "techniqueID": "T1090.003",
            "comment": "executed by Attor, Dok, GreyEnergy, Keydnap, MacSpy, Ursnif, WannaCry",
            "score": 7
        },
        {
            "techniqueID": "T1055.004",
            "comment": "executed by Attor, TURNEDUP",
            "score": 2
        },
        {
            "techniqueID": "T1071.002",
            "comment": "executed by Attor, JPIN, Kazuar, Machete, NOKKI, SYSCON, XAgentOSX, ZxShell",
            "score": 8
        },
        {
            "techniqueID": "T1020",
            "comment": "executed by Attor, CosmicDuke, LightNeuron, Machete, Rover, TINYTYPHON, TajMahal, USBStealer",
            "score": 8
        },
        {
            "techniqueID": "T1543.003",
            "comment": "executed by Attor, AuditCred, BBSRAT, Bankshot, BlackEnergy, Briba, Carbon, Catchamas, CosmicDuke, CozyCar, Duqu, Dyre, Elise, Emissary, Emotet, Exaramel for Windows, FinFisher, GreyEnergy, Hydraq, InnaputRAT, JHUHUGIT, Kazuar, KeyBoy, Kwampirs, LoudMiner, MoonWind, Naid, Nerex, Nidiran, Okrum, PlugX, PoisonIvy, Ragnar Locker, RawPOS, Reaver, Sakula, Seasalt, Shamoon, ShimRat, StreamEx, TDTESS, TYPEFRAME, TinyZBot, Ursnif, Volgmer, WannaCry, Wiarp, Wingbird, Winnti for Windows, ZLib, ZeroT, ZxShell, gh0st RAT, hcdLoader, zwShell",
            "score": 55
        },
        {
            "techniqueID": "T1123",
            "comment": "executed by Attor, Bandook, Cadelspy, Cobian RAT, DOGCALL, DarkComet, Derusbi, EvilGrab, Flame, InvisiMole, Janicab, MacSpy, Machete, Micropsia, NanoCore, ROKRAT, Revenge RAT, T9000, TajMahal, VERMIN, jRAT",
            "score": 21
        },
        {
            "techniqueID": "T1036.004",
            "comment": "executed by Attor, Catchamas, ComRAT, Exaramel for Windows, Fysbis, InnaputRAT, Kwampirs, Machete, Nidiran, Okrum, POWERSTATS, PlugX, RTM, RawPOS, Seasalt, Shamoon, ShimRat, Truvasys, Volgmer, build_downer",
            "score": 20
        },
        {
            "techniqueID": "T1059.001",
            "comment": "executed by AutoIt backdoor, BONDUPDATER, ComRAT, Denis, DownPaper, Emotet, GRIFFON, HALFBAKED, HAMMERTOSS, Helminth, JCry, KONNI, KeyBoy, Mosquito, Netwalker, OSX_OCEANLOTUS.D, POSHSPY, POWERSOURCE, POWERSTATS, POWERTON, POWRUNER, PUNCHBUGGY, PowerShower, PowerStallion, QUADAGENT, RATANKBA, Revenge RAT, RogueRobin, SHARPSTATS, SQLRat, SeaDuke, ServHelper, Socksbot, Ursnif, Valak, Xbash, Zeus Panda",
            "score": 37
        },
        {
            "techniqueID": "T1548.002",
            "comment": "executed by AutoIt backdoor, BlackEnergy, Downdelph, FinFisher, H1N1, InvisiMole, KONNI, PLAINTEE, RTM, Ramsay, Sakula, Shamoon, ShimRat, ZeroT",
            "score": 14
        },
        {
            "techniqueID": "T1552.001",
            "comment": "executed by Azorult, BlackEnergy, Emotet, Smoke Loader, TrickBot, XTunnel, jRAT, pngdowner",
            "score": 8
        },
        {
            "techniqueID": "T1555.003",
            "comment": "executed by Azorult, Backdoor.Oldrea, BlackEnergy, ChChes, CosmicDuke, Crimson, Emotet, H1N1, KONNI, KeyBoy, Lokibot, Machete, OLDBAIT, Olympic Destroyer, PLEAD, PinchDuke, PoetRAT, Prikormka, Proton, ROKRAT, RedLeaves, Smoke Loader, TSCookie, TrickBot, Unknown Logger, XAgentOSX, Zebrocy, jRAT, njRAT",
            "score": 29
        },
        {
            "techniqueID": "T1562.004",
            "comment": "executed by BACKSPACE, BADCALL, DarkComet, H1N1, HARDRAIN, HOPLIGHT, InvisiMole, Kasidet, NanoCore, Remsec, TYPEFRAME, ZxShell, njRAT",
            "score": 13
        },
        {
            "techniqueID": "T1090.001",
            "comment": "executed by BACKSPACE, CHOPSTICK, Duqu, Hikit, InvisiMole",
            "score": 5
        },
        {
            "techniqueID": "T1104",
            "comment": "executed by BACKSPACE, BLACKCOFFEE, Chaos",
            "score": 3
        },
        {
            "techniqueID": "T1132.002",
            "comment": "executed by BACKSPACE, Bankshot, OceanSalt",
            "score": 3
        },
        {
            "techniqueID": "T1001.003",
            "comment": "executed by BADCALL, Bankshot, FALLCHILL, FakeM, HARDRAIN, KeyBoy, Okrum",
