{
"base": "http://localhost:63030",
"models": [
"vanilla-rag",
"hybrid-rag",
"contextual-rag",
"graph-rag",
"agentic-rag",
"n8n-adaptive-rag",
"vanilla-rag-wide",
"hybrid-rag-high-recall",
"hybrid-rag-fast",
"contextual-rag-high-recall",
"graph-rag-fast",
"graph-rag-wide",
"agentic-rag-deeper",
"n8n-adaptive-rag-default"
],
"model_profiles": [
{
"model": "vanilla-rag",
"base_model": "vanilla-rag",
"flavor": "default",
"requires_reingest": false
},
{
"model": "hybrid-rag",
"base_model": "hybrid-rag",
"flavor": "default",
"requires_reingest": false
},
{
"model": "contextual-rag",
"base_model": "contextual-rag",
"flavor": "default",
"requires_reingest": false
},
{
"model": "graph-rag",
"base_model": "graph-rag",
"flavor": "default",
"requires_reingest": false
},
{
"model": "agentic-rag",
"base_model": "agentic-rag",
"flavor": "default",
"requires_reingest": false
},
{
"model": "n8n-adaptive-rag",
"base_model": "n8n-adaptive-rag",
"flavor": "default",
"requires_reingest": false
},
{
"model": "vanilla-rag-wide",
"base_model": "vanilla-rag",
"flavor": "wide",
"requires_reingest": false
},
{
"model": "hybrid-rag-high-recall",
"base_model": "hybrid-rag",
"flavor": "high-recall",
"requires_reingest": false
},
{
"model": "hybrid-rag-fast",
"base_model": "hybrid-rag",
"flavor": "fast",
"requires_reingest": false
},
{
"model": "contextual-rag-high-recall",
"base_model": "contextual-rag",
"flavor": "high-recall",
"requires_reingest": false
},
{
"model": "graph-rag-fast",
"base_model": "graph-rag",
"flavor": "fast",
"requires_reingest": false
},
{
"model": "graph-rag-wide",
"base_model": "graph-rag",
"flavor": "wide",
"requires_reingest": false
},
{
"model": "agentic-rag-deeper",
"base_model": "agentic-rag",
"flavor": "deeper",
"requires_reingest": false
},
{
"model": "n8n-adaptive-rag-default",
"base_model": "n8n-adaptive-rag",
"flavor": "default",
"requires_reingest": false
}
],
"queries_file": "demo/cyber_threat_intel_queries.yaml",
"queries": [
{
"id": "cyber_group_technique_software_chain",
"query": "Which intrusion groups in this slice share credential-access or discovery techniques, and what software or tools connect them?",
"expect_winner": "graph-rag",
"rationale": "Requires graph paths across intrusion groups, tools, malware, and ATT&CK techniques."
},
{
"id": "cyber_credential_access_path",
"query": "Trace the relationship path from Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Which actors and software converge on credential access?",
"expect_winner": "graph-rag",
"rationale": "Requires multi-hop path traversal over intrusion sets, software tools, and techniques."
},
{
"id": "cyber_campaign_overlap",
"query": "Which campaigns overlap by tooling or technique, especially around PowerShell, Reg, spearphishing, discovery, or exfiltration?",
"expect_winner": "graph-rag",
"rationale": "Requires shared-entity graph reasoning across campaigns, groups, tools, and techniques."
},
{
"id": "cyber_mitigation_coverage",
"query": "Which mitigations cover credential, Active Directory, web-content, or registry-related techniques, and which techniques do they mitigate?",
"expect_winner": "graph-rag",
"rationale": "Requires relationship aggregation over mitigation-to-technique paths."
},
{
"id": "cyber_campaign_timeline_context",
"query": "Compare Frankenstein, Operation CuckooBees, Operation Honeybee, and Night Dragon by timeframe, target context, and the techniques or tools each used.",
"expect_winner": "graph-rag",
"rationale": "Requires temporal graph reasoning plus textual evidence."
},
{
"id": "cyber_protocol_and_web_mitigation_path",
"query": "Connect protocol impersonation, web-based content restrictions, spearphishing links, and command-and-control style techniques. Which groups, campaigns, or software are involved?",
"expect_winner": "graph-rag",
"rationale": "Requires graph path reasoning across techniques, mitigations, campaigns, groups, and software."
}
],
"cells": [
{
"query_id": "cyber_group_technique_software_chain",
"model": "vanilla-rag",
"base_model": "vanilla-rag",
"flavor": "default",
"requires_reingest": false,
"ok": true,
"latency_s": 12.7,
"raw": "Based on the provided context, **Cleaver** (G0003) is the only group explicitly linked to credential-access techniques. It uses **LSASS Memory** (T1003.001), which falls under the OS Credential Dumping technique (T1003). Cleaver also uses several tools: **Net Crawler**, **ARP Cache Poisoning**, **PsExec**, **Tool**, and **TinyZBot**.\n\nThe context for **OS Credential Dumping** (T1003) mentions that adversaries may use various tools, but it does not list specific intrusion groups other than a truncated reference to \"Ember Bear\" using \"OS\". No other groups in the provided text (Carbanak, APT12, APT28) are explicitly linked to credential-access or discovery techniques.\n\nTherefore, no multiple intrusion groups are shown to share these techniques via connecting software/tools in this specific slice. Only Cleaver is identified with credential-access methods.\n\n🔎 Retrieved context (5 sources)
\n\n**1. 003-g0003.md**\n\n> # Cleaver\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0003\nSTIX ID: intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063\n\nDescription:\n[Cleaver](https://attack.mitre.org/groups/G0003) is a threat grou\n\n**2. 008-g0008.md**\n\n> # Carbanak\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0008\nSTIX ID: intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c\n\nDescription:\n[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercrim\n\n**3. 046-t1003.md**\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n**4. 005-g0005.md**\n\n> # APT12\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0005\nSTIX ID: intrusion-set--c47f937f-1022-4f42-8525-e7a4779a14cb\n\nDescription:\n[APT12](https://attack.mitre.org/groups/G0005) is a threat group th\n\n**5. 007-g0007.md**\n\n> # APT28\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0007\nSTIX ID: intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c\n\nDescription:\n[APT28](https://attack.mitre.org/groups/G0007) is a threat group th\n\n🔎 Retrieved context (5 sources)
\n\n**1. 046-t1003.md** · score 0.016\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n**2. 009-g0009.md** · score 0.015\n\n> # Deep Panda\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0009\nSTIX ID: intrusion-set--a653431d-6a5e-4600-8ad3-609b5af57064\n\nDescription:\n[Deep Panda](https://attack.mitre.org/groups/G0009) is a suspe\n\n**3. 048-t1003-002.md** · score 0.012\n\n> # Security Account Manager\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003.002\nSTIX ID: attack-pattern--1644e709-12d2-41e5-a60f-3470991f5011\n\nDescription:\nAdversaries may attempt to extract credent\n\n**4. 047-t1003-001.md** · score 0.012\n\n> # LSASS Memory\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003.001\nSTIX ID: attack-pattern--65f2d882-3f41-4d48-8a06-29af77ec9f90\n\nDescription:\nAdversaries may attempt to access credential material \n\n**5. 001-g0001.md** · score 0.012\n\n> # Axiom\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0001\nSTIX ID: intrusion-set--a0cb9370-e39b-44d5-9f50-ef78e412b973\n\nDescription:\n[Axiom](https://attack.mitre.org/groups/G0001) is a suspected Chine\n\n🔎 Retrieved context (5 sources)
\n\n**1. 047-t1003-001.md** · score 0.052\n\n> This section lists specific threat actors and tools that utilize the LSASS Memory technique for credential harvesting, linking them to the broader OS Credential Dumping tactic. It also confirms the hierarchical relationship between LSASS Me\n\n**2. 009-g0009.md** · score 0.036\n\n> This text introduces Deep Panda (G0009), a suspected Chinese threat group also known by aliases such as Shell Crew and Black Vine, which is detailed in the MITRE ATT&CK Enterprise STIX bundle. The document further lists specific techniques \n\n**3. 046-t1003.md** · score 0.031\n\n> This section details the OS Credential Dumping technique (T1003), which involves adversaries extracting login credentials from operating system caches or memory to facilitate lateral movement and unauthorized access. It lists specific threa\n\n**4. 048-t1003-002.md** · score 0.028\n\n> This section lists specific threat actors, tools, and detection techniques that utilize or detect the Security Account Manager (SAM) database for credential dumping. It provides concrete examples of adversaries like APT29 and FIN13, as well\n\n**5. 033-s0006.md** · score 0.026\n\n> This text provides technical details and threat actor associations for the \"pwdump\" credential dumping tool within the MITRE ATT&CK framework. It links the tool to specific techniques and groups that utilize it for data exfiltration.\n\n# pwd\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Thought:** To answer this question accurately, I need to access the specific document corpus or knowledge graph that contains the \"slice\" of data you are referring to. Since the context of \"this slice\" is not provided in the prompt, I will perform a search for intrusion groups known to share credential-access and discovery techniques, as well as the tools they use, which often appear in threat intelligence reports (like those from Mandiant, CrowdStrike, or Microsoft).\n\nHowever, without the specific source text, I cannot definitively say which groups are in *your* specific slice. I will assume you are referring to a common set of APTs often analyzed together in such contexts (e.g., APT29, APT28, APT41, or similar clusters).\n\nLet's search for information on intrusion groups sharing these techniques and the connecting tools.\n\n**Action:** `search_vectors(intrusion groups share credential-access discovery techniques software tools)`\n\n**Observation:** - 046-t1003.md: # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversari\n- 048-t1003-002.md: # Security Account Manager\n\nSource: MITRE ATT&CK Enterprise STI\n\n🔎 Retrieved context (5 sources)
\n\n**1. 003-g0003.md**\n\n> # Cleaver\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0003\nSTIX ID: intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063\n\nDescription:\n[Cleaver](https://attack.mitre.org/groups/G0003) is a threat grou\n\n**2. 008-g0008.md**\n\n> # Carbanak\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0008\nSTIX ID: intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c\n\nDescription:\n[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercrim\n\n**3. 046-t1003.md**\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n**4. 005-g0005.md**\n\n> # APT12\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0005\nSTIX ID: intrusion-set--c47f937f-1022-4f42-8525-e7a4779a14cb\n\nDescription:\n[APT12](https://attack.mitre.org/groups/G0005) is a threat group th\n\n**5. 007-g0007.md**\n\n> # APT28\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0007\nSTIX ID: intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c\n\nDescription:\n[APT28](https://attack.mitre.org/groups/G0007) is a threat group th\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (8 sources)
\n\n**1. 003-g0003.md**\n\n> # Cleaver\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0003\nSTIX ID: intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063\n\nDescription:\n[Cleaver](https://attack.mitre.org/groups/G0003) is a threat grou\n\n**2. 008-g0008.md**\n\n> # Carbanak\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0008\nSTIX ID: intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c\n\nDescription:\n[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercrim\n\n**3. 046-t1003.md**\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n**4. 005-g0005.md**\n\n> # APT12\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0005\nSTIX ID: intrusion-set--c47f937f-1022-4f42-8525-e7a4779a14cb\n\nDescription:\n[APT12](https://attack.mitre.org/groups/G0005) is a threat group th\n\n**5. 007-g0007.md**\n\n> # APT28\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0007\nSTIX ID: intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c\n\nDescription:\n[APT28](https://attack.mitre.org/groups/G0007) is a threat group th\n\n**6. 010-g0010.md**\n\n> # Turla\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0010\nSTIX ID: intrusion-set--7a19ecb1-3c65-4de3-a230-993516aed6a6\n\nDescription:\n[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage\n\n**7. 001-g0001.md**\n\n> # Axiom\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0001\nSTIX ID: intrusion-set--a0cb9370-e39b-44d5-9f50-ef78e412b973\n\nDescription:\n[Axiom](https://attack.mitre.org/groups/G0001) is a suspected Chine\n\n**8. 053-m1016.md**\n\n> # Vulnerability Scanning\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1016\nSTIX ID: course-of-action--15437c6d-b998-4a36-be41-4ace3d54d266\n\nDescription:\nVulnerability scanning involves the automate\n\n🔎 Retrieved context (8 sources)
