From 48ec70af3cb16abcf7044b8c60e5445ddbd72721 Mon Sep 17 00:00:00 2001 From: Michael Carenzo Date: Tue, 1 Aug 2023 13:57:34 -0400 Subject: [PATCH 01/18] Update FocusBox, FocusBox usage, Text and Enum Fields --- .../BlockDiagram/Property/EnumProperty.ts | 6 +- .../BlockDiagram/Property/StringProperty.ts | 6 + .../src/components/Containers/FocusBox.vue | 92 ++++-- .../src/components/Controls/ContextMenu.vue | 11 +- .../Controls/ContextMenuListing.vue | 115 +++++-- .../Controls/Fields/DictionaryField.vue | 4 - .../components/Controls/Fields/EnumField.vue | 298 +++++++++++------- .../Controls/Fields/OptionsList.vue | 242 ++++++++++++++ .../components/Controls/Fields/TextField.vue | 250 +++++++++++---- .../src/components/Controls/TitleBar.vue | 39 ++- .../src/components/Elements/BlockDiagram.vue | 10 +- .../PageCommands/SetStringProperty.ts | 2 +- 12 files changed, 821 insertions(+), 254 deletions(-) create mode 100644 src/attack_flow_builder/src/components/Controls/Fields/OptionsList.vue diff --git a/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/EnumProperty.ts b/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/EnumProperty.ts index 8f1f7218..e252f447 100644 --- a/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/EnumProperty.ts +++ b/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/EnumProperty.ts @@ -1,4 +1,4 @@ -import { computeHash, MD5 } from "../Utilities"; +import { computeHash } from "../Utilities"; import { CollectionProperty, EnumPropertyDescriptor, @@ -50,14 +50,14 @@ export class EnumProperty extends Property { } else if(value !== undefined) { v = value; } else if(descriptor.value) { - v = MD5(descriptor.value) + v = descriptor.value } else { v = null; } // Set value if(v === null) { this.setValue(null); - } else if(typeof v === "string") { + } else if(typeof v === "string") { this.setValue(v); } else { this.setValue(null); diff --git a/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/StringProperty.ts b/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/StringProperty.ts index c6c134a1..899ab4da 100644 --- a/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/StringProperty.ts +++ b/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/StringProperty.ts @@ -12,6 +12,11 @@ export class StringProperty extends Property { */ public override readonly descriptor: StringPropertyDescriptor; + /** + * The property's suggestions. + */ + public suggestions: string[]; + /** * The property's value. */ @@ -34,6 +39,7 @@ export class StringProperty extends Property { ) { super(parent, descriptor); this.descriptor = descriptor; + this.suggestions = []; this._value = null; if(value === null) { this.setValue(null); diff --git a/src/attack_flow_builder/src/components/Containers/FocusBox.vue b/src/attack_flow_builder/src/components/Containers/FocusBox.vue index 9f81961f..23bcfe03 100644 --- a/src/attack_flow_builder/src/components/Containers/FocusBox.vue +++ b/src/attack_flow_builder/src/components/Containers/FocusBox.vue @@ -1,36 +1,92 @@ + + diff --git a/src/attack_flow_builder/src/components/Controls/ContextMenu.vue b/src/attack_flow_builder/src/components/Controls/ContextMenu.vue index 71110fbd..aa4784b4 100644 --- a/src/attack_flow_builder/src/components/Controls/ContextMenu.vue +++ b/src/attack_flow_builder/src/components/Controls/ContextMenu.vue @@ -2,21 +2,22 @@ @@ -176,33 +279,21 @@ export default defineComponent({ /** === Main Field === */ .enum-field-control { - display: flex; - align-items: center; - color: #cccccc; -} - -.enum-field-control.open { - border: solid 1px #3d3d3d; -} - -.grid-container { display: grid; grid-template-columns: minmax(0, 1fr); - grid-template-rows: minmax(0, 1fr) minmax(0, auto); - width: 100%; + grid-template-rows: minmax(0, 1fr); + color: #cccccc; + box-sizing: border-box; + cursor: pointer; } /** === Value Text === */ .value-container { + position: relative; grid-area: 1 / 1; display: flex; align-items: center; - cursor: pointer; -} - -.disabled .value-container { - cursor: inherit; } .value-text { @@ -223,6 +314,29 @@ export default defineComponent({ font-weight: 500; } +.value-search { + flex: 1; + height: 100%; + min-width: 0px; + color: inherit; + font-size: inherit; + font-weight: inherit; + font-family: inherit; + padding: 6px 8px 6px 12px; + border: none; + box-sizing: border-box; + background: none; +} + +.value-search::placeholder { + color: #999; + opacity: 1; +} + +.value-search:focus { + outline: none; +} + .dropdown-arrow { color: #666666; font-size: 6pt; @@ -235,37 +349,9 @@ export default defineComponent({ /** === Dropdown Options === */ -.scrollbox-container { - grid-area: 2 / 1; - border-top: dotted 1px #3d3d3d;; - border-bottom-left-radius: 4px; - border-bottom-right-radius: 4px; - box-sizing: border-box; - background: #242424; -} - -.dropdown-options { - padding: 6px 5px; -} - -.dropdown-options li { - list-style: none; - font-size: 10pt; - user-select: none; - white-space: nowrap; - text-overflow: ellipsis; - padding: 5px 12px; - overflow: hidden; -} - -.dropdown-options li.active, -.dropdown-options li.active.null { - color: #fff; - background: #726de2; -} - -.dropdown-options li.null { - color: #999; +.options-container { + position: relative; + grid-area: 1 / 1; } diff --git a/src/attack_flow_builder/src/components/Controls/Fields/OptionsList.vue b/src/attack_flow_builder/src/components/Controls/Fields/OptionsList.vue new file mode 100644 index 00000000..7394354a --- /dev/null +++ b/src/attack_flow_builder/src/components/Controls/Fields/OptionsList.vue @@ -0,0 +1,242 @@ + + + + + diff --git a/src/attack_flow_builder/src/components/Controls/Fields/TextField.vue b/src/attack_flow_builder/src/components/Controls/Fields/TextField.vue index 8364248b..5ed12767 100644 --- a/src/attack_flow_builder/src/components/Controls/Fields/TextField.vue +++ b/src/attack_flow_builder/src/components/Controls/Fields/TextField.vue @@ -1,21 +1,43 @@ @@ -184,27 +307,31 @@ export default defineComponent({ /** === Main Field === */ .text-field-control { - display: flex; - align-items: center; + display: grid; + grid-template-columns: minmax(0, 1fr); + grid-template-rows: minmax(0, 1fr); color: #cccccc; - cursor: text; - overflow: hidden; -} - -.text-field-control.disabled { - cursor: inherit; + box-sizing: border-box; } .text-field-control:focus { outline: none; } +.value { + position: relative; + display: flex; + grid-area: 1 / 1; + cursor:text +} + textarea { display: block; + width: 100%; color: inherit; font-size: inherit; + font-weight: inherit; font-family: inherit; - width: 100%; margin: 6px 12px; border: none; padding: 0px; @@ -222,4 +349,9 @@ textarea:focus { outline: none; } +.options-container { + position: relative; + grid-area: 1 / 1; +} + diff --git a/src/attack_flow_builder/src/components/Controls/TitleBar.vue b/src/attack_flow_builder/src/components/Controls/TitleBar.vue index b6e71d79..c462da9c 100644 --- a/src/attack_flow_builder/src/components/Controls/TitleBar.vue +++ b/src/attack_flow_builder/src/components/Controls/TitleBar.vue @@ -1,21 +1,21 @@ @@ -20,10 +20,7 @@ import { CommandEmitter } from "@/store/Commands/Command"; import { defineComponent, inject, markRaw } from 'vue'; import { mapGetters, mapMutations, mapState } from "vuex"; import { - ContextMenu as Menu, - ContextMenuSection, - ContextMenuSubmenu, - MenuType + ContextMenuSection } from "@/assets/scripts/ContextMenuTypes"; import { BlockDiagram,CameraLocation,Cursor, @@ -33,8 +30,6 @@ import { DiagramLineModel, DiagramObjectModel, MouseClick, - Namespace, - titleCase } from "@/assets/scripts/BlockDiagram"; // Components import ContextMenu from "@/components/Controls/ContextMenu.vue"; @@ -188,7 +183,6 @@ export default defineComponent({ } catch(ex: any) { console.error(ex); } - this.closeContextMenu(); }, /** diff --git a/src/attack_flow_builder/src/store/Commands/PageCommands/SetStringProperty.ts b/src/attack_flow_builder/src/store/Commands/PageCommands/SetStringProperty.ts index 7475a79e..8cb9ff17 100644 --- a/src/attack_flow_builder/src/store/Commands/PageCommands/SetStringProperty.ts +++ b/src/attack_flow_builder/src/store/Commands/PageCommands/SetStringProperty.ts @@ -26,7 +26,7 @@ export class SetStringProperty extends PageCommand { * @param value * The property's new value. */ - constructor(property: StringProperty, value: string) { + constructor(property: StringProperty, value: string | null) { let root = property.root; if(!root) { throw new Error("Property does not have a root.") From 3bf9ebaf10bfc9080d0b9a915bcf7031518c3cef Mon Sep 17 00:00:00 2001 From: Michael Carenzo Date: Tue, 1 Aug 2023 18:09:01 -0400 Subject: [PATCH 02/18] Add support for StringProperty text suggestions. --- .../BlockDiagram/Property/PropertyDescriptorTypes.ts | 6 +++++- .../assets/scripts/BlockDiagram/Property/StringProperty.ts | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/PropertyDescriptorTypes.ts b/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/PropertyDescriptorTypes.ts index e97c933e..2d0adf8e 100644 --- a/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/PropertyDescriptorTypes.ts +++ b/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/PropertyDescriptorTypes.ts @@ -13,6 +13,10 @@ type ValueDescriptorBase = { is_required? : boolean, } +type StringValueDescriptor = ValueDescriptorBase & { + suggestions?: string[] +} + type IntValueDescriptor = ValueDescriptorBase & { min?: number, max?: number @@ -71,7 +75,7 @@ export type PropertyDescriptor | DictionaryPropertyDescriptor export type StringPropertyDescriptor - = ValueDescriptorBase; + = StringValueDescriptor; export type NumberPropertyDescriptor = IntValueDescriptor diff --git a/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/StringProperty.ts b/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/StringProperty.ts index 899ab4da..82174963 100644 --- a/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/StringProperty.ts +++ b/src/attack_flow_builder/src/assets/scripts/BlockDiagram/Property/StringProperty.ts @@ -39,7 +39,7 @@ export class StringProperty extends Property { ) { super(parent, descriptor); this.descriptor = descriptor; - this.suggestions = []; + this.suggestions = descriptor.suggestions ?? []; this._value = null; if(value === null) { this.setValue(null); From d4d63c2ccc58534e46aad7c3955010eb5d9fa5fc Mon Sep 17 00:00:00 2001 From: Michael Carenzo <79934822+mikecarenzo@users.noreply.github.com> Date: Thu, 3 Aug 2023 13:42:04 -0400 Subject: [PATCH 03/18] create intel file --- .../attack/download_attack.js | 160 + .../attack/update_attack_intel.js | 70 + src/attack_flow_builder/package.json | 64 +- .../src/assets/builder.config.intel.ts | 9534 +++++++++++++++++ 4 files changed, 9797 insertions(+), 31 deletions(-) create mode 100644 src/attack_flow_builder/attack/download_attack.js create mode 100644 src/attack_flow_builder/attack/update_attack_intel.js create mode 100644 src/attack_flow_builder/src/assets/builder.config.intel.ts diff --git a/src/attack_flow_builder/attack/download_attack.js b/src/attack_flow_builder/attack/download_attack.js new file mode 100644 index 00000000..7ae5fffd --- /dev/null +++ b/src/attack_flow_builder/attack/download_attack.js @@ -0,0 +1,160 @@ +const https = require("https"); + +/** + * @typedef {Object} AttackObject + * An ATT&CK Object. + * @property {string} id + * The object's ATT&CK id. + * @property {string} name + * The object's ATT&CK name. + * @property {string} type + * The object's type. + * @property {string} url + * The object's ATT&CK url. + * @property {string} stixId + * The object's STIX id. + * @property {boolean} deprecated + * True if the ATT&CK object has been deprecated, false otherwise. + */ + +/** + * A map that relates STIX types to ATT&CK types. + */ +const STIX_TO_ATTACK = { + "campaign" : "campaign", + "course-of-action" : "mitigation", + "intrusion-set" : "group", + "malware" : "software", + "tool" : "software", + "x-mitre-data-source" : "data_source", + "x-mitre-tactic" : "tactic", + "attack-pattern" : "technique" +} + +/** + * MITRE's source identifiers. + */ +const MITRE_SOURCES = new Set([ + "mitre-attack", + "mitre-ics-attack", + "mitre-mobile-attack" +]) + +/** + * Fetches JSON data from a url. + * @param {string} url + * The url. + * @param {Object} options + * The request's options. + * @returns {Promise} + * A Promise that resolves with the JSON data. + */ +function fetchJson(url, options = {}) { + return new Promise((resolve, reject) => { + https.get(url, options, res => { + let json = ""; + res.on("data", chunk => { + json += chunk; + }); + res.on("end", () => { + try { + resolve(JSON.parse(json)); + } catch(err) { + reject(err) + } + }) + }).on("error", (err) => { + reject(err); + }); + }) +} + + +/** + * Parses an ATT&CK object from a STIX object. + * @param {Object} obj + * The STIX object. + * @returns {AttackObject} + * The parsed ATT&CK object. + */ +function parseStixToAttackObject(obj) { + + // Parse STIX id, name, and type directly + let parse = { + stixId : obj.id, + name : obj.name, + type : STIX_TO_ATTACK[obj.type] + } + + // Parse MITRE reference information + let mitreRef = obj.external_references.find( + o => MITRE_SOURCES.has(o.source_name) + ); + if(!mitreRef) { + throw new Error("Missing MITRE reference information.") + } + parse.id = mitreRef.external_id; + parse.url = mitreRef.url; + + // Parse deprecation status + parse.deprecated = (obj.x_mitre_deprecated || obj.revoked) ?? false; + + // Return + return parse; +} + +/** + * Parses a set of ATT&CK objects from a STIX manifest. + * @param {Object} data + * The STIX manifest. + * @returns {AttackObject[]} + * The parsed ATT&CK objects. + */ +function parseAttackObjectsFromManifest(data) { + let objs = [] + for(let obj of data.objects) { + if(!(obj.type in STIX_TO_ATTACK)) { + continue; + } + objs.push(parseStixToAttackObject(obj)); + } + return objs; +} + +/** + * Fetches ATT&CK data from a set of STIX manifests. + * @param {...string} urls + * A list of STIX manifests specified by url. + * @returns {Promise>} + * A Promise that resolves with the parsed ATT&CK data. + */ +async function fetchAttackData(...urls) { + console.log("→ Downloading ATT&CK Data..."); + + // Parse objects + let catalog = new Map(); + for(let url of urls) { + console.log(` → ${ url.length > 70 ? '...' : '' }${ url.substr(url.length - 70) }`); + let objs = parseAttackObjectsFromManifest(await fetchJson(url)); + for(let obj of objs) { + catalog.set(obj.stixId, obj); + } + } + + // Categorize catalog + let types = new Map( + Object.values(STIX_TO_ATTACK).map(v => [v, []]) + ); + for(let obj of catalog.values()) { + types.get(obj.type).push(obj); + } + + // Return + return types; + +} + +/** + * Define exports. + */ +module.exports = { fetchAttackData } diff --git a/src/attack_flow_builder/attack/update_attack_intel.js b/src/attack_flow_builder/attack/update_attack_intel.js new file mode 100644 index 00000000..ed143ddc --- /dev/null +++ b/src/attack_flow_builder/attack/update_attack_intel.js @@ -0,0 +1,70 @@ +const { resolve } = require("path"); +const { writeFileSync } = require("fs"); +const { fetchAttackData } = require("./download_attack"); + +/** + * The base URL for the ATT&CK repository. + */ +const BASE_URL = "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master"; + +/** + * The intel file's export key. + */ +const EXPORT_KEY = "intel"; + +/** + * The intel file's path. + */ +const INTEL_FILE_PATH = "../src/assets/builder.config.intel.ts"; + +/** + * JavaScript variable regex. + */ +const JS_VAR_REGEX = /^[a-z_$][a-z0-9_$]*$/i; + +/** + * Updates the specified intel file. + * @param {string} path + * The intel file's path. + * @param {...string} urls + * A list of STIX manifests specified by url. + */ +async function updateApplicationAttackIntel(path, ...urls) { + path = resolve(__dirname, path); + + // Validate export key + if(!JS_VAR_REGEX.test(EXPORT_KEY)) { + throw new Error(`Export key '${ EXPORT_KEY }' is not a valid variable name.`); + } + + // Collect intel + let types = await fetchAttackData(...urls); + console.log("→ Generating Application Intel File..."); + let intel = { + tactics : types.get("tactic"), + tactic_recs : types.get("tactic").map(o => `${o.id} - ${o.name}`).sort(), + technique : types.get("technique"), + technique_recs : types.get("technique").map(o => `${o.id} - ${o.name}`).sort() + }; + + // Generate intel file + let file = ""; + file += `export const ${ EXPORT_KEY } = `; + file += JSON.stringify(intel, null, 4); + file += `;\n\nexport default ${ EXPORT_KEY };\n` + writeFileSync(path, file); + + // Done + console.log("\nIntelligence updated successfully.\n"); + +} + +/** + * Main + */ +updateApplicationAttackIntel( + INTEL_FILE_PATH, + `${BASE_URL}/enterprise-attack/enterprise-attack-13.0.json`, + `${BASE_URL}/ics-attack/ics-attack-13.0.json`, + `${BASE_URL}/mobile-attack/mobile-attack-13.0.json` +); diff --git a/src/attack_flow_builder/package.json b/src/attack_flow_builder/package.json index eaea43f3..986ea875 100644 --- a/src/attack_flow_builder/package.json +++ b/src/attack_flow_builder/package.json @@ -1,31 +1,33 @@ -{ - "name": "attack-flow-builder", - "version": "2.0.1", - "private": true, - "scripts": { - "serve": "vue-cli-service serve", - "build": "vue-cli-service build", - "release": "standard-version" - }, - "author": "mcarenzo", - "dependencies": { - "vue": "^3.0.0", - "vuex": "^4.0.0-0" - }, - "devDependencies": { - "@types/d3": "^7.4.0", - "@types/resize-observer-browser": "^0.1.7", - "@vue/cli-plugin-typescript": "~4.5.15", - "@vue/cli-plugin-vuex": "~4.5.15", - "@vue/cli-service": "~4.5.15", - "@vue/compiler-sfc": "^3.0.0", - "d3": "^7.4.4", - "standard-version": "^9.3.2", - "typescript": "^4.1.5" - }, - "browserslist": [ - "> 1%", - "last 2 versions", - "not dead" - ] -} +{ + "name": "attack-flow-builder", + "version": "2.0.1", + "private": true, + "scripts": { + "serve": "vue-cli-service serve", + "build": "vue-cli-service build", + "release": "standard-version", + "update-intel": "node ./attack/update_attack_intel.js" + }, + "author": "mcarenzo", + "dependencies": { + "vue": "^3.0.0", + "vuex": "^4.0.0-0" + }, + "devDependencies": { + "@types/d3": "^7.4.0", + "@types/resize-observer-browser": "^0.1.7", + "@vue/cli-plugin-typescript": "~4.5.15", + "@vue/cli-plugin-vuex": "~4.5.15", + "@vue/cli-service": "~4.5.15", + "@vue/compiler-sfc": "^3.0.0", + "d3": "^7.4.4", + "ssl-root-cas": "^1.3.1", + "standard-version": "^9.3.2", + "typescript": "^4.1.5" + }, + "browserslist": [ + "> 1%", + "last 2 versions", + "not dead" + ] +} diff --git a/src/attack_flow_builder/src/assets/builder.config.intel.ts b/src/attack_flow_builder/src/assets/builder.config.intel.ts new file mode 100644 index 00000000..d7999a17 --- /dev/null +++ b/src/attack_flow_builder/src/assets/builder.config.intel.ts @@ -0,0 +1,9534 @@ +export const intel = { + "tactics": [ + { + "stixId": "x-mitre-tactic--2558fd61-8c75-4730-94c4-11926db2a263", + "name": "Credential Access", + "type": "tactic", + "id": "TA0006", + "url": "https://attack.mitre.org/tactics/TA0006", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--4ca45d45-df4d-4613-8980-bac22d278fa5", + "name": "Execution", + "type": "tactic", + "id": "TA0002", + "url": "https://attack.mitre.org/tactics/TA0002", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--5569339b-94c2-49ee-afb3-2222936582c8", + "name": "Impact", + "type": "tactic", + "id": "TA0040", + "url": "https://attack.mitre.org/tactics/TA0040", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--5bc1d813-693e-4823-9961-abf9af4b0e92", + "name": "Persistence", + "type": "tactic", + "id": "TA0003", + "url": "https://attack.mitre.org/tactics/TA0003", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--5e29b093-294e-49e9-a803-dab3d73b77dd", + "name": "Privilege Escalation", + "type": "tactic", + "id": "TA0004", + "url": "https://attack.mitre.org/tactics/TA0004", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--7141578b-e50b-4dcc-bfa4-08a8dd689e9e", + "name": "Lateral Movement", + "type": "tactic", + "id": "TA0008", + "url": "https://attack.mitre.org/tactics/TA0008", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--78b23412-0651-46d7-a540-170a1ce8bd5a", + "name": "Defense Evasion", + "type": "tactic", + "id": "TA0005", + "url": "https://attack.mitre.org/tactics/TA0005", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--9a4e74ab-5008-408c-84bf-a10dfbc53462", + "name": "Exfiltration", + "type": "tactic", + "id": "TA0010", + "url": "https://attack.mitre.org/tactics/TA0010", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--c17c5845-175e-4421-9713-829d0573dbc9", + "name": "Discovery", + "type": "tactic", + "id": "TA0007", + "url": "https://attack.mitre.org/tactics/TA0007", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--d108ce10-2419-4cf9-a774-46161d6c6cfe", + "name": "Collection", + "type": "tactic", + "id": "TA0009", + "url": "https://attack.mitre.org/tactics/TA0009", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--d679bca2-e57d-4935-8650-8031c87a4400", + "name": "Resource Development", + "type": "tactic", + "id": "TA0042", + "url": "https://attack.mitre.org/tactics/TA0042", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--daa4cbb1-b4f4-4723-a824-7f1efd6e0592", + "name": "Reconnaissance", + "type": "tactic", + "id": "TA0043", + "url": "https://attack.mitre.org/tactics/TA0043", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--f72804c5-f15a-449e-a5da-2eecd181f813", + "name": "Command and Control", + "type": "tactic", + "id": "TA0011", + "url": "https://attack.mitre.org/tactics/TA0011", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--ffd5bcee-6e16-4dd2-8eca-7b3beedf33ca", + "name": "Initial Access", + "type": "tactic", + "id": "TA0001", + "url": "https://attack.mitre.org/tactics/TA0001", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--298fe907-7931-4fd2-8131-2814dd493134", + "name": "Inhibit Response Function", + "type": "tactic", + "id": "TA0107", + "url": "https://attack.mitre.org/tactics/TA0107", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--33752ae7-f875-4f43-bdb6-d8d02d341046", + "name": "Privilege Escalation", + "type": "tactic", + "id": "TA0111", + "url": "https://attack.mitre.org/tactics/TA0111", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--51c25a9e-8615-40c0-8afd-1da578847924", + "name": "Lateral Movement", + "type": "tactic", + "id": "TA0109", + "url": "https://attack.mitre.org/tactics/TA0109", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--696af733-728e-49d7-8261-75fdc590f453", + "name": "Discovery", + "type": "tactic", + "id": "TA0102", + "url": "https://attack.mitre.org/tactics/TA0102", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--69da72d2-f550-41c5-ab9e-e8255707f28a", + "name": "Initial Access", + "type": "tactic", + "id": "TA0108", + "url": "https://attack.mitre.org/tactics/TA0108", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--77542f83-70d0-40c2-8a9d-ad2eb8b00279", + "name": "Impact", + "type": "tactic", + "id": "TA0105", + "url": "https://attack.mitre.org/tactics/TA0105", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--78f1d2ae-a579-44c4-8fc5-3e1775c73fac", + "name": "Persistence", + "type": "tactic", + "id": "TA0110", + "url": "https://attack.mitre.org/tactics/TA0110", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--93bf9a8e-b14c-4587-b6d5-9efc7c12eb45", + "name": "Execution", + "type": "tactic", + "id": "TA0104", + "url": "https://attack.mitre.org/tactics/TA0104", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--97c8ff73-bd14-4b6c-ac32-3d91d2c41e3f", + "name": "Command and Control", + "type": "tactic", + "id": "TA0101", + "url": "https://attack.mitre.org/tactics/TA0101", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--b2a67b1e-913c-46f6-b219-048a90560bb9", + "name": "Collection", + "type": "tactic", + "id": "TA0100", + "url": "https://attack.mitre.org/tactics/TA0100", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--ddf70682-f3ce-479c-a9a4-7eadf9bfead7", + "name": "Evasion", + "type": "tactic", + "id": "TA0103", + "url": "https://attack.mitre.org/tactics/TA0103", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--ff048b6c-b872-4218-b68c-3735ebd1f024", + "name": "Impair Process Control", + "type": "tactic", + "id": "TA0106", + "url": "https://attack.mitre.org/tactics/TA0106", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--0a93fd8e-4a83-4c15-8203-db290e5f2ac6", + "name": "Initial Access", + "type": "tactic", + "id": "TA0027", + "url": "https://attack.mitre.org/tactics/TA0027", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--10fa8d8d-1b04-4176-917e-738724239981", + "name": "Exfiltration", + "type": "tactic", + "id": "TA0036", + "url": "https://attack.mitre.org/tactics/TA0036", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--363bbeff-bb2a-4734-ac74-d6d37202fe54", + "name": "Persistence", + "type": "tactic", + "id": "TA0028", + "url": "https://attack.mitre.org/tactics/TA0028", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--3e962de5-3280-43b7-bc10-334fbc1d6fa8", + "name": "Privilege Escalation", + "type": "tactic", + "id": "TA0029", + "url": "https://attack.mitre.org/tactics/TA0029", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--3f660805-fa2e-42e8-8851-57f9e9b653e3", + "name": "Command and