            "score": 7
        },
        {
            "techniqueID": "T1571",
            "comment": "executed by BADCALL, Bankshot, Derusbi, Emotet, GravityRAT, HARDRAIN, HOPLIGHT, MoonWind, PoetRAT, RTM, RedLeaves, TYPEFRAME, TrickBot",
            "score": 13
        },
        {
            "techniqueID": "T1574.002",
            "comment": "executed by BADNEWS, BBSRAT, Denis, FinFisher, Goopy, HTTPBrowser, HyperBro, Metamorfo, OwaAuth, PlugX, Sakula, T9000, Wingbird, ZeroT, gh0st RAT",
            "score": 15
        },
        {
            "techniqueID": "T1039",
            "comment": "executed by BADNEWS, CosmicDuke, Ramsay",
            "score": 3
        },
        {
            "techniqueID": "T1005",
            "comment": "executed by BADNEWS, BadPatch, Bankshot, Calisto, China Chopper, CosmicDuke, FLASHFLOOD, Goopy, GravityRAT, Hydraq, Ixeshe, Kazuar, LightNeuron, Linfo, Machete, MobileOrder, POWERSTATS, PUNCHTRACK, Pasam, PinchDuke, PoisonIvy, Proxysvc, ROKRAT, Ramsay, RawPOS, Rover, SDBot, ShimRat, TajMahal, TrickBot, USBferry, Ursnif, njRAT, yty",
            "score": 34
        },
        {
            "techniqueID": "T1553.002",
            "comment": "executed by BADNEWS, BOOSTWRITE, BackConfig, ChChes, Daserf, Ebury, Epic, Gazer, GreyEnergy, Helminth, Janicab, LockerGoga, Metamorfo, More_eggs, NETWIRE, Nerex, RTM",
            "score": 17
        },
        {
            "techniqueID": "T1102.001",
            "comment": "executed by BADNEWS, BLACKCOFFEE, MiniDuke, PlugX, RTM, Xbash",
            "score": 6
        },
        {
            "techniqueID": "T1132",
            "comment": "executed by BADNEWS, H1N1, Linux Rabbit, Ursnif",
            "score": 4
        },
        {
            "techniqueID": "T1036.005",
            "comment": "executed by BADNEWS, BackConfig, Bundlore, Calisto, ChChes, DarkComet, Daserf, Elise, Felismus, FinFisher, Fysbis, Goopy, HTTPBrowser, InnaputRAT, InvisiMole, Ixeshe, KONNI, LightNeuron, Machete, MechaFlounder, Metamorfo, Mis-Type, Misdat, NOKKI, OLDBAIT, OSX/Shlayer, OwaAuth, PUNCHBUGGY, Pony, QUADAGENT, Ramsay, Remsec, Ryuk, S-Type, Skidmap, SslMM, Starloader, USBStealer, Ursnif, Winnti for Windows, ZLib",
            "score": 41
        },
        {
            "techniqueID": "T1102.002",
            "comment": "executed by BADNEWS, BLACKCOFFEE, CALENDAR, CloudDuke, ComRAT, Comnie, CozyCar, DOGCALL, GLOOXMAIL, KARAE, Kazuar, LOWBALL, Orz, POORAIM, PowerStallion, ROKRAT, Revenge RAT, RogueRobin, SLOWDRIFT, Twitoor, UBoatRAT, yty",
            "score": 22
        },
        {
            "techniqueID": "T1007",
            "comment": "executed by BBSRAT, Comnie, Dyre, Elise, Emissary, Epic, GeminiDuke, GravityRAT, GreyEnergy, HotCroissant, Hydraq, HyperBro, InvisiMole, Ixeshe, JPIN, Kwampirs, RATANKBA, S-Type, Sykipot, SynAck, TrickBot, Ursnif, Volgmer, WINERACK, ZLib, ZxShell, jRAT",
            "score": 27
        },
        {
            "techniqueID": "T1560.002",
            "comment": "executed by BBSRAT, Cardinal RAT, Denis, Epic, SeaDuke, TajMahal, ZLib",
            "score": 7
        },
        {
            "techniqueID": "T1008",
            "comment": "executed by BISCUIT, BlackEnergy, CHOPSTICK, Cardinal RAT, Derusbi, DustySky, HOPLIGHT, JHUHUGIT, Kazuar, Kwampirs, Linfo, Machete, MiniDuke, Mis-Type, NETEAGLE, QUADAGENT, S-Type, ShimRat, SslMM, WinMM, XTunnel",
            "score": 21
        },
        {
            "techniqueID": "T1071.004",
            "comment": "executed by BONDUPDATER, Cobian RAT, Denis, Ebury, Goopy, HTTPBrowser, Helminth, Matroyshka, NanHaiShu, POWERSOURCE, POWRUNER, Pisloader, PlugX, QUADAGENT, Remsec, SOUNDBITE, TEXTMATE",
            "score": 17
        },
        {
            "techniqueID": "T1574.001",
            "comment": "executed by BOOSTWRITE, Downdelph, FinFisher, HTTPBrowser, Hikit, InvisiMole, MirageFox, Prikormka, RedLeaves, WEBC2",
            "score": 10
        },
        {
            "techniqueID": "T1542.003",
            "comment": "executed by BOOTRASH, FinFisher, ROCKBOOT",
            "score": 3
        },
        {