\n\n**1. 046-t1003.md** · score 0.016\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n**2. 034-s0008.md** · score 0.016\n\n> # gsecdump\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0008\nSTIX ID: tool--b07c2c47-fefb-4d7c-a69e-6a3296171f54\n\nDescription:\n[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available creden\n\n**3. 009-g0009.md** · score 0.015\n\n> # Deep Panda\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0009\nSTIX ID: intrusion-set--a653431d-6a5e-4600-8ad3-609b5af57064\n\nDescription:\n[Deep Panda](https://attack.mitre.org/groups/G0009) is a suspe\n\n**4. 046-t1003.md** · score 0.014\n\n> sters. Additional custom tools likely exist as well.\n\n\nRelations:\n- Ember Bear (G1003) -> uses -> OS Credential Dumping\n- Security Account Manager (T1003.002) -> subtechnique-of -> OS Credential Dumping\n- APT39 (G0087) -> uses -> OS Credent\n\n**5. 029-s0013.md** · score 0.013\n\n> # PlugX\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: malware\nATT&CK ID: S0013\nSTIX ID: malware--64fa0de0-6240-41f4-8638-f4ca7ed528fd\n\nDescription:\n[PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) \n\n**6. 011-c0001.md** · score 0.013\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n**7. 048-t1003-002.md** · score 0.012\n\n> # Security Account Manager\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003.002\nSTIX ID: attack-pattern--1644e709-12d2-41e5-a60f-3470991f5011\n\nDescription:\nAdversaries may attempt to extract credent\n\n**8. 049-t1003-003.md** · score 0.012\n\n> information.(Citation: Metcalf 2015)\n\nThe following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.\n\n* Volume Shadow Copy\n* secretsdump.py\n* Using the in-built Windows tool\n\n🔎 Retrieved context (5 sources)
\n\n**1. 008-g0008.md** · score 0.841\n\n> # Carbanak\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0008\nSTIX ID: intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c\n\nDescription:\n[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercrim\n\n**2. 046-t1003.md** · score 0.776\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n**3. 010-g0010.md** · score 0.725\n\n> # Turla\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0010\nSTIX ID: intrusion-set--7a19ecb1-3c65-4de3-a230-993516aed6a6\n\nDescription:\n[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage\n\n**4. 048-t1003-002.md** · score 0.719\n\n> # Security Account Manager\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003.002\nSTIX ID: attack-pattern--1644e709-12d2-41e5-a60f-3470991f5011\n\nDescription:\nAdversaries may attempt to extract credent\n\n**5. 009-g0009.md** · score 0.670\n\n> oups/G0009) also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. (Citation: Symantec Black Vine) Some analysts track [Deep Panda](https://attack.mitre.org/groups/G0009) and [APT19](htt\n\n🔎 Retrieved context (8 sources)
\n\n**1. 047-t1003-001.md** · score 0.052\n\n> This section lists specific threat actors and tools that utilize the LSASS Memory technique for credential harvesting, linking them to the broader OS Credential Dumping tactic. It also confirms the hierarchical relationship between LSASS Me\n\n**2. 009-g0009.md** · score 0.036\n\n> This text introduces Deep Panda (G0009), a suspected Chinese threat group also known by aliases such as Shell Crew and Black Vine, which is detailed in the MITRE ATT&CK Enterprise STIX bundle. The document further lists specific techniques \n\n**3. 046-t1003.md** · score 0.031\n\n> This section details the OS Credential Dumping technique (T1003), which involves adversaries extracting login credentials from operating system caches or memory to facilitate lateral movement and unauthorized access. It lists specific threa\n\n**4. 048-t1003-002.md** · score 0.028\n\n> This section lists specific threat actors, tools, and detection techniques that utilize or detect the Security Account Manager (SAM) database for credential dumping. It provides concrete examples of adversaries like APT29 and FIN13, as well\n\n**5. 033-s0006.md** · score 0.026\n\n> This text provides technical details and threat actor associations for the \"pwdump\" credential dumping tool within the MITRE ATT&CK framework. It links the tool to specific techniques and groups that utilize it for data exfiltration.\n\n# pwd\n\n**6. 032-s0005.md** · score 0.025\n\n> This text is part of a list detailing various threat groups and actors that utilize the Windows Credential Editor tool for password dumping operations. The snippet specifically highlights the association between the BRONZE BUTLER group and \n\n**7. 050-t1003-004.md** · score 0.022\n\n> This section details the LSA Secrets technique (T1003.004), explaining how adversaries with SYSTEM access can extract credentials from the Windows registry or memory using tools like Reg and Mimikatz. It serves as a specific entry within th\n\n**8. 050-t1003-004.md** · score 0.022\n\n> This section details the tools and threat actors associated with the LSA Secrets technique, following the description of how adversaries extract credentials from the registry or memory. It lists specific software used for extraction and gro\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=local) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Thought:** To answer this question accurately, I need to access the specific document corpus or knowledge graph that contains the \"slice\" of data you are referring to. Since the context of \"this slice\" is not provided in the prompt, I will perform a search for intrusion groups known to share credential-access and discovery techniques, as well as the tools they use, which often appear in threat intelligence reports (like those from Mandiant, CrowdStrike, or Microsoft).\n\nHowever, without the specific source text, I cannot definitively say which groups are in *your* specific slice. I will assume you are referring to a common set of APTs often analyzed together in such contexts (e.g., APT29, APT28, APT41, or similar clusters).\n\nLet's search for information on intrusion groups sharing these techniques and the connecting tools.\n\n**Action:** `search_vectors(intrusion groups share credential-access discovery techniques software tools)`\n\n**Observation:** - 046-t1003.md: # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversari\n- 048-t1003-002.md: # Security Account Manager\n\nSource: MITRE ATT&CK Enterprise STI\n\n🔎 Retrieved context (5 sources)
\n\n**1. 003-g0003.md**\n\n> # Cleaver\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0003\nSTIX ID: intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063\n\nDescription:\n[Cleaver](https://attack.mitre.org/groups/G0003) is a threat grou\n\n**2. 008-g0008.md**\n\n> # Carbanak\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0008\nSTIX ID: intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c\n\nDescription:\n[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercrim\n\n**3. 046-t1003.md**\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n**4. 005-g0005.md**\n\n> # APT12\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0005\nSTIX ID: intrusion-set--c47f937f-1022-4f42-8525-e7a4779a14cb\n\nDescription:\n[APT12](https://attack.mitre.org/groups/G0005) is a threat group th\n\n**5. 007-g0007.md**\n\n> # APT28\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0007\nSTIX ID: intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c\n\nDescription:\n[APT28](https://attack.mitre.org/groups/G0007) is a threat group th\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (5 sources)
\n\n**1. 032-s0005.md**\n\n> # Windows Credential Editor\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0005\nSTIX ID: tool--242f3da3-4425-4d11-8f5c-b842886da966\n\nDescription:\n[Windows Credential Editor](https://attack.mitre.org/software/S00\n\n**2. 047-t1003-001.md**\n\n> Services.(Citation: TechNet Blogs Credential Protection)\n\n\nRelations:\n- LSASS Memory -> subtechnique-of -> OS Credential Dumping (T1003)\n- Indrik Spider (G0119) -> uses -> LSASS Memory\n- Operation Wocao (C0014) -> uses -> LSASS Memory\n- Oil\n\n**3. 046-t1003.md**\n\n> sters. Additional custom tools likely exist as well.\n\n\nRelations:\n- Ember Bear (G1003) -> uses -> OS Credential Dumping\n- Security Account Manager (T1003.002) -> subtechnique-of -> OS Credential Dumping\n- APT39 (G0087) -> uses -> OS Credent\n\n**4. 031-s0002.md**\n\n> # Mimikatz\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0002\nSTIX ID: tool--afc079f3-c0ea-4096-b75d-3f05338b7f60\n\nDescription:\n[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable\n\n**5. 046-t1003.md**\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n🔎 Retrieved context (5 sources)
\n\n**1. 003-g0003.md** · score 0.059\n\n> # Cleaver\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0003\nSTIX ID: intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063\n\nDescription:\n[Cleaver](https://attack.mitre.org/groups/G0003) is a threat grou\n\n**2. 047-t1003-001.md** · score 0.039\n\n> Services.(Citation: TechNet Blogs Credential Protection)\n\n\nRelations:\n- LSASS Memory -> subtechnique-of -> OS Credential Dumping (T1003)\n- Indrik Spider (G0119) -> uses -> LSASS Memory\n- Operation Wocao (C0014) -> uses -> LSASS Memory\n- Oil\n\n**3. 032-s0005.md** · score 0.019\n\n> # Windows Credential Editor\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0005\nSTIX ID: tool--242f3da3-4425-4d11-8f5c-b842886da966\n\nDescription:\n[Windows Credential Editor](https://attack.mitre.org/software/S00\n\n**4. 008-g0008.md** · score 0.019\n\n> # Carbanak\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0008\nSTIX ID: intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c\n\nDescription:\n[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercrim\n\n**5. 046-t1003.md** · score 0.018\n\n> sters. Additional custom tools likely exist as well.\n\n\nRelations:\n- Ember Bear (G1003) -> uses -> OS Credential Dumping\n- Security Account Manager (T1003.002) -> subtechnique-of -> OS Credential Dumping\n- APT39 (G0087) -> uses -> OS Credent\n\n🔎 Retrieved context (5 sources)
\n\n**1. 047-t1003-001.md** · score 0.132\n\n> This section lists specific threat actors and tools that utilize the LSASS Memory technique for credential harvesting, linking them to the broader OS Credential Dumping tactic. It also confirms the hierarchical relationship between LSASS Me\n\n**2. 003-g0003.md** · score 0.101\n\n> This section details the threat group Cleaver, attributed to Iranian actors, and lists specific techniques and tools they utilize, such as Net Crawler, PsExec, and Mimikatz.\n\n# Cleaver\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject ty\n\n**3. 032-s0005.md** · score 0.041\n\n> This text is part of a list detailing various threat groups and actors that utilize the Windows Credential Editor tool for password dumping operations. The snippet specifically highlights the association between the BRONZE BUTLER group and \n\n**4. 032-s0005.md** · score 0.037\n\n> This text provides technical details and threat actor associations for the Windows Credential Editor tool within the MITRE ATT&CK framework. It identifies the tool's function as password dumping and lists specific groups that utilize it.\n\n#\n\n**5. 046-t1003.md** · score 0.036\n\n> This relation identifies a specific mitigation strategy for the OS Credential Dumping technique (T1003), which involves adversaries extracting credentials from operating system caches or memory. It links the defensive measure of encrypting \n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Action:** `query_graph(Trace the relationship path between Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Identify which actors and software converge on credential access techniques involving these components.)`\n\n**Observation:** The\n\n**Step 2.** **Action:** `query_graph(What is the relationship between Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory in terms of credential access?)`\n\n**Observation:** Cle\n\n**Step 3.** **Action:** `query_graph(Trace the relationship path from Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Which actors and software converge on credential access?)`\n\n**Observation:** To\n\n**Step 4.** **Action:** `query_graph(Trace the relationship path between Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Which actors and software converge on credential access?)`\n\n**Observation:** The\n\n🔎 Retrieved context (5 sources)
\n\n**1. 032-s0005.md**\n\n> # Windows Credential Editor\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0005\nSTIX ID: tool--242f3da3-4425-4d11-8f5c-b842886da966\n\nDescription:\n[Windows Credential Editor](https://attack.mitre.org/software/S00\n\n**2. 047-t1003-001.md**\n\n> Services.(Citation: TechNet Blogs Credential Protection)\n\n\nRelations:\n- LSASS Memory -> subtechnique-of -> OS Credential Dumping (T1003)\n- Indrik Spider (G0119) -> uses -> LSASS Memory\n- Operation Wocao (C0014) -> uses -> LSASS Memory\n- Oil\n\n**3. 046-t1003.md**\n\n> sters. Additional custom tools likely exist as well.\n\n\nRelations:\n- Ember Bear (G1003) -> uses -> OS Credential Dumping\n- Security Account Manager (T1003.002) -> subtechnique-of -> OS Credential Dumping\n- APT39 (G0087) -> uses -> OS Credent\n\n**4. 031-s0002.md**\n\n> # Mimikatz\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0002\nSTIX ID: tool--afc079f3-c0ea-4096-b75d-3f05338b7f60\n\nDescription:\n[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable\n\n**5. 046-t1003.md**\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (8 sources)