Control", + "type": "tactic", + "id": "TA0037", + "url": "https://attack.mitre.org/tactics/TA0037", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--4a800987-a3a8-4d56-a1bd-0d7171431756", + "name": "Execution", + "type": "tactic", + "id": "TA0041", + "url": "https://attack.mitre.org/tactics/TA0041", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--6ebce653-294a-444a-bffb-14c04c8d137e", + "name": "Impact", + "type": "tactic", + "id": "TA0034", + "url": "https://attack.mitre.org/tactics/TA0034", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--6fcb36b8-3776-483b-8699-42215714fb10", + "name": "Credential Access", + "type": "tactic", + "id": "TA0031", + "url": "https://attack.mitre.org/tactics/TA0031", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--7a0d25d3-f0c0-40bf-bf90-c743871b19ba", + "name": "Collection", + "type": "tactic", + "id": "TA0035", + "url": "https://attack.mitre.org/tactics/TA0035", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--7be441c2-0095-4b1e-8125-fa8ffda29b0f", + "name": "Lateral Movement", + "type": "tactic", + "id": "TA0033", + "url": "https://attack.mitre.org/tactics/TA0033", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--987cda6d-eb77-406b-bf68-bcb5f3d2e1df", + "name": "Defense Evasion", + "type": "tactic", + "id": "TA0030", + "url": "https://attack.mitre.org/tactics/TA0030", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--9eb4c21e-4fa8-44c9-b167-dbfc455f9210", + "name": "Network Effects", + "type": "tactic", + "id": "TA0038", + "url": "https://attack.mitre.org/tactics/TA0038", + "deprecated": true + }, + { + "stixId": "x-mitre-tactic--d418cdeb-1b9f-4a6b-a15d-2f89f549f8c1", + "name": "Discovery", + "type": "tactic", + "id": "TA0032", + "url": "https://attack.mitre.org/tactics/TA0032", + "deprecated": false + }, + { + "stixId": "x-mitre-tactic--e78d7d60-41b5-49b7-b0a9-5c5d4cbabe17", + "name": "Remote Service Effects", + "type": "tactic", + "id": "TA0039", + "url": "https://attack.mitre.org/tactics/TA0039", + "deprecated": true + } + ], + "tactic_recs": [ + "TA0001 - Initial Access", + "TA0002 - Execution", + "TA0003 - Persistence", + "TA0004 - Privilege Escalation", + "TA0005 - Defense Evasion", + "TA0006 - Credential Access", + "TA0007 - Discovery", + "TA0008 - Lateral Movement", + "TA0009 - Collection", + "TA0010 - Exfiltration", + "TA0011 - Command and Control", + "TA0027 - Initial Access", + "TA0028 - Persistence", + "TA0029 - Privilege Escalation", + "TA0030 - Defense Evasion", + "TA0031 - Credential Access", + "TA0032 - Discovery", + "TA0033 - Lateral Movement", + "TA0034 - Impact", + "TA0035 - Collection", + "TA0036 - Exfiltration", + "TA0037 - Command and Control", + "TA0038 - Network Effects", + "TA0039 - Remote Service Effects", + "TA0040 - Impact", + "TA0041 - Execution", + "TA0042 - Resource Development", + "TA0043 - Reconnaissance", + "TA0100 - Collection", + "TA0101 - Command and Control", + "TA0102 - Discovery", + "TA0103 - Evasion", + "TA0104 - Execution", + "TA0105 - Impact", + "TA0106 - Impair Process Control", + "TA0107 - Inhibit Response Function", + "TA0108 - Initial Access", + "TA0109 - Lateral Movement", + "TA0110 - Persistence", + "TA0111 - Privilege Escalation" + ], + "technique": [ + { + "stixId": "attack-pattern--0042a9f5-f053-4769-b3ef-9ad018dfa298", + "name": "Extra Window Memory Injection", + "type": "technique", + "id": "T1055.011", + "url": "https://attack.mitre.org/techniques/T1055/011", + "deprecated": false + }, + { + "stixId": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "name": "Scheduled Task", + "type": "technique", + "id": "T1053.005", + "url": "https://attack.mitre.org/techniques/T1053/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--005cc321-08ce-4d17-b1ea-cb5275926520", + "name": "Socket Filters", + "type": "technique", + "id": "T1205.002", + "url": "https://attack.mitre.org/techniques/T1205/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--00d0b012-8a03-410e-95de-5826bf542de6", + "name": "Indicator Removal from Tools", + "type": "technique", + "id": "T1066", + "url": "https://attack.mitre.org/techniques/T1066", + "deprecated": true + }, + { + "stixId": "attack-pattern--00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "name": "Archive via Utility", + "type": "technique", + "id": "T1560.001", + "url": "https://attack.mitre.org/techniques/T1560/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--01327cde-66c4-4123-bf34-5f258d59457b", + "name": "VNC", + "type": "technique", + "id": "T1021.005", + "url": "https://attack.mitre.org/techniques/T1021/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--01a5a209-b94c-450b-b7f9-946497d91055", + "name": "Windows Management Instrumentation", + "type": "technique", + "id": "T1047", + "url": "https://attack.mitre.org/techniques/T1047", + "deprecated": false + }, + { + "stixId": "attack-pattern--01df3350-ce05-4bdf-bdf8-0a919a66d4a8", + "name": "Malicious Shell Modification", + "type": "technique", + "id": "T1156", + "url": "https://attack.mitre.org/techniques/T1156", + "deprecated": true + }, + { + "stixId": "attack-pattern--0259baeb-9f63-4c69-bf10-eb038c390688", + "name": "Screen Capture", + "type": "technique", + "id": "T1113", + "url": "https://attack.mitre.org/techniques/T1113", + "deprecated": false + }, + { + "stixId": "attack-pattern--02c5abff-30bf-4703-ab92-1f6072fae939", + "name": "Fileless Storage", + "type": "technique", + "id": "T1027.011", + "url": "https://attack.mitre.org/techniques/T1027/011", + "deprecated": false + }, + { + "stixId": "attack-pattern--02fefddc-fb1b-423f-a76b-7552dd211d4d", + "name": "Bootkit", + "type": "technique", + "id": "T1067", + "url": "https://attack.mitre.org/techniques/T1067", + "deprecated": true + }, + { + "stixId": "attack-pattern--03259939-0b57-482f-8eb5-87c0e0d54334", + "name": "Boot or Logon Initialization Scripts", + "type": "technique", + "id": "T1037", + "url": "https://attack.mitre.org/techniques/T1037", + "deprecated": false + }, + { + "stixId": "attack-pattern--035bb001-ab69-4a0b-9f6c-2de8b09e1b9d", + "name": "Adversary-in-the-Middle", + "type": "technique", + "id": "T1557", + "url": "https://attack.mitre.org/techniques/T1557", + "deprecated": false + }, + { + "stixId": "attack-pattern--03d7999c-1f4c-42cc-8373-e7690d318104", + "name": "System Owner/User Discovery", + "type": "technique", + "id": "T1033", + "url": "https://attack.mitre.org/techniques/T1033", + "deprecated": false + }, + { + "stixId": "attack-pattern--0458aab9-ad42-4eac-9e22-706a95bafee2", + "name": "Acquire Infrastructure", + "type": "technique", + "id": "T1583", + "url": "https://attack.mitre.org/techniques/T1583", + "deprecated": false + }, + { + "stixId": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5", + "name": "Rundll32", + "type": "technique", + "id": "T1218.011", + "url": "https://attack.mitre.org/techniques/T1218/011", + "deprecated": false + }, + { + "stixId": "attack-pattern--0470e792-32f8-46b0-a351-652bc35e9336", + "name": "Container and Resource Discovery", + "type": "technique", + "id": "T1613", + "url": "https://attack.mitre.org/techniques/T1613", + "deprecated": false + }, + { + "stixId": "attack-pattern--04a5a8ab-3bc8-4c83-95c9-55274a89786d", + "name": "Serverless", + "type": "technique", + "id": "T1583.007", + "url": "https://attack.mitre.org/techniques/T1583/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf", + "name": "Hidden Window", + "type": "technique", + "id": "T1143", + "url": "https://attack.mitre.org/techniques/T1143", + "deprecated": true + }, + { + "stixId": "attack-pattern--04ef4356-8926-45e2-9441-634b6f3dcecb", + "name": "LC_LOAD_DYLIB Addition", + "type": "technique", + "id": "T1161", + "url": "https://attack.mitre.org/techniques/T1161", + "deprecated": true + }, + { + "stixId": "attack-pattern--04fd5427-79c7-44ea-ae13-11b24778ff1c", + "name": "Standard Encoding", + "type": "technique", + "id": "T1132.001", + "url": "https://attack.mitre.org/techniques/T1132/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--0533ab23-3f7d-463f-9bd8-634d27e4dee1", + "name": "Embedded Payloads", + "type": "technique", + "id": "T1027.009", + "url": "https://attack.mitre.org/techniques/T1027/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--06780952-177c-4247-b978-79c357fb311f", + "name": "Plist Modification", + "type": "technique", + "id": "T1150", + "url": "https://attack.mitre.org/techniques/T1150", + "deprecated": true + }, + { + "stixId": "attack-pattern--06c00069-771a-4d57-8ef5-d3718c1a8771", + "name": "Pluggable Authentication Modules", + "type": "technique", + "id": "T1556.003", + "url": "https://attack.mitre.org/techniques/T1556/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--0708ae90-d0eb-4938-9a76-d0fc94f6eec1", + "name": "Revert Cloud Instance", + "type": "technique", + "id": "T1578.004", + "url": "https://attack.mitre.org/techniques/T1578/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--086952c4-5b90-4185-b573-02bad8e11953", + "name": "HISTCONTROL", + "type": "technique", + "id": "T1148", + "url": "https://attack.mitre.org/techniques/T1148", + "deprecated": true + }, + { + "stixId": "attack-pattern--09312b1a-c3c6-4b45-9844-3ccc78e5d82f", + "name": "Gather Victim Host Information", + "type": "technique", + "id": "T1592", + "url": "https://attack.mitre.org/techniques/T1592", + "deprecated": false + }, + { + "stixId": "attack-pattern--0979abf9-4e26-43ec-9b6e-54efc4e70fca", + "name": "Digital Certificates", + "type": "technique", + "id": "T1596.003", + "url": "https://attack.mitre.org/techniques/T1596/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "name": "Keylogging", + "type": "technique", + "id": "T1056.001", + "url": "https://attack.mitre.org/techniques/T1056/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--09b130a2-a77e-4af0-a361-f46f9aad1345", + "name": "Linux and Mac File and Directory Permissions Modification", + "type": "technique", + "id": "T1222.002", + "url": "https://attack.mitre.org/techniques/T1222/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", + "name": "Password Guessing", + "type": "technique", + "id": "T1110.001", + "url": "https://attack.mitre.org/techniques/T1110/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--09cd431f-eaf4-4d2a-acaf-2a7acfe7ed58", + "name": "PubPrn", + "type": "technique", + "id": "T1216.001", + "url": "https://attack.mitre.org/techniques/T1216/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--0a241b6c-7bb2-48f9-98f7-128145b4d27f", + "name": "Purchase Technical Data", + "type": "technique", + "id": "T1597.002", + "url": "https://attack.mitre.org/techniques/T1597/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "name": "OS Credential Dumping", + "type": "technique", + "id": "T1003", + "url": "https://attack.mitre.org/techniques/T1003", + "deprecated": false + }, + { + "stixId": "attack-pattern--0a5231ec-41af-4a35-83d0-6bdf11f28c65", + "name": "Shared Modules", + "type": "technique", + "id": "T1129", + "url": "https://attack.mitre.org/techniques/T1129", + "deprecated": false + }, + { + "stixId": "attack-pattern--0ad7bc5c-235a-4048-944b-3b286676cb74", + "name": "Data from Configuration Repository", + "type": "technique", + "id": "T1602", + "url": "https://attack.mitre.org/techniques/T1602", + "deprecated": false + }, + { + "stixId": "attack-pattern--0af0ca99-357d-4ba1-805f-674fdfb7bef9", + "name": "Disk Structure Wipe", + "type": "technique", + "id": "T1561.002", + "url": "https://attack.mitre.org/techniques/T1561/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--0bda01d5-4c1d-4062-8ee2-6872334383c3", + "name": "Direct Network Flood", + "type": "technique", + "id": "T1498.001", + "url": "https://attack.mitre.org/techniques/T1498/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--0bf78622-e8d2-41da-a857-731472d61a92", + "name": "Stored Data Manipulation", + "type": "technique", + "id": "T1492", + "url": "https://attack.mitre.org/techniques/T1492", + "deprecated": true + }, + { + "stixId": "attack-pattern--0c2d00da-7742-49e7-9928-4514e5075d32", + "name": "Path Interception by PATH Environment Variable", + "type": "technique", + "id": "T1574.007", + "url": "https://attack.mitre.org/techniques/T1574/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--0c4b4fda-9062-47da-98b9-ceae2dcf052a", + "name": "Sharepoint", + "type": "technique", + "id": "T1213.002", + "url": "https://attack.mitre.org/techniques/T1213/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--0c8ab3eb-df48-4b9c-ace7-beacaac81cc5", + "name": "Direct Volume Access", + "type": "technique", + "id": "T1006", + "url": "https://attack.mitre.org/techniques/T1006", + "deprecated": false + }, + { + "stixId": "attack-pattern--0ca7beef-9bbc-4e35-97cf-437384ddce6a", + "name": "File System Permissions Weakness", + "type": "technique", + "id": "T1044", + "url": "https://attack.mitre.org/techniques/T1044", + "deprecated": true + }, + { + "stixId": "attack-pattern--0cf55441-b176-4332-89e7-2c4c7799d0ff", + "name": "Email Hiding Rules", + "type": "technique", + "id": "T1564.008", + "url": "https://attack.mitre.org/techniques/T1564/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--0cfe31a7-81fc-472c-bc45-e2808d1066a3", + "name": "External Defacement", + "type": "technique", + "id": "T1491.002", + "url": "https://attack.mitre.org/techniques/T1491/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--0dbf5f1b-a560-4d51-ac1b-d70caab3e1f0", + "name": "LLMNR/NBT-NS Poisoning and Relay", + "type": "technique", + "id": "T1171", + "url": "https://attack.mitre.org/techniques/T1171", + "deprecated": true + }, + { + "stixId": "attack-pattern--0dda99f0-4701-48ca-9774-8504922e92d3", + "name": "IP Addresses", + "type": "technique", + "id": "T1590.005", + "url": "https://attack.mitre.org/techniques/T1590/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--0df05477-c572-4ed6-88a9-47c581f548f7", + "name": "OS Exhaustion Flood", + "type": "technique", + "id": "T1499.001", + "url": "https://attack.mitre.org/techniques/T1499/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", + "name": "Rootkit", + "type": "technique", + "id": "T1014", + "url": "https://attack.mitre.org/techniques/T1014", + "deprecated": false + }, + { + "stixId": "attack-pattern--0f2c410d-d740-4ed9-abb1-b8f4a7faf6c3", + "name": "PowerShell Profile", + "type": "technique", + "id": "T1546.013", + "url": "https://attack.mitre.org/techniques/T1546/013", + "deprecated": false + }, + { + "stixId": "attack-pattern--0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "name": "JavaScript", + "type": "technique", + "id": "T1059.007", + "url": "https://attack.mitre.org/techniques/T1059/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--0ff59227-8aa8-4c09-bf1f-925605bd07ea", + "name": "DNS", + "type": "technique", + "id": "T1590.002", + "url": "https://attack.mitre.org/techniques/T1590/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--0fff2797-19cb-41ea-a5f1-8a9303b8158e", + "name": "Systemd Service", + "type": "technique", + "id": "T1501", + "url": "https://attack.mitre.org/techniques/T1501", + "deprecated": true + }, + { + "stixId": "attack-pattern--101c3a64-9ba5-46c9-b573-5c501053cbca", + "name": "Elevated Execution with Prompt", + "type": "technique", + "id": "T1514", + "url": "https://attack.mitre.org/techniques/T1514", + "deprecated": true + }, + { + "stixId": "attack-pattern--1035cdf2-3e5f-446f-a7a7-e8f6d7925967", + "name": "Audio Capture", + "type": "technique", + "id": "T1123", + "url": "https://attack.mitre.org/techniques/T1123", + "deprecated": false + }, + { + "stixId": "attack-pattern--106c0cf6-bf73-4601-9aa8-0945c2715ec5", + "name": "Create or Modify System Process", + "type": "technique", + "id": "T1543", + "url": "https://attack.mitre.org/techniques/T1543", + "deprecated": false + }, + { + "stixId": "attack-pattern--10d51417-ee35-4589-b1ff-b6df1c334e8d", + "name": "External Remote Services", + "type": "technique", + "id": "T1133", + "url": "https://attack.mitre.org/techniques/T1133", + "deprecated": false + }, + { + "stixId": "attack-pattern--10d5f3b7-6be6-4da5-9a77-0f1e2bbfcc44", + "name": "Component Firmware", + "type": "technique", + "id": "T1109", + "url": "https://attack.mitre.org/techniques/T1109", + "deprecated": true + }, + { + "stixId": "attack-pattern--10ff21b9-5a01-4268-a1b5-3b55015f1847", + "name": "LC_LOAD_DYLIB Addition", + "type": "technique", + "id": "T1546.006", + "url": "https://attack.mitre.org/techniques/T1546/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--10ffac09-e42d-4f56-ab20-db94c67d76ff", + "name": "Steal Web Session Cookie", + "type": "technique", + "id": "T1539", + "url": "https://attack.mitre.org/techniques/T1539", + "deprecated": false + }, + { + "stixId": "attack-pattern--1126cab1-c700-412f-a510-61f4937bb096", + "name": "Container Orchestration Job", + "type": "technique", + "id": "T1053.007", + "url": "https://attack.mitre.org/techniques/T1053/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--118f61a5-eb3e-4fb6-931f-2096647f4ecd", + "name": "Domain Generation Algorithms", + "type": "technique", + "id": "T1568.002", + "url": "https://attack.mitre.org/techniques/T1568/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--11f29a39-0942-4d62-92b6-fe236cf3066e", + "name": "Double File Extension", + "type": "technique", + "id": "T1036.007", + "url": "https://attack.mitre.org/techniques/T1036/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--120d5519-3098-4e1c-9191-2aa61232f073", + "name": "Bypass User Account Control", + "type": "technique", + "id": "T1548.002", + "url": "https://attack.mitre.org/techniques/T1548/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--128c55d3-aeba-469f-bd3e-c8996ab4112a", + "name": "Timestomp", + "type": "technique", + "id": "T1099", + "url": "https://attack.mitre.org/techniques/T1099", + "deprecated": true + }, + { + "stixId": "attack-pattern--132d5b37-aac5-4378-a8dc-3127b18a73dc", + "name": "Internet Connection Discovery", + "type": "technique", + "id": "T1016.001", + "url": "https://attack.mitre.org/techniques/T1016/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--1365fe3b-0f50-455d-b4da-266ce31c23b0", + "name": "Sudo and Sudo Caching", + "type": "technique", + "id": "T1548.003", + "url": "https://attack.mitre.org/techniques/T1548/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--143c0cbb-a297-4142-9624-87ffc778980b", + "name": "Archive via Custom Method", + "type": "technique", + "id": "T1560.003", + "url": "https://attack.mitre.org/techniques/T1560/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--144e007b-e638-431d-a894-45d90c54ab90", + "name": "Modify Cloud Compute Infrastructure", + "type": "technique", + "id": "T1578", + "url": "https://attack.mitre.org/techniques/T1578", + "deprecated": false + }, + { + "stixId": "attack-pattern--155207c0-7f53-4f13-a06b-0a9907ef5096", + "name": "Malvertising", + "type": "technique", + "id": "T1583.008", + "url": "https://attack.mitre.org/techniques/T1583/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--15dbf668-795c-41e6-8219-f0447c0e64ce", + "name": "Permission Groups Discovery", + "type": "technique", + "id": "T1069", + "url": "https://attack.mitre.org/techniques/T1069", + "deprecated": false + }, + { + "stixId": "attack-pattern--1608f3e1-598a-42f4-a01a-2e252e81728f", + "name": "Email Collection", + "type": "technique", + "id": "T1114", + "url": "https://attack.mitre.org/techniques/T1114", + "deprecated": false + }, + { + "stixId": "attack-pattern--1644e709-12d2-41e5-a60f-3470991f5011", + "name": "Security Account Manager", + "type": "technique", + "id": "T1003.002", + "url": "https://attack.mitre.org/techniques/T1003/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--166de1c6-2814-4fe5-8438-4e80f76b169f", + "name": "WHOIS", + "type": "technique", + "id": "T1596.002", + "url": "https://attack.mitre.org/techniques/T1596/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--16ab6452-c3c1-497c-a47d-206018ca1ada", + "name": "System Firmware", + "type": "technique", + "id": "T1542.001", + "url": "https://attack.mitre.org/techniques/T1542/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--16cdd21f-da65-4e4f-bc04-dd7d198c7b26", + "name": "Search Victim-Owned Websites", + "type": "technique", + "id": "T1594", + "url": "https://attack.mitre.org/techniques/T1594", + "deprecated": false + }, + { + "stixId": "attack-pattern--16e94db9-b5b1-4cd0-b851-f38fbd0a70f2", + "name": "Cloud Groups", + "type": "technique", + "id": "T1069.003", + "url": "https://attack.mitre.org/techniques/T1069/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--17cc750b-e95b-4d7d-9dde-49e0de24148c", + "name": "Services Registry Permissions Weakness", + "type": "technique", + "id": "T1574.011", + "url": "https://attack.mitre.org/techniques/T1574/011", + "deprecated": false + }, + { + "stixId": "attack-pattern--17fd695c-b88c-455a-a3d1-43b6cb728532", + "name": "DNS/Passive DNS", + "type": "technique", + "id": "T1596.001", + "url": "https://attack.mitre.org/techniques/T1596/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--18cffc21-3260-437e-80e4-4ab8bf2ba5e9", + "name": "Application Exhaustion Flood", + "type": "technique", + "id": "T1499.003", + "url": "https://attack.mitre.org/techniques/T1499/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--18d4ab39-12ed-4a16-9fdb-ae311bba4a0f", + "name": "Rc.common", + "type": "technique", + "id": "T1163", + "url": "https://attack.mitre.org/techniques/T1163", + "deprecated": true + }, + { + "stixId": "attack-pattern--191cc6af-1bb2-4344-ab5f-28e496638720", + "name": "Compromise Software Dependencies and Development Tools", + "type": "technique", + "id": "T1195.001", + "url": "https://attack.mitre.org/techniques/T1195/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--19401639-28d0-4c3c-adcc-bc2ba22f6421", + "name": "Digital Certificates", + "type": "technique", + "id": "T1588.004", + "url": "https://attack.mitre.org/techniques/T1588/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--197ef1b9-e764-46c3-b96c-23f77985dc81", + "name": "DNS Server", + "type": "technique", + "id": "T1583.002", + "url": "https://attack.mitre.org/techniques/T1583/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--1988cc35-ced8-4dad-b2d1-7628488fa967", + "name": "Disk Wipe", + "type": "technique", + "id": "T1561", + "url": "https://attack.mitre.org/techniques/T1561", + "deprecated": false + }, + { + "stixId": "attack-pattern--1996eef1-ced3-4d7f-bf94-33298cabbf72", + "name": "DNS", + "type": "technique", + "id": "T1071.004", + "url": "https://attack.mitre.org/techniques/T1071/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--19bf235b-8620-4997-b5b4-94e0659ed7c3", + "name": "Cloud Instance Metadata API", + "type": "technique", + "id": "T1552.005", + "url": "https://attack.mitre.org/techniques/T1552/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--1a80d097-54df-41d8-9d33-34e755ec5e72", + "name": "Securityd Memory", + "type": "technique", + "id": "T1555.002", + "url": "https://attack.mitre.org/techniques/T1555/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--1b20efbf-8063-4fc3-a07d-b575318a301b", + "name": "Group Policy Discovery", + "type": "technique", + "id": "T1615", + "url": "https://attack.mitre.org/techniques/T1615", + "deprecated": false + }, + { + "stixId": "attack-pattern--1b7b1806-7746-41a1-a35d-e48dae25ddba", + "name": "Bootkit", + "type": "technique", + "id": "T1542.003", + "url": "https://attack.mitre.org/techniques/T1542/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--1b7ba276-eedc-4951-a762-0ceea2c030ec", + "name": "Data from Removable Media", + "type": "technique", + "id": "T1025", + "url": "https://attack.mitre.org/techniques/T1025", + "deprecated": false + }, + { + "stixId": "attack-pattern--1b84d551-6de8-4b96-9930-d177677c3b1d", + "name": "Code Signing", + "type": "technique", + "id": "T1116", + "url": "https://attack.mitre.org/techniques/T1116", + "deprecated": true + }, + { + "stixId": "attack-pattern--1bae753e-8e52-4055-a66d-2ead90303ca9", + "name": "Mavinject", + "type": "technique", + "id": "T1218.013", + "url": "https://attack.mitre.org/techniques/T1218/013", + "deprecated": false + }, + { + "stixId": "attack-pattern--1c2fd73a-e634-44ed-b1b5-9e7cf7404e9f", + "name": "Cloud Instance Metadata API", + "type": "technique", + "id": "T1522", + "url": "https://attack.mitre.org/techniques/T1522", + "deprecated": true + }, + { + "stixId": "attack-pattern--1c338d0f-a65e-4073-a5c1-c06878849f21", + "name": "Process Hollowing", + "type": "technique", + "id": "T1093", + "url": "https://attack.mitre.org/techniques/T1093", + "deprecated": true + }, + { + "stixId": "attack-pattern--1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "name": "Local Data Staging", + "type": "technique", + "id": "T1074.001", + "url": "https://attack.mitre.org/techniques/T1074/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "name": "Match Legitimate Name or Location", + "type": "technique", + "id": "T1036.005", + "url": "https://attack.mitre.org/techniques/T1036/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--1ce03c65-5946-4ac9-9d4d-66db87e024bd", + "name": "Domain Fronting", + "type": "technique", + "id": "T1172", + "url": "https://attack.mitre.org/techniques/T1172", + "deprecated": true + }, + { + "stixId": "attack-pattern--1cec9319-743b-4840-bb65-431547bce82a", + "name": "Digital Certificates", + "type": "technique", + "id": "T1587.003", + "url": "https://attack.mitre.org/techniques/T1587/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--1cfcb312-b8d7-47a4-b560-4b16cc677292", + "name": "Stored