            "techniqueID": "T1564.005",
            "comment": "executed by BOOTRASH, ComRAT, Regin",
            "score": 3
        },
        {
            "techniqueID": "T1204.001",
            "comment": "executed by BackConfig, Emotet, PLEAD, Pony, TSCookie",
            "score": 5
        },
        {
            "techniqueID": "T1059.005",
            "comment": "executed by BackConfig, Bisonal, Comnie, Emotet, Exaramel for Windows, Goopy, Helminth, JCry, KeyBoy, NanHaiShu, NanoCore, OSX_OCEANLOTUS.D, OopsIE, POWERSTATS, PoetRAT, PowerShower, QUADAGENT, Ramsay, Remexi, Smoke Loader, StoneDrill, TYPEFRAME, Ursnif, VBShower, Xbash, jRAT",
            "score": 26
        },
        {
            "techniqueID": "T1137.001",
            "comment": "executed by BackConfig",
            "score": 1
        },
        {
            "techniqueID": "T1087.003",
            "comment": "executed by Backdoor.Oldrea, Emotet, TrickBot",
            "score": 3
        },
        {
            "techniqueID": "T1203",
            "comment": "executed by Bankshot, DealersChoice, EvilBunny, HAWKBALL, Ramsay, SpeakUp, Xbash",
            "score": 7
        },
        {
            "techniqueID": "T1070",
            "comment": "executed by Bankshot, Goopy, MAZE, Misdat, Orz, PoetRAT, Prikormka, RTM, Rising Sun, SDBot",
            "score": 10
        },
        {
            "techniqueID": "T1087.002",
            "comment": "executed by Bankshot, OSInfo, POWRUNER, Sykipot, Valak",
            "score": 5
        },
        {
            "techniqueID": "T1485",
            "comment": "executed by BlackEnergy, Kazuar, Olympic Destroyer, PowerDuke, Proxysvc, Shamoon, StoneDrill, Xbash",
            "score": 8
        },
        {
            "techniqueID": "T1021.002",
            "comment": "executed by BlackEnergy, Duqu, Emotet, Kwampirs, Net Crawler, NotPetya, Olympic Destroyer, Regin, Shamoon, zwShell",
            "score": 10
        },
        {
            "techniqueID": "T1046",
            "comment": "executed by BlackEnergy, China Chopper, HDoor, MURKYTOP, Ramsay, Remsec, SpeakUp, XTunnel, Xbash, ZxShell",
            "score": 10
        },
        {
            "techniqueID": "T1070.001",
            "comment": "executed by BlackEnergy, FinFisher, Hydraq, NotPetya, Olympic Destroyer, RunningRAT, SynAck, ZxShell, gh0st RAT",
            "score": 9
        },
        {
            "techniqueID": "T1574.010",
            "comment": "executed by BlackEnergy",
            "score": 1
        },
        {
            "techniqueID": "T1189",
            "comment": "executed by Bundlore, KARAE, LoudMiner, POORAIM",
            "score": 4
        },
        {
            "techniqueID": "T1056.002",
            "comment": "executed by Bundlore, Calisto, Dok, Keydnap, Proton, iKitten",
            "score": 6
        },
        {
            "techniqueID": "T1059.004",
            "comment": "executed by Bundlore, CallMe, Chaos, CoinTicker, Derusbi, Exaramel for Linux, Fysbis, Kazuar, LoudMiner, OSX/Shlayer, Proton, Skidmap, WindTail",
            "score": 13
        },
        {
            "techniqueID": "T1543.001",
            "comment": "executed by Bundlore, Calisto, CoinTicker, CrossRAT, Dok, FruitFly, Keydnap, Komplex, MacSpy, OSX_OCEANLOTUS.D, Proton",
            "score": 11
        },
        {
            "techniqueID": "T1059.002",
            "comment": "executed by Bundlore, Dok",
            "score": 2
        },
        {
            "techniqueID": "T1543.004",
            "comment": "executed by Bundlore, LoudMiner, OSX_OCEANLOTUS.D",
            "score": 3
        },
        {
            "techniqueID": "T1098.004",
            "comment": "executed by Bundlore, Skidmap",
            "score": 2
        },
        {
            "techniqueID": "T1059.006",
            "comment": "executed by Bundlore, CoinTicker, KeyBoy, Keydnap, Machete, MechaFlounder, PUNCHBUGGY, PoetRAT, SpeakUp",
            "score": 9
        },
        {
            "techniqueID": "T1518",
            "comment": "executed by Bundlore, ComRAT, DustySky, Dyre, HotCroissant, Orz, RTM, TajMahal, down_new",
            "score": 9
        },
        {