\n\n**1. 032-s0005.md**\n\n> # Windows Credential Editor\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0005\nSTIX ID: tool--242f3da3-4425-4d11-8f5c-b842886da966\n\nDescription:\n[Windows Credential Editor](https://attack.mitre.org/software/S00\n\n**2. 047-t1003-001.md**\n\n> Services.(Citation: TechNet Blogs Credential Protection)\n\n\nRelations:\n- LSASS Memory -> subtechnique-of -> OS Credential Dumping (T1003)\n- Indrik Spider (G0119) -> uses -> LSASS Memory\n- Operation Wocao (C0014) -> uses -> LSASS Memory\n- Oil\n\n**3. 046-t1003.md**\n\n> sters. Additional custom tools likely exist as well.\n\n\nRelations:\n- Ember Bear (G1003) -> uses -> OS Credential Dumping\n- Security Account Manager (T1003.002) -> subtechnique-of -> OS Credential Dumping\n- APT39 (G0087) -> uses -> OS Credent\n\n**4. 031-s0002.md**\n\n> # Mimikatz\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0002\nSTIX ID: tool--afc079f3-c0ea-4096-b75d-3f05338b7f60\n\nDescription:\n[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable\n\n**5. 046-t1003.md**\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n**6. 032-s0005.md**\n\n> itor\n- BRONZE BUTLER (G0060) -> uses -> Windows Credential Editor\n\n**7. 047-t1003-001.md**\n\n> # LSASS Memory\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003.001\nSTIX ID: attack-pattern--65f2d882-3f41-4d48-8a06-29af77ec9f90\n\nDescription:\nAdversaries may attempt to access credential material \n\n**8. 047-t1003-001.md**\n\n> new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)\n\nThe following SSPs can be used to access credentials:\n\n* Msv: Interactive logons, batch l\n\n🔎 Retrieved context (8 sources)
\n\n**1. 003-g0003.md** · score 0.059\n\n> # Cleaver\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0003\nSTIX ID: intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063\n\nDescription:\n[Cleaver](https://attack.mitre.org/groups/G0003) is a threat grou\n\n**2. 047-t1003-001.md** · score 0.039\n\n> Services.(Citation: TechNet Blogs Credential Protection)\n\n\nRelations:\n- LSASS Memory -> subtechnique-of -> OS Credential Dumping (T1003)\n- Indrik Spider (G0119) -> uses -> LSASS Memory\n- Operation Wocao (C0014) -> uses -> LSASS Memory\n- Oil\n\n**3. 032-s0005.md** · score 0.019\n\n> # Windows Credential Editor\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0005\nSTIX ID: tool--242f3da3-4425-4d11-8f5c-b842886da966\n\nDescription:\n[Windows Credential Editor](https://attack.mitre.org/software/S00\n\n**4. 008-g0008.md** · score 0.019\n\n> # Carbanak\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: intrusion-set\nATT&CK ID: G0008\nSTIX ID: intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c\n\nDescription:\n[Carbanak](https://attack.mitre.org/groups/G0008) is a cybercrim\n\n**5. 046-t1003.md** · score 0.018\n\n> sters. Additional custom tools likely exist as well.\n\n\nRelations:\n- Ember Bear (G1003) -> uses -> OS Credential Dumping\n- Security Account Manager (T1003.002) -> subtechnique-of -> OS Credential Dumping\n- APT39 (G0087) -> uses -> OS Credent\n\n**6. 023-s0004.md** · score 0.017\n\n> # TinyZBot\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: malware\nATT&CK ID: S0004\nSTIX ID: malware--c0c45d38-fe57-4cd4-b2b2-9ecd0ddd4ca9\n\nDescription:\n[TinyZBot](https://attack.mitre.org/software/S0004) is a bot written in C# t\n\n**7. 008-g0008.md** · score 0.015\n\n> FireEye FIN7 April 2017)(Citation: Europol Cobalt Mar 2018)(Citation: Secureworks GOLD NIAGARA Threat Profile)(Citation: Secureworks GOLD KINGSWOOD Threat Profile)\n\nRelations:\n- Carbanak -> uses -> Masquerade Task or Service (T1036.004)\n- C\n\n**8. 003-g0003.md** · score 0.013\n\n> uses -> Tool (T1588.002)\n- Cleaver -> uses -> TinyZBot (S0004)\n- Cleaver -> uses -> Malware (T1587.001)\n- Cleaver -> uses -> Social Media Accounts (T1585.001)\n- Cleaver -> uses -> Mimikatz (S0002)\n\n🔎 Retrieved context (5 sources)
\n\n**1. 032-s0005.md** · score 1.000\n\n> # Windows Credential Editor\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0005\nSTIX ID: tool--242f3da3-4425-4d11-8f5c-b842886da966\n\nDescription:\n[Windows Credential Editor](https://attack.mitre.org/software/S00\n\n**2. 047-t1003-001.md** · score 0.853\n\n> Services.(Citation: TechNet Blogs Credential Protection)\n\n\nRelations:\n- LSASS Memory -> subtechnique-of -> OS Credential Dumping (T1003)\n- Indrik Spider (G0119) -> uses -> LSASS Memory\n- Operation Wocao (C0014) -> uses -> LSASS Memory\n- Oil\n\n**3. 047-t1003-001.md** · score 0.631\n\n> # LSASS Memory\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003.001\nSTIX ID: attack-pattern--65f2d882-3f41-4d48-8a06-29af77ec9f90\n\nDescription:\nAdversaries may attempt to access credential material \n\n**4. 046-t1003.md** · score 0.622\n\n> sters. Additional custom tools likely exist as well.\n\n\nRelations:\n- Ember Bear (G1003) -> uses -> OS Credential Dumping\n- Security Account Manager (T1003.002) -> subtechnique-of -> OS Credential Dumping\n- APT39 (G0087) -> uses -> OS Credent\n\n**5. 032-s0005.md** · score 0.604\n\n> itor\n- BRONZE BUTLER (G0060) -> uses -> Windows Credential Editor\n\n🔎 Retrieved context (8 sources)
\n\n**1. 047-t1003-001.md** · score 0.132\n\n> This section lists specific threat actors and tools that utilize the LSASS Memory technique for credential harvesting, linking them to the broader OS Credential Dumping tactic. It also confirms the hierarchical relationship between LSASS Me\n\n**2. 003-g0003.md** · score 0.101\n\n> This section details the threat group Cleaver, attributed to Iranian actors, and lists specific techniques and tools they utilize, such as Net Crawler, PsExec, and Mimikatz.\n\n# Cleaver\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject ty\n\n**3. 023-s0004.md** · score 0.057\n\n> This text fragment is part of the \"Relations\" section for the malware TinyZBot, listing its associated tactics and techniques alongside its connection to the Cleaver threat group. It specifically details how Cleaver utilizes TinyZBot and re\n\n**4. 023-s0004.md** · score 0.056\n\n> This section details the technical capabilities and persistence mechanisms of the TinyZBot malware, specifically listing the ATT&CK techniques it employs such as keylogging and shortcut modification. It also establishes the relationship bet\n\n**5. 008-g0008.md** · score 0.043\n\n> This text introduces the Carbanak intrusion set, detailing its history of targeting financial institutions and its potential links to other cybercriminal groups like Cobalt Group and FIN7. It serves as the introductory description for the g\n\n**6. 003-g0003.md** · score 0.041\n\n> This text lists specific techniques and tools utilized by the Iranian threat group Cleaver, as detailed in the MITRE ATT&CK Enterprise STIX bundle. These relations illustrate the group's operational capabilities and associated malware withi\n\n**7. 032-s0005.md** · score 0.041\n\n> This text is part of a list detailing various threat groups and actors that utilize the Windows Credential Editor tool for password dumping operations. The snippet specifically highlights the association between the BRONZE BUTLER group and \n\n**8. 032-s0005.md** · score 0.037\n\n> This text provides technical details and threat actor associations for the Windows Credential Editor tool within the MITRE ATT&CK framework. It identifies the tool's function as password dumping and lists specific groups that utilize it.\n\n#\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=local) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Action:** `query_graph(Trace the relationship path between Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Identify which actors and software converge on credential access techniques involving these components.)`\n\n**Observation:** The\n\n**Step 2.** **Action:** `query_graph(What is the relationship between Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory in terms of credential access?)`\n\n**Observation:** Cle\n\n**Step 3.** **Action:** `query_graph(Trace the relationship path from Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Which actors and software converge on credential access?)`\n\n**Observation:** To\n\n**Step 4.** **Action:** `query_graph(Trace the relationship path between Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Which actors and software converge on credential access?)`\n\n**Observation:** The\n\n**Step 5.** **Action:** `query_graph(Trace the relationship path between Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Which actors and software converge on credential access?)`\n\n**Observation:** The\n\n**Step 6.** **Action:** `query_graph(Trace the relationship path between Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Which actors and software converge on credential access?)`\n\n**Observation:** The\n\n**Step 7.** **Action:** `query_graph(Trace the relationship path from Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Which actors and software converge on credential access?)`\n\n**Observation:** To\n\n**Step 8.** **Action:** `query_graph(Trace the relationship path from Cleaver, Carbanak, Mimikatz, Windows Credential Editor, and LSASS Memory. Which actors and software converge on credential access?)`\n\n**Observation:** To\n\n🔎 Retrieved context (5 sources)
\n\n**1. 032-s0005.md**\n\n> # Windows Credential Editor\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0005\nSTIX ID: tool--242f3da3-4425-4d11-8f5c-b842886da966\n\nDescription:\n[Windows Credential Editor](https://attack.mitre.org/software/S00\n\n**2. 047-t1003-001.md**\n\n> Services.(Citation: TechNet Blogs Credential Protection)\n\n\nRelations:\n- LSASS Memory -> subtechnique-of -> OS Credential Dumping (T1003)\n- Indrik Spider (G0119) -> uses -> LSASS Memory\n- Operation Wocao (C0014) -> uses -> LSASS Memory\n- Oil\n\n**3. 046-t1003.md**\n\n> sters. Additional custom tools likely exist as well.\n\n\nRelations:\n- Ember Bear (G1003) -> uses -> OS Credential Dumping\n- Security Account Manager (T1003.002) -> subtechnique-of -> OS Credential Dumping\n- APT39 (G0087) -> uses -> OS Credent\n\n**4. 031-s0002.md**\n\n> # Mimikatz\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: tool\nATT&CK ID: S0002\nSTIX ID: tool--afc079f3-c0ea-4096-b75d-3f05338b7f60\n\nDescription:\n[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable\n\n**5. 046-t1003.md**\n\n> # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversaries may attempt to dump credentials to ob\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (5 sources)
\n\n**1. 014-c0005.md**\n\n> with other campaigns dating back to April 2018, including at least one separately attributed to [APT-C-36](https://attack.mitre.org/groups/G0099), however identified enough differences to report this as separate, unattributed activity.(Cita\n\n**2. 051-m1013.md**\n\n> ameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to assess threats during application design.\n- Use Case: Before launching a customer portal, a SaaS company identifie\n\n**3. 020-c0013.md**\n\n> # Operation Sharpshooter\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0013\nSTIX ID: campaign--37764c78-2a99-46d1-a7ea-6454b9bf93a0\n\nDescription:\n[Operation Sharpshooter](https://attack.mitre.org/campaigns/\n\n**4. 014-c0005.md**\n\n> # Operation Spalax\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0005\nSTIX ID: campaign--4c840263-bbda-440d-a22b-674679ddebf1\n\nDescription:\n[Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a\n\n**5. 011-c0001.md**\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n🔎 Retrieved context (5 sources)
\n\n**1. 044-t1001-003.md** · score 0.127\n\n> # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescription:\nAdversaries may impersonate legit\n\n**2. 019-c0012.md** · score 0.122\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**3. 014-c0005.md** · score 0.115\n\n> # Operation Spalax\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0005\nSTIX ID: campaign--4c840263-bbda-440d-a22b-674679ddebf1\n\nDescription:\n[Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a\n\n**4. 020-c0013.md** · score 0.114\n\n> # Operation Sharpshooter\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0013\nSTIX ID: campaign--37764c78-2a99-46d1-a7ea-6454b9bf93a0\n\nDescription:\n[Operation Sharpshooter](https://attack.mitre.org/campaigns/\n\n**5. 045-t1002.md** · score 0.091\n\n> # Data Compressed\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1002\nSTIX ID: attack-pattern--b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4\n\nDescription:\nAn adversary may compress data (e.g., sensitive documen\n\n🔎 Retrieved context (5 sources)