Data Manipulation", + "type": "technique", + "id": "T1565.001", + "url": "https://attack.mitre.org/techniques/T1565/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--1d24cdee-9ea2-4189-b08e-af110bf2435d", + "name": "Password Cracking", + "type": "technique", + "id": "T1110.002", + "url": "https://attack.mitre.org/techniques/T1110/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--1df0326d-2fbc-4d08-a16b-48365f1e742d", + "name": "SID-History Injection", + "type": "technique", + "id": "T1178", + "url": "https://attack.mitre.org/techniques/T1178", + "deprecated": true + }, + { + "stixId": "attack-pattern--1e9eb839-294b-48cc-b0d3-c45555a2a004", + "name": "Local Email Collection", + "type": "technique", + "id": "T1114.001", + "url": "https://attack.mitre.org/techniques/T1114/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--1eaebf46-e361-4437-bc23-d5d65a3b92e3", + "name": "Keychain", + "type": "technique", + "id": "T1555.001", + "url": "https://attack.mitre.org/techniques/T1555/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf", + "name": "Boot or Logon Autostart Execution", + "type": "technique", + "id": "T1547", + "url": "https://attack.mitre.org/techniques/T1547", + "deprecated": false + }, + { + "stixId": "attack-pattern--1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "name": "LSA Secrets", + "type": "technique", + "id": "T1003.004", + "url": "https://attack.mitre.org/techniques/T1003/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--1f47e2fd-fa77-4f2f-88ee-e85df308f125", + "name": "Port Monitors", + "type": "technique", + "id": "T1013", + "url": "https://attack.mitre.org/techniques/T1013", + "deprecated": true + }, + { + "stixId": "attack-pattern--1f9012ef-1e10-4e48-915e-e03563435fe8", + "name": "Weaken Encryption", + "type": "technique", + "id": "T1600", + "url": "https://attack.mitre.org/techniques/T1600", + "deprecated": false + }, + { + "stixId": "attack-pattern--1f9c2bae-b441-4f66-a8af-b65946ee72f2", + "name": "SAML Tokens", + "type": "technique", + "id": "T1606.002", + "url": "https://attack.mitre.org/techniques/T1606/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--20138b9d-1aac-4a26-8654-a36b6bbf2bba", + "name": "Spearphishing Link", + "type": "technique", + "id": "T1192", + "url": "https://attack.mitre.org/techniques/T1192", + "deprecated": true + }, + { + "stixId": "attack-pattern--208884f1-7b83-4473-ac22-4e1cf6c41471", + "name": "Masquerade File Type", + "type": "technique", + "id": "T1036.008", + "url": "https://attack.mitre.org/techniques/T1036/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--20fb2507-d71c-455d-9b6d-6104461cf26b", + "name": "Service Stop", + "type": "technique", + "id": "T1489", + "url": "https://attack.mitre.org/techniques/T1489", + "deprecated": false + }, + { + "stixId": "attack-pattern--212306d8-efa4-44c9-8c2d-ed3d2e224aa0", + "name": "Malware", + "type": "technique", + "id": "T1587.001", + "url": "https://attack.mitre.org/techniques/T1587/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--215190a9-9f02-4e83-bb5f-e0589965a302", + "name": "Regsvcs/Regasm", + "type": "technique", + "id": "T1121", + "url": "https://attack.mitre.org/techniques/T1121", + "deprecated": true + }, + { + "stixId": "attack-pattern--215d9700-5881-48b8-8265-6449dbb7195d", + "name": "Device Driver Discovery", + "type": "technique", + "id": "T1652", + "url": "https://attack.mitre.org/techniques/T1652", + "deprecated": false + }, + { + "stixId": "attack-pattern--2169ba87-1146-4fc7-a118-12b72251db7e", + "name": "Sudo Caching", + "type": "technique", + "id": "T1206", + "url": "https://attack.mitre.org/techniques/T1206", + "deprecated": true + }, + { + "stixId": "attack-pattern--21875073-b0ee-49e3-9077-1e2a885359af", + "name": "Domain Account", + "type": "technique", + "id": "T1087.002", + "url": "https://attack.mitre.org/techniques/T1087/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--22522668-ddf6-470b-a027-9d6866679f67", + "name": "Active Setup", + "type": "technique", + "id": "T1547.014", + "url": "https://attack.mitre.org/techniques/T1547/014", + "deprecated": false + }, + { + "stixId": "attack-pattern--22905430-4901-4c2a-84f6-98243cb173f8", + "name": "Hide Artifacts", + "type": "technique", + "id": "T1564", + "url": "https://attack.mitre.org/techniques/T1564", + "deprecated": false + }, + { + "stixId": "attack-pattern--232a7e42-cd6e-4902-8fe9-2960f529dd4d", + "name": "Dynamic Data Exchange", + "type": "technique", + "id": "T1559.002", + "url": "https://attack.mitre.org/techniques/T1559/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--232b7f21-adf9-4b42-b936-b9d6f7df856e", + "name": "Malicious File", + "type": "technique", + "id": "T1204.002", + "url": "https://attack.mitre.org/techniques/T1204/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--2339cf19-8f1e-48f7-8a91-0262ba547b6f", + "name": "Identify Business Tempo", + "type": "technique", + "id": "T1591.003", + "url": "https://attack.mitre.org/techniques/T1591/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--241814ae-de3f-4656-b49e-f9a80764d4b7", + "name": "Security Software Discovery", + "type": "technique", + "id": "T1063", + "url": "https://attack.mitre.org/techniques/T1063", + "deprecated": true + }, + { + "stixId": "attack-pattern--24286c33-d4a4-4419-85c2-1d094a896c26", + "name": "Hardware", + "type": "technique", + "id": "T1592.001", + "url": "https://attack.mitre.org/techniques/T1592/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--246fd3c7-f5e3-466d-8787-4c13d9e3b61c", + "name": "Taint Shared Content", + "type": "technique", + "id": "T1080", + "url": "https://attack.mitre.org/techniques/T1080", + "deprecated": false + }, + { + "stixId": "attack-pattern--24769ab5-14bd-4f4e-a752-cfb185da53ee", + "name": "Domain Trust Modification", + "type": "technique", + "id": "T1484.002", + "url": "https://attack.mitre.org/techniques/T1484/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "name": "Symmetric Cryptography", + "type": "technique", + "id": "T1573.001", + "url": "https://attack.mitre.org/techniques/T1573/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--25659dd6-ea12-45c4-97e6-381e3e4b593e", + "name": "Local Account", + "type": "technique", + "id": "T1087.001", + "url": "https://attack.mitre.org/techniques/T1087/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--2715c335-1bf2-4efe-9f18-0691317ff83b", + "name": "Securityd Memory", + "type": "technique", + "id": "T1167", + "url": "https://attack.mitre.org/techniques/T1167", + "deprecated": true + }, + { + "stixId": "attack-pattern--274770e0-2612-4ccf-a678-ef8e7bad365d", + "name": "Social Media Accounts", + "type": "technique", + "id": "T1586.001", + "url": "https://attack.mitre.org/techniques/T1586/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--27960489-4e7f-461d-a62a-f5c0cb521e4a", + "name": "Application Access Token", + "type": "technique", + "id": "T1527", + "url": "https://attack.mitre.org/techniques/T1527", + "deprecated": true + }, + { + "stixId": "attack-pattern--28170e17-8384-415c-8486-2e6b294cb803", + "name": "Safe Mode Boot", + "type": "technique", + "id": "T1562.009", + "url": "https://attack.mitre.org/techniques/T1562/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--2892b9ee-ca9f-4723-b332-0dc6e843a8ae", + "name": "Screensaver", + "type": "technique", + "id": "T1180", + "url": "https://attack.mitre.org/techniques/T1180", + "deprecated": true + }, + { + "stixId": "attack-pattern--28abec6c-4443-4b03-8206-07f2e264a6b4", + "name": "TFTP Boot", + "type": "technique", + "id": "T1542.005", + "url": "https://attack.mitre.org/techniques/T1542/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--2959d63f-73fd-46a1-abd2-109d7dcede32", + "name": "Windows Service", + "type": "technique", + "id": "T1543.003", + "url": "https://attack.mitre.org/techniques/T1543/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--29ba5a15-3b7b-4732-b817-65ea8f6468e6", + "name": "Fast Flux DNS", + "type": "technique", + "id": "T1568.001", + "url": "https://attack.mitre.org/techniques/T1568/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--29be378d-262d-4e99-b00d-852d573628e6", + "name": "System Checks", + "type": "technique", + "id": "T1497.001", + "url": "https://attack.mitre.org/techniques/T1497/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--2acf44aa-542f-4366-b4eb-55ef5747759c", + "name": "Cron", + "type": "technique", + "id": "T1053.003", + "url": "https://attack.mitre.org/techniques/T1053/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "name": "Domain Groups", + "type": "technique", + "id": "T1069.002", + "url": "https://attack.mitre.org/techniques/T1069/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--2b5aa86b-a0df-4382-848d-30abea443327", + "name": "Vulnerabilities", + "type": "technique", + "id": "T1588.006", + "url": "https://attack.mitre.org/techniques/T1588/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--2b742742-28c3-4e1b-bab7-8350d6300fa7", + "name": "Spearphishing Link", + "type": "technique", + "id": "T1566.002", + "url": "https://attack.mitre.org/techniques/T1566/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--2ba5aa71-9d15-4b22-b726-56af06d9ad2f", + "name": "Startup Items", + "type": "technique", + "id": "T1165", + "url": "https://attack.mitre.org/techniques/T1165", + "deprecated": true + }, + { + "stixId": "attack-pattern--2bce5b30-7014-4a5d-ade7-12913fe6ac36", + "name": "Clear Linux or Mac System Logs", + "type": "technique", + "id": "T1070.002", + "url": "https://attack.mitre.org/techniques/T1070/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--2bee5ffb-7a7a-4119-b1f2-158151b19ac0", + "name": "Application or System Exploitation", + "type": "technique", + "id": "T1499.004", + "url": "https://attack.mitre.org/techniques/T1499/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--2c4d4e92-0ccf-4a97-b54c-86d662988a53", + "name": "Office Application Startup", + "type": "technique", + "id": "T1137", + "url": "https://attack.mitre.org/techniques/T1137", + "deprecated": false + }, + { + "stixId": "attack-pattern--2cd950a6-16c4-404a-aa01-044322395107", + "name": "InstallUtil", + "type": "technique", + "id": "T1218.004", + "url": "https://attack.mitre.org/techniques/T1218/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--2d3f5b3c-54ca-4f4d-bb1f-849346d31230", + "name": "Spearphishing Link", + "type": "technique", + "id": "T1598.003", + "url": "https://attack.mitre.org/techniques/T1598/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--2db31dcd-54da-405d-acef-b9129b816ed6", + "name": "SSH", + "type": "technique", + "id": "T1021.004", + "url": "https://attack.mitre.org/techniques/T1021/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", + "name": "Additional Cloud Roles", + "type": "technique", + "id": "T1098.003", + "url": "https://attack.mitre.org/techniques/T1098/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--2de47683-f398-448f-b947-9abcc3e32fad", + "name": "Print Processors", + "type": "technique", + "id": "T1547.012", + "url": "https://attack.mitre.org/techniques/T1547/012", + "deprecated": false + }, + { + "stixId": "attack-pattern--2e0dd10b-676d-4964-acd0-8a404c92b044", + "name": "Disabling Security Tools", + "type": "technique", + "id": "T1089", + "url": "https://attack.mitre.org/techniques/T1089", + "deprecated": true + }, + { + "stixId": "attack-pattern--2e114e45-2c50-404c-804a-3af9564d240e", + "name": "Disk Structure Wipe", + "type": "technique", + "id": "T1487", + "url": "https://attack.mitre.org/techniques/T1487", + "deprecated": true + }, + { + "stixId": "attack-pattern--2e34237d-8574-43f6-aace-ae2915de8597", + "name": "Spearphishing Attachment", + "type": "technique", + "id": "T1566.001", + "url": "https://attack.mitre.org/techniques/T1566/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--2edd9d6a-5674-4326-a600-ba56de467286", + "name": "Credentials in Registry", + "type": "technique", + "id": "T1214", + "url": "https://attack.mitre.org/techniques/T1214", + "deprecated": true + }, + { + "stixId": "attack-pattern--2f41939b-54c3-41d6-8f8b-35f1ec18ed97", + "name": "Stripped Payloads", + "type": "technique", + "id": "T1027.008", + "url": "https://attack.mitre.org/techniques/T1027/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--2f6b4ed7-fef1-44ba-bcb8-1b4beb610b64", + "name": "Component Object Model", + "type": "technique", + "id": "T1559.001", + "url": "https://attack.mitre.org/techniques/T1559/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34", + "name": "DLL Search Order Hijacking", + "type": "technique", + "id": "T1574.001", + "url": "https://attack.mitre.org/techniques/T1574/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--30208d3e-0d6b-43c8-883e-44462a514619", + "name": "Automated Collection", + "type": "technique", + "id": "T1119", + "url": "https://attack.mitre.org/techniques/T1119", + "deprecated": false + }, + { + "stixId": "attack-pattern--30973a08-aed9-4edf-8604-9084ce1b5c4f", + "name": "Clipboard Data", + "type": "technique", + "id": "T1115", + "url": "https://attack.mitre.org/techniques/T1115", + "deprecated": false + }, + { + "stixId": "attack-pattern--3120b9fa-23b8-4500-ae73-09494f607b7d", + "name": "Proc Filesystem", + "type": "technique", + "id": "T1003.007", + "url": "https://attack.mitre.org/techniques/T1003/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--31225cd3-cd46-4575-b287-c2c14011c074", + "name": "Botnet", + "type": "technique", + "id": "T1583.005", + "url": "https://attack.mitre.org/techniques/T1583/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--315f51f0-6b03-4c1e-bfb2-84740afb8e21", + "name": "Password Managers", + "type": "technique", + "id": "T1555.005", + "url": "https://attack.mitre.org/techniques/T1555/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--317fefa6-46c7-4062-adb6-2008cf6bcb41", + "name": "AppInit DLLs", + "type": "technique", + "id": "T1103", + "url": "https://attack.mitre.org/techniques/T1103", + "deprecated": true + }, + { + "stixId": "attack-pattern--31a0a2ac-c67c-4a7e-b9ed-6a96477d4e8e", + "name": "Gatekeeper Bypass", + "type": "technique", + "id": "T1553.001", + "url": "https://attack.mitre.org/techniques/T1553/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--31fe0ba2-62fd-4fd9-9293-4043d84f7fe9", + "name": "Drive-by Target", + "type": "technique", + "id": "T1608.004", + "url": "https://attack.mitre.org/techniques/T1608/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--322bad5a-1c49-4d23-ab79-76d641794afa", + "name": "System Service Discovery", + "type": "technique", + "id": "T1007", + "url": "https://attack.mitre.org/techniques/T1007", + "deprecated": false + }, + { + "stixId": "attack-pattern--3257eb21-f9a7-4430-8de1-d8b6e288f529", + "name": "Network Sniffing", + "type": "technique", + "id": "T1040", + "url": "https://attack.mitre.org/techniques/T1040", + "deprecated": false + }, + { + "stixId": "attack-pattern--327f3cc5-eea1-42d4-a6cd-ed34b7ce8f61", + "name": "Application Deployment Software", + "type": "technique", + "id": "T1017", + "url": "https://attack.mitre.org/techniques/T1017", + "deprecated": true + }, + { + "stixId": "attack-pattern--32901740-b42c-4fdd-bc02-345b5dc57082", + "name": "Code Signing", + "type": "technique", + "id": "T1553.002", + "url": "https://attack.mitre.org/techniques/T1553/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--3298ce88-1628-43b1-87d9-0b5336b193d7", + "name": "Data from Cloud Storage", + "type": "technique", + "id": "T1530", + "url": "https://attack.mitre.org/techniques/T1530", + "deprecated": false + }, + { + "stixId": "attack-pattern--32ad5c86-2bcf-47d8-8fdc-d7f3d79a7490", + "name": "Runtime Data Manipulation", + "type": "technique", + "id": "T1565.003", + "url": "https://attack.mitre.org/techniques/T1565/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--341e222a-a6e3-4f6f-b69c-831d792b1580", + "name": "Credentials in Registry", + "type": "technique", + "id": "T1552.002", + "url": "https://attack.mitre.org/techniques/T1552/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--3489cfc5-640f-4bb3-a103-9137b97de79f", + "name": "Network Share Discovery", + "type": "technique", + "id": "T1135", + "url": "https://attack.mitre.org/techniques/T1135", + "deprecated": false + }, + { + "stixId": "attack-pattern--348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "name": "Peripheral Device Discovery", + "type": "technique", + "id": "T1120", + "url": "https://attack.mitre.org/techniques/T1120", + "deprecated": false + }, + { + "stixId": "attack-pattern--34ab90a3-05f6-4259-8f21-621081fdaba5", + "name": "Network Topology", + "type": "technique", + "id": "T1590.004", + "url": "https://attack.mitre.org/techniques/T1590/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--34b3f738-bd64-40e5-a112-29b0542bc8bf", + "name": "Code Signing Certificates", + "type": "technique", + "id": "T1587.002", + "url": "https://attack.mitre.org/techniques/T1587/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--34e793de-0274-4982-9c1a-246ed1c19dee", + "name": "Windows File and Directory Permissions Modification", + "type": "technique", + "id": "T1222.001", + "url": "https://attack.mitre.org/techniques/T1222/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--34f1d81d-fe88-4f97-bd3b-a3164536255d", + "name": "Add-ins", + "type": "technique", + "id": "T1137.006", + "url": "https://attack.mitre.org/techniques/T1137/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--35187df2-31ed-43b6-a1f5-2f1d3d58d3f1", + "name": "Transport Agent", + "type": "technique", + "id": "T1505.002", + "url": "https://attack.mitre.org/techniques/T1505/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--354a7f88-63fb-41b5-a801-ce3b377b36f1", + "name": "System Information Discovery", + "type": "technique", + "id": "T1082", + "url": "https://attack.mitre.org/techniques/T1082", + "deprecated": false + }, + { + "stixId": "attack-pattern--355be19c-ffc9-46d5-8d50-d6a036c675b6", + "name": "Application Layer Protocol", + "type": "technique", + "id": "T1071", + "url": "https://attack.mitre.org/techniques/T1071", + "deprecated": false + }, + { + "stixId": "attack-pattern--359b00ad-9425-420b-bba5-6de8d600cbc0", + "name": "Remote Data Staging", + "type": "technique", + "id": "T1074.002", + "url": "https://attack.mitre.org/techniques/T1074/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "name": "Scheduled Task/Job", + "type": "technique", + "id": "T1053", + "url": "https://attack.mitre.org/techniques/T1053", + "deprecated": false + }, + { + "stixId": "attack-pattern--365be77f-fc0e-42ee-bac8-4faf806d9336", + "name": "Msiexec", + "type": "technique", + "id": "T1218.007", + "url": "https://attack.mitre.org/techniques/T1218/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--36675cd3-fe00-454c-8516-aebecacbe9d9", + "name": "Login Item", + "type": "technique", + "id": "T1162", + "url": "https://attack.mitre.org/techniques/T1162", + "deprecated": true + }, + { + "stixId": "attack-pattern--36aa137f-5166-41f8-b2f0-a4cfa1b4133e", + "name": "Network Trust Dependencies", + "type": "technique", + "id": "T1590.003", + "url": "https://attack.mitre.org/techniques/T1590/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--36b2a1d7-e09e-49bf-b45e-477076c2ec01", + "name": "Reflection Amplification", + "type": "technique", + "id": "T1498.002", + "url": "https://attack.mitre.org/techniques/T1498/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--3731fbcd-0e43-47ae-ae6c-d15e510f0d42", + "name": "Password Filter DLL", + "type": "technique", + "id": "T1556.002", + "url": "https://attack.mitre.org/techniques/T1556/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--379809f6-2fac-42c1-bd2e-e9dee70b27f8", + "name": "Terminal Services DLL", + "type": "technique", + "id": "T1505.005", + "url": "https://attack.mitre.org/techniques/T1505/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--37b11151-1776-4f8f-b328-30939fbf2ceb", + "name": "AppleScript", + "type": "technique", + "id": "T1059.002", + "url": "https://attack.mitre.org/techniques/T1059/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--389735f1-f21c-4208-b8f0-f8031e7169b8", + "name": "Browser Extensions", + "type": "technique", + "id": "T1176", + "url": "https://attack.mitre.org/techniques/T1176", + "deprecated": false + }, + { + "stixId": "attack-pattern--38eb0c22-6caf-46ce-8869-5964bd735858", + "name": "Service Exhaustion Flood", + "type": "technique", + "id": "T1499.002", + "url": "https://attack.mitre.org/techniques/T1499/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--39131305-9282-45e4-ac3b-591d2d4fc3ef", + "name": "Compromise Hardware Supply Chain", + "type": "technique", + "id": "T1195.003", + "url": "https://attack.mitre.org/techniques/T1195/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--391d824f-0ef1-47a0-b0ee-c59a75e27670", + "name": "Native API", + "type": "technique", + "id": "T1106", + "url": "https://attack.mitre.org/techniques/T1106", + "deprecated": false + }, + { + "stixId": "attack-pattern--3975dbb5-0e1e-4f5b-bae1-cf2ab84b46dc", + "name": "Clear Network Connection History and Configurations", + "type": "technique", + "id": "T1070.007", + "url": "https://attack.mitre.org/techniques/T1070/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--3986e7fd-a8e9-4ecb-bfc6-55920855912b", + "name": "AS-REP Roasting", + "type": "technique", + "id": "T1558.004", + "url": "https://attack.mitre.org/techniques/T1558/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--39a130e1-6ab7-434a-8bd2-418e7d9d6427", + "name": "Service Registry Permissions Weakness", + "type": "technique", + "id": "T1058", + "url": "https://attack.mitre.org/techniques/T1058", + "deprecated": true + }, + { + "stixId": "attack-pattern--39cc9f64-cf74-4a48-a4d8-fe98c54a02e0", + "name": "Virtual Private Server", + "type": "technique", + "id": "T1584.003", + "url": "https://attack.mitre.org/techniques/T1584/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--3a40f208-a9c1-4efa-a598-4003c3681fb8", + "name": "Reduce Key Space", + "type": "technique", + "id": "T1600.001", + "url": "https://attack.mitre.org/techniques/T1600/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--3aef9463-9a7a-43ba-8957-a867e07c1e6a", + "name": "Clear Command History", + "type": "technique", + "id": "T1070.003", + "url": "https://attack.mitre.org/techniques/T1070/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--3b0e52ce-517a-4614-a523-1bd5deef6c5e", + "name": "Indirect Command Execution", + "type": "technique", + "id": "T1202", + "url": "https://attack.mitre.org/techniques/T1202", + "deprecated": false + }, + { + "stixId": "attack-pattern--3b3cbbe0-6ed3-4334-b543-3ddfd8c5642d", + "name": "Custom Cryptographic Protocol", + "type": "technique", + "id": "T1024", + "url": "https://attack.mitre.org/techniques/T1024", + "deprecated": true + }, + { + "stixId": "attack-pattern--3b4121aa-fc8b-40c8-ac4f-afcb5838b72c", + "name": "Revert Cloud Instance", + "type": "technique", + "id": "T1536", + "url": "https://attack.mitre.org/techniques/T1536", + "deprecated": true + }, + { + "stixId": "attack-pattern--3b744087-9945-4a6f-91e8-9dbceda417a4", + "name": "Replication Through Removable Media", + "type": "technique", + "id": "T1091", + "url": "https://attack.mitre.org/techniques/T1091", + "deprecated": false + }, + { + "stixId": "attack-pattern--3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "name": "Data from Local System", + "type": "technique", + "id": "T1005", + "url": "https://attack.mitre.org/techniques/T1005", + "deprecated": false + }, + { + "stixId": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "name": "Deobfuscate/Decode Files or Information", + "type": "technique", + "id": "T1140", + "url": "https://attack.mitre.org/techniques/T1140", + "deprecated": false + }, + { + "stixId": "attack-pattern--3d1b9d7e-3921-4d25-845a-7d9f15c0da44", + "name": "Outlook Rules", + "type": "technique", + "id": "T1137.005", + "url": "https://attack.mitre.org/techniques/T1137/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--3d333250-30e4-4a82-9edc-756c68afc529", + "name": "Impair Defenses", + "type": "technique", + "id": "T1562", + "url": "https://attack.mitre.org/techniques/T1562", + "deprecated": false + }, + { + "stixId": "attack-pattern--3d52e51e-f6db-4719-813c-48002a99f43a", + "name": "Cloud Accounts", + "type": "technique", + "id": "T1586.003", + "url": "https://attack.mitre.org/techniques/T1586/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--3dc8c101-d4db-4f4d-8150-1b5a76ca5f1b", + "name": "Email Accounts", + "type": "technique", + "id": "T1586.002", + "url": "https://attack.mitre.org/techniques/T1586/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--3ee16395-03f0-4690-a32e-69ce9ada0f9e", + "name": "Upload Malware", + "type": "technique", + "id": "T1608.001", + "url": "https://attack.mitre.org/techniques/T1608/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--3f18edba-28f4-4bb9-82c3-8aa60dcac5f7", + "name": "Supply Chain Compromise", + "type": "technique", + "id": "T1195", + "url": "https://attack.mitre.org/techniques/T1195", + "deprecated": false + }, + { + "stixId": "attack-pattern--3f886f2a-874f-4333-b794-aa6075009b1c", + "name": "Exploit Public-Facing Application", + "type": "technique", + "id": "T1190", + "url": "https://attack.mitre.org/techniques/T1190", + "deprecated": false + }, + { + "stixId": "attack-pattern--3fc01293-ef5e-41c6-86ce-61f10706b64a", + "name": "Steal or Forge Kerberos Tickets", + "type": "technique", + "id": "T1558", + "url": "https://attack.mitre.org/techniques/T1558", + "deprecated": false + }, + { + "stixId": "attack-pattern--3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "name": "Credentials from Password Stores", + "type": "technique", + "id": "T1555", + "url": "https://attack.mitre.org/techniques/T1555", + "deprecated": false + }, + { + "stixId": "attack-pattern--40597f16-0963-4249-bf4c-ac93b7fb9807", + "name": "Exfiltration Over Web Service", + "type": "technique", + "id": "T1567", + "url": "https://attack.mitre.org/techniques/T1567", + "deprecated": false + }, + { + "stixId": "attack-pattern--4061e78c-1284-44b4-9116-73e4ac3912f7", + "name": "Remote Access Software", + "type": "technique", + "id": "T1219", + "url": "https://attack.mitre.org/techniques/T1219", + "deprecated": false + }, + { + "stixId": "attack-pattern--40f5caa0-4cb7-4117-89fc-d421bb493df3", + "name": "Domains", + "type": "technique", + "id": "T1583.001", + "url": "https://attack.mitre.org/techniques/T1583/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--41868330-6ee2-4d0f-b743-9f2294c3c9b6", + "name": "Archive via Library", + "type": "technique", + "id": "T1560.002", + "url": "https://attack.mitre.org/techniques/T1560/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--41d9846c-f6af-4302-a654-24bba2729bc6", + "name": "Thread Execution Hijacking", + "type": "technique", + "id": "T1055.003", + "url": "https://attack.mitre.org/techniques/T1055/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--428ca9f8-0e33-442a-be87-f869cb4cf73e", + "name": "Multilayer Encryption", + "type": "technique", + "id": "T1079", + "url": "https://attack.mitre.org/techniques/T1079", + "deprecated": true + }, + { + "stixId": "attack-pattern--42e8de7b-37b2-4258-905a-6897815e58e0", + "name": "Masquerading", + "type": "technique", + "id": "T1036", + "url": "https://attack.mitre.org/techniques/T1036", + "deprecated": false + }, + { + "stixId": "attack-pattern--42fe883a-21ea-4cfb-b94a-78b6476dcc83", + "name": "Application Shimming", + "type": "technique", + "id": "T1546.011", + "url": "https://attack.mitre.org/techniques/T1546/011", + "deprecated": false + }, + { + "stixId": "attack-pattern--435dfb86-2697-4867-85b5-2fef496c0517", + "name": "Unsecured Credentials", + "type": "technique", + "id": "T1552", + "url": "https://attack.mitre.org/techniques/T1552", + "deprecated": false + }, + { + "stixId": "attack-pattern--43881e51-ac74-445b-b4c6-f9f9e9bf23fe", + "name": "Port Monitors", + "type": "technique", + "id": "T1547.010", + "url": "https://attack.mitre.org/techniques/T1547/010", + "deprecated": false + }, + { + "stixId": "attack-pattern--438c967d-3996-4870-bfc2-3954752a1927", + "name": "Clear Mailbox Data", + "type": "technique", + "id": "T1070.008", + "url": "https://attack.mitre.org/techniques/T1070/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--43ba2b05-cf72-4b6c-8243-03a4aba41ee0", + "name": "Login Hook", + "type": "technique", + "id": "T1037.002", + "url": "https://attack.mitre.org/techniques/T1037/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "name": "Process Injection", + "type": "technique", + "id": "T1055", + "url": "https://attack.mitre.org/techniques/T1055", + "deprecated": false + }, + { + "stixId": "attack-pattern--44dca04b-808d-46ca-b25f-d85236d4b9f8", + "name": "Bash History", + "type": "technique", + "id": "T1139", + "url": "https://attack.mitre.org/techniques/T1139", + "deprecated": true + }, + { + "stixId": "attack-pattern--451a9977-d255-43c9-b431-66de80130c8c", + "name": "Traffic Signaling", + "type": "technique", + "id": "T1205", + "url": "https://attack.mitre.org/techniques/T1205", + "deprecated": false + }, + { + "stixId": "attack-pattern--4579d9c9-d5b9-45e0-9848-0104637b579f", + "name": "Credentials from Web Browsers", + "type": "technique", + "id": "T1503", + "url": "https://attack.mitre.org/techniques/T1503", + "deprecated": true + }, + { + "stixId": "attack-pattern--457c7820-d331-465a-915e-42f85500ccc4", + "name": "System Binary Proxy Execution", + "type": "technique", + "id": "T1218", + "url": "https://attack.mitre.org/techniques/T1218", + "deprecated": false + }, + { + "stixId": "attack-pattern--45d84c8b-c1e2-474d-a14d-69b5de0a2bc0", + "name": "Source", + "type": "technique", + "id": "T1153", + "url": "https://attack.mitre.org/techniques/T1153", + "deprecated": true + }, + { + "stixId": "attack-pattern--46944654-fcc1-4f63-9dad-628102376586", + "name": "DLL Search Order Hijacking", + "type": "technique", + "id": "T1038", + "url": "https://attack.mitre.org/techniques/T1038", + "deprecated": true + }, + { + "stixId": "attack-pattern--478aa214-2ca7-4ec0-9978-18798e514790", + "name": "New Service", + "type": "technique", + "id": "T1050", + "url": "https://attack.mitre.org/techniques/T1050", + "deprecated": true + }, + { + "stixId": "attack-pattern--47f2d673-ca62-47e9-929b-1b0be9657611", + "name": "Timestomp", + "type": "technique", + "id": "T1070.006", + "url": "https://attack.mitre.org/techniques/T1070/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--4933e63b-9b77-476e-ab29-761bc5b7d15a", + "name": "Reflective Code Loading", + "type": "technique", + "id": "T1620", + "url": "https://attack.mitre.org/techniques/T1620", + "deprecated": false + }, + { + "stixId": "attack-pattern--4a5b7ade-8bb5-4853-84ed-23f262002665", + "name": "Escape to Host", + "type": "technique", + "id": "T1611", + "url": "https://attack.mitre.org/techniques/T1611", + "deprecated": false + }, + { + "stixId": "attack-pattern--4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", + "name": "Shortcut Modification", + "type": "technique", + "id": "T1547.009", + "url": "https://attack.mitre.org/techniques/T1547/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--4ae4f953-fe58-4cc8-a327-33257e30a830", + "name": "Application Window Discovery", + "type": "technique", + "id": "T1010", + "url": "https://attack.mitre.org/techniques/T1010", + "deprecated": false + }, + { + "stixId": "attack-pattern--4b74a1d4-b0e9-4ef1-93f1-14ecc6e2f5b5", + "name": "Standard Cryptographic Protocol", + "type": "technique", + "id": "T1032", + "url": "https://attack.mitre.org/techniques/T1032", + "deprecated": true + }, + { + "stixId": "attack-pattern--4bc31b94-045b-4752-8920-aebaebdb6470", + "name": "Email Account", + "type": "technique", + "id": "T1087.003", + "url": "https://attack.mitre.org/techniques/T1087/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--4be89c7c-ace6-4876-9377-c8d54cef3d63", + "name": "Hypervisor", + "type": "technique", + "id": "T1062", + "url": "https://attack.mitre.org/techniques/T1062", + "deprecated": true + }, + { + "stixId": "attack-pattern--4bed873f-0b7d-41d4-b93a-b6905d1f90b0", + "name": "Time Based Evasion", + "type": "technique", + "id": "T1497.003", + "url": "https://attack.mitre.org/techniques/T1497/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--4bf5845d-a814-4490-bc5c-ccdee6043025", + "name": "AppCert DLLs", + "type": "technique", + "id": "T1182", + "url": "https://attack.mitre.org/techniques/T1182", + "deprecated": true + }, + { + "stixId": "attack-pattern--4cbc6a62-9e34-4f94-8a19-5c1a11392a49", + "name": "CMSTP", + "type": "technique", + "id": "T1218.003", + "url": "https://attack.mitre.org/techniques/T1218/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--4d2a5b3e-340d-4600-9123-309dd63c9bf8", + "name": "SSH Hijacking", + "type": "technique", + "id": "T1563.001", + "url": "https://attack.mitre.org/techniques/T1563/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--4eb28bed-d11a-4641-9863-c2ac017d910a", + "name": "Disable Windows Event Logging", + "type": "technique", + "id": "T1562.002", + "url": "https://attack.mitre.org/techniques/T1562/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--4eeaf8a9-c86b-4954-a663-9555fb406466", + "name": "Scheduled Transfer", + "type": "technique", + "id": "T1029", + "url": "https://attack.mitre.org/techniques/T1029", + "deprecated": false + }, + { + "stixId": "attack-pattern--4f9ca633-15c5-463c-9724-bdcd54fde541", + "name": "SMB/Windows Admin Shares", + "type": "technique", + "id": "T1021.002", + "url": "https://attack.mitre.org/techniques/T1021/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--4fd8a28b-4b3a-4cd6-a8cf-85ba5f824a7f", + "name": "Implant Internal Image", + "type": "technique", + "id": "T1525", + "url": "https://attack.mitre.org/techniques/T1525", + "deprecated": false + }, + { + "stixId": "attack-pattern--4fe28b27-b13c-453e-a386-c2ef362a573b", + "name": "Protocol Tunneling", + "type": "technique", + "id": "T1572", + "url": "https://attack.mitre.org/techniques/T1572", + "deprecated": false + }, + { + "stixId": "attack-pattern--4ff5d6a8-c062-4c68-a778-36fc5edd564f", + "name": "Control Panel", + "type": "technique", + "id": "T1218.002", + "url": "https://attack.mitre.org/techniques/T1218/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--4ffc1794-ec3b-45be-9e52-42dbcb2af2de", + "name": "Network Address Translation Traversal", + "type": "technique", + "id": "T1599.001", + "url": "https://attack.mitre.org/techniques/T1599/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--506f6f49-7045-4156-9007-7474cb44ad6d", + "name": "Upload Tool", + "type": "technique", + "id": "T1608.002", + "url": "https://attack.mitre.org/techniques/T1608/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--5095a853-299c-4876-abd7-ac0050fb5462", + "name": "Security Support Provider", + "type": "technique", + "id": "T1547.005", + "url": "https://attack.mitre.org/techniques/T1547/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--514ede4c-78b3-4d78-a38b-daddf6217a79", + "name": "Winlogon Helper DLL", + "type": "technique", + "id": "T1004", + "url": "https://attack.mitre.org/techniques/T1004", + "deprecated": true + }, + { + "stixId": "attack-pattern--519630c5-f03f-4882-825c-3af924935817", + "name": "Binary Padding", + "type": "technique", + "id": "T1009", + "url": "https://attack.mitre.org/techniques/T1009", + "deprecated": true + }, + { + "stixId": "attack-pattern--51a14c76-dd3b-440b-9c20-2bf91d25a814", + "name": "Use Alternate Authentication Material", + "type": "technique", + "id": "T1550", + "url": "https://attack.mitre.org/techniques/T1550", + "deprecated": false + }, + { + "stixId": "attack-pattern--51dea151-0898-4a45-967c-3ebee0420484", + "name": "Remote Desktop Protocol", + "type": "technique", + "id": "T1076", + "url": "https://attack.mitre.org/techniques/T1076", + "deprecated": true + }, + { + "stixId": "attack-pattern--51e54974-a541-4fb6-a61b-0518e4c6de41", + "name": "Threat Intel Vendors", + "type": "technique", + "id": "T1597.001", + "url": "https://attack.mitre.org/techniques/T1597/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--51ea26b1-ff1e-4faa-b1a0-1114cd298c87", + "name": "Exfiltration Over Other Network Medium", + "type": "technique", + "id": "T1011", + "url": "https://attack.mitre.org/techniques/T1011", + "deprecated": false + }, + { + "stixId": "attack-pattern--52759bf1-fe12-4052-ace6-c5b0cf7dd7fd", + "name": "Network Device Configuration Dump", + "type": "technique", + "id": "T1602.002", + "url": "https://attack.mitre.org/techniques/T1602/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--5282dd9a-d26d-4e16-88b7-7c0f4553daf4", + "name": "Gather Victim Identity Information", + "type": "technique", + "id": "T1589", + "url": "https://attack.mitre.org/techniques/T1589", + "deprecated": false + }, + { + "stixId": "attack-pattern--52d40641-c480-4ad5-81a3-c80ccaddf82d", + "name": "Authentication Package", + "type": "technique", + "id": "T1131", + "url": "https://attack.mitre.org/techniques/T1131", + "deprecated": true + }, + { + "stixId": "attack-pattern--52f3d5a6-8a0f-4f82-977e-750abf90d0b0", + "name": "Extra Window Memory Injection", + "type": "technique", + "id": "T1181", + "url": "https://attack.mitre.org/techniques/T1181", + "deprecated": true + }, + { + "stixId": "attack-pattern--5372c5fe-f424-4def-bcd5-d3a8e770f07b", + "name": "Disable or Modify System Firewall", + "type": "technique", + "id": "T1562.004", + "url": "https://attack.mitre.org/techniques/T1562/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", + "name": "Archive Collected Data", + "type": "technique", + "id": "T1560", + "url": "https://attack.mitre.org/techniques/T1560", + "deprecated": false + }, + { + "stixId": "attack-pattern--53bfc8bf-8f76-4cd7-8958-49a884ddb3ee", + "name": "Launchctl", + "type": "technique", + "id": "T1152", + "url": "https://attack.mitre.org/techniques/T1152", + "deprecated": true + }, + { + "stixId": "attack-pattern--543fceb5-cb92-40cb-aacf-6913d4db58bc", + "name": "SIP and Trust Provider Hijacking", + "type": "technique", + "id": "T1553.003", + "url": "https://attack.mitre.org/techniques/T1553/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--54456690-84de-4538-9101-643e26437e09", + "name": "Domain Generation Algorithms", + "type": "technique", + "id": "T1483", + "url": "https://attack.mitre.org/techniques/T1483", + "deprecated": true + }, + { + "stixId": "attack-pattern--544b0346-29ad-41e1-a808-501bb4193f47", + "name": "Browser Session Hijacking", + "type": "technique", + "id": "T1185", + "url": "https://attack.mitre.org/techniques/T1185", + "deprecated": false + }, + { + "stixId": "attack-pattern--54a649ff-439a-41a4-9856-8d144a2551ba", + "name": "Remote Services", + "type": "technique", + "id": "T1021", + "url": "https://attack.mitre.org/techniques/T1021", + "deprecated": false + }, + { + "stixId": "attack-pattern--54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "name": "Mail Protocols", + "type": "technique", + "id": "T1071.003", + "url": "https://attack.mitre.org/techniques/T1071/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--54ca26f3-c172-4231-93e5-ccebcac2161f", + "name": "Hybrid Identity", + "type": "technique", + "id": "T1556.007", + "url": "https://attack.mitre.org/techniques/T1556/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--5502c4e9-24ef-4d5f-8ee9-9e906c2f82c4", + "name": "Vulnerability Scanning", + "type": "technique", + "id": "T1595.002", + "url": "https://attack.mitre.org/techniques/T1595/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--55bb4471-ff1f-43b4-88c1-c9384ec47abf", + "name": "Cloud API", + "type": "technique", + "id": "T1059.009", + "url": "https://attack.mitre.org/techniques/T1059/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--55fc4df0-b42c-479a-b860-7a6761bcaad0", + "name": "Search Open Technical Databases", + "type": "technique", + "id": "T1596", + "url": "https://attack.mitre.org/techniques/T1596", + "deprecated": false + }, + { + "stixId": "attack-pattern--564998d8-ab3e-4123-93fb-eccaa6b9714a", + "name": "Rogue Domain Controller", + "type": "technique", + "id": "T1207", + "url": "https://attack.mitre.org/techniques/T1207", + "deprecated": false + }, + { + "stixId": "attack-pattern--565275d5-fcc3-4b66-b4e7-928e4cac6b8c", + "name": "Code Signing Policy Modification", + "type": "technique", + "id": "T1553.006", + "url": "https://attack.mitre.org/techniques/T1553/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--56e0d8b8-3e25-49dd-9050-3aa252f5aa92", + "name": "Deploy Container", + "type": "technique", + "id": "T1610", + "url": "https://attack.mitre.org/techniques/T1610", + "deprecated": false + }, + { + "stixId": "attack-pattern--56fca983-1cf1-4fd1-bda0-5e170a37ab59", + "name": "File Deletion", + "type": "technique", + "id": "T1107", + "url": "https://attack.mitre.org/techniques/T1107", + "deprecated": true + }, + { + "stixId": "attack-pattern--56ff457d-5e39-492b-974c-dfd2b8603ffe", + "name": "Private Keys", + "type": "technique", + "id": "T1145", + "url": "https://attack.mitre.org/techniques/T1145", + "deprecated": true + }, + { + "stixId": "attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4", + "name": "Modify Registry", + "type": "technique", + "id": "T1112", + "url": "https://attack.mitre.org/techniques/T1112", + "deprecated": false + }, + { + "stixId": "attack-pattern--573ad264-1371-4ae0-8482-d2673b719dba", + "name": "Launch Daemon", + "type": "technique", + "id": "T1543.004", + "url": "https://attack.mitre.org/techniques/T1543/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--57a3d31a-d04f-4663-b2da-7df8ec3f8c9d", + "name": "Cloud Infrastructure Discovery", + "type": "technique", + "id": "T1580", + "url": "https://attack.mitre.org/techniques/T1580", + "deprecated": false + }, + { + "stixId": "attack-pattern--58a3e6aa-4453-4cc8-a51f-4befe80b31a8", + "name": "Credentials from Web Browsers", + "type": "technique", + "id": "T1555.003", + "url": "https://attack.mitre.org/techniques/T1555/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--58af3705-8740-4c68-9329-ec015a7013c2", + "name": "Path Interception by Search Order Hijacking", + "type": "technique", + "id": "T1574.008", + "url": "https://attack.mitre.org/techniques/T1574/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--5909f20f-3c39-4795-be06-ef1ea40d350b", + "name": "Defacement", + "type": "technique", + "id": "T1491", + "url": "https://attack.mitre.org/techniques/T1491", + "deprecated": false + }, + { + "stixId": "attack-pattern--59bd0dec-f8b2-4b9a-9141-37a1e6899761", + "name": "Unused/Unsupported Cloud Regions", + "type": "technique", + "id": "T1535", + "url": "https://attack.mitre.org/techniques/T1535", + "deprecated": false + }, + { + "stixId": "attack-pattern--59ff91cd-1430-4075-8563-e6f15f4f9ff5", + "name": "DHCP Spoofing", + "type": "technique", + "id": "T1557.003", + "url": "https://attack.mitre.org/techniques/T1557/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--5ad95aaa-49c1-4784-821d-2e83f47b079b", + "name": "AppleScript", + "type": "technique", + "id": "T1155", + "url": "https://attack.mitre.org/techniques/T1155", + "deprecated": true + }, + { + "stixId": "attack-pattern--5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5", + "name": "Remote Service Session Hijacking", + "type": "technique", + "id": "T1563", + "url": "https://attack.mitre.org/techniques/T1563", + "deprecated": false + }, + { + "stixId": "attack-pattern--5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "name": "Binary Padding", + "type": "technique", + "id": "T1027.001", + "url": "https://attack.mitre.org/techniques/T1027/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--5d0d3609-d06d-49e1-b9c9-b544e0c618cb", + "name": "Web Shell", + "type": "technique", + "id": "T1505.003", + "url": "https://attack.mitre.org/techniques/T1505/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--5d2be8b9-d24c-4e98-83bf-2f5f79477163", + "name": "Group Policy Modification", + "type": "technique", + "id": "T1484.001", + "url": "https://attack.mitre.org/techniques/T1484/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--5e4a2073-9643-44cb-a0b5-e7f4048446c7", + "name": "Browser Information Discovery", + "type": "technique", + "id": "T1217", + "url": "https://attack.mitre.org/techniques/T1217", + "deprecated": false + }, + { + "stixId": "attack-pattern--60b508a1-6a5e-46b1-821a-9f7b78752abf", + "name": "Private Keys", + "type": "technique", + "id": "T1552.004", + "url": "https://attack.mitre.org/techniques/T1552/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--60c4b628-4807-4b0b-bbf5-fdac8643c337", + "name": "Server", + "type": "technique", + "id": "T1583.004", + "url": "https://attack.mitre.org/techniques/T1583/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65", + "name": "Windows Remote Management", + "type": "technique", + "id": "T1021.006", + "url": "https://attack.mitre.org/techniques/T1021/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--613d08bc-e8f4-4791-80b0-c8b974340dfd", + "name": "Exfiltration Over Bluetooth", + "type": "technique", + "id": "T1011.001", + "url": "https://attack.mitre.org/techniques/T1011/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--6151cbea-819b-455a-9fa6-99a1cc58797d", + "name": "Default Accounts", + "type": "technique", + "id": "T1078.001", + "url": "https://attack.mitre.org/techniques/T1078/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--61afc315-860c-4364-825d-0d62b2e91edc", + "name": "Time Providers", + "type": "technique", + "id": "T1547.003", + "url": "https://attack.mitre.org/techniques/T1547/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--62166220-e498-410f-a90a-19d4339d4e99", + "name": "Image File Execution Options Injection", + "type": "technique", + "id": "T1183", + "url": "https://attack.mitre.org/techniques/T1183", + "deprecated": true + }, + { + "stixId": "attack-pattern--62b8c999-dcc0-4755-bd69-09442d9359f5", + "name": "Rundll32", + "type": "technique", + "id": "T1085", + "url": "https://attack.mitre.org/techniques/T1085", + "deprecated": true + }, + { + "stixId": "attack-pattern--62dfd1ca-52d5-483c-a84b-d6e80bf94b7b", + "name": "Modify Existing Service", + "type": "technique", + "id": "T1031", + "url": "https://attack.mitre.org/techniques/T1031", + "deprecated": true + }, + { + "stixId": "attack-pattern--63220765-d418-44de-8fae-694b3912317d", + "name": "Trap", + "type": "technique", + "id": "T1546.005", + "url": "https://attack.mitre.org/techniques/T1546/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--633a100c-b2c9-41bf-9be5-905c1b16c825", + "name": "Dynamic Linker Hijacking", + "type": "technique", + "id": "T1574.006", + "url": "https://attack.mitre.org/techniques/T1574/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--635cbe30-392d-4e27-978e-66774357c762", + "name": "Local Account", + "type": "technique", + "id": "T1136.001", + "url": "https://attack.mitre.org/techniques/T1136/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--64196062-5210-42c3-9a02-563a0d1797ef", + "name": "Communication Through Removable Media", + "type": "technique", + "id": "T1092", + "url": "https://attack.mitre.org/techniques/T1092", + "deprecated": false + }, + { + "stixId": "attack-pattern--6495ae23-3ab4-43c5-a94f-5638a2c31fd2", + "name": "Clear Windows Event Logs", + "type": "technique", + "id": "T1070.001", + "url": "https://attack.mitre.org/techniques/T1070/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--65013dd2-bc61-43e3-afb5-a14c4fa7437a", + "name": "Email Accounts", + "type": "technique", + "id": "T1585.002", + "url": "https://attack.mitre.org/techniques/T1585/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--650c784b-7504-4df7-ab2c-4ea882384d1e", + "name": "LLMNR/NBT-NS Poisoning and SMB Relay", + "type": "technique", + "id": "T1557.001", + "url": "https://attack.mitre.org/techniques/T1557/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--65917ae0-b854-4139-83fe-bf2441cf0196", + "name": "File and Directory Permissions Modification", + "type": "technique", + "id": "T1222", + "url": "https://attack.mitre.org/techniques/T1222", + "deprecated": false + }, + { + "stixId": "attack-pattern--65f2d882-3f41-4d48-8a06-29af77ec9f90", + "name": "LSASS Memory", + "type": "technique", + "id": "T1003.001", + "url": "https://attack.mitre.org/techniques/T1003/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--6636bc83-0611-45a6-b74f-1f3daf635b8e", + "name": "At (Linux)", + "type": "technique", + "id": "T1053.001", + "url": "https://attack.mitre.org/techniques/T1053/001", + "deprecated": true + }, + { + "stixId": "attack-pattern--66f73398-8394-4711-85e5-34c8540b22a5", + "name": "Hooking", + "type": "technique", + "id": "T1179", + "url": "https://attack.mitre.org/techniques/T1179", + "deprecated": true + }, + { + "stixId": "attack-pattern--67073dde-d720-45ae-83da-b12d5e73ca3b", + "name": "Active Scanning", + "type": "technique", + "id": "T1595", + "url": "https://attack.mitre.org/techniques/T1595", + "deprecated": false + }, + { + "stixId": "attack-pattern--6747daa2-3533-4e78-8fb8-446ebb86448a", + "name": "Plist Modification", + "type": "technique", + "id": "T1547.011", + "url": "https://attack.mitre.org/techniques/T1547/011", + "deprecated": true + }, + { + "stixId": "attack-pattern--67720091-eee3-4d2d-ae16-8264567f6f5b", + "name": "Abuse Elevation Control Mechanism", + "type": "technique", + "id": "T1548", + "url": "https://attack.mitre.org/techniques/T1548", + "deprecated": false + }, + { + "stixId": "attack-pattern--677569f9-a8b0-459e-ab24-7f18091fa7bf", + "name": "Create Process with Token", + "type": "technique", + "id": "T1134.002", + "url": "https://attack.mitre.org/techniques/T1134/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--6831414d-bb70-42b7-8030-d4e06b2660c9", + "name": "Setuid and Setgid", + "type": "technique", + "id": "T1548.001", + "url": "https://attack.mitre.org/techniques/T1548/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--6836813e-8ec8-4375-b459-abb388cb1a35", + "name": "Winlogon Helper DLL", + "type": "technique", + "id": "T1547.004", + "url": "https://attack.mitre.org/techniques/T1547/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--6856ddd6-2df3-4379-8b87-284603c189c3", + "name": "System Firmware", + "type": "technique", + "id": "T1019", + "url": "https://attack.mitre.org/techniques/T1019", + "deprecated": true + }, + { + "stixId": "attack-pattern--68a0c5ed-bee2-4513-830d-5b0d650139bd", + "name": "Distributed Component Object Model", + "type": "technique", + "id": "T1021.003", + "url": "https://attack.mitre.org/techniques/T1021/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--68c96494-1a50-403e-8844-69a6af278c68", + "name": "Change