            "techniqueID": "T1176",
            "comment": "executed by Bundlore, OSX/Shlayer",
            "score": 2
        },
        {
            "techniqueID": "T1195.002",
            "comment": "executed by CCBkdr",
            "score": 1
        },
        {
            "techniqueID": "T1092",
            "comment": "executed by CHOPSTICK, USBStealer",
            "score": 2
        },
        {
            "techniqueID": "T1059",
            "comment": "executed by CHOPSTICK, DarkComet, Get2, Matroyshka, SpeakUp, WINERACK, Zeus Panda, gh0st RAT",
            "score": 8
        },
        {
            "techniqueID": "T1560.001",
            "comment": "executed by CORALDECK, Calisto, Daserf, DustySky, InvisiMole, Micropsia, Okrum, OopsIE, PUNCHBUGGY, PoetRAT, PowerShower, Ramsay, WindTail, iKitten",
            "score": 14
        },
        {
            "techniqueID": "T1027.001",
            "comment": "executed by CORESHELL, Comnie, Emissary, FinFisher, Goopy, Kwampirs, MAZE, POWERSTATS, Rifdoor, SamSam, XTunnel, ZeroT, yty",
            "score": 13
        },
        {
            "techniqueID": "T1098",
            "comment": "executed by Calisto",
            "score": 1
        },
        {
            "techniqueID": "T1555.001",
            "comment": "executed by Calisto, Proton, iKitten",
            "score": 3
        },
        {
            "techniqueID": "T1217",
            "comment": "executed by Calisto, Machete, MobileOrder",
            "score": 3
        },
        {
            "techniqueID": "T1569.001",
            "comment": "executed by Calisto, LoudMiner",
            "score": 2
        },
        {
            "techniqueID": "T1136.001",
            "comment": "executed by Calisto, Carbanak, Flame, HiddenWasp, Mis-Type, S-Type, ServHelper, ZxShell",
            "score": 8
        },
        {
            "techniqueID": "T1547.004",
            "comment": "executed by Cannon, Dipsind, Gazer, KeyBoy, Remexi",
            "score": 5
        },
        {
            "techniqueID": "T1003",
            "comment": "executed by Carbanak, HOMEFRY, OnionDuke, PinchDuke, Revenge RAT, Trojan.Karagany",
            "score": 6
        },
        {
            "techniqueID": "T1114.001",
            "comment": "executed by Carbanak, CosmicDuke, Crimson, Emotet, Smoke Loader",
            "score": 5
        },
        {
            "techniqueID": "T1219",
            "comment": "executed by Carbanak, Dridex, RTM",
            "score": 3
        },
        {
            "techniqueID": "T1030",
            "comment": "executed by Carbanak, Helminth, OopsIE, POSHSPY",
            "score": 4
        },
        {
            "techniqueID": "T1055.002",
            "comment": "executed by Carbanak, GreyEnergy, Zeus Panda",
            "score": 3
        },
        {
            "techniqueID": "T1021.001",
            "comment": "executed by Carbanak, DarkComet, Revenge RAT, SDBot, ServHelper, ZxShell, jRAT, njRAT, zwShell",
            "score": 9
        },
        {
            "techniqueID": "T1018",
            "comment": "executed by Carbon, Comnie, Epic, Kwampirs, MURKYTOP, OSInfo, Olympic Destroyer, PoetRAT, RATANKBA, Remsec, SHOTPUT, Shamoon, Sykipot, USBferry, WannaCry, njRAT, yty",
            "score": 17
        },
        {
            "techniqueID": "T1027.004",
            "comment": "executed by Cardinal RAT",
            "score": 1
        },
        {
            "techniqueID": "T1110",
            "comment": "executed by Chaos",
            "score": 1
        },
        {
            "techniqueID": "T1205",
            "comment": "executed by Chaos, Umbreon, Winnti for Linux",
            "score": 3
        },
        {
            "techniqueID": "T1546.010",
            "comment": "executed by Cherry Picker, Ramsay, T9000",
            "score": 3
        },
        {
            "techniqueID": "T1110.001",
            "comment": "executed by China Chopper, Emotet, Pony, SpeakUp, Xbash",
            "score": 5
        },
        {
            "techniqueID": "T1553.001",
            "comment": "executed by CoinTicker",
            "score": 1
        },