\n\n**1. 011-c0001.md** · score 0.217\n\n> This list details the specific ATT&CK techniques and software tools utilized by the Frankenstein threat actor campaign, which relied on open-source components like Empire for its operations.\n\nProcess Discovery (T1057)\n- Frankenstein -> uses\n\n**2. 014-c0005.md** · score 0.188\n\n> This list details the specific MITRE ATT&CK techniques and tools utilized by the Operation Spalax threat actors, such as spearphishing links and software packing, which are part of their broader campaign targeting Colombian government and p\n\n**3. 011-c0001.md** · score 0.185\n\n> This section introduces the Frankenstein campaign (C0001), detailing its characteristics as a highly-targeted operation using open-source tools like Empire in early 2019. It serves as the header for the list of specific tactics and techniqu\n\n**4. 020-c0013.md** · score 0.176\n\n> This text lists specific MITRE ATT&CK techniques and tactics utilized by the Operation Sharpshooter cyber espionage campaign, detailing methods such as tool transfer and malware deployment. It serves as the concluding portion of the relatio\n\n**5. 005-g0005.md** · score 0.175\n\n> This list details specific tactics and techniques attributed to the Chinese threat group APT12, including their use of spearphishing attachments and tools like RIPTIDE and HTRAN for malicious activities.\n\n- APT12 -> uses -> Spearphishing At\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Thought:** To identify which campaigns overlap in their tooling and techniques (specifically regarding PowerShell, Registry manipulation, Spearphishing, Discovery, and Exfiltration), I need to query the knowledge graph for relationships between threat actors/campaigns and these specific TTPs (Tactics, Techniques, and Procedures).\n\nI will start by searching for campaigns associated with these specific techniques to see which ones are linked.\n\n**Action:** `query_graph(Which campaigns use PowerShell, Registry manipulation, Spearphishing, Discovery, or Exfiltration techniques? List the campaigns and their associated techniques.)`\n\n**Observation:** Based on the provided context, several cyber espionage campaigns have utilized various techniques involving PowerShell, registry manipulation, spearphishing, discovery, or exfiltration. Below is a summary of these campaigns and their associated techniques:\n\n### Campaigns and Associated Techniques\n\n#\n\n**Step 2.** **Thought:** The initial search provided some high-level information but lacked the specific technical details (like PowerShell usage or detailed discovery/exfiltration methods) needed to definitively map overlaps. I need to dig deeper into the specific techniques for these campaigns and potentially find more campaigns that use these exact TTPs.\n\nI will query the knowledge graph specifically for campaigns that use **PowerShell**, **Registry modification**, **Spearphishing**, **Discovery**, and **Exfiltration** to get a more precise list of overlapping actors.\n\n**Action:** `query_graph(Find all campaigns that use PowerShell, Registry modification, Spearphishing, Discovery, or Exfiltration techniques. List the campaign names and their associated threat actors if available.)`\n\n**Observation:** Based on the provided context, here are the campaigns that utilize PowerShell, registry modification, spearphishing, discovery, or exfiltration techniques:\n\n1. **Operation Spalax**\n - **Threat Actor**: Unattributed (though noted with some overlaps with APT-C-36)\n - **Techniques Used**:\n - Sp\n\n🔎 Retrieved context (5 sources)
\n\n**1. 014-c0005.md**\n\n> with other campaigns dating back to April 2018, including at least one separately attributed to [APT-C-36](https://attack.mitre.org/groups/G0099), however identified enough differences to report this as separate, unattributed activity.(Cita\n\n**2. 051-m1013.md**\n\n> ameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to assess threats during application design.\n- Use Case: Before launching a customer portal, a SaaS company identifie\n\n**3. 020-c0013.md**\n\n> # Operation Sharpshooter\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0013\nSTIX ID: campaign--37764c78-2a99-46d1-a7ea-6454b9bf93a0\n\nDescription:\n[Operation Sharpshooter](https://attack.mitre.org/campaigns/\n\n**4. 014-c0005.md**\n\n> # Operation Spalax\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0005\nSTIX ID: campaign--4c840263-bbda-440d-a22b-674679ddebf1\n\nDescription:\n[Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a\n\n**5. 011-c0001.md**\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (8 sources)
\n\n**1. 014-c0005.md**\n\n> with other campaigns dating back to April 2018, including at least one separately attributed to [APT-C-36](https://attack.mitre.org/groups/G0099), however identified enough differences to report this as separate, unattributed activity.(Cita\n\n**2. 051-m1013.md**\n\n> ameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to assess threats during application design.\n- Use Case: Before launching a customer portal, a SaaS company identifie\n\n**3. 020-c0013.md**\n\n> # Operation Sharpshooter\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0013\nSTIX ID: campaign--37764c78-2a99-46d1-a7ea-6454b9bf93a0\n\nDescription:\n[Operation Sharpshooter](https://attack.mitre.org/campaigns/\n\n**4. 014-c0005.md**\n\n> # Operation Spalax\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0005\nSTIX ID: campaign--4c840263-bbda-440d-a22b-674679ddebf1\n\nDescription:\n[Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a\n\n**5. 011-c0001.md**\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n**6. 018-c0011.md**\n\n> Education Campaign July 2022) \n\nRelations:\n- C0011 -> uses -> Upload Malware (T1608.001)\n- C0011 -> uses -> Spearphishing Link (T1566.002)\n- C0011 -> attributed-to -> Transparent Tribe (G0134)\n- C0011 -> uses -> Malicious Link (T1204.001)\n-\n\n**7. 011-c0001.md**\n\n> Process Discovery (T1057)\n- Frankenstein -> uses -> System Information Discovery (T1082)\n- Frankenstein -> uses -> Command Obfuscation (T1027.010)\n- Frankenstein -> uses -> Automated Exfiltration (T1020)\n- Frankenstein -> uses -> Empire (S0\n\n**8. 019-c0012.md**\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n🔎 Retrieved context (8 sources)
\n\n**1. 044-t1001-003.md** · score 0.127\n\n> # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescription:\nAdversaries may impersonate legit\n\n**2. 019-c0012.md** · score 0.122\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**3. 014-c0005.md** · score 0.115\n\n> # Operation Spalax\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0005\nSTIX ID: campaign--4c840263-bbda-440d-a22b-674679ddebf1\n\nDescription:\n[Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a\n\n**4. 020-c0013.md** · score 0.114\n\n> # Operation Sharpshooter\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0013\nSTIX ID: campaign--37764c78-2a99-46d1-a7ea-6454b9bf93a0\n\nDescription:\n[Operation Sharpshooter](https://attack.mitre.org/campaigns/\n\n**5. 015-c0006.md** · score 0.096\n\n> # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](https://attack.mitre.org/campaigns/C0006) w\n\n**6. 045-t1002.md** · score 0.091\n\n> # Data Compressed\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1002\nSTIX ID: attack-pattern--b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4\n\nDescription:\nAn adversary may compress data (e.g., sensitive documen\n\n**7. 011-c0001.md** · score 0.086\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n**8. 044-t1001-003.md** · score 0.086\n\n> ike it is related with a trusted entity. \n\nAdversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, an\n\n🔎 Retrieved context (5 sources)
\n\n**1. 011-c0001.md** · score 0.886\n\n> Process Discovery (T1057)\n- Frankenstein -> uses -> System Information Discovery (T1082)\n- Frankenstein -> uses -> Command Obfuscation (T1027.010)\n- Frankenstein -> uses -> Automated Exfiltration (T1020)\n- Frankenstein -> uses -> Empire (S0\n\n**2. 013-c0004.md** · score 0.574\n\n> # CostaRicto\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0004\nSTIX ID: campaign--f9cc545e-b0ef-4b92-8884-a3a4427609f6\n\nDescription:\n[CostaRicto](https://attack.mitre.org/campaigns/C0004) was a suspected h\n\n**3. 011-c0001.md** · score 0.564\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n**4. 019-c0012.md** · score 0.559\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**5. 014-c0005.md** · score 0.516\n\n> with other campaigns dating back to April 2018, including at least one separately attributed to [APT-C-36](https://attack.mitre.org/groups/G0099), however identified enough differences to report this as separate, unattributed activity.(Cita\n\n🔎 Retrieved context (8 sources)
\n\n**1. 020-c0013.md** · score 0.235\n\n> This section provides the high-level overview of Operation Sharpshooter, detailing its nature as a global cyber espionage campaign and its association with the Lazarus Group. It serves as the introductory summary before listing the specific\n\n**2. 019-c0012.md** · score 0.232\n\n> This section introduces Operation CuckooBees as a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since 2019. It outlines the attackers' primary objective of stealing\n\n**3. 011-c0001.md** · score 0.217\n\n> This list details the specific ATT&CK techniques and software tools utilized by the Frankenstein threat actor campaign, which relied on open-source components like Empire for its operations.\n\nProcess Discovery (T1057)\n- Frankenstein -> uses\n\n**4. 014-c0005.md** · score 0.188\n\n> This list details the specific MITRE ATT&CK techniques and tools utilized by the Operation Spalax threat actors, such as spearphishing links and software packing, which are part of their broader campaign targeting Colombian government and p\n\n**5. 011-c0001.md** · score 0.185\n\n> This section introduces the Frankenstein campaign (C0001), detailing its characteristics as a highly-targeted operation using open-source tools like Empire in early 2019. It serves as the header for the list of specific tactics and techniqu\n\n**6. 006-g0006.md** · score 0.178\n\n> This section lists specific techniques and tools utilized by the APT1 threat group, including GLOOXMAIL, Pass the Hash, and Archive via Utility, as part of their known operational capabilities.\n\n)\n- APT1 -> uses -> GLOOXMAIL (S0026)\n- APT1 \n\n**7. 009-g0009.md** · score 0.176\n\n> This text fragment lists additional techniques and tools utilized by the Deep Panda threat group, continuing from the previous section of relations. It details specific methods such as StreamEx, Hidden Window, PowerShell, and Sakula that ar\n\n**8. 020-c0013.md** · score 0.176\n\n> This text lists specific MITRE ATT&CK techniques and tactics utilized by the Operation Sharpshooter cyber espionage campaign, detailing methods such as tool transfer and malware deployment. It serves as the concluding portion of the relatio\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=local) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Thought:** To identify which campaigns overlap in their tooling and techniques (specifically regarding PowerShell, Registry manipulation, Spearphishing, Discovery, and Exfiltration), I need to query the knowledge graph for relationships between threat actors/campaigns and these specific TTPs (Tactics, Techniques, and Procedures).\n\nI will start by searching for campaigns associated with these specific techniques to see which ones are linked.\n\n**Action:** `query_graph(Which campaigns use PowerShell, Registry manipulation, Spearphishing, Discovery, or Exfiltration techniques? List the campaigns and their associated techniques.)`\n\n**Observation:** Based on the provided context, several cyber espionage campaigns have utilized various techniques involving PowerShell, registry manipulation, spearphishing, discovery, or exfiltration. Below is a summary of these campaigns and their associated techniques:\n\n### Campaigns and Associated Techniques\n\n#\n\n**Step 2.** **Thought:** The initial search provided some high-level information but lacked the specific technical details (like PowerShell usage or detailed discovery/exfiltration methods) needed to definitively map overlaps. I need to dig deeper into the specific techniques for these campaigns and potentially find more campaigns that use these exact TTPs.\n\nI will query the knowledge graph specifically for campaigns that use **PowerShell**, **Registry modification**, **Spearphishing**, **Discovery**, and **Exfiltration** to get a more precise list of overlapping actors.\n\n**Action:** `query_graph(Find all campaigns that use PowerShell, Registry modification, Spearphishing, Discovery, or Exfiltration techniques. List the campaign names and their associated threat actors if available.)`\n\n**Observation:** Based on the provided context, here are the campaigns that utilize PowerShell, registry modification, spearphishing, discovery, or exfiltration techniques:\n\n1. **Operation Spalax**\n - **Threat Actor**: Unattributed (though noted with some overlaps with APT-C-36)\n - **Techniques Used**:\n - Sp\n\n🔎 Retrieved context (5 sources)
\n\n**1. 014-c0005.md**\n\n> with other campaigns dating back to April 2018, including at least one separately attributed to [APT-C-36](https://attack.mitre.org/groups/G0099), however identified enough differences to report this as separate, unattributed activity.(Cita\n\n**2. 051-m1013.md**\n\n> ameworks like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) to assess threats during application design.\n- Use Case: Before launching a customer portal, a SaaS company identifie\n\n**3. 020-c0013.md**\n\n> # Operation Sharpshooter\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0013\nSTIX ID: campaign--37764c78-2a99-46d1-a7ea-6454b9bf93a0\n\nDescription:\n[Operation Sharpshooter](https://attack.mitre.org/campaigns/\n\n**4. 014-c0005.md**\n\n> # Operation Spalax\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0005\nSTIX ID: campaign--4c840263-bbda-440d-a22b-674679ddebf1\n\nDescription:\n[Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a\n\n**5. 011-c0001.md**\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (5 sources)