Default File Association", + "type": "technique", + "id": "T1042", + "url": "https://attack.mitre.org/techniques/T1042", + "deprecated": true + }, + { + "stixId": "attack-pattern--68f7e3a1-f09f-4164-9a62-16b648a0dd5a", + "name": "Regsvr32", + "type": "technique", + "id": "T1117", + "url": "https://attack.mitre.org/techniques/T1117", + "deprecated": true + }, + { + "stixId": "attack-pattern--692074ae-bb62-4a5e-a735-02cb6bde458c", + "name": "Password Spraying", + "type": "technique", + "id": "T1110.003", + "url": "https://attack.mitre.org/techniques/T1110/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--69b8fd78-40e8-4600-ae4d-662c9d7afdb3", + "name": "External Proxy", + "type": "technique", + "id": "T1090.002", + "url": "https://attack.mitre.org/techniques/T1090/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--69e5226d-05dc-4f15-95d7-44f5ed78d06e", + "name": "Web Portal Capture", + "type": "technique", + "id": "T1056.003", + "url": "https://attack.mitre.org/techniques/T1056/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--69f897fd-12a9-4c89-ad6a-46d2f3c38262", + "name": "Email Addresses", + "type": "technique", + "id": "T1589.002", + "url": "https://attack.mitre.org/techniques/T1589/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--6a3be63a-64c5-4678-a036-03ff8fc35300", + "name": "Re-opened Applications", + "type": "technique", + "id": "T1164", + "url": "https://attack.mitre.org/techniques/T1164", + "deprecated": true + }, + { + "stixId": "attack-pattern--6a5848a8-6201-4a2c-8a6a-ca5af8c6f3df", + "name": "Indicator Blocking", + "type": "technique", + "id": "T1054", + "url": "https://attack.mitre.org/techniques/T1054", + "deprecated": true + }, + { + "stixId": "attack-pattern--6aabc5ec-eae6-422c-8311-38d45ee9838a", + "name": "Redundant Access", + "type": "technique", + "id": "T1108", + "url": "https://attack.mitre.org/techniques/T1108", + "deprecated": true + }, + { + "stixId": "attack-pattern--6aac77c4-eaf2-4366-8c13-ce50ab951f38", + "name": "Spearphishing Attachment", + "type": "technique", + "id": "T1193", + "url": "https://attack.mitre.org/techniques/T1193", + "deprecated": true + }, + { + "stixId": "attack-pattern--6add2ab5-2711-4e9d-87c8-7a0be8531530", + "name": "Cached Domain Credentials", + "type": "technique", + "id": "T1003.005", + "url": "https://attack.mitre.org/techniques/T1003/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--6b57dc31-b814-4a03-8706-28bc20d739c4", + "name": "SSH Authorized Keys", + "type": "technique", + "id": "T1098.004", + "url": "https://attack.mitre.org/techniques/T1098/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--6be14413-578e-46c1-8304-310762b3ecd5", + "name": "Kernel Modules and Extensions", + "type": "technique", + "id": "T1215", + "url": "https://attack.mitre.org/techniques/T1215", + "deprecated": true + }, + { + "stixId": "attack-pattern--6c174520-beea-43d9-aac6-28fb77f3e446", + "name": "Security Support Provider", + "type": "technique", + "id": "T1101", + "url": "https://attack.mitre.org/techniques/T1101", + "deprecated": true + }, + { + "stixId": "attack-pattern--6c2957f9-502a-478c-b1dd-d626c0659413", + "name": "Network Security Appliances", + "type": "technique", + "id": "T1590.006", + "url": "https://attack.mitre.org/techniques/T1590/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--6d4a7fb3-5a24-42be-ae61-6728a2b581f6", + "name": "Image File Execution Options Injection", + "type": "technique", + "id": "T1546.012", + "url": "https://attack.mitre.org/techniques/T1546/012", + "deprecated": false + }, + { + "stixId": "attack-pattern--6e3bd510-6b33-41a4-af80-2d80f3ee0071", + "name": "Odbcconf", + "type": "technique", + "id": "T1218.008", + "url": "https://attack.mitre.org/techniques/T1218/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--6e561441-8431-4773-a9b8-ccf28ef6a968", + "name": "Search Engines", + "type": "technique", + "id": "T1593.002", + "url": "https://attack.mitre.org/techniques/T1593/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--6e6845c2-347a-4a6f-a2d1-b74a18ebd352", + "name": "LSASS Driver", + "type": "technique", + "id": "T1177", + "url": "https://attack.mitre.org/techniques/T1177", + "deprecated": true + }, + { + "stixId": "attack-pattern--6ee2dc99-91ad-4534-a7d8-a649358c331f", + "name": "Business Relationships", + "type": "technique", + "id": "T1591.002", + "url": "https://attack.mitre.org/techniques/T1591/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--6faf650d-bf31-4eb4-802d-1000cf38efaf", + "name": "Video Capture", + "type": "technique", + "id": "T1125", + "url": "https://attack.mitre.org/techniques/T1125", + "deprecated": false + }, + { + "stixId": "attack-pattern--6fb6408c-0db3-41d9-a3a1-a32e5f16454e", + "name": "Gatekeeper Bypass", + "type": "technique", + "id": "T1144", + "url": "https://attack.mitre.org/techniques/T1144", + "deprecated": true + }, + { + "stixId": "attack-pattern--6ff403bc-93e3-48be-8687-e102fdba8c88", + "name": "Software Packing", + "type": "technique", + "id": "T1045", + "url": "https://attack.mitre.org/techniques/T1045", + "deprecated": true + }, + { + "stixId": "attack-pattern--7007935a-a8a7-4c0b-bd98-4e85be8ed197", + "name": "Process Doppelgänging", + "type": "technique", + "id": "T1055.013", + "url": "https://attack.mitre.org/techniques/T1055/013", + "deprecated": false + }, + { + "stixId": "attack-pattern--707399d6-ab3e-4963-9315-d9d3818cd6a0", + "name": "System Network Configuration Discovery", + "type": "technique", + "id": "T1016", + "url": "https://attack.mitre.org/techniques/T1016", + "deprecated": false + }, + { + "stixId": "attack-pattern--70857657-bd0b-4695-ad3e-b13f92cac1b4", + "name": "Delete Cloud Instance", + "type": "technique", + "id": "T1578.003", + "url": "https://attack.mitre.org/techniques/T1578/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--70910fbd-58dc-4c1c-8c48-814d11fcd022", + "name": "Code Repositories", + "type": "technique", + "id": "T1593.003", + "url": "https://attack.mitre.org/techniques/T1593/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--70d81154-b187-45f9-8ec5-295d01255979", + "name": "Executable Installer File Permissions Weakness", + "type": "technique", + "id": "T1574.005", + "url": "https://attack.mitre.org/techniques/T1574/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--70e52b04-2a0c-4cea-9d18-7149f1df9dc5", + "name": "Accessibility Features", + "type": "technique", + "id": "T1546.008", + "url": "https://attack.mitre.org/techniques/T1546/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--723e3a2b-ca0d-4daa-ada8-82ea35d3733a", + "name": "PowerShell Profile", + "type": "technique", + "id": "T1504", + "url": "https://attack.mitre.org/techniques/T1504", + "deprecated": true + }, + { + "stixId": "attack-pattern--72b5ef57-325c-411b-93ca-a3ca6fa17e31", + "name": "SIP and Trust Provider Hijacking", + "type": "technique", + "id": "T1198", + "url": "https://attack.mitre.org/techniques/T1198", + "deprecated": true + }, + { + "stixId": "attack-pattern--72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "name": "Account Discovery", + "type": "technique", + "id": "T1087", + "url": "https://attack.mitre.org/techniques/T1087", + "deprecated": false + }, + { + "stixId": "attack-pattern--731f4f55-b6d0-41d1-a7a9-072a66389aea", + "name": "Proxy", + "type": "technique", + "id": "T1090", + "url": "https://attack.mitre.org/techniques/T1090", + "deprecated": false + }, + { + "stixId": "attack-pattern--7385dfaf-6886-4229-9ecd-6fd678040830", + "name": "Command and Scripting Interpreter", + "type": "technique", + "id": "T1059", + "url": "https://attack.mitre.org/techniques/T1059", + "deprecated": false + }, + { + "stixId": "attack-pattern--74d2a63f-3c7b-4852-92da-02d8fbab16da", + "name": "Indicator Blocking", + "type": "technique", + "id": "T1562.006", + "url": "https://attack.mitre.org/techniques/T1562/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--7610cada-1499-41a4-b3dd-46467b68d177", + "name": "Domain Account", + "type": "technique", + "id": "T1136.002", + "url": "https://attack.mitre.org/techniques/T1136/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--76551c52-b111-4884-bc47-ff3e728f0156", + "name": "Employee Names", + "type": "technique", + "id": "T1589.003", + "url": "https://attack.mitre.org/techniques/T1589/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--767dbf9e-df3f-45cb-8998-4903ab5f80c0", + "name": "Domain Trust Discovery", + "type": "technique", + "id": "T1482", + "url": "https://attack.mitre.org/techniques/T1482", + "deprecated": false + }, + { + "stixId": "attack-pattern--768dce68-8d0d-477a-b01d-0eea98b963a1", + "name": "Golden Ticket", + "type": "technique", + "id": "T1558.001", + "url": "https://attack.mitre.org/techniques/T1558/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--772bc7a8-a157-42cc-8728-d648e25c7fe7", + "name": "Component Object Model and Distributed COM", + "type": "technique", + "id": "T1175", + "url": "https://attack.mitre.org/techniques/T1175", + "deprecated": true + }, + { + "stixId": "attack-pattern--774a3188-6ba9-4dc4-879d-d54ee48a5ce9", + "name": "Automated Exfiltration", + "type": "technique", + "id": "T1020", + "url": "https://attack.mitre.org/techniques/T1020", + "deprecated": false + }, + { + "stixId": "attack-pattern--774ad5bb-2366-4c13-a8a9-65e50b292e7c", + "name": "Client Configurations", + "type": "technique", + "id": "T1592.004", + "url": "https://attack.mitre.org/techniques/T1592/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--77532a55-c283-4cd2-bc5d-2d0b65e9d88c", + "name": "Disable or Modify Cloud Firewall", + "type": "technique", + "id": "T1562.007", + "url": "https://attack.mitre.org/techniques/T1562/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--77eae145-55db-4519-8ae5-77b0c7215d69", + "name": "Right-to-Left Override", + "type": "technique", + "id": "T1036.002", + "url": "https://attack.mitre.org/techniques/T1036/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--7807d3a4-a885-4639-a786-c1ed41484970", + "name": "Malware", + "type": "technique", + "id": "T1588.001", + "url": "https://attack.mitre.org/techniques/T1588/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--791481f8-e96a-41be-b089-a088763083d4", + "name": "Component Firmware", + "type": "technique", + "id": "T1542.002", + "url": "https://attack.mitre.org/techniques/T1542/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--799ace7f-e227-4411-baa0-8868704f2a69", + "name": "Indicator Removal", + "type": "technique", + "id": "T1070", + "url": "https://attack.mitre.org/techniques/T1070", + "deprecated": false + }, + { + "stixId": "attack-pattern--79a4052e-1a89-4b09-aea6-51f1d11fe19c", + "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol", + "type": "technique", + "id": "T1048.001", + "url": "https://attack.mitre.org/techniques/T1048/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--79a47ad0-fc3b-4821-9f01-a026b1ddba21", + "name": "Office Template Macros", + "type": "technique", + "id": "T1137.001", + "url": "https://attack.mitre.org/techniques/T1137/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--79da0971-3147-4af6-a4f5-e8cd447cd795", + "name": "Virtual Private Server", + "type": "technique", + "id": "T1583.003", + "url": "https://attack.mitre.org/techniques/T1583/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--7ad38ef1-381a-406d-872a-38b136eb5ecc", + "name": "Confluence", + "type": "technique", + "id": "T1213.001", + "url": "https://attack.mitre.org/techniques/T1213/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--7b211ac6-c815-4189-93a9-ab415deca926", + "name": "Pass the Ticket", + "type": "technique", + "id": "T1550.003", + "url": "https://attack.mitre.org/techniques/T1550/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--7b50a1d3-4ca7-45d1-989d-a6503f04bfe1", + "name": "Container Administration Command", + "type": "technique", + "id": "T1609", + "url": "https://attack.mitre.org/techniques/T1609", + "deprecated": false + }, + { + "stixId": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18", + "name": "File and Directory Discovery", + "type": "technique", + "id": "T1083", + "url": "https://attack.mitre.org/techniques/T1083", + "deprecated": false + }, + { + "stixId": "attack-pattern--7bd9c723-2f78-4309-82c5-47cad406572b", + "name": "Dynamic Resolution", + "type": "technique", + "id": "T1568", + "url": "https://attack.mitre.org/techniques/T1568", + "deprecated": false + }, + { + "stixId": "attack-pattern--7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "name": "Masquerade Task or Service", + "type": "technique", + "id": "T1036.004", + "url": "https://attack.mitre.org/techniques/T1036/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--7c0f17c9-1af6-4628-9cbd-9e45482dd605", + "name": "Asynchronous Procedure Call", + "type": "technique", + "id": "T1055.004", + "url": "https://attack.mitre.org/techniques/T1055/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--7c46b364-8496-4234-8a56-f7e6727e21e1", + "name": "Traffic Duplication", + "type": "technique", + "id": "T1020.001", + "url": "https://attack.mitre.org/techniques/T1020/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--7c93aa74-4bc0-4a9e-90ea-f25f86301566", + "name": "Application Shimming", + "type": "technique", + "id": "T1138", + "url": "https://attack.mitre.org/techniques/T1138", + "deprecated": true + }, + { + "stixId": "attack-pattern--7d20fff9-8751-404e-badd-ccd71bda0236", + "name": "Plist File Modification", + "type": "technique", + "id": "T1647", + "url": "https://attack.mitre.org/techniques/T1647", + "deprecated": false + }, + { + "stixId": "attack-pattern--7d57b371-10c2-45e5-b3cc-83a8fb380e4c", + "name": "AppCert DLLs", + "type": "technique", + "id": "T1546.009", + "url": "https://attack.mitre.org/techniques/T1546/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--7d6f590f-544b-45b4-9a42-e0805f342af3", + "name": "CMSTP", + "type": "technique", + "id": "T1191", + "url": "https://attack.mitre.org/techniques/T1191", + "deprecated": true + }, + { + "stixId": "attack-pattern--7d751199-05fa-4a72-920f-85df4506c76c", + "name": "Multi-hop Proxy", + "type": "technique", + "id": "T1188", + "url": "https://attack.mitre.org/techniques/T1188", + "deprecated": true + }, + { + "stixId": "attack-pattern--7d77a07d-02fe-4e88-8bd9-e9c008c01bf0", + "name": "Email Forwarding Rule", + "type": "technique", + "id": "T1114.003", + "url": "https://attack.mitre.org/techniques/T1114/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "name": "Data Staged", + "type": "technique", + "id": "T1074", + "url": "https://attack.mitre.org/techniques/T1074", + "deprecated": false + }, + { + "stixId": "attack-pattern--7de1f7ac-5d0c-4c9c-8873-627202205331", + "name": "Steal or Forge Authentication Certificates", + "type": "technique", + "id": "T1649", + "url": "https://attack.mitre.org/techniques/T1649", + "deprecated": false + }, + { + "stixId": "attack-pattern--7decb26c-715c-40cf-b7e0-026f7d7cc215", + "name": "Device Registration", + "type": "technique", + "id": "T1098.005", + "url": "https://attack.mitre.org/techniques/T1098/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--7e150503-88e7-4861-866b-ff1ac82c4475", + "name": "System Network Connections Discovery", + "type": "technique", + "id": "T1049", + "url": "https://attack.mitre.org/techniques/T1049", + "deprecated": false + }, + { + "stixId": "attack-pattern--7e3beebd-8bfe-4e7b-a892-e44ab06a75f9", + "name": "Compromise Infrastructure", + "type": "technique", + "id": "T1584", + "url": "https://attack.mitre.org/techniques/T1584", + "deprecated": false + }, + { + "stixId": "attack-pattern--7e7c2fba-7cca-486c-9582-4c1bb2851961", + "name": "Mark-of-the-Web Bypass", + "type": "technique", + "id": "T1553.005", + "url": "https://attack.mitre.org/techniques/T1553/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--7efba77e-3bc4-4ca5-8292-d8201dcd64b5", + "name": "Disable Crypto Hardware", + "type": "technique", + "id": "T1600.002", + "url": "https://attack.mitre.org/techniques/T1600/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--7f0ca133-88c4-40c6-a62f-b3083a7fbc2e", + "name": "Pre-OS Boot", + "type": "technique", + "id": "T1542", + "url": "https://attack.mitre.org/techniques/T1542", + "deprecated": false + }, + { + "stixId": "attack-pattern--7fd87010-3a00-4da3-b905-410525e8ec44", + "name": "Scripting", + "type": "technique", + "id": "T1064", + "url": "https://attack.mitre.org/techniques/T1064", + "deprecated": true + }, + { + "stixId": "attack-pattern--800f9819-7007-4540-a520-40e655876800", + "name": "Build Image on Host", + "type": "technique", + "id": "T1612", + "url": "https://attack.mitre.org/techniques/T1612", + "deprecated": false + }, + { + "stixId": "attack-pattern--804c042c-cfe6-449e-bc1a-ba0a998a70db", + "name": "Shared Webroot", + "type": "technique", + "id": "T1051", + "url": "https://attack.mitre.org/techniques/T1051", + "deprecated": true + }, + { + "stixId": "attack-pattern--806a49c4-970d-43f9-9acc-ac0ee11e6662", + "name": "Portable Executable Injection", + "type": "technique", + "id": "T1055.002", + "url": "https://attack.mitre.org/techniques/T1055/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--808e6329-ca91-4b87-ac2d-8eadc5f8f327", + "name": "Verclsid", + "type": "technique", + "id": "T1218.012", + "url": "https://attack.mitre.org/techniques/T1218/012", + "deprecated": false + }, + { + "stixId": "attack-pattern--81033c3b-16a4-46e4-8fed-9b030dd03c4a", + "name": "Compromise Accounts", + "type": "technique", + "id": "T1586", + "url": "https://attack.mitre.org/techniques/T1586", + "deprecated": false + }, + { + "stixId": "attack-pattern--810aa4ad-61c9-49cb-993f-daa06199421d", + "name": "Launchctl", + "type": "technique", + "id": "T1569.001", + "url": "https://attack.mitre.org/techniques/T1569/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--810d8072-afb6-4a56-9ee7-86379ac4a6f3", + "name": "Botnet", + "type": "technique", + "id": "T1584.005", + "url": "https://attack.mitre.org/techniques/T1584/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--818302b2-d640-477b-bf88-873120ce85c4", + "name": "Network Device CLI", + "type": "technique", + "id": "T1059.008", + "url": "https://attack.mitre.org/techniques/T1059/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--8187bd2a-866f-4457-9009-86b0ddedffa3", + "name": "Bash History", + "type": "technique", + "id": "T1552.003", + "url": "https://attack.mitre.org/techniques/T1552/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--824add00-99a1-4b15-9a2d-6c5683b7b497", + "name": "Downgrade Attack", + "type": "technique", + "id": "T1562.010", + "url": "https://attack.mitre.org/techniques/T1562/010", + "deprecated": false + }, + { + "stixId": "attack-pattern--8252f135-ed26-4ce1-ae61-f26e94429a19", + "name": "XPC Services", + "type": "technique", + "id": "T1559.003", + "url": "https://attack.mitre.org/techniques/T1559/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--82caa33e-d11a-433a-94ea-9b5a5fbef81d", + "name": "Virtualization/Sandbox Evasion", + "type": "technique", + "id": "T1497", + "url": "https://attack.mitre.org/techniques/T1497", + "deprecated": false + }, + { + "stixId": "attack-pattern--830c9528-df21-472c-8c14-a036bf17d665", + "name": "Web Service", + "type": "technique", + "id": "T1102", + "url": "https://attack.mitre.org/techniques/T1102", + "deprecated": false + }, + { + "stixId": "attack-pattern--837f9164-50af-4ac0-8219-379d8a74cefc", + "name": "Credentials In Files", + "type": "technique", + "id": "T1552.001", + "url": "https://attack.mitre.org/techniques/T1552/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--83a766f8-1501-4b3a-a2de-2e2849e8dfc1", + "name": "DNS Calculation", + "type": "technique", + "id": "T1568.003", + "url": "https://attack.mitre.org/techniques/T1568/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--840a987a-99bd-4a80-a5c9-0cb2baa6cade", + "name": "Mshta", + "type": "technique", + "id": "T1218.005", + "url": "https://attack.mitre.org/techniques/T1218/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--84601337-6a55-4ad7-9c35-79e0d1ea2ab3", + "name": "Login Items", + "type": "technique", + "id": "T1547.015", + "url": "https://attack.mitre.org/techniques/T1547/015", + "deprecated": false + }, + { + "stixId": "attack-pattern--84771bc3-f6a0-403e-b144-01af70e5fda0", + "name": "Stage Capabilities", + "type": "technique", + "id": "T1608", + "url": "https://attack.mitre.org/techniques/T1608", + "deprecated": false + }, + { + "stixId": "attack-pattern--84ae8255-b4f4-4237-b5c5-e717405a9701", + "name": "Link Target", + "type": "technique", + "id": "T1608.005", + "url": "https://attack.mitre.org/techniques/T1608/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--84e02621-8fdf-470f-bd58-993bb6a89d91", + "name": "Multi-Stage Channels", + "type": "technique", + "id": "T1104", + "url": "https://attack.mitre.org/techniques/T1104", + "deprecated": false + }, + { + "stixId": "attack-pattern--853c4192-4311-43e1-bfbb-b11b14911852", + "name": "Execution Guardrails", + "type": "technique", + "id": "T1480", + "url": "https://attack.mitre.org/techniques/T1480", + "deprecated": false + }, + { + "stixId": "attack-pattern--8565825b-21c8-4518-b75e-cbc4c717a156", + "name": "Cloud Storage Object Discovery", + "type": "technique", + "id": "T1619", + "url": "https://attack.mitre.org/techniques/T1619", + "deprecated": false + }, + { + "stixId": "attack-pattern--861b8fd2-57f3-4ee1-ab5d-c19c3b8c7a4a", + "name": "Web Cookies", + "type": "technique", + "id": "T1606.001", + "url": "https://attack.mitre.org/techniques/T1606/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--86850eff-2729-40c3-b85e-c4af26da4a2d", + "name": "Token Impersonation/Theft", + "type": "technique", + "id": "T1134.001", + "url": "https://attack.mitre.org/techniques/T1134/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--86a96bf6-cf8b-411c-aaeb-8959944d64f7", + "name": "Exfiltration to Code Repository", + "type": "technique", + "id": "T1567.001", + "url": "https://attack.mitre.org/techniques/T1567/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--8861073d-d1b8-4941-82ce-dce621d398f0", + "name": "Cloud Services", + "type": "technique", + "id": "T1021.007", + "url": "https://attack.mitre.org/techniques/T1021/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--8868cb5b-d575-4a60-acb2-07d37389a2fd", + "name": "Port Knocking", + "type": "technique", + "id": "T1205.001", + "url": "https://attack.mitre.org/techniques/T1205/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--88d31120-5bc7-4ce3-a9c0-7cf147be8e54", + "name": "Web Services", + "type": "technique", + "id": "T1583.006", + "url": "https://attack.mitre.org/techniques/T1583/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--890c9858-598c-401d-a4d5-c67ebcdd703a", + "name": "Steal Application Access Token", + "type": "technique", + "id": "T1528", + "url": "https://attack.mitre.org/techniques/T1528", + "deprecated": false + }, + { + "stixId": "attack-pattern--8982a661-d84c-48c0-b4ec-1db29c6cf3bc", + "name": "Spearphishing Attachment", + "type": "technique", + "id": "T1598.002", + "url": "https://attack.mitre.org/techniques/T1598/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--8a2f40cf-8325-47f9-96e4-b1ca4c7389bd", + "name": "Additional Cloud Credentials", + "type": "technique", + "id": "T1098.001", + "url": "https://attack.mitre.org/techniques/T1098/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--8c32eb4d-805f-4fc5-bf60-c4d476c131b5", + "name": "User Execution", + "type": "technique", + "id": "T1204", + "url": "https://attack.mitre.org/techniques/T1204", + "deprecated": false + }, + { + "stixId": "attack-pattern--8c41090b-aa47-4331-986b-8c9a51a91103", + "name": "Internal Defacement", + "type": "technique", + "id": "T1491.001", + "url": "https://attack.mitre.org/techniques/T1491/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--8c4aef43-48d5-49aa-b2af-c0cd58d30c3d", + "name": "Hidden Users", + "type": "technique", + "id": "T1564.002", + "url": "https://attack.mitre.org/techniques/T1564/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--8cdeb020-e31e-4f88-a582-f53dcfbda819", + "name": "Make and Impersonate Token", + "type": "technique", + "id": "T1134.003", + "url": "https://attack.mitre.org/techniques/T1134/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--8d7bd4f5-3a89-4453-9c82-2c8894d5655e", + "name": "Group Policy Preferences", + "type": "technique", + "id": "T1552.006", + "url": "https://attack.mitre.org/techniques/T1552/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--8df54627-376c-487c-a09c-7d2b5620f56e", + "name": "Control Panel Items", + "type": "technique", + "id": "T1196", + "url": "https://attack.mitre.org/techniques/T1196", + "deprecated": true + }, + { + "stixId": "attack-pattern--8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5", + "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol", + "type": "technique", + "id": "T1048.002", + "url": "https://attack.mitre.org/techniques/T1048/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--8f104855-e5b7-4077-b1f5-bc3103b41abe", + "name": "Cloud Account", + "type": "technique", + "id": "T1087.004", + "url": "https://attack.mitre.org/techniques/T1087/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "name": "Process