        {
            "techniqueID": "T1068",
            "comment": "executed by CosmicDuke, JHUHUGIT, Remsec, Wingbird",
            "score": 4
        },
        {
            "techniqueID": "T1003.004",
            "comment": "executed by CosmicDuke",
            "score": 1
        },
        {
            "techniqueID": "T1003.002",
            "comment": "executed by CosmicDuke, CozyCar, HOPLIGHT, Mivast, POWERTON, Remsec",
            "score": 6
        },
        {
            "techniqueID": "T1036.003",
            "comment": "executed by CozyCar, NotPetya",
            "score": 2
        },
        {
            "techniqueID": "T1003.001",
            "comment": "executed by CozyCar, Daserf, Emotet, GreyEnergy, Net Crawler, NotPetya, Okrum, Olympic Destroyer, PoetRAT",
            "score": 9
        },
        {
            "techniqueID": "T1027.005",
            "comment": "executed by Daserf, GravityRAT",
            "score": 2
        },
        {
            "techniqueID": "T1001.002",
            "comment": "executed by Daserf, Duqu, HAMMERTOSS, LightNeuron, ZeroT",
            "score": 5
        },
        {
            "techniqueID": "T1574",
            "comment": "executed by Denis, Ramsay, ShimRat",
            "score": 3
        },
        {
            "techniqueID": "T1553.004",
            "comment": "executed by Dok, Hikit, RTM",
            "score": 3
        },
        {
            "techniqueID": "T1547.011",
            "comment": "executed by Dok, LoudMiner",
            "score": 2
        },
        {
            "techniqueID": "T1001.001",
            "comment": "executed by Downdelph, P2P ZeuS, PLEAD",
            "score": 3
        },
        {
            "techniqueID": "T1134",
            "comment": "executed by Duqu, Hydraq, Ryuk, SslMM",
            "score": 4
        },
        {
            "techniqueID": "T1071",
            "comment": "executed by Duqu, NETEAGLE, Regin",
            "score": 3
        },
        {
            "techniqueID": "T1078",
            "comment": "executed by Duqu, Linux Rabbit, SeaDuke",
            "score": 3
        },
        {
            "techniqueID": "T1218.007",
            "comment": "executed by Duqu, LoudMiner, Ragnar Locker",
            "score": 3
        },
        {
            "techniqueID": "T1572",
            "comment": "executed by Duqu, FLIPSIDE",
            "score": 2
        },
        {
            "techniqueID": "T1570",
            "comment": "executed by DustySky, LockerGoga, Netwalker, Olympic Destroyer, Shamoon, WannaCry",
            "score": 6
        },
        {
            "techniqueID": "T1529",
            "comment": "executed by DustySky, LockerGoga, NotPetya, Olympic Destroyer, Shamoon",
            "score": 5
        },
        {
            "techniqueID": "T1552.004",
            "comment": "executed by Ebury, Machete, jRAT",
            "score": 3
        },
        {
            "techniqueID": "T1562.002",
            "comment": "executed by Ebury",
            "score": 1
        },
        {
            "techniqueID": "T1554",
            "comment": "executed by Ebury",
            "score": 1
        },
        {
            "techniqueID": "T1069.001",
            "comment": "executed by Emissary, Epic, FlawedAmmyy, Helminth, JPIN, Kazuar, Kwampirs, OSInfo, POWRUNER, Sys10",
            "score": 10
        },
        {
            "techniqueID": "T1040",
            "comment": "executed by Emotet, MESSAGETAP, Regin",
            "score": 3
        },
        {
            "techniqueID": "T1210",
            "comment": "executed by Emotet, Flame, NotPetya, WannaCry",
            "score": 4
        },
        {
            "techniqueID": "T1566.002",
            "comment": "executed by Emotet, Pony",
            "score": 2
        },
        {
            "techniqueID": "T1566.001",
            "comment": "executed by Emotet, OceanSalt, PoetRAT, Pony, RTM, Rifdoor, TrickBot",
            "score": 7
        },
        {
            "techniqueID": "T1078.003",
            "comment": "executed by Emotet, NotPetya, Umbreon",
            "score": 3
        },
        {
            "techniqueID": "T1055.011",