\n\n**1. 052-m1015.md**\n\n> - Active Directory Configuration -> mitigates -> Unsecured Credentials (T1552)\n- Active Directory Configuration -> mitigates -> SID-History Injection (T1134.005)\n- Active Directory Configuration -> mitigates -> SAML Tokens (T1606.002)\n- Act\n\n**2. 058-m1021.md**\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**3. 052-m1015.md**\n\n> # Active Directory Configuration\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1015\nSTIX ID: course-of-action--e3388c78-2a8d-47c2-8422-c1398b324462\n\nDescription:\nImplement robust Active Directory (A\n\n**4. 058-m1021.md**\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n**5. 052-m1015.md**\n\n> age AD’s centralized management, including group policies, auditing, and access control.\n- Use Case: For IT staff managing shared resources, provision domain accounts that allow IT teams to log in centrally, reducing the risk of unmanaged, \n\n🔎 Retrieved context (5 sources)
\n\n**1. 060-m1024.md** · score 0.588\n\n> such as `Run`, `RunOnce`, and `Services` to ensure only authorized users have write access.\n- Use tools like `icacls` or `PowerShell` to automate permission adjustments.\n\nEnable Registry Auditing\n\n- Enable auditing on sensitive keys to log \n\n**2. 052-m1015.md** · score 0.562\n\n> such as one set of accounts for installations and another for managing repository access. This limits exposure and helps reduce attack vectors.\n\nAuthentication Silos:\n\n- Implementation: Configure Authentication Silos in AD, using group poli\n\n**3. 052-m1015.md** · score 0.509\n\n> unts are compromised.\n\n**Tools for Implementation**:\n\n- Active Directory Group Policies: Use Group Policy Management Console (GPMC) to configure, deploy, and enforce policies across AD environments.\n- PowerShell: Automate account configurat\n\n**4. 052-m1015.md** · score 0.393\n\n> # Active Directory Configuration\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1015\nSTIX ID: course-of-action--e3388c78-2a8d-47c2-8422-c1398b324462\n\nDescription:\nImplement robust Active Directory (A\n\n**5. 058-m1021.md** · score 0.362\n\n> Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.\n- Configure alerts for access attempts to blocked domains or repeated file download failures.\n\nRel\n\n🔎 Retrieved context (5 sources)
\n\n**1. 060-m1024.md** · score 0.848\n\n> This text details specific mitigation measures for restricting registry permissions, including adjusting access controls on critical keys, enabling auditing, protecting credential-related hives, and limiting the use of registry editing tool\n\n**2. 052-m1015.md** · score 0.738\n\n> This section details the specific tools required to implement Active Directory security configurations and lists the various MITRE ATT&CK techniques that these mitigations are designed to counteract.\n\nunts are compromised.\n\n**Tools for Impl\n\n**3. 052-m1015.md** · score 0.681\n\n> This list details specific MITRE ATT&CK techniques that are mitigated by implementing robust Active Directory configurations, such as using group policies and dedicated administrative accounts. These measures help secure user accounts, cont\n\n**4. 052-m1015.md** · score 0.666\n\n> This section details specific Active Directory configuration measures, including Remote Desktop Settings and Dedicated Administrative Accounts, which are part of a broader strategy to secure user accounts and minimize the attack surface thr\n\n**5. 052-m1015.md** · score 0.586\n\n> This section details specific implementation measures for securing Active Directory, including the use of Authentication Silos and dedicated administrative accounts to limit exposure. It concludes by listing the primary tools, such as Group\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Thought:** To answer this question accurately, I need to search the document corpus for specific mitigation strategies related to the four categories you mentioned: **Credential**, **Active Directory**, **Web-Content**, and **Registry**.\n\nI will perform separate searches for each category to identify the relevant mitigations and the specific techniques they mitigate.\n\n**Action:** `search_vectors(mitigations for credential access techniques)`\n\n**Observation:** - 046-t1003.md: # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversari\n- 060-m1024.md: such as `Run`, `RunOnce`, and `Services` to ensure only authorized \n\n**Step 2.** **Action:** `search_vectors(mitigations for Active Directory attacks techniques)`\n\n**Observation:** - 052-m1015.md: - Active Directory Configuration -> mitigates -> Unsecured Credentials (T1552)\n- Active Directory Configuration -> mitigates -> SID-History Injection (T1134.005)\n- Active Directory Configuration -> mi\n- 052-m1015.md: unts are compromised.\n\n**Tools for Implementation**:\n\n- Active Dire\n\n**Step 3.** **Action:** `search_vectors(mitigations for web content delivery or exploitation techniques)`\n\n**Observation:** - 058-m1021.md: # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\n\n- 058-m1021.md: Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collec\n\n**Step 4.** **Action:** `search_vectors(mitigations for registry modification or access techniques)`\n\n**Observation:** - 060-m1024.md: # Restrict Registry Permissions\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1024\nSTIX ID: course-of-action--a2c36a5d-4058-475e-8e77-fff75e50d3b9\n\nDescriptio\n- 060-m1024.md: such as `Run`, `RunOnce`, and `Services` to ensure only authorized \n\n🔎 Retrieved context (5 sources)
\n\n**1. 052-m1015.md**\n\n> - Active Directory Configuration -> mitigates -> Unsecured Credentials (T1552)\n- Active Directory Configuration -> mitigates -> SID-History Injection (T1134.005)\n- Active Directory Configuration -> mitigates -> SAML Tokens (T1606.002)\n- Act\n\n**2. 058-m1021.md**\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**3. 052-m1015.md**\n\n> # Active Directory Configuration\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1015\nSTIX ID: course-of-action--e3388c78-2a8d-47c2-8422-c1398b324462\n\nDescription:\nImplement robust Active Directory (A\n\n**4. 058-m1021.md**\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n**5. 052-m1015.md**\n\n> age AD’s centralized management, including group policies, auditing, and access control.\n- Use Case: For IT staff managing shared resources, provision domain accounts that allow IT teams to log in centrally, reducing the risk of unmanaged, \n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (8 sources)
\n\n**1. 052-m1015.md**\n\n> - Active Directory Configuration -> mitigates -> Unsecured Credentials (T1552)\n- Active Directory Configuration -> mitigates -> SID-History Injection (T1134.005)\n- Active Directory Configuration -> mitigates -> SAML Tokens (T1606.002)\n- Act\n\n**2. 058-m1021.md**\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**3. 052-m1015.md**\n\n> # Active Directory Configuration\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1015\nSTIX ID: course-of-action--e3388c78-2a8d-47c2-8422-c1398b324462\n\nDescription:\nImplement robust Active Directory (A\n\n**4. 058-m1021.md**\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n**5. 052-m1015.md**\n\n> age AD’s centralized management, including group policies, auditing, and access control.\n- Use Case: For IT staff managing shared resources, provision domain accounts that allow IT teams to log in centrally, reducing the risk of unmanaged, \n\n**6. 058-m1021.md**\n\n> Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.\n- Configure alerts for access attempts to blocked domains or repeated file download failures.\n\nRel\n\n**7. 060-m1024.md**\n\n> such as `Run`, `RunOnce`, and `Services` to ensure only authorized users have write access.\n- Use tools like `icacls` or `PowerShell` to automate permission adjustments.\n\nEnable Registry Auditing\n\n- Enable auditing on sensitive keys to log \n\n**8. 060-m1024.md**\n\n> # Restrict Registry Permissions\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1024\nSTIX ID: course-of-action--a2c36a5d-4058-475e-8e77-fff75e50d3b9\n\nDescription:\nRestricting registry permissions invo\n\n🔎 Retrieved context (8 sources)
\n\n**1. 060-m1024.md** · score 0.588\n\n> such as `Run`, `RunOnce`, and `Services` to ensure only authorized users have write access.\n- Use tools like `icacls` or `PowerShell` to automate permission adjustments.\n\nEnable Registry Auditing\n\n- Enable auditing on sensitive keys to log \n\n**2. 052-m1015.md** · score 0.562\n\n> such as one set of accounts for installations and another for managing repository access. This limits exposure and helps reduce attack vectors.\n\nAuthentication Silos:\n\n- Implementation: Configure Authentication Silos in AD, using group poli\n\n**3. 060-m1024.md** · score 0.550\n\n> # Restrict Registry Permissions\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1024\nSTIX ID: course-of-action--a2c36a5d-4058-475e-8e77-fff75e50d3b9\n\nDescription:\nRestricting registry permissions invo\n\n**4. 052-m1015.md** · score 0.509\n\n> unts are compromised.\n\n**Tools for Implementation**:\n\n- Active Directory Group Policies: Use Group Policy Management Console (GPMC) to configure, deploy, and enforce policies across AD environments.\n- PowerShell: Automate account configurat\n\n**5. 041-t1001.md** · score 0.483\n\n> -> mitigates -> Data Obfuscation\n\n**6. 055-m1018.md** · score 0.462\n\n> s unauthorized access, even if credentials are stolen.\n\nRestricting Interactive Logins\n\n- Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce l\n\n**7. 053-m1016.md** · score 0.405\n\n> public read access, which is remediated to prevent potential data leakage.\n\nNetwork Device Scanning\n\n- Implementation: Use tools to scan network devices for vulnerabilities, such as weak SNMP strings or outdated firmware. Correlate scan res\n\n**8. 052-m1015.md** · score 0.393\n\n> # Active Directory Configuration\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1015\nSTIX ID: course-of-action--e3388c78-2a8d-47c2-8422-c1398b324462\n\nDescription:\nImplement robust Active Directory (A\n\n🔎 Retrieved context (5 sources)
\n\n**1. 052-m1015.md** · score 0.867\n\n> - Active Directory Configuration -> mitigates -> Unsecured Credentials (T1552)\n- Active Directory Configuration -> mitigates -> SID-History Injection (T1134.005)\n- Active Directory Configuration -> mitigates -> SAML Tokens (T1606.002)\n- Act\n\n**2. 049-t1003-003.md** · score 0.822\n\n> # NTDS\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003.003\nSTIX ID: attack-pattern--edf91964-b26e-4b4a-9600-ccacd7d7df24\n\nDescription:\nAdversaries may attempt to access or create a copy of the Acti\n\n**3. 058-m1021.md** · score 0.780\n\n> Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.\n- Configure alerts for access attempts to blocked domains or repeated file download failures.\n\nRel\n\n**4. 058-m1021.md** · score 0.757\n\n> File (T1218.001)\n- Restrict Web-Based Content -> mitigates -> Dynamic Resolution (T1568)\n- Restrict Web-Based Content -> mitigates -> Dead Drop Resolver (T1102.001)\n- Restrict Web-Based Content -> mitigates -> User Execution (T1204)\n- Restr\n\n**5. 058-m1021.md** · score 0.747\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n🔎 Retrieved context (8 sources)
\n\n**1. 060-m1024.md** · score 0.848\n\n> This text details specific mitigation measures for restricting registry permissions, including adjusting access controls on critical keys, enabling auditing, protecting credential-related hives, and limiting the use of registry editing tool\n\n**2. 052-m1015.md** · score 0.738\n\n> This section details the specific tools required to implement Active Directory security configurations and lists the various MITRE ATT&CK techniques that these mitigations are designed to counteract.\n\nunts are compromised.\n\n**Tools for Impl\n\n**3. 052-m1015.md** · score 0.681\n\n> This list details specific MITRE ATT&CK techniques that are mitigated by implementing robust Active Directory configurations, such as using group policies and dedicated administrative accounts. These measures help secure user accounts, cont\n\n**4. 052-m1015.md** · score 0.666\n\n> This section details specific Active Directory configuration measures, including Remote Desktop Settings and Dedicated Administrative Accounts, which are part of a broader strategy to secure user accounts and minimize the attack surface thr\n\n**5. 060-m1024.md** · score 0.647\n\n> This section introduces the mitigation strategy of restricting registry permissions to prevent unauthorized modifications for persistence or privilege escalation. It begins by outlining the first implementation measure: reviewing and adjust\n\n**6. 052-m1015.md** · score 0.586\n\n> This section details specific implementation measures for securing Active Directory, including the use of Authentication Silos and dedicated administrative accounts to limit exposure. It concludes by listing the primary tools, such as Group\n\n**7. 046-t1003.md** · score 0.585\n\n> This relation identifies a specific mitigation strategy for the OS Credential Dumping technique (T1003), which involves adversaries extracting credentials from operating system caches or memory. It links the defensive measure of encrypting \n\n**8. 