Discovery", + "type": "technique", + "id": "T1057", + "url": "https://attack.mitre.org/techniques/T1057", + "deprecated": false + }, + { + "stixId": "attack-pattern--8f504411-cb96-4dac-a537-8d2bb7679c59", + "name": "Impair Command History Logging", + "type": "technique", + "id": "T1562.003", + "url": "https://attack.mitre.org/techniques/T1562/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--8faedf87-dceb-4c35-b2a2-7286f59a3bc3", + "name": "Launchd", + "type": "technique", + "id": "T1053.004", + "url": "https://attack.mitre.org/techniques/T1053/004", + "deprecated": true + }, + { + "stixId": "attack-pattern--90c4a591-d02d-490b-92aa-619d9701ac04", + "name": "Network Provider DLL", + "type": "technique", + "id": "T1556.008", + "url": "https://attack.mitre.org/techniques/T1556/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--910906dd-8c0a-475a-9cc1-5e029e2fad58", + "name": "Windows Management Instrumentation Event Subscription", + "type": "technique", + "id": "T1546.003", + "url": "https://attack.mitre.org/techniques/T1546/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--91177e6d-b616-4a03-ba4b-f3b32f7dda75", + "name": "CDNs", + "type": "technique", + "id": "T1596.004", + "url": "https://attack.mitre.org/techniques/T1596/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--91541e7e-b969-40c6-bbd8-1b5352ec2938", + "name": "User Activity Based Checks", + "type": "technique", + "id": "T1497.002", + "url": "https://attack.mitre.org/techniques/T1497/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--91ce1ede-107f-4d8b-bf4c-735e8789c94b", + "name": "Input Prompt", + "type": "technique", + "id": "T1141", + "url": "https://attack.mitre.org/techniques/T1141", + "deprecated": true + }, + { + "stixId": "attack-pattern--926d8cfd-1d0d-4da2-ab49-3ca10ec3f3b5", + "name": "Cloud Accounts", + "type": "technique", + "id": "T1585.003", + "url": "https://attack.mitre.org/techniques/T1585/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--92a78814-b191-47ca-909c-1ccfe3777414", + "name": "Software Deployment Tools", + "type": "technique", + "id": "T1072", + "url": "https://attack.mitre.org/techniques/T1072", + "deprecated": false + }, + { + "stixId": "attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d", + "name": "Exfiltration Over C2 Channel", + "type": "technique", + "id": "T1041", + "url": "https://attack.mitre.org/techniques/T1041", + "deprecated": false + }, + { + "stixId": "attack-pattern--93591901-3172-4e94-abf8-6034ab26f44a", + "name": "Parent PID Spoofing", + "type": "technique", + "id": "T1134.004", + "url": "https://attack.mitre.org/techniques/T1134/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--937e4772-8441-4e4a-8bf0-8d447d667e23", + "name": "Gather Victim Org Information", + "type": "technique", + "id": "T1591", + "url": "https://attack.mitre.org/techniques/T1591", + "deprecated": false + }, + { + "stixId": "attack-pattern--9422fc14-1c43-410d-ab0f-a709b76c72dc", + "name": "Registry Run Keys / Startup Folder", + "type": "technique", + "id": "T1060", + "url": "https://attack.mitre.org/techniques/T1060", + "deprecated": true + }, + { + "stixId": "attack-pattern--94cb00a4-b295-4d06-aa2b-5653b9c1be9c", + "name": "Forge Web Credentials", + "type": "technique", + "id": "T1606", + "url": "https://attack.mitre.org/techniques/T1606", + "deprecated": false + }, + { + "stixId": "attack-pattern--954a1639-f2d6-407d-aef3-4917622ca493", + "name": "Multi-Factor Authentication Request Generation", + "type": "technique", + "id": "T1621", + "url": "https://attack.mitre.org/techniques/T1621", + "deprecated": false + }, + { + "stixId": "attack-pattern--960c3c86-1480-4d72-b4e0-8c242e84a5c5", + "name": "Compromise Client Software Binary", + "type": "technique", + "id": "T1554", + "url": "https://attack.mitre.org/techniques/T1554", + "deprecated": false + }, + { + "stixId": "attack-pattern--9664ad0e-789e-40ac-82e2-d7b17fbe8fb3", + "name": "Chat Messages", + "type": "technique", + "id": "T1552.008", + "url": "https://attack.mitre.org/techniques/T1552/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736", + "name": "PowerShell", + "type": "technique", + "id": "T1059.001", + "url": "https://attack.mitre.org/techniques/T1059/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--970cdb5c-02fb-4c38-b17e-d6327cf3c810", + "name": "Shortcut Modification", + "type": "technique", + "id": "T1023", + "url": "https://attack.mitre.org/techniques/T1023", + "deprecated": true + }, + { + "stixId": "attack-pattern--98034fef-d9fb-4667-8dc4-2eab6231724c", + "name": "Change Default File Association", + "type": "technique", + "id": "T1546.001", + "url": "https://attack.mitre.org/techniques/T1546/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--98be40f2-c86b-4ade-b6fc-4964932040e5", + "name": "VDSO Hijacking", + "type": "technique", + "id": "T1055.014", + "url": "https://attack.mitre.org/techniques/T1055/014", + "deprecated": false + }, + { + "stixId": "attack-pattern--99709758-2b96-48f2-a68a-ad7fbd828091", + "name": "Multiband Communication", + "type": "technique", + "id": "T1026", + "url": "https://attack.mitre.org/techniques/T1026", + "deprecated": true + }, + { + "stixId": "attack-pattern--9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "name": "File Transfer Protocols", + "type": "technique", + "id": "T1071.002", + "url": "https://attack.mitre.org/techniques/T1071/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--9b52fca7-1a36-4da0-b62d-da5bd83b4d69", + "name": "Component Object Model Hijacking", + "type": "technique", + "id": "T1122", + "url": "https://attack.mitre.org/techniques/T1122", + "deprecated": true + }, + { + "stixId": "attack-pattern--9b99b83a-1aac-4e29-b975-b374950551a3", + "name": "Accessibility Features", + "type": "technique", + "id": "T1015", + "url": "https://attack.mitre.org/techniques/T1015", + "deprecated": true + }, + { + "stixId": "attack-pattern--9c306d8d-cde7-4b4c-b6e8-d0bb16caca36", + "name": "Exploitation for Credential Access", + "type": "technique", + "id": "T1212", + "url": "https://attack.mitre.org/techniques/T1212", + "deprecated": false + }, + { + "stixId": "attack-pattern--9c45eaa3-8604-4780-8988-b5074dbb9ecd", + "name": "Emond", + "type": "technique", + "id": "T1546.014", + "url": "https://attack.mitre.org/techniques/T1546/014", + "deprecated": false + }, + { + "stixId": "attack-pattern--9c99724c-a483-4d60-ad9d-7f004e42e8e8", + "name": "One-Way Communication", + "type": "technique", + "id": "T1102.003", + "url": "https://attack.mitre.org/techniques/T1102/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--9d48cab2-7929-4812-ad22-f536665f0109", + "name": "Gather Victim Network Information", + "type": "technique", + "id": "T1590", + "url": "https://attack.mitre.org/techniques/T1590", + "deprecated": false + }, + { + "stixId": "attack-pattern--9db0cf3a-a3c9-4012-8268-123b9db6fd82", + "name": "Exploitation of Remote Services", + "type": "technique", + "id": "T1210", + "url": "https://attack.mitre.org/techniques/T1210", + "deprecated": false + }, + { + "stixId": "attack-pattern--9ddc2534-e91c-4dab-a8f6-43dab81e8142", + "name": "Parent PID Spoofing", + "type": "technique", + "id": "T1502", + "url": "https://attack.mitre.org/techniques/T1502", + "deprecated": true + }, + { + "stixId": "attack-pattern--9e09ddb2-1746-4448-9cad-7f8b41777d6d", + "name": "Keychain", + "type": "technique", + "id": "T1142", + "url": "https://attack.mitre.org/techniques/T1142", + "deprecated": true + }, + { + "stixId": "attack-pattern--9e7452df-5144-4b6e-b04a-b66dd4016747", + "name": "Internal Spearphishing", + "type": "technique", + "id": "T1534", + "url": "https://attack.mitre.org/techniques/T1534", + "deprecated": false + }, + { + "stixId": "attack-pattern--9e80ddfb-ce32-4961-a778-ca6a10cfae72", + "name": "Sudo", + "type": "technique", + "id": "T1169", + "url": "https://attack.mitre.org/techniques/T1169", + "deprecated": true + }, + { + "stixId": "attack-pattern--9e8b28c9-35fe-48ac-a14d-e6cc032dcbcd", + "name": "Services File Permissions Weakness", + "type": "technique", + "id": "T1574.010", + "url": "https://attack.mitre.org/techniques/T1574/010", + "deprecated": false + }, + { + "stixId": "attack-pattern--9efb1ea7-c37b-4595-9640-b7680cd84279", + "name": "Registry Run Keys / Startup Folder", + "type": "technique", + "id": "T1547.001", + "url": "https://attack.mitre.org/techniques/T1547/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--9fa07bef-9c81-421e-a8e5-ad4366c5a925", + "name": "Trusted Relationship", + "type": "technique", + "id": "T1199", + "url": "https://attack.mitre.org/techniques/T1199", + "deprecated": false + }, + { + "stixId": "attack-pattern--a009cb25-4801-4116-9105-80a91cf15c1b", + "name": "Cloud Account", + "type": "technique", + "id": "T1136.003", + "url": "https://attack.mitre.org/techniques/T1136/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--a01bf75f-00b2-4568-a58f-565ff9bf202b", + "name": "Local Groups", + "type": "technique", + "id": "T1069.001", + "url": "https://attack.mitre.org/techniques/T1069/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--a0a189c8-d3bd-4991-bf6f-153d185ee373", + "name": "LC_MAIN Hijacking", + "type": "technique", + "id": "T1149", + "url": "https://attack.mitre.org/techniques/T1149", + "deprecated": true + }, + { + "stixId": "attack-pattern--a0e6614a-7740-4b24-bd65-f1bde09fc365", + "name": "Search Open Websites/Domains", + "type": "technique", + "id": "T1593", + "url": "https://attack.mitre.org/techniques/T1593", + "deprecated": false + }, + { + "stixId": "attack-pattern--a10641f4-87b4-45a3-a906-92a149cb2c27", + "name": "Account Manipulation", + "type": "technique", + "id": "T1098", + "url": "https://attack.mitre.org/techniques/T1098", + "deprecated": false + }, + { + "stixId": "attack-pattern--a127c32c-cbb0-4f9d-be07-881a792408ec", + "name": "Mshta", + "type": "technique", + "id": "T1170", + "url": "https://attack.mitre.org/techniques/T1170", + "deprecated": true + }, + { + "stixId": "attack-pattern--a19e86f8-1c0a-4fea-8407-23b73d615776", + "name": "Exfiltration Over Alternative Protocol", + "type": "technique", + "id": "T1048", + "url": "https://attack.mitre.org/techniques/T1048", + "deprecated": false + }, + { + "stixId": "attack-pattern--a1b52199-c8c5-438a-9ded-656f1d0888c6", + "name": "Kernel Modules and Extensions", + "type": "technique", + "id": "T1547.006", + "url": "https://attack.mitre.org/techniques/T1547/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--a2029942-0a85-4947-b23c-ca434698171d", + "name": "GUI Input Capture", + "type": "technique", + "id": "T1056.002", + "url": "https://attack.mitre.org/techniques/T1056/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--a257ed11-ff3b-4216-8c9d-3938ef57064c", + "name": "Pass the Ticket", + "type": "technique", + "id": "T1097", + "url": "https://attack.mitre.org/techniques/T1097", + "deprecated": true + }, + { + "stixId": "attack-pattern--a2fdce72-04b2-409a-ac10-cc1695f4fce0", + "name": "Tool", + "type": "technique", + "id": "T1588.002", + "url": "https://attack.mitre.org/techniques/T1588/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--a3e1e6c5-9c74-4fc0-a16c-a9d228c17829", + "name": "Exfiltration over USB", + "type": "technique", + "id": "T1052.001", + "url": "https://attack.mitre.org/techniques/T1052/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--a4657bc9-d22f-47d2-a7b7-dd6ec33f3dde", + "name": "KernelCallbackTable", + "type": "technique", + "id": "T1574.013", + "url": "https://attack.mitre.org/techniques/T1574/013", + "deprecated": false + }, + { + "stixId": "attack-pattern--a51eb150-93b1-484b-a503-e51453b127a4", + "name": "Search Closed Sources", + "type": "technique", + "id": "T1597", + "url": "https://attack.mitre.org/techniques/T1597", + "deprecated": false + }, + { + "stixId": "attack-pattern--a542bac9-7bc1-4da7-9a09-96f69e23cc21", + "name": "Systemd Timers", + "type": "technique", + "id": "T1053.006", + "url": "https://attack.mitre.org/techniques/T1053/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "name": "Phishing", + "type": "technique", + "id": "T1566", + "url": "https://attack.mitre.org/techniques/T1566", + "deprecated": false + }, + { + "stixId": "attack-pattern--a6525aec-acc4-47fe-92f9-b9b4de4b9228", + "name": "Graphical User Interface", + "type": "technique", + "id": "T1061", + "url": "https://attack.mitre.org/techniques/T1061", + "deprecated": true + }, + { + "stixId": "attack-pattern--a6557c75-798f-42e4-be70-ab4502e0a3bc", + "name": "ROMMONkit", + "type": "technique", + "id": "T1542.004", + "url": "https://attack.mitre.org/techniques/T1542/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--a6937325-9321-4e2e-bb2b-3ed2d40b2a9d", + "name": "Compiled HTML File", + "type": "technique", + "id": "T1218.001", + "url": "https://attack.mitre.org/techniques/T1218/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--a750a9f6-0bde-4bb3-9aae-1e2786e9780c", + "name": "Network Share Connection Removal", + "type": "technique", + "id": "T1070.005", + "url": "https://attack.mitre.org/techniques/T1070/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--a782ebe2-daba-42c7-bc82-e8e9d923162d", + "name": "Multi-hop Proxy", + "type": "technique", + "id": "T1090.003", + "url": "https://attack.mitre.org/techniques/T1090/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--a93494bb-4b80-4ea1-8695-3236a49916fd", + "name": "Brute Force", + "type": "technique", + "id": "T1110", + "url": "https://attack.mitre.org/techniques/T1110", + "deprecated": false + }, + { + "stixId": "attack-pattern--a9d4b653-6915-42af-98b2-5758c4ceee56", + "name": "Unix Shell", + "type": "technique", + "id": "T1059.004", + "url": "https://attack.mitre.org/techniques/T1059/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--a9e2cea0-c805-4bf8-9e31-f5f0513a3634", + "name": "Outlook Forms", + "type": "technique", + "id": "T1137.003", + "url": "https://attack.mitre.org/techniques/T1137/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--aa8bfbc9-78dc-41a4-a03b-7453e0fdccda", + "name": "Dylib Hijacking", + "type": "technique", + "id": "T1157", + "url": "https://attack.mitre.org/techniques/T1157", + "deprecated": true + }, + { + "stixId": "attack-pattern--ac08589e-ee59-4935-8667-d845e38fe579", + "name": "Disable or Modify Tools", + "type": "technique", + "id": "T1562.001", + "url": "https://attack.mitre.org/techniques/T1562/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--ac9e6b22-11bf-45d7-9181-c1cb08360931", + "name": "Data Manipulation", + "type": "technique", + "id": "T1565", + "url": "https://attack.mitre.org/techniques/T1565", + "deprecated": false + }, + { + "stixId": "attack-pattern--acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "name": "Inter-Process Communication", + "type": "technique", + "id": "T1559", + "url": "https://attack.mitre.org/techniques/T1559", + "deprecated": false + }, + { + "stixId": "attack-pattern--ad255bfe-a9e6-4b52-a258-8d3462abe842", + "name": "Data Obfuscation", + "type": "technique", + "id": "T1001", + "url": "https://attack.mitre.org/techniques/T1001", + "deprecated": false + }, + { + "stixId": "attack-pattern--ae676644-d2d2-41b7-af7e-9bed1b55898c", + "name": "Data from Network Shared Drive", + "type": "technique", + "id": "T1039", + "url": "https://attack.mitre.org/techniques/T1039", + "deprecated": false + }, + { + "stixId": "attack-pattern--ae797531-3219-49a4-bccf-324ad7a4c7b2", + "name": "Web Services", + "type": "technique", + "id": "T1584.006", + "url": "https://attack.mitre.org/techniques/T1584/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--ae7f3575-0a5e-427e-991b-fe03ad44c754", + "name": "Modify System Image", + "type": "technique", + "id": "T1601", + "url": "https://attack.mitre.org/techniques/T1601", + "deprecated": false + }, + { + "stixId": "attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6", + "name": "Hijack Execution Flow", + "type": "technique", + "id": "T1574", + "url": "https://attack.mitre.org/techniques/T1574", + "deprecated": false + }, + { + "stixId": "attack-pattern--b0533c6e-8fea-4788-874f-b799cacc4b92", + "name": "Indicator Removal from Tools", + "type": "technique", + "id": "T1027.005", + "url": "https://attack.mitre.org/techniques/T1027/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--b0c74ef9-c61e-4986-88cb-78da98a355ec", + "name": "Malicious Image", + "type": "technique", + "id": "T1204.003", + "url": "https://attack.mitre.org/techniques/T1204/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--b17a1a56-e99c-403c-8948-561df0cffe81", + "name": "Valid Accounts", + "type": "technique", + "id": "T1078", + "url": "https://attack.mitre.org/techniques/T1078", + "deprecated": false + }, + { + "stixId": "attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18", + "name": "Non-Standard Port", + "type": "technique", + "id": "T1571", + "url": "https://attack.mitre.org/techniques/T1571", + "deprecated": false + }, + { + "stixId": "attack-pattern--b1ccd744-3f78-4a0e-9bb2-2002057f7928", + "name": "Social Media Accounts", + "type": "technique", + "id": "T1585.001", + "url": "https://attack.mitre.org/techniques/T1585/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--b2001907-166b-4d71-bb3c-9d26c871de09", + "name": "DLL Side-Loading", + "type": "technique", + "id": "T1073", + "url": "https://attack.mitre.org/techniques/T1073", + "deprecated": true + }, + { + "stixId": "attack-pattern--b200542e-e877-4395-875b-cf1a44537ca4", + "name": "Process Hollowing", + "type": "technique", + "id": "T1055.012", + "url": "https://attack.mitre.org/techniques/T1055/012", + "deprecated": false + }, + { + "stixId": "attack-pattern--b21c3b2d-02e6-45b1-980b-e69051040839", + "name": "Exploitation for Privilege Escalation", + "type": "technique", + "id": "T1068", + "url": "https://attack.mitre.org/techniques/T1068", + "deprecated": false + }, + { + "stixId": "attack-pattern--b22e5153-ac28-4cc6-865c-2054e36285cb", + "name": "Resource Forking", + "type": "technique", + "id": "T1564.009", + "url": "https://attack.mitre.org/techniques/T1564/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--b24e2a20-3b3d-4bf0-823b-1ed765398fb0", + "name": "Account Access Removal", + "type": "technique", + "id": "T1531", + "url": "https://attack.mitre.org/techniques/T1531", + "deprecated": false + }, + { + "stixId": "attack-pattern--b2d03cea-aec1-45ca-9744-9ee583c1e1cc", + "name": "Credential Stuffing", + "type": "technique", + "id": "T1110.004", + "url": "https://attack.mitre.org/techniques/T1110/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--b39d03cb-7b98-41c4-a878-c40c1a913dc0", + "name": "Kerberoasting", + "type": "technique", + "id": "T1208", + "url": "https://attack.mitre.org/techniques/T1208", + "deprecated": true + }, + { + "stixId": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "name": "Obfuscated Files or Information", + "type": "technique", + "id": "T1027", + "url": "https://attack.mitre.org/techniques/T1027", + "deprecated": false + }, + { + "stixId": "attack-pattern--b4409cd8-0da9-46e1-a401-a241afd4d1cc", + "name": "Multi-Factor Authentication", + "type": "technique", + "id": "T1556.006", + "url": "https://attack.mitre.org/techniques/T1556/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--b4694861-542c-48ea-9eb1-10d356e7140a", + "name": "Remote Email Collection", + "type": "technique", + "id": "T1114.002", + "url": "https://attack.mitre.org/techniques/T1114/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--b46a801b-fd98-491c-a25a-bca25d6e3001", + "name": "IIS Components", + "type": "technique", + "id": "T1505.004", + "url": "https://attack.mitre.org/techniques/T1505/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--b4b7458f-81f2-4d38-84be-1c5ba0167a52", + "name": "Invalid Code Signature", + "type": "technique", + "id": "T1036.001", + "url": "https://attack.mitre.org/techniques/T1036/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--b5327dd1-6bf9-4785-a199-25bcbd1f4a9d", + "name": "Run Virtual Instance", + "type": "technique", + "id": "T1564.006", + "url": "https://attack.mitre.org/techniques/T1564/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--b53dbcc6-147d-48bb-9df4-bcb8bb808ff6", + "name": "Trap", + "type": "technique", + "id": "T1154", + "url": "https://attack.mitre.org/techniques/T1154", + "deprecated": true + }, + { + "stixId": "attack-pattern--b6075259-dba3-44e9-87c7-e954f37ec0d5", + "name": "Password Policy Discovery", + "type": "technique", + "id": "T1201", + "url": "https://attack.mitre.org/techniques/T1201", + "deprecated": false + }, + { + "stixId": "attack-pattern--b6301b64-ef57-4cce-bb0b-77026f14a8db", + "name": "Event Triggered Execution", + "type": "technique", + "id": "T1546", + "url": "https://attack.mitre.org/techniques/T1546", + "deprecated": false + }, + { + "stixId": "attack-pattern--b63a34e8-0a61-4c97-a23b-bf8a2ed812e2", + "name": "Unix Shell Configuration Modification", + "type": "technique", + "id": "T1546.004", + "url": "https://attack.mitre.org/techniques/T1546/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--b77cf5f3-6060-475d-bd60-40ccbf28fdc2", + "name": "Forced Authentication", + "type": "technique", + "id": "T1187", + "url": "https://attack.mitre.org/techniques/T1187", + "deprecated": false + }, + { + "stixId": "attack-pattern--b7dc639b-24cd-482d-a7f1-8897eda21023", + "name": "SID-History Injection", + "type": "technique", + "id": "T1134.005", + "url": "https://attack.mitre.org/techniques/T1134/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--b8017880-4b1e-42de-ad10-ae7ac6705166", + "name": "Network Boundary Bridging", + "type": "technique", + "id": "T1599", + "url": "https://attack.mitre.org/techniques/T1599", + "deprecated": false + }, + { + "stixId": "attack-pattern--b80d107d-fa0d-4b60-9684-b0433e8bdba0", + "name": "Data Encrypted for Impact", + "type": "technique", + "id": "T1486", + "url": "https://attack.mitre.org/techniques/T1486", + "deprecated": false + }, + { + "stixId": "attack-pattern--b82f7d37-b826-4ec9-9391-8e121c78aed7", + "name": "Disk Content Wipe", + "type": "technique", + "id": "T1488", + "url": "https://attack.mitre.org/techniques/T1488", + "deprecated": true + }, + { + "stixId": "attack-pattern--b83e166d-13d7-4b52-8677-dff90c548fd7", + "name": "Subvert Trust Controls", + "type": "technique", + "id": "T1553", + "url": "https://attack.mitre.org/techniques/T1553", + "deprecated": false + }, + { + "stixId": "attack-pattern--b84903f0-c7d5-435d-a69e-de47cc3578c0", + "name": "Elevated Execution with Prompt", + "type": "technique", + "id": "T1548.004", + "url": "https://attack.mitre.org/techniques/T1548/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--b85f6ce5-81e8-4f36-aff2-3df9d02a9c9d", + "name": "Firmware", + "type": "technique", + "id": "T1592.003", + "url": "https://attack.mitre.org/techniques/T1592/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--b8902400-e6c5-4ba2-95aa-2d35b442b118", + "name": "Encrypted Channel", + "type": "technique", + "id": "T1573", + "url": "https://attack.mitre.org/techniques/T1573", + "deprecated": false + }, + { + "stixId": "attack-pattern--b8c5c9dd-a662-479d-9428-ae745872537c", + "name": "Password Filter DLL", + "type": "technique", + "id": "T1174", + "url": "https://attack.mitre.org/techniques/T1174", + "deprecated": true + }, + { + "stixId": "attack-pattern--b8cfed42-6a8a-4989-ad72-541af74475ec", + "name": "Authentication Package", + "type": "technique", + "id": "T1547.002", + "url": "https://attack.mitre.org/techniques/T1547/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--b97f1d35-4249-4486-a6b5-ee60ccf24fab", + "name": "Regsvr32", + "type": "technique", + "id": "T1218.010", + "url": "https://attack.mitre.org/techniques/T1218/010", + "deprecated": false + }, + { + "stixId": "attack-pattern--b9f5dbe2-4c55-4fc5-af2e-d42c1d182ec4", + "name": "Data Compressed", + "type": "technique", + "id": "T1002", + "url": "https://attack.mitre.org/techniques/T1002", + "deprecated": true + }, + { + "stixId": "attack-pattern--ba04e672-da86-4e69-aa15-0eca5db25f43", + "name": "Exfiltration to Text Storage Sites", + "type": "technique", + "id": "T1567.003", + "url": "https://attack.mitre.org/techniques/T1567/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--ba8e391f-14b5-496f-81f2-2d5ecd646c1c", + "name": "Credentials in Files", + "type": "technique", + "id": "T1081", + "url": "https://attack.mitre.org/techniques/T1081", + "deprecated": true + }, + { + "stixId": "attack-pattern--baf60e1a-afe5-4d31-830f-1b1ba2351884", + "name": "Software", + "type": "technique", + "id": "T1592.002", + "url": "https://attack.mitre.org/techniques/T1592/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--bb0e0cb5-f3e4-4118-a4cb-6bf13bfbc9f2", + "name": "Netsh Helper DLL", + "type": "technique", + "id": "T1128", + "url": "https://attack.mitre.org/techniques/T1128", + "deprecated": true + }, + { + "stixId": "attack-pattern--bb5a00de-e086-4859-a231-fa793f6797e2", + "name": "Input Capture", + "type": "technique", + "id": "T1056", + "url": "https://attack.mitre.org/techniques/T1056", + "deprecated": false + }, + { + "stixId": "attack-pattern--bbc3cba7-84ae-410d-b18b-16750731dfa2", + "name": "Exploits", + "type": "technique", + "id": "T1587.004", + "url": "https://attack.mitre.org/techniques/T1587/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--bbe5b322-e2af-4a5e-9625-a4e62bf84ed3", + "name": "Social