            "comment": "executed by Epic, Power Loader",
            "score": 2
        },
        {
            "techniqueID": "T1053.003",
            "comment": "executed by Exaramel for Linux, Janicab, Skidmap, SpeakUp, Xbash",
            "score": 5
        },
        {
            "techniqueID": "T1543.002",
            "comment": "executed by Exaramel for Linux, Fysbis",
            "score": 2
        },
        {
            "techniqueID": "T1056.004",
            "comment": "executed by FinFisher, NOKKI, RDFSNIFFER, TrickBot, Ursnif, Zebrocy, Zeus Panda, ZxShell",
            "score": 8
        },
        {
            "techniqueID": "T1011.001",
            "comment": "executed by Flame",
            "score": 1
        },
        {
            "techniqueID": "T1547.002",
            "comment": "executed by Flame",
            "score": 1
        },
        {
            "techniqueID": "T1001",
            "comment": "executed by FlawedAmmyy",
            "score": 1
        },
        {
            "techniqueID": "T1069.002",
            "comment": "executed by GRIFFON, Helminth, Kwampirs, OSInfo, POWRUNER",
            "score": 5
        },
        {
            "techniqueID": "T1055.003",
            "comment": "executed by Gazer",
            "score": 1
        },
        {
            "techniqueID": "T1546.002",
            "comment": "executed by Gazer",
            "score": 1
        },
        {
            "techniqueID": "T1564.004",
            "comment": "executed by Gazer, LoJax, POWERSOURCE, PowerDuke, Regin, Valak, Zeroaccess",
            "score": 7
        },
        {
            "techniqueID": "T1559.002",
            "comment": "executed by GravityRAT, HAWKBALL, KeyBoy, POWERSTATS, PoetRAT, RTM, Ramsay",
            "score": 7
        },
        {
            "techniqueID": "T1080",
            "comment": "executed by H1N1, Miner-C, Ramsay, Ursnif",
            "score": 4
        },
        {
            "techniqueID": "T1490",
            "comment": "executed by H1N1, JCry, MAZE, Netwalker, Olympic Destroyer, Ragnar Locker, RobbinHood, Ryuk, WannaCry",
            "score": 9
        },
        {
            "techniqueID": "T1102.003",
            "comment": "executed by HAMMERTOSS, OnionDuke",
            "score": 2
        },
        {
            "techniqueID": "T1567.002",
            "comment": "executed by HAMMERTOSS",
            "score": 1
        },
        {
            "techniqueID": "T1014",
            "comment": "executed by HIDEDRV, Hacking Team UEFI Rootkit, HiddenWasp, Hikit, LoJax, PoisonIvy, Ramsay, Skidmap, Umbreon, Uroburos, Winnti for Linux, Zeroaccess",
            "score": 12
        },
        {
            "techniqueID": "T1550.002",
            "comment": "executed by HOPLIGHT",
            "score": 1
        },
        {
            "techniqueID": "T1542.001",
            "comment": "executed by Hacking Team UEFI Rootkit, LoJax, Trojan.Mebromi",
            "score": 3
        },
        {
            "techniqueID": "T1546.004",
            "comment": "executed by HiddenWasp, Linux Rabbit",
            "score": 2
        },
        {
            "techniqueID": "T1574.006",
            "comment": "executed by HiddenWasp",
            "score": 1
        },
        {
            "techniqueID": "T1489",
            "comment": "executed by HotCroissant, Netwalker, Olympic Destroyer, Ragnar Locker, RobbinHood, Ryuk, WannaCry",
            "score": 7
        },
        {
            "techniqueID": "T1048",
            "comment": "executed by Hydraq, PoetRAT",
            "score": 2
        },
        {
            "techniqueID": "T1135",
            "comment": "executed by InvisiMole, Kwampirs, MURKYTOP, OSInfo, Olympic Destroyer, PlugX, Ramsay, ShimRat, Zebrocy",
            "score": 9
        },
        {
            "techniqueID": "T1486",
            "comment": "executed by JCry, LockerGoga, MAZE, Netwalker, NotPetya, Ragnar Locker, RobbinHood, Ryuk, SamSam, Shamoon, SynAck, WannaCry, Xbash",
            "score": 13
        },
        {
            "techniqueID": "T1222.001",
            "comment": "executed by JPIN, WannaCry",