060-m1024.md** · score 0.568\n\n> This section lists specific MITRE ATT&CK techniques that are mitigated by restricting registry permissions, detailing how securing access control prevents adversary actions such as disabling firewalls, modifying system components, and clear\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=local) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Thought:** To answer this question accurately, I need to search the document corpus for specific mitigation strategies related to the four categories you mentioned: **Credential**, **Active Directory**, **Web-Content**, and **Registry**.\n\nI will perform separate searches for each category to identify the relevant mitigations and the specific techniques they mitigate.\n\n**Action:** `search_vectors(mitigations for credential access techniques)`\n\n**Observation:** - 046-t1003.md: # OS Credential Dumping\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1003\nSTIX ID: attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22\n\nDescription:\nAdversari\n- 060-m1024.md: such as `Run`, `RunOnce`, and `Services` to ensure only authorized \n\n**Step 2.** **Action:** `search_vectors(mitigations for Active Directory attacks techniques)`\n\n**Observation:** - 052-m1015.md: - Active Directory Configuration -> mitigates -> Unsecured Credentials (T1552)\n- Active Directory Configuration -> mitigates -> SID-History Injection (T1134.005)\n- Active Directory Configuration -> mi\n- 052-m1015.md: unts are compromised.\n\n**Tools for Implementation**:\n\n- Active Dire\n\n**Step 3.** **Action:** `search_vectors(mitigations for web content delivery or exploitation techniques)`\n\n**Observation:** - 058-m1021.md: # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\n\n- 058-m1021.md: Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collec\n\n**Step 4.** **Action:** `search_vectors(mitigations for registry modification or access techniques)`\n\n**Observation:** - 060-m1024.md: # Restrict Registry Permissions\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1024\nSTIX ID: course-of-action--a2c36a5d-4058-475e-8e77-fff75e50d3b9\n\nDescriptio\n- 060-m1024.md: such as `Run`, `RunOnce`, and `Services` to ensure only authorized \n\n🔎 Retrieved context (5 sources)
\n\n**1. 052-m1015.md**\n\n> - Active Directory Configuration -> mitigates -> Unsecured Credentials (T1552)\n- Active Directory Configuration -> mitigates -> SID-History Injection (T1134.005)\n- Active Directory Configuration -> mitigates -> SAML Tokens (T1606.002)\n- Act\n\n**2. 058-m1021.md**\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**3. 052-m1015.md**\n\n> # Active Directory Configuration\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1015\nSTIX ID: course-of-action--e3388c78-2a8d-47c2-8422-c1398b324462\n\nDescription:\nImplement robust Active Directory (A\n\n**4. 058-m1021.md**\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n**5. 052-m1015.md**\n\n> age AD’s centralized management, including group policies, auditing, and access control.\n- Use Case: For IT staff managing shared resources, provision domain accounts that allow IT teams to log in centrally, reducing the risk of unmanaged, \n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (5 sources)
\n\n**1. 019-c0012.md**\n\n> eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason Op\n\n**2. 019-c0012.md**\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**3. 012-c0002.md**\n\n> # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber e\n\n**4. 015-c0006.md**\n\n> # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](https://attack.mitre.org/campaigns/C0006) w\n\n**5. 011-c0001.md**\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n🔎 Retrieved context (5 sources)
\n\n**1. 011-c0001.md** · score 0.150\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n**2. 019-c0012.md** · score 0.118\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**3. 011-c0001.md** · score 0.068\n\n> Process Discovery (T1057)\n- Frankenstein -> uses -> System Information Discovery (T1082)\n- Frankenstein -> uses -> Command Obfuscation (T1027.010)\n- Frankenstein -> uses -> Automated Exfiltration (T1020)\n- Frankenstein -> uses -> Empire (S0\n\n**4. 012-c0002.md** · score 0.061\n\n> # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber e\n\n**5. 015-c0006.md** · score 0.058\n\n> # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](https://attack.mitre.org/campaigns/C0006) w\n\n🔎 Retrieved context (5 sources)
\n\n**1. 011-c0001.md** · score 0.196\n\n> This section introduces the Frankenstein campaign (C0001), detailing its characteristics as a highly-targeted operation using open-source tools like Empire in early 2019. It serves as the header for the list of specific tactics and techniqu\n\n**2. 011-c0001.md** · score 0.164\n\n> This list details the specific ATT&CK techniques and software tools utilized by the Frankenstein threat actor campaign, which relied on open-source components like Empire for its operations.\n\nProcess Discovery (T1057)\n- Frankenstein -> uses\n\n**3. 019-c0012.md** · score 0.150\n\n> This section introduces Operation CuckooBees as a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since 2019. It outlines the attackers' primary objective of stealing\n\n**4. 019-c0012.md** · score 0.082\n\n> This list details specific ATT&CK techniques employed by the Operation CuckooBees campaign for reconnaissance and persistence, following the initial description of the group's objectives and affiliations. These technical indicators illustra\n\n**5. 012-c0002.md** · score 0.080\n\n> This chunk introduces the \"Night Dragon\" cyber espionage campaign, detailing its targets and origin, while beginning to list the specific techniques and tools used by the threat actors.\n\n# Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX \n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n
• **Credential Access:** Valid Accounts (Domain Accounts)
• **Discovery:** System Information Discovery
• **Exfiltration:** Automated Exfiltration | • **gsecdump:** Used to dump credentials from memory.
• **Custom Malware:** Often referred to as \"Night Dragon\" malware, which included backdoors and data exfiltration capabilities. |\n| **Frankenstein** | • **Discovery:** Process Discovery (T1057), System Information Discovery (T1082)
• **Defense Evasion:** Command Obfuscation (T1027.010)
• **Exfiltration:** Automated Exfiltration over C2 Channel | • **Custom Backdoors:** Used sophisticated custom malware for persistence and data theft.
• **Obfuscated Commands:** Used command obfuscation to evade detection. |\n| **Operation Honeybee** | • **Initial Access:** Spearphishing Attachment (via Word docs)
• **Persistence:** Modify Registry (T1112)
• **Exfiltration:** Exfiltration Over C2 Channel (T1041) | • **Reg (S0075):** A specific tool used for registry modifications.
• **Malicious Word Documents:** The primary delivery mechanism, named \"Honeybee\" after the author field in the documents. |\n| **Operation CuckooBees** | • **Discovery:** File and Directory Discovery (T1083), System Information Discovery (T1082), System Time Discovery (T1124)
• **Initial Access:** Spearphishing Link
• **Exfiltration:** Automated Exfiltration | • **Custom Malware:** Used custom-built malware for data theft.
• **System Enumeration:** Focused heavily on discovering system time and file structures to identify valuable intellectual property. |\n\n### Summary of Differences\n* **Evolution of Tactics:** Night Dragon relied heavily on credential dumping (gsecdump) and valid accounts, while later campaigns like Frankenstein and CuckooBees shifted toward more sophisticated discovery and obfuscation techniques. Operation Honeybee is distinct for its reliance on malicious Word documents as the primary initial access vector.\n* **Target Scope:** While all were linked to Winnti/APT41, Night Dragon was narrowly focused on the energy sector's intellectual property. Frankenstein and CuckooBees expanded this to include high-tech manufacturing and telecommunications. Operation Honeybee had a broader, more diverse target list including government entities.\n* **Tooling:** Night Dragon is notable for using **gsecdump**, a well-known credential dumping tool. Operation Honeybee used a specific registry modification tool (**Reg/S0075**). Frankenstein and CuckooBees relied more on custom malware with built-in discovery and exfiltration capabilities rather than third-party tools like gsecdump.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Action:** `search_vectors(Frankenstein malware operation details timeframe target techniques)`\n\n**Observation:** - 011-c0001.md: Process Discovery (T1057)\n- Frankenstein -> uses -> System Information Discovery (T1082)\n- Frankenstein -> uses -> Command Obfuscation (T1027.010)\n- Frankenstein -> uses -> Automated Exfiltration (T10\n- 011-c0001.md: # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject\n\n**Step 2.** **Action:** `search_vectors(Operation CuckooBees malware campaign details timeframe target techniques)`\n\n**Observation:** - 019-c0012.md: # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees]\n- 019-c0012.md: eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was c\n\n**Step 3.** **Action:** `search_vectors(Operation Honeybee malware campaign details timeframe target techniques)`\n\n**Observation:** - 015-c0006.md: # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](htt\n- 015-c0006.md: campaign \"Honeybee\" after the author name discovered in malicious W\n\n**Step 4.** **Action:** `search_vectors(Night Dragon cyber espionage operation details timeframe target techniques)`\n\n**Observation:** - 012-c0002.md: # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.\n- 012-c0002.md: in China.(Citation: McAfee Night Dragon)\n\nRelations:\n- Night Dragon\n\n**Step 5.** **Action:** `search_vectors(Frankenstein campaign timeframe target context techniques tools)`\n\n**Observation:** - 011-c0001.md: # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.\n- 011-c0001.md: Process Discovery (T1057)\n- Frankenstein -> uses -> System Informat\n\n**Step 6.** **Action:** `search_vectors(Operation CuckooBees campaign timeframe target context techniques tools)`\n\n**Observation:** - 019-c0012.md: # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees]\n- 019-c0012.md: eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was c\n\n**Step 7.** **Action:** `search_vectors(Operation Honeybee campaign timeframe target context techniques tools)`\n\n**Observation:** - 015-c0006.md: # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](htt\n- 015-c0006.md: campaign \"Honeybee\" after the author name discovered in malicious W\n\n**Step 8.** **Action:** `search_vectors(Night Dragon campaign timeframe target context techniques tools)`\n\n**Observation:** - 012-c0002.md: # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.\n- 012-c0002.md: in China.(Citation: McAfee Night Dragon)\n\nRelations:\n- Night Dragon\n\n**Step 9.** **Action:** `search_vectors(Frankenstein campaign timeframe target context techniques tools)`\n\n**Observation:** - 011-c0001.md: # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.\n- 011-c0001.md: Process Discovery (T1057)\n- Frankenstein -> uses -> System Informat\n\n**Step 10.** **Action:** `search_vectors(Night Dragon campaign timeframe target context techniques tools)`\n\n**Observation:** - 012-c0002.md: # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.\n- 012-c0002.md: in China.(Citation: McAfee Night Dragon)\n\nRelations:\n- Night Dragon\n\n**Step 11.** **Action:** `search_vectors(Operation CuckooBees campaign timeframe target context techniques tools)`\n\n**Observation:** - 019-c0012.md: # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees]\n- 019-c0012.md: eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was c\n\n**Step 12.** **Action:** `search_vectors(Operation Honeybee campaign timeframe target context techniques tools)`\n\n**Observation:** - 015-c0006.md: # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](htt\n- 015-c0006.md: campaign \"Honeybee\" after the author name discovered in malicious W\n\n
• **Credential Access:** Valid Accounts (Domain Accounts)
• **Discovery:** System Information Discovery
• **Exfiltration:** Automated Exfiltration | • **gsecdump:** Used to dump credentials from memory.
• **Custom Malware:** Often referred to as \"Night Dragon\" malware, which included backdoors and data exfiltration capabilities. |\n| **Frankenstein** | • **Discovery:** Process Discovery (T1057), System Information Discovery (T1082)
• **Defense Evasion:** Command Obfuscation (T1027.010)
• **Exfiltration:** Automated Exfiltration over C2 Channel | • **Custom Backdoors:** Used sophisticated custom malware for persistence and data theft.
• **Obfuscated Commands:** Used command obfuscation to evade detection. |\n| **Operation Honeybee** | • **Initial Access:** Spearphishing Attachment (via Word docs)
• **Persistence:** Modify Registry (T1112)
• **Exfiltration:** Exfiltration Over C2 Channel (T1041) | • **Reg (S0075):** A specific tool used for registry modifications.
• **Malicious Word Documents:** The primary delivery mechanism, named \"Honeybee\" after the author field in the documents. |\n| **Operation CuckooBees** | • **Discovery:** File and Directory Discovery (T1083), System Information Discovery (T1082), System Time Discovery (T1124)
• **Initial Access:** Spearphishing Link
• **Exfiltration:** Automated Exfiltration | • **Custom Malware:** Used custom-built malware for data theft.
