"type","name","description"
"2",Hotfix,Installs a hotfix to mitigate an exploit in the short term.
"1",Valid Password Hash,Provides a legitimate hash representing a password.
"2",Network-based IDS I,Spots suspicious traffic and reports threats to the operator.
"2",Analysis Sandbox I,"Analyzes suspicious code in a dedicated, isolated environment."
"1",Spyware II,Extracts interesting information and user inputs.
"1",Spyware I,Extracts interesting information and user inputs.
"2",Antivirus II,App looking for signatures or behavior patterns of malware.
"2",Antivirus I,App looking for signatures or behavior patterns of malware.
"2",Host-based IDS II,Spots suspicious system & user activity and reports threats.
"2",Host-based IDS I,Spots suspicious system & user activity and reports threats.
"2",Auth Server I,System providing identifier & authenticator management.
"2",Auth Server II,System providing identifier & authenticator management.
"2",Content Filter I,Blocks potentially unwanted content from web traffic.
"2",Web App Firewall II,Blocks suspicious web app traffic based on signatures & rules.
"2",Web App Firewall I,Blocks suspicious web app traffic based on signatures & rules.
"2",Authentication Policy,Implements rules governing i.e. password strength and reuse.
"2",Contigency Plan,Sets up a process for dealing with unforeseen events.
"2",Access Control Policy,"Implements rules regulating accounts, privileges, remote access, etc."
"2",Network-based IPS I,Blocks the transmission of suspicious packets based on rules.
"2",Host-based IPS II,Halts the execution of suspicious functions or filesystem ops.
"2",Host-based IPS I,Halts the execution of suspicious functions or filesystem ops.
"1",Unrestricted Configuration,Allows the attacker to gain higher privileges on the system. 
"1",Address Spoofer,Falsifies the attacker's network address to avoid detection.
"1",Web Exploit Kit,Locates flaws in websites and content management systems.
"1",Scripting Suite,Automates the creation of attack scripts.
"1",Malicious DNS Server,"Offers stealth, DNS poisoning, and other traffic redirection."
"1",Malicious App Server,"Provides platform for downloads, uploads, or command traffic."
"1",Unauthorized Callers,Allows users to bypass intended restrictions and read/write to app data. 
"2",Official Fix,Installs an official patch to fix security issues in the system.
"2",Security Patch,Installs an official patch to fix security issues in the system.
"1",Valid External Account,Provides legitimate access to e.g. a user's social media.
"2",Honeypot I,"Pretends to be a genuine service or system, luring in attackers."
"2",Debugger,Executes suspicious apps and keeps track of its instructions.
"1",DoS Tool,"Sends undesired traffic to a target, enabling DoS attacks."
"1",Fake Social Media Account,Allows access to social media posts and helps with recon.
"1",Keyboard Emulator,Provides keyboard emulation for attack automation and stealth.
"1",Valid Admin Account,Provides legitimate admin access to a system.
"2",Mail Gateway I,Scans mail messages and provides mail reputation scanning.
"1",Fake Messaging Account,Allows sending/receiving messages using a fake identity.
"2",Mail Gateway II,Scans mail messages and provides mail reputation scanning.
"2",Honeypot II,"Pretends to be a genuine service or system, luring in attackers."
"1",Port Scanner,"Scans a network range for active addresses, services, and more."
"1",Log Remote Execution,Allows attackers to execute arbitrary code via the logging service. 
"1",Generic Exploit,Abuses a newfound system vulnerability.
"2",Config Mgmt Policy,Implements rules and procedures regulating system changes.
"2",Network-based IDS II,Spots suspicious traffic and reports threats to the operator.
"2",Backup Server,Automates backup and recovery procedures.
"2",Mobile Device Policy,Defines secure handling procedures for mobile devices.
"2",Analysis Sandbox II,"Analyzes suspicious code in a dedicated, isolated environment."
"2",Update Server,Automates software updates to keep systems up to date.
"2",Inventory System,Keeps track of currently installed apps and system configs.
"2",Incident Response Plan,Sets up a process for dealing with security incidents of any kind.
"1",Low-Level Rootkit,"Provides hidden execution of code in boot sector, SMM, or firmware."
"1",Encryption Downgrade,Allows attackers to obtain sensitive information from encrypted traffic.
"1",Kernel Rootkit,Provides hidden execution of code on OS kernel level.
"1",Remote Access Trojan,Offers all-in-one up-/download as well as backdoor capabilities. 
"1",Search Routine Exec.,Allows code execution due to bad handling of DNS responses.
"1",Shell Remote Execution,Allows remote attackers to execute arbitrary code.
"1",User Rootkit,Provides hidden execution of code on user level.
"1",Zero Day Exploit,"Abuses a versatile, hitherto unknown system vulnerability."
"1",Ransomware I,Encrypts personal or business-critical files for ransom money.
"2",Secure Coding Suite,Offers automation and guidelines for secure programming.
"2",Content Filter II,Blocks potentially unwanted content from web traffic.
"2",Log Aggregator I,Collects and correlates log files to identify suspicious activity.
"2",Logic Analyzer,"Decodes common protocols such as serial, SPI, etc. for analysis."
"2",Audit Policy,Implements rules regulating data logging and retention.
"2",API Monitor,Executes suspicious apps and keeps track of its function calls.
"2",Detonation Chamber II,Executes suspicious links or files inside a dynamic sandbox.
"2",Log Aggregator II,Collects and correlates log files to identify suspicious activity.
"2",Detonation Chamber I,Executes suspicious links or files inside a dynamic sandbox.
"2",Account Monitor II,Keeps track of user activity through log event analysis.