            "score": 2
        },
        {
            "techniqueID": "T1197",
            "comment": "executed by JPIN, UBoatRAT",
            "score": 2
        },
        {
            "techniqueID": "T1548.001",
            "comment": "executed by Keydnap",
            "score": 1
        },
        {
            "techniqueID": "T1555.002",
            "comment": "executed by Keydnap",
            "score": 1
        },
        {
            "techniqueID": "T1036.006",
            "comment": "executed by Keydnap",
            "score": 1
        },
        {
            "techniqueID": "T1021",
            "comment": "executed by Kivars",
            "score": 1
        },
        {
            "techniqueID": "T1201",
            "comment": "executed by Kwampirs",
            "score": 1
        },
        {
            "techniqueID": "T1114.002",
            "comment": "executed by LightNeuron, SeaDuke, Valak",
            "score": 3
        },
        {
            "techniqueID": "T1565.002",
            "comment": "executed by LightNeuron",
            "score": 1
        },
        {
            "techniqueID": "T1505.002",
            "comment": "executed by LightNeuron",
            "score": 1
        },
        {
            "techniqueID": "T1133",
            "comment": "executed by Linux Rabbit",
            "score": 1
        },
        {
            "techniqueID": "T1110.003",
            "comment": "executed by Linux Rabbit",
            "score": 1
        },
        {
            "techniqueID": "T1531",
            "comment": "executed by LockerGoga",
            "score": 1
        },
        {
            "techniqueID": "T1547",
            "comment": "executed by LoudMiner",
            "score": 1
        },
        {
            "techniqueID": "T1496",
            "comment": "executed by LoudMiner, Skidmap",
            "score": 2
        },
        {
            "techniqueID": "T1564.006",
            "comment": "executed by LoudMiner, Ragnar Locker",
            "score": 2
        },
        {
            "techniqueID": "T1568",
            "comment": "executed by MAZE, NETEAGLE, RTM",
            "score": 3
        },
        {
            "techniqueID": "T1053.002",
            "comment": "executed by MURKYTOP",
            "score": 1
        },
        {
            "techniqueID": "T1069",
            "comment": "executed by MURKYTOP",
            "score": 1
        },
        {
            "techniqueID": "T1218.005",
            "comment": "executed by NanHaiShu, POWERSTATS, Revenge RAT, Xbash",
            "score": 4
        },
        {
            "techniqueID": "T1110.002",
            "comment": "executed by Net Crawler",
            "score": 1
        },
        {
            "techniqueID": "T1548.004",
            "comment": "executed by OSX/Shlayer",
            "score": 1
        },
        {
            "techniqueID": "T1222.002",
            "comment": "executed by OSX/Shlayer",
            "score": 1
        },
        {
            "techniqueID": "T1090.002",
            "comment": "executed by Okrum, POWERSTATS, Regin, ShimRat",
            "score": 4
        },
        {
            "techniqueID": "T1003.005",
            "comment": "executed by Okrum",
            "score": 1
        },
        {
            "techniqueID": "T1497.003",
            "comment": "executed by Okrum, Pony, Ursnif",
            "score": 3
        },
        {
            "techniqueID": "T1497.002",
            "comment": "executed by Okrum",
            "score": 1
        },
        {
            "techniqueID": "T1546.003",
            "comment": "executed by POSHSPY, POWERTON, SeaDuke, adbupd",
            "score": 4
        },
        {
            "techniqueID": "T1559.001",
            "comment": "executed by POWERSTATS, Ursnif",
            "score": 2
        },
        {
            "techniqueID": "T1546.009",
            "comment": "executed by PUNCHBUGGY",
            "score": 1
        },
        {
            "techniqueID": "T1547.008",
            "comment": "executed by Pasam, Wingbird",
            "score": 2
        },
        {
            "techniqueID": "T1127.001",