• **System Enumeration:** Focused heavily on discovering system time and file structures to identify valuable intellectual property. |\n\n### Summary of Differences\n* **Evolution of Tactics:** Night Dragon relied heavily on credential dumping (gsecdump) and valid accounts, while later campaigns like Frankenstein and CuckooBees shifted toward more sophisticated discovery and obfuscation techniques. Operation Honeybee is distinct for its reliance on malicious Word documents as the primary initial access vector.\n* **Target Scope:** While all were linked to Winnti/APT41, Night Dragon was narrowly focused on the energy sector's intellectual property. Frankenstein and CuckooBees expanded this to include high-tech manufacturing and telecommunications. Operation Honeybee had a broader, more diverse target list including government entities.\n* **Tooling:** Night Dragon is notable for using **gsecdump**, a well-known credential dumping tool. Operation Honeybee used a specific registry modification tool (**Reg/S0075**). Frankenstein and CuckooBees relied more on custom malware with built-in discovery and exfiltration capabilities rather than third-party tools like gsecdump.",
"sources": [
{
"title": "🤖 Agent trace",
"score": null
}
],
"metrics": {
"seconds": 26.1,
"chunks": 0,
"llm_calls": 16,
"cloud_calls": 0
}
},
{
"query_id": "cyber_campaign_timeline_context",
"model": "n8n-adaptive-rag",
"base_model": "n8n-adaptive-rag",
"flavor": "default",
"requires_reingest": false,
"ok": true,
"latency_s": 0.3,
"raw": "Based on the provided context, here is the comparison of the four campaigns:\n\n**1. Timeframe**\n* **Frankenstein:** Early 2019.\n* **Operation CuckooBees:** Since at least 2019; ongoing as of May 2022.\n* **Operation Honeybee:** Late 2017 through early 2018.\n* **Night Dragon:** The specific timeframe is not mentioned in the context, only that it was a campaign involving observed techniques and tools.\n\n**2. Target Context**\n* **Frankenstein:** Highly-targeted; no specific industry or geographic targets are listed, though it relied on open-source tools.\n* **Operation CuckooBees:** Technology and manufacturing companies in East Asia, Western Europe, and North America. The goal was the theft of proprietary information, R&D documents, source code, and blueprints.\n* **Operation Honeybee:** Humanitarian aid and inter-Korean affairs organizations. Initially South Korea, expanding to Vietnam, Singapore, Japan, Indonesia, Argentina, and Canada.\n* **Night Dragon:** Oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States.\n\n**3. Techniques or Tools Used**\n* **Frankenstein:** Primarily relied on open source tools, including Empire. Specific techniques listed are Process Discovery (T1057) and System Information Discovery (T1082).\n* **Operation CuckooBees:** Uses Peripheral Device Discovery (T1120), dsquery (S0105), Remote System Discovery (T1018), Windows Service (T1543.003), Archive via Utility (T1560.001), External Remote Services (T1133), File and Directory Discovery (T1083), and System Information Discovery (T108). Conducted by actors affiliated with Winnti Group, APT41, and BARIUM.\n* **Operation Honeybee:** The context does not list specific techniques or tools, but notes that threat actors were likely Korean speakers based on metadata in lure documents and executables, and the name \"Honeybee\" comes from an author name discovered in malicious Word documents.\n* **Night Dragon:** Collected data from SCADA systems. Specific technique listed is Domain Accounts (T107). The context notes that security researchers assessed the campaign involved a threat group based in China.\n\n🔎 Retrieved context (5 sources)
\n\n**1. 019-c0012.md**\n\n> eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason Op\n\n**2. 019-c0012.md**\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**3. 012-c0002.md**\n\n> # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber e\n\n**4. 015-c0006.md**\n\n> # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](https://attack.mitre.org/campaigns/C0006) w\n\n**5. 011-c0001.md**\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (8 sources)
\n\n**1. 019-c0012.md**\n\n> eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason Op\n\n**2. 019-c0012.md**\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**3. 012-c0002.md**\n\n> # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber e\n\n**4. 015-c0006.md**\n\n> # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](https://attack.mitre.org/campaigns/C0006) w\n\n**5. 011-c0001.md**\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n**6. 019-c0012.md**\n\n> and Directory Discovery (T1083)\n- Operation CuckooBees -> uses -> System Information Discovery (T1082)\n- Operation CuckooBees -> uses -> System Time Discovery (T1124)\n- Operation CuckooBees -> uses -> Domain Accounts (T1078.002)\n- Operation\n\n**7. 011-c0001.md**\n\n> Process Discovery (T1057)\n- Frankenstein -> uses -> System Information Discovery (T1082)\n- Frankenstein -> uses -> Command Obfuscation (T1027.010)\n- Frankenstein -> uses -> Automated Exfiltration (T1020)\n- Frankenstein -> uses -> Empire (S0\n\n**8. 015-c0006.md**\n\n> campaign \"Honeybee\" after the author name discovered in malicious Word documents.(Citation: McAfee Honeybee) \n\nRelations:\n- Operation Honeybee -> uses -> Email Accounts (T1585.002)\n- Operation Honeybee -> uses -> SYSCON (S0464)\n- Operation \n\n🔎 Retrieved context (8 sources)
\n\n**1. 011-c0001.md** · score 0.150\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n**2. 019-c0012.md** · score 0.118\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**3. 011-c0001.md** · score 0.068\n\n> Process Discovery (T1057)\n- Frankenstein -> uses -> System Information Discovery (T1082)\n- Frankenstein -> uses -> Command Obfuscation (T1027.010)\n- Frankenstein -> uses -> Automated Exfiltration (T1020)\n- Frankenstein -> uses -> Empire (S0\n\n**4. 012-c0002.md** · score 0.061\n\n> # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber e\n\n**5. 015-c0006.md** · score 0.058\n\n> # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](https://attack.mitre.org/campaigns/C0006) w\n\n**6. 043-t1001-002.md** · score 0.048\n\n> # Steganography\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.002\nSTIX ID: attack-pattern--eec23884-3fa1-4d8a-ac50-6f104d51e235\n\nDescription:\nAdversaries may use steganographic techniques to hide\n\n**7. 007-g0007.md** · score 0.047\n\n> n: SecureWorks TG-4127)(Citation: FireEye APT28 January 2017)(Citation: GRIZZLY STEPPE JAR)(Citation: Sofacy DealersChoice)(Citation: Palo Alto Sofacy 06-2018)(Citation: Symantec APT28 Oct 2018)(Citation: ESET Zebrocy May 2019)\n\n[APT28](htt\n\n**8. 014-c0005.md** · score 0.046\n\n> # Operation Spalax\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0005\nSTIX ID: campaign--4c840263-bbda-440d-a22b-674679ddebf1\n\nDescription:\n[Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a\n\n🔎 Retrieved context (5 sources)
\n\n**1. 019-c0012.md** · score 0.955\n\n> eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason Op\n\n**2. 012-c0002.md** · score 0.951\n\n> # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber e\n\n**3. 019-c0012.md** · score 0.870\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**4. 019-c0012.md** · score 0.867\n\n> and Directory Discovery (T1083)\n- Operation CuckooBees -> uses -> System Information Discovery (T1082)\n- Operation CuckooBees -> uses -> System Time Discovery (T1124)\n- Operation CuckooBees -> uses -> Domain Accounts (T1078.002)\n- Operation\n\n**5. 015-c0006.md** · score 0.834\n\n> campaign \"Honeybee\" after the author name discovered in malicious Word documents.(Citation: McAfee Honeybee) \n\nRelations:\n- Operation Honeybee -> uses -> Email Accounts (T1585.002)\n- Operation Honeybee -> uses -> SYSCON (S0464)\n- Operation \n\n🔎 Retrieved context (8 sources)
\n\n**1. 011-c0001.md** · score 0.196\n\n> This section introduces the Frankenstein campaign (C0001), detailing its characteristics as a highly-targeted operation using open-source tools like Empire in early 2019. It serves as the header for the list of specific tactics and techniqu\n\n**2. 011-c0001.md** · score 0.164\n\n> This list details the specific ATT&CK techniques and software tools utilized by the Frankenstein threat actor campaign, which relied on open-source components like Empire for its operations.\n\nProcess Discovery (T1057)\n- Frankenstein -> uses\n\n**3. 019-c0012.md** · score 0.150\n\n> This section introduces Operation CuckooBees as a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since 2019. It outlines the attackers' primary objective of stealing\n\n**4. 019-c0012.md** · score 0.082\n\n> This list details specific ATT&CK techniques employed by the Operation CuckooBees campaign for reconnaissance and persistence, following the initial description of the group's objectives and affiliations. These technical indicators illustra\n\n**5. 012-c0002.md** · score 0.080\n\n> This chunk introduces the \"Night Dragon\" cyber espionage campaign, detailing its targets and origin, while beginning to list the specific techniques and tools used by the threat actors.\n\n# Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX \n\n**6. 020-c0013.md** · score 0.075\n\n> This section provides the high-level overview of Operation Sharpshooter, detailing its nature as a global cyber espionage campaign and its association with the Lazarus Group. It serves as the introductory summary before listing the specific\n\n**7. 015-c0006.md** · score 0.070\n\n> This section provides the high-level overview of Operation Honeybee, detailing its timeline, geographic scope, and the rationale behind its naming convention. It serves as the introductory summary for the campaign before listing specific te\n\n**8. 019-c0012.md** · score 0.058\n\n> This section details the threat actors associated with Operation CuckooBees and lists specific ATT&CK techniques used in the campaign.\n\neration CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [W\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=local) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Action:** `search_vectors(Frankenstein malware operation details timeframe target techniques)`\n\n**Observation:** - 011-c0001.md: Process Discovery (T1057)\n- Frankenstein -> uses -> System Information Discovery (T1082)\n- Frankenstein -> uses -> Command Obfuscation (T1027.010)\n- Frankenstein -> uses -> Automated Exfiltration (T10\n- 011-c0001.md: # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject\n\n**Step 2.** **Action:** `search_vectors(Operation CuckooBees malware campaign details timeframe target techniques)`\n\n**Observation:** - 019-c0012.md: # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees]\n- 019-c0012.md: eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was c\n\n**Step 3.** **Action:** `search_vectors(Operation Honeybee malware campaign details timeframe target techniques)`\n\n**Observation:** - 015-c0006.md: # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](htt\n- 015-c0006.md: campaign \"Honeybee\" after the author name discovered in malicious W\n\n**Step 4.** **Action:** `search_vectors(Night Dragon cyber espionage operation details timeframe target techniques)`\n\n**Observation:** - 012-c0002.md: # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.\n- 012-c0002.md: in China.(Citation: McAfee Night Dragon)\n\nRelations:\n- Night Dragon\n\n**Step 5.** **Thought:** I need to gather more detailed information about each of these campaigns, specifically their timeframes, target contexts, and techniques/tools. Let me search for more specific details.\n\n**Action:** `search_vectors(Frankenstein campaign timeframe date target context techniques tools)`\n\n**Observation:** - 011-c0001.md: # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.\n- 011-c0001.md: Process Discovery (T1057)\n- Frankenstein -> uses -> System Informat\n\n**Step 6.** **Action:** `search_vectors(Operation CuckooBees campaign timeframe date target context techniques tools)`\n\n**Observation:** - 019-c0012.md: # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees]\n- 019-c0012.md: eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was c\n\n**Step 7.** **Action:** `search_vectors(Operation Honeybee campaign timeframe date target context techniques tools)`\n\n**Observation:** - 015-c0006.md: # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](htt\n- 015-c0006.md: campaign \"Honeybee\" after the author name discovered in malicious W\n\n**Step 8.** **Action:** `search_vectors(Night Dragon campaign timeframe date target context techniques tools)`\n\n**Observation:** - 012-c0002.md: # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.\n- 012-c0002.md: in China.(Citation: McAfee Night Dragon)\n\nRelations:\n- Night Dragon\n\n🔎 Retrieved context (5 sources)
\n\n**1. 019-c0012.md**\n\n> eration CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason Op\n\n**2. 019-c0012.md**\n\n> # Operation CuckooBees\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0012\nSTIX ID: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b\n\nDescription:\n[Operation CuckooBees](https://attack.mitre.org/campaigns/C001\n\n**3. 012-c0002.md**\n\n> # Night Dragon\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0002\nSTIX ID: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a\n\nDescription:\n[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber e\n\n**4. 015-c0006.md**\n\n> # Operation Honeybee\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0006\nSTIX ID: campaign--4553292d-12c6-4a93-934d-12160370d4e0\n\nDescription:\n[Operation Honeybee](https://attack.mitre.org/campaigns/C0006) w\n\n**5. 011-c0001.md**\n\n> # Frankenstein\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: campaign\nATT&CK ID: C0001\nSTIX ID: campaign--26d9ebae-de59-427f-ae9a-349456bae4b1\n\nDescription:\n[Frankenstein](https://attack.mitre.org/campaigns/C0001) was described\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (5 sources)
\n\n**1. 044-t1001-003.md**\n\n> # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescription:\nAdversaries may impersonate legit\n\n**2. 058-m1021.md**\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n**3. 058-m1021.md**\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**4. 044-t1001-003.md**\n\n> ike it is related with a trusted entity. \n\nAdversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, an\n\n**5. 018-c0011.md**\n\n> Education Campaign July 2022) \n\nRelations:\n- C0011 -> uses -> Upload Malware (T1608.001)\n- C0011 -> uses -> Spearphishing Link (T1566.002)\n- C0011 -> attributed-to -> Transparent Tribe (G0134)\n- C0011 -> uses -> Malicious Link (T1204.001)\n-\n\n🔎 Retrieved context (5 sources)