"2",Vulnerability Scanner II,Tool designed to probe hosts and network devices for weaknesses.
"2",Vulnerability Scanner I,Tool designed to probe hosts and network devices for weaknesses.
"2",Account Monitor I,Keeps track of user activity through log event analysis.
"2",Threat Intel Database,Provides threat information helpful to counter exploitation.
"2",Stateful Packet Filter II,Filters network packets while allowing responses to valid requests.
"2",Stateful Packet Filter I,Filters network packets while allowing responses to valid requests.
"2",Packet Filter II,Filters network packets from and to defined addresses and ports.
"2",Next Gen Firewall II,Filters network packets while considering content & app context.
"2",Next Gen Firewall I,Filters network packets while considering content & app context.
"2",Network-based IPS II,Blocks the transmission of suspicious packets based on rules.
"2",Packet Filter I,Filters network packets from and to defined addresses and ports.
"1",Credential Dumper,Looks for system credentials and automatically extracts them.
"1",Config Extractor,Locates common config files or RAM content for easier interaction.
"1",Boot Imager,Accesses and changes device boot images.
"1",Batch Downloader,Collects data from a remote system and optimizes downloads.
"1",App Packer,Compresses attack apps to hinder detection systems.
"1",DDoS Botnet,"Grants control of a botnet, enabling (D)DoS attacks."
"1",Valid Account,Provides legitimate access to a system.
"1",Data Wiper,Helps destroy or encrypt data on a drive or device.
"1",Digital Certificate,"Provides legitimacy to malicious services, apps, or files."
"1",Android Recovery Replacer,Allows attackers to bypass security by replacing the recovery software.
"1",API Remote Execution,Allows attackers to execute arbitrary code via an OS API function. 
"1",Backdoor,"Opens a hidden connection to the attacker, enabling future access."
"1",Graphics Handler Exec.,Allows an attacker to execute code via OS font embedding. 
"1",DB Encryption Downgrade,Allows attackers to decrypt database connections.
"1",Traffic Encryption Bypass,Allows attackers to obtain sensitive information from encrypted traffic.
"1",Buffer Over-Read,Allows attackers to obtain sensitive information from memory.
"1",Bus Interface Device,Enables direct serial access to circruit boards and microcontrollers.
"1",Industrial Exploit Kit,Locates flaws in industrial control and safety systems.
"1",Mobile Exploit Kit,Locates flaws in mobile device hard- and software.
"1",Mobile Forensics Suite,Combines extraction and exploitation for automated hacking.
"1",Database Exploit Kit,Locates flaws in databases and automates queries.
"1",Code Obfuscator,Makes attack code harder to read and analyze.
"1",Code Fuzzer,Triggers desired (error) states in program binaries.
"1",Cloud Scanner,Identifies and analyzes common cloud instances.
"1",Browser Exploit Kit,Locates errors in a browser's page and session handling.
"1",Exploit Repository,Contains useful knowledge about current exploits.
"1",Firmware Imager,Accesses and changes device firmware images.
"1",Harvester,Searches local storage for interesting information and downloads it.
"1",Spambot,Misappropriates resources to send lucrative spam.
"1",Cryptojacker II,Misappropriates computing resources to mine crypto currency.
"1",Cryptojacker I,Misappropriates computing resources to mine crypto currency.
"1",Adware,Injects advertisements to trick a user into buying stuff.
"1",Hash Cracker,Attempts to crack local passwords using brute force or dicts.
"1",iOS Bootrom Patcher,Allows attackers to bypass security features via BootROM exploit.
"1",Scareware,Frightens users into buying e.g. (useless) software.
"1",Keylogger,Provides hardware of software key press monitoring.
"1",Web Crawler,"Searches the net for interesting data, addresses, and more."
"1",URL Scanner,Identifies interesting URL parameters for exploitation.
"1",Software Defined Radio,Allows radio band communication via antenna & dedicated software.
"1",Social Engineering Kit,"Combines web site forgery, phishing mail creation, and more."
"1",Proxy Server,Directs attacks through an intermediate network to stay hidden.
"1",Pentesting Suite II,Combines scanning and exploitation for automated hacking.
"1",Pentesting Suite I,Combines scanning and exploitation for automated hacking.
"1",Packet Sniffer,Scans network traffic to extract interesting information.
"1",Password Cracker,Attempts to guess service passwords using brute force or dicts.
"1",Network Tunnel,Bypasses security scans by hiding connections in harmless traffic.
"1",Network Tracer,Uses existing connections to identify network nodes.
"1",Malicious Web Server,Pretends to be a genuine web server for deception and staging.
"1",Malicious Transmitter,"Offers signal jamming, forgery, and interception capabilities."
"1",Malicious Domain,Provides a means for social engineering or waterholing attacks.
"1",Lockpick,Allows physical access to the target's premises. Old-school B&E.
"1",Key Extractor,"Locates cryptographic keys in stored data, RAM, or input."
"1",Vulnerability Scanner I,Tool designed to probe hosts and network devices for weaknesses.
"2",Disassembler,Reverse-engineers suspicious binary files.
"2",Physical Security Policy,Implements rules for controlled perimeter access.
"2",Risk Assessment Policy,Implements regular risk assessments and plans their mitigation.
"2",Data Diode,Prevents two-way communication between IT and OT networks.
"2",Firmware Patch,Installs a firmware update to address deep-rooted security issues.
"2",Workaround,Installs a workaround to mitigate an exploit in the short term.
"1",Vulnerability Scanner II,Tool designed to probe hosts and network devices for weaknesses.
"1",Ransomware II,Encrypts personal or business-critical files for ransom money.