            "comment": "executed by PlugX",
            "score": 1
        },
        {
            "techniqueID": "T1548.003",
            "comment": "executed by Proton",
            "score": 1
        },
        {
            "techniqueID": "T1070.002",
            "comment": "executed by Proton",
            "score": 1
        },
        {
            "techniqueID": "T1021.005",
            "comment": "executed by Proton, ZxShell",
            "score": 2
        },
        {
            "techniqueID": "T1036",
            "comment": "executed by RTM, Ramsay, WindTail",
            "score": 3
        },
        {
            "techniqueID": "T1218.002",
            "comment": "executed by Reaver",
            "score": 1
        },
        {
            "techniqueID": "T1036.001",
            "comment": "executed by Regin, WindTail",
            "score": 2
        },
        {
            "techniqueID": "T1556.002",
            "comment": "executed by Remsec",
            "score": 1
        },
        {
            "techniqueID": "T1053",
            "comment": "executed by Remsec",
            "score": 1
        },
        {
            "techniqueID": "T1202",
            "comment": "executed by Revenge RAT",
            "score": 1
        },
        {
            "techniqueID": "T1070.005",
            "comment": "executed by RobbinHood",
            "score": 1
        },
        {
            "techniqueID": "T1546.012",
            "comment": "executed by SDBot",
            "score": 1
        },
        {
            "techniqueID": "T1546.011",
            "comment": "executed by SDBot, ShimRat",
            "score": 2
        },
        {
            "techniqueID": "T1550.003",
            "comment": "executed by SeaDuke",
            "score": 1
        },
        {
            "techniqueID": "T1078.002",
            "comment": "executed by Shamoon",
            "score": 1
        },
        {
            "techniqueID": "T1561.002",
            "comment": "executed by Shamoon, StoneDrill",
            "score": 2
        },
        {
            "techniqueID": "T1556.001",
            "comment": "executed by Skeleton Key",
            "score": 1
        },
        {
            "techniqueID": "T1547.006",
            "comment": "executed by Skidmap",
            "score": 1
        },
        {
            "techniqueID": "T1556.003",
            "comment": "executed by Skidmap",
            "score": 1
        },
        {
            "techniqueID": "T1561.001",
            "comment": "executed by StoneDrill",
            "score": 1
        },
        {
            "techniqueID": "T1111",
            "comment": "executed by Sykipot",
            "score": 1
        },
        {
            "techniqueID": "T1055.013",
            "comment": "executed by SynAck",
            "score": 1
        },
        {
            "techniqueID": "T1539",
            "comment": "executed by TajMahal",
            "score": 1
        },
        {
            "techniqueID": "T1482",
            "comment": "executed by TrickBot",
            "score": 1
        },
        {
            "techniqueID": "T1552.002",
            "comment": "executed by TrickBot",
            "score": 1
        },
        {
            "techniqueID": "T1055.005",
            "comment": "executed by Ursnif",
            "score": 1
        },
        {
            "techniqueID": "T1563.002",
            "comment": "executed by WannaCry",
            "score": 1
        },
        {
            "techniqueID": "T1072",
            "comment": "executed by Wiper",
            "score": 1
        },
        {
            "techniqueID": "T1499",
            "comment": "executed by ZxShell",
            "score": 1
        },
        {
            "techniqueID": "T1037.004",
            "comment": "executed by iKitten",
            "score": 1
        },
        {
            "techniqueID": "T1037.005",
            "comment": "executed by jRAT",
            "score": 1
        }
    ],
    "sorting": 3,
    "gradient": {
        "colors": [
            "#fff7b3",
            "#ff6666"
        ],
        "minValue": 1,
        "maxValue": 170
    }
}