\n\n**1. 044-t1001-003.md** · score 0.331\n\n> # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescription:\nAdversaries may impersonate legit\n\n**2. 044-t1001-003.md** · score 0.102\n\n> ike it is related with a trusted entity. \n\nAdversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, an\n\n**3. 041-t1001.md** · score 0.094\n\n> # Data Obfuscation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001\nSTIX ID: attack-pattern--ad255bfe-a9e6-4b52-a258-8d3462abe842\n\nDescription:\nAdversaries may obfuscate command and control traffic \n\n**4. 044-t1001-003.md** · score 0.064\n\n> Service Impersonation\n- PUBLOAD (S1228) -> uses -> Protocol or Service Impersonation\n- Detecting Protocol or Service Impersonation via Anomalous TLS, HTTP Header, and Port Mismatch Correlation (DET0470) -> detects -> Protocol or Service Imp\n\n**5. 058-m1021.md** · score 0.035\n\n> Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.\n- Configure alerts for access attempts to blocked domains or repeated file download failures.\n\nRel\n\n🔎 Retrieved context (5 sources)
\n\n**1. 044-t1001-003.md** · score 0.469\n\n> This section defines the \"Protocol or Service Impersonation\" technique (T1001.003), detailing how adversaries disguise command and control traffic by mimicking legitimate protocols like SSL/TLS or web services to evade detection. It serves \n\n**2. 044-t1001-003.md** · score 0.191\n\n> This text describes how adversaries manipulate legitimate protocols and web services to disguise command and control traffic as trusted entities. It is part of the MITRE ATT&CK entry for Protocol or Service Impersonation (T1001.003), which \n\n**3. 044-t1001-003.md** · score 0.139\n\n> This text fragment appears at the end of the \"Relations\" section, which lists various threat actors and tools that utilize Protocol or Service Impersonation (T1001.003) as a subtechnique of Data Obfuscation.\n\nersonation\n\n**4. 044-t1001-003.md** · score 0.106\n\n> This section lists specific threat actors and tools that utilize the Protocol or Service Impersonation technique, along with detection methods for identifying such impersonation activities.\n\nService Impersonation\n- PUBLOAD (S1228) -> uses -\n\n**5. 041-t1001.md** · score 0.076\n\n> This section details the MITRE ATT&CK technique T1001 for Data Obfuscation, specifically focusing on how adversaries hide command and control traffic to evade detection. It lists specific threat actors like StrelaStealer and Gamaredon Group\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Action:** `search_vectors(protocol impersonation web-based content restrictions spearphishing links command-and-control style techniques threat groups campaigns)`\n\n**Observation:** - 058-m1021.md: # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\n\n- 058-m1021.md: Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collec\n\n**Step 2.** **Action:** `query_graph(threat actors using protocol impersonation and web-based content restrictions for spearphishing and C2)`\n\n**Observation:** Threat actors often employ various techniques to conduct spearphishing attacks and establish command and control (C2) channels. One such technique is **Protocol or Service Impersonation**, which involves impersonating legitimate protocols or web service traffic to disguise malicious activities. This\n\n**Step 3.** **Action:** `search_vectors(groups campaigns software protocol impersonation spearphishing links command and control)`\n\n**Observation:** - 044-t1001-003.md: # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescri\n- 044-t1001-003.md: ike it is related with a trusted entity. \n\nAdversaries may \n\n**Step 4.** **Action:** `query_graph(threat actors groups campaigns using protocol impersonation spearphishing links and command-and-control techniques)`\n\n**Observation:** Threat actors have employed a combination of **Protocol or Service Impersonation**, **Spearphishing Links**, and **Command-and-Control (C2) Techniques** in various cyber campaigns. These methods are often used to disguise malicious activities, evade detection, and manipulate victims into revealing s\n\n**Step 5.** **Action:** `query_graph(groups campaigns software that use protocol impersonation spearphishing links and command-and-control techniques)`\n\n**Observation:** Several groups, campaigns, and software have been identified as utilizing **Protocol or Service Impersonation**, **Spearphishing Links**, and **Command-and-Control (C2) Techniques**. Below is a detailed breakdown of these entities:\n\n### Groups Using Protocol or Service Impersonation\n\n1. **Lazarus Gr\n\n🔎 Retrieved context (5 sources)
\n\n**1. 044-t1001-003.md**\n\n> # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescription:\nAdversaries may impersonate legit\n\n**2. 058-m1021.md**\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n**3. 058-m1021.md**\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**4. 044-t1001-003.md**\n\n> ike it is related with a trusted entity. \n\nAdversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, an\n\n**5. 018-c0011.md**\n\n> Education Campaign July 2022) \n\nRelations:\n- C0011 -> uses -> Upload Malware (T1608.001)\n- C0011 -> uses -> Spearphishing Link (T1566.002)\n- C0011 -> attributed-to -> Transparent Tribe (G0134)\n- C0011 -> uses -> Malicious Link (T1204.001)\n-\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n🔎 Retrieved context (8 sources)
\n\n**1. 044-t1001-003.md**\n\n> # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescription:\nAdversaries may impersonate legit\n\n**2. 058-m1021.md**\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n**3. 058-m1021.md**\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**4. 044-t1001-003.md**\n\n> ike it is related with a trusted entity. \n\nAdversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, an\n\n**5. 018-c0011.md**\n\n> Education Campaign July 2022) \n\nRelations:\n- C0011 -> uses -> Upload Malware (T1608.001)\n- C0011 -> uses -> Spearphishing Link (T1566.002)\n- C0011 -> attributed-to -> Transparent Tribe (G0134)\n- C0011 -> uses -> Malicious Link (T1204.001)\n-\n\n**6. 058-m1021.md**\n\n> Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.\n- Configure alerts for access attempts to blocked domains or repeated file download failures.\n\nRel\n\n**7. 056-m1019.md**\n\n> Community and Collaboration Tools:\n\n- ISAC Memberships: Join industry-specific ISACs for intelligence sharing.\n- Slack/Discord Channels: Participate in threat intelligence communities for real-time collaboration.\n\nRelations:\n- Threat Intell\n\n**8. 014-c0005.md**\n\n> )\n- Operation Spalax -> uses -> Malicious Link (T1204.001)\n- Operation Spalax -> uses -> Spearphishing Link (T1566.002)\n- Operation Spalax -> uses -> Web Service (T1102)\n- Operation Spalax -> uses -> Software Packing (T1027.002)\n- Operation\n\n🔎 Retrieved context (8 sources)
\n\n**1. 044-t1001-003.md** · score 0.331\n\n> # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescription:\nAdversaries may impersonate legit\n\n**2. 044-t1001-003.md** · score 0.102\n\n> ike it is related with a trusted entity. \n\nAdversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, an\n\n**3. 041-t1001.md** · score 0.094\n\n> # Data Obfuscation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001\nSTIX ID: attack-pattern--ad255bfe-a9e6-4b52-a258-8d3462abe842\n\nDescription:\nAdversaries may obfuscate command and control traffic \n\n**4. 044-t1001-003.md** · score 0.064\n\n> Service Impersonation\n- PUBLOAD (S1228) -> uses -> Protocol or Service Impersonation\n- Detecting Protocol or Service Impersonation via Anomalous TLS, HTTP Header, and Port Mismatch Correlation (DET0470) -> detects -> Protocol or Service Imp\n\n**5. 058-m1021.md** · score 0.035\n\n> Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.\n- Configure alerts for access attempts to blocked domains or repeated file download failures.\n\nRel\n\n**6. 041-t1001.md** · score 0.031\n\n> otocols. \n\nRelations:\n- StrelaStealer (S1183) -> uses -> Data Obfuscation\n- Gamaredon Group (G0047) -> uses -> Data Obfuscation\n- Junk Data (T1001.001) -> subtechnique-of -> Data Obfuscation\n- Okrum (S0439) -> uses -> Data Obfuscation\n- Sys\n\n**7. 058-m1021.md** · score 0.028\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**8. 043-t1001-002.md** · score 0.028\n\n> # Steganography\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.002\nSTIX ID: attack-pattern--eec23884-3fa1-4d8a-ac50-6f104d51e235\n\nDescription:\nAdversaries may use steganographic techniques to hide\n\n🔎 Retrieved context (5 sources)
\n\n**1. 058-m1021.md** · score 0.970\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n**2. 058-m1021.md** · score 0.920\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**3. 058-m1021.md** · score 0.894\n\n> Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collect and analyze web proxy logs for signs of anomalous or malicious activity.\n- Configure alerts for access attempts to blocked domains or repeated file download failures.\n\nRel\n\n**4. 044-t1001-003.md** · score 0.873\n\n> # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescription:\nAdversaries may impersonate legit\n\n**5. 044-t1001-003.md** · score 0.822\n\n> ike it is related with a trusted entity. \n\nAdversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, an\n\n🔎 Retrieved context (8 sources)
\n\n**1. 044-t1001-003.md** · score 0.469\n\n> This section defines the \"Protocol or Service Impersonation\" technique (T1001.003), detailing how adversaries disguise command and control traffic by mimicking legitimate protocols like SSL/TLS or web services to evade detection. It serves \n\n**2. 044-t1001-003.md** · score 0.191\n\n> This text describes how adversaries manipulate legitimate protocols and web services to disguise command and control traffic as trusted entities. It is part of the MITRE ATT&CK entry for Protocol or Service Impersonation (T1001.003), which \n\n**3. 044-t1001-003.md** · score 0.139\n\n> This text fragment appears at the end of the \"Relations\" section, which lists various threat actors and tools that utilize Protocol or Service Impersonation (T1001.003) as a subtechnique of Data Obfuscation.\n\nersonation\n\n**4. 044-t1001-003.md** · score 0.106\n\n> This section lists specific threat actors and tools that utilize the Protocol or Service Impersonation technique, along with detection methods for identifying such impersonation activities.\n\nService Impersonation\n- PUBLOAD (S1228) -> uses -\n\n**5. 041-t1001.md** · score 0.076\n\n> This section details the MITRE ATT&CK technique T1001 for Data Obfuscation, specifically focusing on how adversaries hide command and control traffic to evade detection. It lists specific threat actors like StrelaStealer and Gamaredon Group\n\n**6. 043-t1001-002.md** · score 0.044\n\n> This section details the specific MITRE ATT&CK technique T1001.002 for Steganography, defining its use in hiding command and control traffic while listing associated threat actors and detection methods.\n\n# Steganography\n\nSource: MITRE ATT&C\n\n**7. 041-t1001.md** · score 0.044\n\n> This section lists specific threat actors, sub-techniques, detection methods, and mitigations associated with the MITRE ATT&CK technique T1001 (Data Obfuscation). It details how various malware groups use this method to hide command and con\n\n**8. 058-m1021.md** · score 0.043\n\n> This section details the monitoring and alerting strategies for detecting web-based threats, which are part of the broader \"Restrict Web-Based Content\" mitigation strategy designed to counter various MITRE ATT&CK techniques.\n\nMonitor and Al\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=local) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. LightRAG knowledge graph**\n\n> Graph + vector dual retrieval (mode=hybrid) over the corpus's extracted entities & relations.\n\n🔎 Retrieved context (1 source)
\n\n**1. 🤖 Agent trace**\n\n> **Step 1.** **Action:** `search_vectors(protocol impersonation web-based content restrictions spearphishing links command-and-control style techniques threat groups campaigns)`\n\n**Observation:** - 058-m1021.md: # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\n\n- 058-m1021.md: Monitor and Alert on Web-Based Threats:\n\n- Use SIEM tools to collec\n\n**Step 2.** **Action:** `query_graph(threat actors using protocol impersonation and web-based content restrictions for spearphishing and C2)`\n\n**Observation:** Threat actors often employ various techniques to conduct spearphishing attacks and establish command and control (C2) channels. One such technique is **Protocol or Service Impersonation**, which involves impersonating legitimate protocols or web service traffic to disguise malicious activities. This\n\n🔎 Retrieved context (5 sources)
\n\n**1. 044-t1001-003.md**\n\n> # Protocol or Service Impersonation\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: attack-pattern\nATT&CK ID: T1001.003\nSTIX ID: attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc\n\nDescription:\nAdversaries may impersonate legit\n\n**2. 058-m1021.md**\n\n> # Restrict Web-Based Content\n\nSource: MITRE ATT&CK Enterprise STIX bundle\n\nObject type: course-of-action\nATT&CK ID: M1021\nSTIX ID: course-of-action--21da4fd4-27ad-4e9c-b93d-0b9b14d02c96\n\nDescription:\nRestricting web-based content involves e\n\n**3. 058-m1021.md**\n\n> utation, and content types.\n- Enforce policies that block unsafe websites or file types at the gateway level.\n\nEnable DNS-Based Filtering:\n\n- Implement tools to restrict access to domains associated with malware or phishing campaigns.\n- Use\n\n**4. 044-t1001-003.md**\n\n> ike it is related with a trusted entity. \n\nAdversaries may also leverage legitimate protocols to impersonate expected web traffic or trusted services. For example, adversaries may manipulate HTTP headers, URI endpoints, SSL certificates, an\n\n**5. 018-c0011.md**\n\n> Education Campaign July 2022) \n\nRelations:\n- C0011 -> uses -> Upload Malware (T1608.001)\n- C0011 -> uses -> Spearphishing Link (T1566.002)\n- C0011 -> attributed-to -> Transparent Tribe (G0134)\n- C0011 -> uses -> Malicious Link (T1204.001)\n-\n\n🔎 Retrieved context (1 source)
\n\n**1. 🧭 Adaptive route**\n\n> n8n routed this query as **simple**.\n\n