Media", + "type": "technique", + "id": "T1593.001", + "url": "https://attack.mitre.org/techniques/T1593/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--bc0f5e80-91c0-4e04-9fbb-e4e332c85dae", + "name": "Component Object Model Hijacking", + "type": "technique", + "id": "T1546.015", + "url": "https://attack.mitre.org/techniques/T1546/015", + "deprecated": false + }, + { + "stixId": "attack-pattern--bc76d0a4-db11-4551-9ac4-01a469cfb161", + "name": "Credentials", + "type": "technique", + "id": "T1589.001", + "url": "https://attack.mitre.org/techniques/T1589/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--bd369cd9-abb8-41ce-b5bb-fff23ee86c00", + "name": "Compromise Software Supply Chain", + "type": "technique", + "id": "T1195.002", + "url": "https://attack.mitre.org/techniques/T1195/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b", + "name": "Rename System Utilities", + "type": "technique", + "id": "T1036.003", + "url": "https://attack.mitre.org/techniques/T1036/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", + "name": "Bidirectional Communication", + "type": "technique", + "id": "T1102.002", + "url": "https://attack.mitre.org/techniques/T1102/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--be2dcee9-a7a7-4e38-afd6-21b31ecc3d63", + "name": "Exploitation for Client Execution", + "type": "technique", + "id": "T1203", + "url": "https://attack.mitre.org/techniques/T1203", + "deprecated": false + }, + { + "stixId": "attack-pattern--bed04f7d-e48a-4e76-bd0f-4c57fe31fc46", + "name": "Wordlist Scanning", + "type": "technique", + "id": "T1595.003", + "url": "https://attack.mitre.org/techniques/T1595/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--bef8aaee-961d-4359-a308-4c2182bcedff", + "name": "Spoof Security Alerting", + "type": "technique", + "id": "T1562.011", + "url": "https://attack.mitre.org/techniques/T1562/011", + "deprecated": false + }, + { + "stixId": "attack-pattern--bf147104-abf9-4221-95d1-e81585859441", + "name": "Outlook Home Page", + "type": "technique", + "id": "T1137.004", + "url": "https://attack.mitre.org/techniques/T1137/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--bf176076-b789-408e-8cba-7275e81c0ada", + "name": "Asymmetric Cryptography", + "type": "technique", + "id": "T1573.002", + "url": "https://attack.mitre.org/techniques/T1573/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--bf1b6176-597c-4600-bfcd-ac989670f96b", + "name": "Exfiltration to Cloud Storage", + "type": "technique", + "id": "T1567.002", + "url": "https://attack.mitre.org/techniques/T1567/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "name": "Lateral Tool Transfer", + "type": "technique", + "id": "T1570", + "url": "https://attack.mitre.org/techniques/T1570", + "deprecated": false + }, + { + "stixId": "attack-pattern--bf96a5a3-3bce-43b7-8597-88545984c07b", + "name": "Path Interception by Unquoted Path", + "type": "technique", + "id": "T1574.009", + "url": "https://attack.mitre.org/techniques/T1574/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--c071d8c1-3b3a-4f22-9407-ca4e96921069", + "name": "Install Digital Certificate", + "type": "technique", + "id": "T1608.003", + "url": "https://attack.mitre.org/techniques/T1608/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--c0a384a4-9a25-40e1-97b6-458388474bc8", + "name": "Local Job Scheduling", + "type": "technique", + "id": "T1168", + "url": "https://attack.mitre.org/techniques/T1168", + "deprecated": true + }, + { + "stixId": "attack-pattern--c0df6533-30ee-4a4a-9c6d-17af5abdf0b2", + "name": "Setuid and Setgid", + "type": "technique", + "id": "T1166", + "url": "https://attack.mitre.org/techniques/T1166", + "deprecated": true + }, + { + "stixId": "attack-pattern--c0dfe7b0-b873-4618-9ff8-53e31f70907f", + "name": "Startup Items", + "type": "technique", + "id": "T1037.005", + "url": "https://attack.mitre.org/techniques/T1037/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--c16e5409-ee53-4d79-afdc-4099dc9292df", + "name": "Web Shell", + "type": "technique", + "id": "T1100", + "url": "https://attack.mitre.org/techniques/T1100", + "deprecated": true + }, + { + "stixId": "attack-pattern--c1a452f3-6499-4c12-b7e9-a6a0a102af76", + "name": "Process Doppelgänging", + "type": "technique", + "id": "T1186", + "url": "https://attack.mitre.org/techniques/T1186", + "deprecated": true + }, + { + "stixId": "attack-pattern--c1b11bf7-c68e-4fbf-a95b-28efbe7953bb", + "name": "SSH Hijacking", + "type": "technique", + "id": "T1184", + "url": "https://attack.mitre.org/techniques/T1184", + "deprecated": true + }, + { + "stixId": "attack-pattern--c1b68a96-3c48-49ea-a6c0-9b27359f9c19", + "name": "System Language Discovery", + "type": "technique", + "id": "T1614.001", + "url": "https://attack.mitre.org/techniques/T1614/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "name": "Non-Application Layer Protocol", + "type": "technique", + "id": "T1095", + "url": "https://attack.mitre.org/techniques/T1095", + "deprecated": false + }, + { + "stixId": "attack-pattern--c23b740b-a42b-47a1-aec2-9d48ddd547ff", + "name": "Pass the Hash", + "type": "technique", + "id": "T1075", + "url": "https://attack.mitre.org/techniques/T1075", + "deprecated": true + }, + { + "stixId": "attack-pattern--c2e147a9-d1a8-4074-811a-d8789202d916", + "name": "Steganography", + "type": "technique", + "id": "T1027.003", + "url": "https://attack.mitre.org/techniques/T1027/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--c2f59d25-87fe-44aa-8f83-e8e59d077bf5", + "name": "DNS Server", + "type": "technique", + "id": "T1584.002", + "url": "https://attack.mitre.org/techniques/T1584/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc", + "name": "Protocol Impersonation", + "type": "technique", + "id": "T1001.003", + "url": "https://attack.mitre.org/techniques/T1001/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--c32f7008-9fea-41f7-8366-5eb9b74bd896", + "name": "Query Registry", + "type": "technique", + "id": "T1012", + "url": "https://attack.mitre.org/techniques/T1012", + "deprecated": false + }, + { + "stixId": "attack-pattern--c3888c54-775d-4b2f-b759-75a2ececcbfd", + "name": "Data Transfer Size Limits", + "type": "technique", + "id": "T1030", + "url": "https://attack.mitre.org/techniques/T1030", + "deprecated": false + }, + { + "stixId": "attack-pattern--c3bce4f4-9795-46c6-976e-8676300bbc39", + "name": "Windows Remote Management", + "type": "technique", + "id": "T1028", + "url": "https://attack.mitre.org/techniques/T1028", + "deprecated": true + }, + { + "stixId": "attack-pattern--c3c8c916-2f3c-4e71-94b2-240bdfc996f0", + "name": "Web Session Cookie", + "type": "technique", + "id": "T1550.004", + "url": "https://attack.mitre.org/techniques/T1550/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", + "name": "Domain Accounts", + "type": "technique", + "id": "T1078.002", + "url": "https://attack.mitre.org/techniques/T1078/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--c48a67ee-b657-45c1-91bf-6cdbe27205f8", + "name": "Regsvcs/Regasm", + "type": "technique", + "id": "T1218.009", + "url": "https://attack.mitre.org/techniques/T1218/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--c4ad009b-6e13-4419-8d21-918a1652de02", + "name": "Path Interception", + "type": "technique", + "id": "T1034", + "url": "https://attack.mitre.org/techniques/T1034", + "deprecated": true + }, + { + "stixId": "attack-pattern--c5e31fb5-fcbd-48a4-af8c-5a6ed5b932e5", + "name": "Web Session Cookie", + "type": "technique", + "id": "T1506", + "url": "https://attack.mitre.org/techniques/T1506", + "deprecated": true + }, + { + "stixId": "attack-pattern--c615231b-f253-4f58-9d47-d5b4cbdb6839", + "name": "Install Root Certificate", + "type": "technique", + "id": "T1553.004", + "url": "https://attack.mitre.org/techniques/T1553/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--c63a348e-ffc2-486a-b9d9-d7f11ec54d99", + "name": "Network Logon Script", + "type": "technique", + "id": "T1037.003", + "url": "https://attack.mitre.org/techniques/T1037/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--c675646d-e204-4aa8-978d-e3d6d65885c4", + "name": "Endpoint Denial of Service", + "type": "technique", + "id": "T1499", + "url": "https://attack.mitre.org/techniques/T1499", + "deprecated": false + }, + { + "stixId": "attack-pattern--c726e0a2-a57a-4b7b-a973-d0f013246617", + "name": "Compile After Delivery", + "type": "technique", + "id": "T1027.004", + "url": "https://attack.mitre.org/techniques/T1027/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--c848fcf7-6b62-4bde-8216-b6c157d48da0", + "name": "Uncommonly Used Port", + "type": "technique", + "id": "T1065", + "url": "https://attack.mitre.org/techniques/T1065", + "deprecated": true + }, + { + "stixId": "attack-pattern--c877e33f-1df6-40d6-b1e7-ce70f16f4979", + "name": "System Location Discovery", + "type": "technique", + "id": "T1614", + "url": "https://attack.mitre.org/techniques/T1614", + "deprecated": false + }, + { + "stixId": "attack-pattern--c898c4b5-bf36-4e6e-a4ad-5b8c4c13e35b", + "name": "VBA Stomping", + "type": "technique", + "id": "T1564.007", + "url": "https://attack.mitre.org/techniques/T1564/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--c8e87b83-edbb-48d4-9295-4974897525b7", + "name": "BITS Jobs", + "type": "technique", + "id": "T1197", + "url": "https://attack.mitre.org/techniques/T1197", + "deprecated": false + }, + { + "stixId": "attack-pattern--c92e3d68-2349-49e4-a341-7edca2deff96", + "name": "MSBuild", + "type": "technique", + "id": "T1127.001", + "url": "https://attack.mitre.org/techniques/T1127/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--ca1a3f50-5ebd-41f8-8320-2c7d6a6e88be", + "name": "Bypass User Account Control", + "type": "technique", + "id": "T1088", + "url": "https://attack.mitre.org/techniques/T1088", + "deprecated": true + }, + { + "stixId": "attack-pattern--ca205a36-c1ad-488b-aa6c-ab34bdd3a36b", + "name": "Runtime Data Manipulation", + "type": "technique", + "id": "T1494", + "url": "https://attack.mitre.org/techniques/T1494", + "deprecated": true + }, + { + "stixId": "attack-pattern--ca9d3402-ada3-484d-876a-d717bd6e05f2", + "name": "Domain Fronting", + "type": "technique", + "id": "T1090.004", + "url": "https://attack.mitre.org/techniques/T1090/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--cabe189c-a0e3-4965-a473-dcff00f17213", + "name": "ARP Cache Poisoning", + "type": "technique", + "id": "T1557.002", + "url": "https://attack.mitre.org/techniques/T1557/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--cacc40da-4c9e-462c-80d5-fd70a178b12d", + "name": "Disable Cloud Logs", + "type": "technique", + "id": "T1562.008", + "url": "https://attack.mitre.org/techniques/T1562/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--cba37adb-d6fb-4610-b069-dd04c0643384", + "name": "Security Software Discovery", + "type": "technique", + "id": "T1518.001", + "url": "https://attack.mitre.org/techniques/T1518/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--cbb66055-0325-4111-aca0-40547b6ad5b0", + "name": "Hidden Window", + "type": "technique", + "id": "T1564.003", + "url": "https://attack.mitre.org/techniques/T1564/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--cc1e737c-236c-4e3b-83ba-32039a626ef8", + "name": "Transmitted Data Manipulation", + "type": "technique", + "id": "T1493", + "url": "https://attack.mitre.org/techniques/T1493", + "deprecated": true + }, + { + "stixId": "attack-pattern--cc3502b5-30cc-4473-ad48-42d51a6ef6d1", + "name": "Python", + "type": "technique", + "id": "T1059.006", + "url": "https://attack.mitre.org/techniques/T1059/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--cc723aff-ec88-40e3-a224-5af9fd983cc4", + "name": "Identify Roles", + "type": "technique", + "id": "T1591.004", + "url": "https://attack.mitre.org/techniques/T1591/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--cc7b8c4e-9be0-47ca-b0bb-83915ec3ee2f", + "name": "Data Encoding", + "type": "technique", + "id": "T1132", + "url": "https://attack.mitre.org/techniques/T1132", + "deprecated": false + }, + { + "stixId": "attack-pattern--cc89ecbd-3d33-4a41-bcca-001e702d18fd", + "name": "AppInit DLLs", + "type": "technique", + "id": "T1546.010", + "url": "https://attack.mitre.org/techniques/T1546/010", + "deprecated": false + }, + { + "stixId": "attack-pattern--cca0ccb6-a068-4574-a722-b1556f86833a", + "name": "Phishing for Information", + "type": "technique", + "id": "T1598", + "url": "https://attack.mitre.org/techniques/T1598", + "deprecated": false + }, + { + "stixId": "attack-pattern--cd25c1b4-935c-4f0e-ba8d-552f28bc4783", + "name": "Resource Hijacking", + "type": "technique", + "id": "T1496", + "url": "https://attack.mitre.org/techniques/T1496", + "deprecated": false + }, + { + "stixId": "attack-pattern--cdfc5f0a-9bb9-4352-b896-553cfa2d8fd8", + "name": "Establish Accounts", + "type": "technique", + "id": "T1585", + "url": "https://attack.mitre.org/techniques/T1585", + "deprecated": false + }, + { + "stixId": "attack-pattern--ce0687a0-e692-4b77-964a-0784a8e54ff1", + "name": "Obtain Capabilities", + "type": "technique", + "id": "T1588", + "url": "https://attack.mitre.org/techniques/T1588", + "deprecated": false + }, + { + "stixId": "attack-pattern--ce4b7013-640e-48a9-b501-d0025a95f4bf", + "name": "Screensaver", + "type": "technique", + "id": "T1546.002", + "url": "https://attack.mitre.org/techniques/T1546/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--ce73ea43-8e77-47ba-9c11-5e9c9c58b9ff", + "name": "Hidden Users", + "type": "technique", + "id": "T1147", + "url": "https://attack.mitre.org/techniques/T1147", + "deprecated": true + }, + { + "stixId": "attack-pattern--cf1c2504-433f-4c4e-a1f8-91de45a0318c", + "name": "Create Cloud Instance", + "type": "technique", + "id": "T1578.002", + "url": "https://attack.mitre.org/techniques/T1578/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--cf7b3a06-8b42-4c33-bbe9-012120027925", + "name": "Compile After Delivery", + "type": "technique", + "id": "T1500", + "url": "https://attack.mitre.org/techniques/T1500", + "deprecated": true + }, + { + "stixId": "attack-pattern--cff94884-3b1c-4987-a70b-6d5643c621c3", + "name": "Code Repositories", + "type": "technique", + "id": "T1213.003", + "url": "https://attack.mitre.org/techniques/T1213/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--d0613359-5781-4fd2-b5be-c269270be1f6", + "name": "Transmitted Data Manipulation", + "type": "technique", + "id": "T1565.002", + "url": "https://attack.mitre.org/techniques/T1565/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4", + "name": "/etc/passwd and /etc/shadow", + "type": "technique", + "id": "T1003.008", + "url": "https://attack.mitre.org/techniques/T1003/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--d10cbd34-42e3-45c0-84d2-535a09849584", + "name": "Launch Agent", + "type": "technique", + "id": "T1543.001", + "url": "https://attack.mitre.org/techniques/T1543/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--d157f9d2-d09a-4efa-bb2a-64963f94e253", + "name": "System Services", + "type": "technique", + "id": "T1569", + "url": "https://attack.mitre.org/techniques/T1569", + "deprecated": false + }, + { + "stixId": "attack-pattern--d1fcf083-a721-4223-aedf-bf8960798d62", + "name": "Windows Command Shell", + "type": "technique", + "id": "T1059.003", + "url": "https://attack.mitre.org/techniques/T1059/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--d201d4cc-214d-4a74-a1ba-b3fa09fd4591", + "name": "Proc Memory", + "type": "technique", + "id": "T1055.009", + "url": "https://attack.mitre.org/techniques/T1055/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--d21a2069-23d5-4043-ad6d-64f6b644cb1a", + "name": "Compiled HTML File", + "type": "technique", + "id": "T1223", + "url": "https://attack.mitre.org/techniques/T1223", + "deprecated": true + }, + { + "stixId": "attack-pattern--d21bb61f-08ad-4dc1-b001-81ca6cb79954", + "name": "Acquire Access", + "type": "technique", + "id": "T1650", + "url": "https://attack.mitre.org/techniques/T1650", + "deprecated": false + }, + { + "stixId": "attack-pattern--d245808a-7086-4310-984a-a84aaaa43f8f", + "name": "Patch System Image", + "type": "technique", + "id": "T1601.001", + "url": "https://attack.mitre.org/techniques/T1601/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--d273434a-448e-4598-8e14-607f4a0d5e27", + "name": "Silver Ticket", + "type": "technique", + "id": "T1558.002", + "url": "https://attack.mitre.org/techniques/T1558/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--d28ef391-8ed4-45dc-bc4a-2f43abf54416", + "name": "Data from Information Repositories", + "type": "technique", + "id": "T1213", + "url": "https://attack.mitre.org/techniques/T1213", + "deprecated": false + }, + { + "stixId": "attack-pattern--d2c4e5ea-dbdf-4113-805a-b1e2a337fb33", + "name": "Clear Persistence", + "type": "technique", + "id": "T1070.009", + "url": "https://attack.mitre.org/techniques/T1070/009", + "deprecated": false + }, + { + "stixId": "attack-pattern--d3046a90-580c-4004-8208-66915bc29830", + "name": "Clear Command History", + "type": "technique", + "id": "T1146", + "url": "https://attack.mitre.org/techniques/T1146", + "deprecated": true + }, + { + "stixId": "attack-pattern--d336b553-5da9-46ca-98a8-0b23f49fb447", + "name": "Windows Credential Manager", + "type": "technique", + "id": "T1555.004", + "url": "https://attack.mitre.org/techniques/T1555/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--d376668f-b208-42de-b1f5-fdfe0ad4b753", + "name": "Emond", + "type": "technique", + "id": "T1519", + "url": "https://attack.mitre.org/techniques/T1519", + "deprecated": true + }, + { + "stixId": "attack-pattern--d3df754e-997b-4cf9-97d4-70feb3120847", + "name": "Spearphishing via Service", + "type": "technique", + "id": "T1194", + "url": "https://attack.mitre.org/techniques/T1194", + "deprecated": true + }, + { + "stixId": "attack-pattern--d40239b3-05ff-46d8-9bdd-b46d13463ef9", + "name": "Hardware Additions", + "type": "technique", + "id": "T1200", + "url": "https://attack.mitre.org/techniques/T1200", + "deprecated": false + }, + { + "stixId": "attack-pattern--d456de47-a16f-4e46-8980-e67478a12dcb", + "name": "Server Software Component", + "type": "technique", + "id": "T1505", + "url": "https://attack.mitre.org/techniques/T1505", + "deprecated": false + }, + { + "stixId": "attack-pattern--d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c", + "name": "Data Destruction", + "type": "technique", + "id": "T1485", + "url": "https://attack.mitre.org/techniques/T1485", + "deprecated": false + }, + { + "stixId": "attack-pattern--d467bc38-284b-4a00-96ac-125f447799fc", + "name": "Non-Standard Encoding", + "type": "technique", + "id": "T1132.002", + "url": "https://attack.mitre.org/techniques/T1132/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--d4b96d2c-1032-4b22-9235-2b5b649d0605", + "name": "Domain Controller Authentication", + "type": "technique", + "id": "T1556.001", + "url": "https://attack.mitre.org/techniques/T1556/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--d4bdbdea-eaec-4071-b4f9-5105e12ea4b6", + "name": "Transfer Data to Cloud Account", + "type": "technique", + "id": "T1537", + "url": "https://attack.mitre.org/techniques/T1537", + "deprecated": false + }, + { + "stixId": "attack-pattern--d4dc46e3-5ba5-45b9-8204-010867cacfcb", + "name": "HTML Smuggling", + "type": "technique", + "id": "T1027.006", + "url": "https://attack.mitre.org/techniques/T1027/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--d50955c2-272d-4ac8-95da-10c29dda1c48", + "name": "Reversible Encryption", + "type": "technique", + "id": "T1556.005", + "url": "https://attack.mitre.org/techniques/T1556/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--d511a6f6-4a33-41d5-bc95-c343875d1377", + "name": "Command Obfuscation", + "type": "technique", + "id": "T1027.010", + "url": "https://attack.mitre.org/techniques/T1027/010", + "deprecated": false + }, + { + "stixId": "attack-pattern--d519cfd5-f3a8-43a9-a846-ed0bb40672b1", + "name": "Install Root Certificate", + "type": "technique", + "id": "T1130", + "url": "https://attack.mitre.org/techniques/T1130", + "deprecated": true + }, + { + "stixId": "attack-pattern--d54416bd-0803-41ca-870a-ce1af7c05638", + "name": "Data Encrypted", + "type": "technique", + "id": "T1022", + "url": "https://attack.mitre.org/techniques/T1022", + "deprecated": true + }, + { + "stixId": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "name": "File Deletion", + "type": "technique", + "id": "T1070.004", + "url": "https://attack.mitre.org/techniques/T1070/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--d742a578-d70e-4d0e-96a6-02a9c30204e6", + "name": "Drive-by Compromise", + "type": "technique", + "id": "T1189", + "url": "https://attack.mitre.org/techniques/T1189", + "deprecated": false + }, + { + "stixId": "attack-pattern--d74c4a7e-ffbf-432f-9365-7ebf1f787cab", + "name": "Network Denial of Service", + "type": "technique", + "id": "T1498", + "url": "https://attack.mitre.org/techniques/T1498", + "deprecated": false + }, + { + "stixId": "attack-pattern--d94b3ae9-8059-4989-8e9f-ea0f601f80a7", + "name": "Cloud Administration Command", + "type": "technique", + "id": "T1651", + "url": "https://attack.mitre.org/techniques/T1651", + "deprecated": false + }, + { + "stixId": "attack-pattern--da051493-ae9c-4b1b-9760-c009c46c9b56", + "name": "Installer Packages", + "type": "technique", + "id": "T1546.016", + "url": "https://attack.mitre.org/techniques/T1546/016", + "deprecated": false + }, + { + "stixId": "attack-pattern--db8f5003-3b20-48f0-9b76-123e44208120", + "name": "Scanning IP Blocks", + "type": "technique", + "id": "T1595.001", + "url": "https://attack.mitre.org/techniques/T1595/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--dc27c2ec-c5f9-4228-ba57-d67b590bda93", + "name": "Hidden Files and Directories", + "type": "technique", + "id": "T1158", + "url": "https://attack.mitre.org/techniques/T1158", + "deprecated": true + }, + { + "stixId": "attack-pattern--dc31fe1e-d722-49da-8f5f-92c7b5aff534", + "name": "Template Injection", + "type": "technique", + "id": "T1221", + "url": "https://attack.mitre.org/techniques/T1221", + "deprecated": false + }, + { + "stixId": "attack-pattern--dca670cf-eeec-438f-8185-fd959d9ef211", + "name": "RC Scripts", + "type": "technique", + "id": "T1037.004", + "url": "https://attack.mitre.org/techniques/T1037/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--dcaa092b-7de9-4a21-977f-7fcb77e89c48", + "name": "Access Token Manipulation", + "type": "technique", + "id": "T1134", + "url": "https://attack.mitre.org/techniques/T1134", + "deprecated": false + }, + { + "stixId": "attack-pattern--dce31a00-1e90-4655-b0f9-e2e71a748a87", + "name": "Time Providers", + "type": "technique", + "id": "T1209", + "url": "https://attack.mitre.org/techniques/T1209", + "deprecated": true + }, + { + "stixId": "attack-pattern--dd43c543-bb85-4a6f-aa6e-160d90d06a49", + "name": "Multi-Factor Authentication Interception", + "type": "technique", + "id": "T1111", + "url": "https://attack.mitre.org/techniques/T1111", + "deprecated": false + }, + { + "stixId": "attack-pattern--dd901512-6e37-4155-943b-453e3777b125", + "name": "Launch Agent", + "type": "technique", + "id": "T1159", + "url": "https://attack.mitre.org/techniques/T1159", + "deprecated": true + }, + { + "stixId": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062", + "name": "Software Packing", + "type": "technique", + "id": "T1027.002", + "url": "https://attack.mitre.org/techniques/T1027/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--df1bc34d-1634-4c93-b89e-8120994fce77", + "name": "Serverless", + "type": "technique", + "id": "T1584.007", + "url": "https://attack.mitre.org/techniques/T1584/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--df8b2a25-8bdf-4856-953c-a04372b1c161", + "name": "Web Protocols", + "type": "technique", + "id": "T1071.001", + "url": "https://attack.mitre.org/techniques/T1071/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "name": "Visual Basic", + "type": "technique", + "id": "T1059.005", + "url": "https://attack.mitre.org/techniques/T1059/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--dfebc3b7-d19d-450b-81c7-6dafe4184c04", + "name": "Hidden File System", + "type": "technique", + "id": "T1564.005", + "url": "https://attack.mitre.org/techniques/T1564/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--dfefe2ed-4389-4318-8762-f0272b350a1b", + "name": "Systemd Service", + "type": "technique", + "id": "T1543.002", + "url": "https://attack.mitre.org/techniques/T1543/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--e0033c16-a07e-48aa-8204-7c3ca669998c", + "name": "RDP Hijacking", + "type": "technique", + "id": "T1563.002", + "url": "https://attack.mitre.org/techniques/T1563/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--e01be9c5-e763-4caf-aeb7-000b416aef67", + "name": "Create Account", + "type": "technique", + "id": "T1136", + "url": "https://attack.mitre.org/techniques/T1136", + "deprecated": false + }, + { + "stixId": "attack-pattern--e0232cb0-ded5-4c2e-9dc7-2893142a5c11", + "name": "XDG Autostart Entries", + "type": "technique", + "id": "T1547.013", + "url": "https://attack.mitre.org/techniques/T1547/013", + "deprecated": false + }, + { + "stixId": "attack-pattern--e196b5c5-8118-4a1c-ab8a-936586ce3db5", + "name": "Server", + "type": "technique", + "id": "T1584.004", + "url": "https://attack.mitre.org/techniques/T1584/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--e24fcba8-2557-4442-a139-1ee2f2e784db", + "name": "Cloud Service Discovery", + "type": "technique", + "id": "T1526", + "url": "https://attack.mitre.org/techniques/T1526", + "deprecated": false + }, + { + "stixId": "attack-pattern--e2907cea-4b43-4ed7-a570-0fdf0fbeea00", + "name": "Space after Filename", + "type": "technique", + "id": "T1151", + "url": "https://attack.mitre.org/techniques/T1151", + "deprecated": true + }, + { + "stixId": "attack-pattern--e358d692-23c0-4a31-9eb6-ecc13a8d7735", + "name": "Remote System Discovery", + "type": "technique", + "id": "T1018", + "url": "https://attack.mitre.org/techniques/T1018", + "deprecated": false + }, + { + "stixId": "attack-pattern--e3a12395-188d-4051-9a16-ea8e14d07b88", + "name": "Network Service Discovery", + "type": "technique", + "id": "T1046", + "url": "https://attack.mitre.org/techniques/T1046", + "deprecated": false + }, + { + "stixId": "attack-pattern--e3b168bd-fcd7-439e-9382-2e6c2f63514d", + "name": "Domain Properties", + "type": "technique", + "id": "T1590.001", + "url": "https://attack.mitre.org/techniques/T1590/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "name": "Software Discovery", + "type": "technique", + "id": "T1518", + "url": "https://attack.mitre.org/techniques/T1518", + "deprecated": false + }, + { + "stixId": "attack-pattern--e49920b0-6c54-40c1-9571-73723653205f", + "name": "Cloud Service Dashboard", + "type": "technique", + "id": "T1538", + "url": "https://attack.mitre.org/techniques/T1538", + "deprecated": false + }, + { + "stixId": "attack-pattern--e49ee9d2-0d98-44ef-85e5-5d3100065744", + "name": "Thread Local Storage", + "type": "technique", + "id": "T1055.005", + "url": "https://attack.mitre.org/techniques/T1055/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391", + "name": "Debugger Evasion", + "type": "technique", + "id": "T1622", + "url": "https://attack.mitre.org/techniques/T1622", + "deprecated": false + }, + { + "stixId": "attack-pattern--e51137a5-1cdc-499e-911a-abaedaa5ac86", + "name": "Space after Filename", + "type": "technique", + "id": "T1036.006", + "url": "https://attack.mitre.org/techniques/T1036/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--e5cc9e7a-e61a-46a1-b869-55fb6eab058e", + "name": "Re-opened Applications", + "type": "technique", + "id": "T1547.007", + "url": "https://attack.mitre.org/techniques/T1547/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--e5d550f3-2202-4634-85f2-4a200a1d49b3", + "name": "SEO Poisoning", + "type": "technique", + "id": "T1608.006", + "url": "https://attack.mitre.org/techniques/T1608/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "name": "Pass the Hash", + "type": "technique", + "id": "T1550.002", + "url": "https://attack.mitre.org/techniques/T1550/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--e6415f09-df0e-48de-9aba-928c902b7549", + "name": "Exfiltration Over Physical Medium", + "type": "technique", + "id": "T1052", + "url": "https://attack.mitre.org/techniques/T1052", + "deprecated": false + }, + { + "stixId": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "name": "DLL Side-Loading", + "type": "technique", + "id": "T1574.002", + "url": "https://attack.mitre.org/techniques/T1574/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--e6919abc-99f9-4c6c-95a5-14761e7b2add", + "name": "Ingress Tool Transfer", + "type": "technique", + "id": "T1105", + "url": "https://attack.mitre.org/techniques/T1105", + "deprecated": false + }, + { + "stixId": "attack-pattern--e74de37c-a829-446c-937d-56a44f0e9306", + "name": "Additional Email Delegate Permissions", + "type": "technique", + "id": "T1098.002", + "url": "https://attack.mitre.org/techniques/T1098/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--e7cbc1de-1f79-48ee-abfd-da1241c65a15", + "name": "Code Signing Certificates", + "type": "technique", + "id": "T1588.003", + "url": "https://attack.mitre.org/techniques/T1588/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--e7eab98d-ae11-4491-bd28-a53ba875865a", + "name": "Network Share Connection Removal", + "type": "technique", + "id": "T1126", + "url": "https://attack.mitre.org/techniques/T1126", + "deprecated": true + }, + { + "stixId": "attack-pattern--e848506b-8484-4410-8017-3d235a52f5b3", + "name": "Serverless Execution", + "type": "technique", + "id": "T1648", + "url": "https://attack.mitre.org/techniques/T1648", + "deprecated": false + }, + { + "stixId": "attack-pattern--e906ae4d-1d3a-4675-be23-22f7311c0da4", + "name": "Windows Management Instrumentation Event Subscription", + "type": "technique", + "id": "T1084", + "url": "https://attack.mitre.org/techniques/T1084", + "deprecated": true + }, + { + "stixId": "attack-pattern--e99ec083-abdd-48de-ad87-4dbf6f8ba2a4", + "name": "Launch Daemon", + "type": "technique", + "id": "T1160", + "url": "https://attack.mitre.org/techniques/T1160", + "deprecated": true + }, + { + "stixId": "attack-pattern--ea016b56-ae0e-47fe-967a-cc0ad51af67f", + "name": "Ptrace System Calls", + "type": "technique", + "id": "T1055.008", + "url": "https://attack.mitre.org/techniques/T1055/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--ea4c2f9c-9df1-477c-8c42-6da1118f2ac4", + "name": "Dynamic API Resolution", + "type": "technique", + "id": "T1027.007", + "url": "https://attack.mitre.org/techniques/T1027/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--eb062747-2193-45de-8fa2-e62549c37ddf", + "name": "Remote Desktop Protocol", + "type": "technique", + "id": "T1021.001", + "url": "https://attack.mitre.org/techniques/T1021/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--eb125d40-0b2d-41ac-a71a-3229241c2cd3", + "name": "Logon Script (Windows)", + "type": "technique", + "id": "T1037.001", + "url": "https://attack.mitre.org/techniques/T1037/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--eb2cb5cb-ae87-4de0-8c35-da2a17aafb99", + "name": "ListPlanting", + "type": "technique", + "id": "T1055.015", + "url": "https://attack.mitre.org/techniques/T1055/015", + "deprecated": false + }, + { + "stixId": "attack-pattern--ebb42bbe-62d7-47d7-a55f-3b08b61d792d", + "name": "Domain Policy Modification", + "type": "technique", + "id": "T1484", + "url": "https://attack.mitre.org/techniques/T1484", + "deprecated": false + }, + { + "stixId": "attack-pattern--ebbe170d-aa74-4946-8511-9921243415a3", + "name": "XSL Script Processing", + "type": "technique", + "id": "T1220", + "url": "https://attack.mitre.org/techniques/T1220", + "deprecated": false + }, + { + "stixId": "attack-pattern--ec4be82f-940c-4dcb-87fe-2bbdd17c692f", + "name": "Scan Databases", + "type": "technique", + "id": "T1596.005", + "url": "https://attack.mitre.org/techniques/T1596/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "name": "Hidden Files and Directories", + "type": "technique", + "id": "T1564.001", + "url": "https://attack.mitre.org/techniques/T1564/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--ed2e45f9-d338-4eb2-8ce5-3a2e03323bc1", + "name": "Create Snapshot", + "type": "technique", + "id": "T1578.001", + "url": "https://attack.mitre.org/techniques/T1578/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--ed730f20-0e44-48b9-85f8-0e2adeb76867", + "name": "Determine Physical Locations", + "type": "technique", + "id": "T1591.001", + "url": "https://attack.mitre.org/techniques/T1591/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--ed7efd4d-ce28-4a19-a8e6-c58011eb2c7a", + "name": "Office Test", + "type": "technique", + "id": "T1137.002", + "url": "https://attack.mitre.org/techniques/T1137/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--edadea33-549c-4ed1-9783-8f5a5853cbdf", + "name": "Develop Capabilities", + "type": "technique", + "id": "T1587", + "url": "https://attack.mitre.org/techniques/T1587", + "deprecated": false + }, + { + "stixId": "attack-pattern--edbe24e9-aec4-4994-ac75-6a6bc7f1ddd0", + "name": "Dynamic Data Exchange", + "type": "technique", + "id": "T1173", + "url": "https://attack.mitre.org/techniques/T1173", + "deprecated": true + }, + { + "stixId": "attack-pattern--edf91964-b26e-4b4a-9600-ccacd7d7df24", + "name": "NTDS", + "type": "technique", + "id": "T1003.003", + "url": "https://attack.mitre.org/techniques/T1003/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--ee7ff928-801c-4f34-8a99-3df965e581a5", + "name": "SNMP (MIB Dump)", + "type": "technique", + "id": "T1602.001", + "url": "https://attack.mitre.org/techniques/T1602/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--eec23884-3fa1-4d8a-ac50-6f104d51e235", + "name": "Steganography", + "type": "technique", + "id": "T1001.002", + "url": "https://attack.mitre.org/techniques/T1001/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--ef67e13e-5598-4adc-bdb2-998225874fa9", + "name": "Malicious Link", + "type": "technique", + "id": "T1204.001", + "url": "https://attack.mitre.org/techniques/T1204/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f005e783-57d4-4837-88ad-dbe7faee1c51", + "name": "Application Access Token", + "type": "technique", + "id": "T1550.001", + "url": "https://attack.mitre.org/techniques/T1550/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f0589bc3-a6ae-425a-a3d5-5659bfee07f4", + "name": "LSASS Driver", + "type": "technique", + "id": "T1547.008", + "url": "https://attack.mitre.org/techniques/T1547/008", + "deprecated": false + }, + { + "stixId": "attack-pattern--f1951e8a-500e-4a26-8803-76d95c4554b4", + "name": "Service Execution", + "type": "technique", + "id": "T1569.002", + "url": "https://attack.mitre.org/techniques/T1569/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--f232fa7a-025c-4d43-abc7-318e81a73d65", + "name": "Cloud Accounts", + "type": "technique", + "id": "T1078.004", + "url": "https://attack.mitre.org/techniques/T1078/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--f244b8dd-af6c-4391-a497-fc03627ce995", + "name": "Environmental Keying", + "type": "technique", + "id": "T1480.001", + "url": "https://attack.mitre.org/techniques/T1480/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433", + "name": "Fallback Channels", + "type": "technique", + "id": "T1008", + "url": "https://attack.mitre.org/techniques/T1008", + "deprecated": false + }, + { + "stixId": "attack-pattern--f2857333-11d4-45bf-b064-2c28d8525be5", + "name": "NTFS File Attributes", + "type": "technique", + "id": "T1564.004", + "url": "https://attack.mitre.org/techniques/T1564/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--f2877f7f-9a4c-4251-879f-1224e3006bee", + "name": "Kerberoasting", + "type": "technique", + "id": "T1558.003", + "url": "https://attack.mitre.org/techniques/T1558/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--f2d44246-91f1-478a-b6c8-1227e0ca109d", + "name": "NTFS File Attributes", + "type": "technique", + "id": "T1096", + "url": "https://attack.mitre.org/techniques/T1096", + "deprecated": true + }, + { + "stixId": "attack-pattern--f303a39a-6255-4b89-aecc-18c4d8ca7163", + "name": "DCSync", + "type": "technique", + "id": "T1003.006", + "url": "https://attack.mitre.org/techniques/T1003/006", + "deprecated": false + }, + { + "stixId": "attack-pattern--f3c544dc-673c-4ef3-accb-53229f1ae077", + "name": "System Time Discovery", + "type": "technique", + "id": "T1124", + "url": "https://attack.mitre.org/techniques/T1124", + "deprecated": false + }, + { + "stixId": "attack-pattern--f3d95a1f-bba2-44ce-9af7-37866cd63fd0", + "name": "At", + "type": "technique", + "id": "T1053.002", + "url": "https://attack.mitre.org/techniques/T1053/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--f44731de-ea9f-406d-9b83-30ecbb9b4392", + "name": "Service Execution", + "type": "technique", + "id": "T1035", + "url": "https://attack.mitre.org/techniques/T1035", + "deprecated": true + }, + { + "stixId": "attack-pattern--f4599aa0-4f85-4a32-80ea-fc39dc965945", + "name": "Dynamic-link Library Injection", + "type": "technique", + "id": "T1055.001", + "url": "https://attack.mitre.org/techniques/T1055/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f4882e23-8aa7-4b12-b28a-b349c12ee9e0", + "name": "PowerShell", + "type": "technique", + "id": "T1086", + "url": "https://attack.mitre.org/techniques/T1086", + "deprecated": true + }, + { + "stixId": "attack-pattern--f4b843c1-7e92-4701-8fed-ce82f8be2636", + "name": "Exploits", + "type": "technique", + "id": "T1588.005", + "url": "https://attack.mitre.org/techniques/T1588/005", + "deprecated": false + }, + { + "stixId": "attack-pattern--f4c1826f-a322-41cd-9557-562100848c84", + "name": "Modify Authentication Process", + "type": "technique", + "id": "T1556", + "url": "https://attack.mitre.org/techniques/T1556", + "deprecated": false + }, + { + "stixId": "attack-pattern--f5946b5e-9408-485f-a7f7-b5efc88909b6", + "name": "Credential API Hooking", + "type": "technique", + "id": "T1056.004", + "url": "https://attack.mitre.org/techniques/T1056/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--f5bb433e-bdf6-4781-84bc-35e97e43be89", + "name": "Firmware Corruption", + "type": "technique", + "id": "T1495", + "url": "https://attack.mitre.org/techniques/T1495", + "deprecated": false + }, + { + "stixId": "attack-pattern--f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a", + "name": "Inhibit System Recovery", + "type": "technique", + "id": "T1490", + "url": "https://attack.mitre.org/techniques/T1490", + "deprecated": false + }, + { + "stixId": "attack-pattern--f63fe421-b1d1-45c0-b8a7-02cd16ff2bed", + "name": "Netsh Helper DLL", + "type": "technique", + "id": "T1546.007", + "url": "https://attack.mitre.org/techniques/T1546/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--f6ad61ee-65f3-4bd0-a3f5-2f0accb36317", + "name": "Spearphishing via Service", + "type": "technique", + "id": "T1566.003", + "url": "https://attack.mitre.org/techniques/T1566/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--f6dacc85-b37d-458e-b58d-74fc4bbf5755", + "name": "Internal Proxy", + "type": "technique", + "id": "T1090.001", + "url": "https://attack.mitre.org/techniques/T1090/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f6fe9070-7a65-49ea-ae72-76292f42cebe", + "name": "System Script Proxy Execution", + "type": "technique", + "id": "T1216", + "url": "https://attack.mitre.org/techniques/T1216", + "deprecated": false + }, + { + "stixId": "attack-pattern--f72eb8a8-cd4c-461d-a814-3f862befbf00", + "name": "Custom Command and Control Protocol", + "type": "technique", + "id": "T1094", + "url": "https://attack.mitre.org/techniques/T1094", + "deprecated": true + }, + { + "stixId": "attack-pattern--f7827069-0bf2-4764-af4f-23fae0d181b7", + "name": "Dead Drop Resolver", + "type": "technique", + "id": "T1102.001", + "url": "https://attack.mitre.org/techniques/T1102/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f792d02f-813d-402b-86a5-ab98cb391d3b", + "name": "InstallUtil", + "type": "technique", + "id": "T1118", + "url": "https://attack.mitre.org/techniques/T1118", + "deprecated": true + }, + { + "stixId": "attack-pattern--f7c0689c-4dbd-489b-81be-7cb7c7079ade", + "name": "Junk Data", + "type": "technique", + "id": "T1001.001", + "url": "https://attack.mitre.org/techniques/T1001/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f870408c-b1cd-49c7-a5c7-0ef0fc496cc6", + "name": "Spearphishing Service", + "type": "technique", + "id": "T1598.001", + "url": "https://attack.mitre.org/techniques/T1598/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f879d51c-5476-431c-aedf-f14d207e4d1e", + "name": "Commonly Used Port", + "type": "technique", + "id": "T1043", + "url": "https://attack.mitre.org/techniques/T1043", + "deprecated": true + }, + { + "stixId": "attack-pattern--f8ef3a62-3f44-40a4-abca-761ab235c436", + "name": "Container API", + "type": "technique", + "id": "T1552.007", + "url": "https://attack.mitre.org/techniques/T1552/007", + "deprecated": false + }, + { + "stixId": "attack-pattern--f9cc4d06-775f-4ee1-b401-4e2cc0da30ba", + "name": "Domains", + "type": "technique", + "id": "T1584.001", + "url": "https://attack.mitre.org/techniques/T1584/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f9e9365a-9ca2-4d9c-8e7c-050d73d1101a", + "name": "SQL Stored Procedures", + "type": "technique", + "id": "T1505.001", + "url": "https://attack.mitre.org/techniques/T1505/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--fa44a152-ac48-441e-a524-dd7b04b8adcd", + "name": "Network Device Authentication", + "type": "technique", + "id": "T1556.004", + "url": "https://attack.mitre.org/techniques/T1556/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--fb640c43-aa6b-431e-a961-a279010424ac", + "name": "Disk Content Wipe", + "type": "technique", + "id": "T1561.001", + "url": "https://attack.mitre.org/techniques/T1561/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--fb8d023d-45be-47e9-bc51-f56bcae6435b", + "name": "Exfiltration Over Unencrypted Non-C2 Protocol", + "type": "technique", + "id": "T1048.003", + "url": "https://attack.mitre.org/techniques/T1048/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--fc742192-19e3-466c-9eb5-964a97b29490", + "name": "Dylib Hijacking", + "type": "technique", + "id": "T1574.004", + "url": "https://attack.mitre.org/techniques/T1574/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--fc74ba38-dc98-461f-8611-b3dbf9978e3d", + "name": "Downgrade System Image", + "type": "technique", + "id": "T1601.002", + "url": "https://attack.mitre.org/techniques/T1601/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--fdc47f44-dd32-4b99-af5f-209f556f63c2", + "name": "Local Accounts", + "type": "technique", + "id": "T1078.003", + "url": "https://attack.mitre.org/techniques/T1078/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--fe926152-f431-4baf-956c-4ad3cb0bf23b", + "name": "Exploitation for Defense Evasion", + "type": "technique", + "id": "T1211", + "url": "https://attack.mitre.org/techniques/T1211", + "deprecated": false + }, + { + "stixId": "attack-pattern--ff25900d-76d5-449b-a351-8824e62fc81b", + "name": "Trusted Developer Utilities Proxy Execution", + "type": "technique", + "id": "T1127", + "url": "https://attack.mitre.org/techniques/T1127", + "deprecated": false + }, + { + "stixId": "attack-pattern--ff73aa03-0090-4464-83ac-f89e233c02bc", + "name": "System Shutdown/Reboot", + "type": "technique", + "id": "T1529", + "url": "https://attack.mitre.org/techniques/T1529", + "deprecated": false + }, + { + "stixId": "attack-pattern--ffbcfdb0-de22-4106-9ed3-fc23c8a01407", + "name": "MMC", + "type": "technique", + "id": "T1218.014", + "url": "https://attack.mitre.org/techniques/T1218/014", + "deprecated": false + }, + { + "stixId": "attack-pattern--ffe59ad3-ad9b-4b9f-b74f-5beb3c309dc1", + "name": "Process Argument Spoofing", + "type": "technique", + "id": "T1564.010", + "url": "https://attack.mitre.org/techniques/T1564/010", + "deprecated": false + }, + { + "stixId": "attack-pattern--ffe742ed-9100-4686-9e00-c331da544787", + "name": "Windows Admin Shares", + "type": "technique", + "id": "T1077", + "url": "https://attack.mitre.org/techniques/T1077", + "deprecated": true + }, + { + "stixId": "attack-pattern--ffeb0780-356e-4261-b036-cfb6bd234335", + "name": "COR_PROFILER", + "type": "technique", + "id": "T1574.012", + "url": "https://attack.mitre.org/techniques/T1574/012", + "deprecated": false + }, + { + "stixId": "attack-pattern--008b8f56-6107-48be-aa9f-746f927dbb61", + "name": "Block Command Message", + "type": "technique", + "id": "T0803", + "url": "https://attack.mitre.org/techniques/T0803", + "deprecated": false + }, + { + "stixId": "attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8", + "name": "Service Stop", + "type": "technique", + "id": "T0881", + "url": "https://attack.mitre.org/techniques/T0881", + "deprecated": false + }, + { + "stixId": "attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722", + "name": "Modify Parameter", + "type": "technique", + "id": "T0836", + "url": "https://attack.mitre.org/techniques/T0836", + "deprecated": false + }, + { + "stixId": "attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243", + "name": "Modify Controller Tasking", + "type": "technique", + "id": "T0821", + "url": "https://attack.mitre.org/techniques/T0821", + "deprecated": false + }, + { + "stixId": "attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72", + "name": "Wireless Sniffing", + "type": "technique", + "id": "T0887", + "url": "https://attack.mitre.org/techniques/T0887", + "deprecated": false + }, + { + "stixId": "attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36", + "name": "Loss of View", + "type": "technique", + "id": "T0829", + "url": "https://attack.mitre.org/techniques/T0829", + "deprecated": false + }, + { + "stixId": "attack-pattern--19a71d1e-6334-4233-8260-b749cae37953", + "name": "Activate Firmware Update Mode", + "type": "technique", + "id": "T0800", + "url": "https://attack.mitre.org/techniques/T0800", + "deprecated": false + }, + { + "stixId": "attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1", + "name": "Manipulation of Control", + "type": "technique", + "id": "T0831", + "url": "https://attack.mitre.org/techniques/T0831", + "deprecated": false + }, + { + "stixId": "attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b", + "name": "Denial of Service", + "type": "technique", + "id": "T0814", + "url": "https://attack.mitre.org/techniques/T0814", + "deprecated": false + }, + { + "stixId": "attack-pattern--1c478716-71d9-46a4-9a53-fa5d576adb60", + "name": "Block Serial COM", + "type": "technique", + "id": "T0805", + "url": "https://attack.mitre.org/techniques/T0805", + "deprecated": false + }, + { + "stixId": "attack-pattern--23270e54-1d68-4c3b-b763-b25607bcef80", + "name": "Role Identification", + "type": "technique", + "id": "T0850", + "url": "https://attack.mitre.org/techniques/T0850", + "deprecated": true + }, + { + "stixId": "attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c", + "name": "Command-Line Interface", + "type": "technique", + "id": "T0807", + "url": "https://attack.mitre.org/techniques/T0807", + "deprecated": false + }, + { + "stixId": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1", + "name": "Point & Tag Identification", + "type": "technique", + "id": "T0861", + "url": "https://attack.mitre.org/techniques/T0861", + "deprecated": false + }, + { + "stixId": "attack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9", + "name": "Device Restart/Shutdown", + "type": "technique", + "id": "T0816", + "url": "https://attack.mitre.org/techniques/T0816", + "deprecated": false + }, + { + "stixId": "attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c", + "name": "User Execution", + "type": "technique", + "id": "T0863", + "url": "https://attack.mitre.org/techniques/T0863", + "deprecated": false + }, + { + "stixId": "attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e", + "name": "Wireless Compromise", + "type": "technique", + "id": "T0860", + "url": "https://attack.mitre.org/techniques/T0860", + "deprecated": false + }, + { + "stixId": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601", + "name": "Change Operating Mode", + "type": "technique", + "id": "T0858", + "url": "https://attack.mitre.org/techniques/T0858", + "deprecated": false + }, + { + "stixId": "attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc", + "name": "Alarm Suppression", + "type": "technique", + "id": "T0878", + "url": "https://attack.mitre.org/techniques/T0878", + "deprecated": false + }, + { + "stixId": "attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a", + "name": "Detect Operating Mode", + "type": "technique", + "id": "T0868", + "url": "https://attack.mitre.org/techniques/T0868", + "deprecated": false + }, + { + "stixId": "attack-pattern--2bb4d762-bf4a-4bc3-9318-15cc6a354163", + "name": "Loss of Protection", + "type": "technique", + "id": "T0837", + "url": "https://attack.mitre.org/techniques/T0837", + "deprecated": false + }, + { + "stixId": "attack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364b", + "name": "Monitor Process State", + "type": "technique", + "id": "T0801", + "url": "https://attack.mitre.org/techniques/T0801", + "deprecated": false + }, + { + "stixId": "attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958", + "name": "Scripting", + "type": "technique", + "id": "T0853", + "url": "https://attack.mitre.org/techniques/T0853", + "deprecated": false + }, + { + "stixId": "attack-pattern--2fedbe69-581f-447d-8a78-32ee7db939a9", + "name": "Remote System Information Discovery", + "type": "technique", + "id": "T0888", + "url": "https://attack.mitre.org/techniques/T0888", + "deprecated": false + }, + { + "stixId": "attack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3", + "name": "Program Upload", + "type": "technique", + "id": "T0845", + "url": "https://attack.mitre.org/techniques/T0845", + "deprecated": false + }, + { + "stixId": "attack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00", + "name": "Exploit Public-Facing Application", + "type": "technique", + "id": "T0819", + "url": "https://attack.mitre.org/techniques/T0819", + "deprecated": false + }, + { + "stixId": "attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f", + "name": "Data from Information Repositories", + "type": "technique", + "id": "T0811", + "url": "https://attack.mitre.org/techniques/T0811", + "deprecated": false + }, + { + "stixId": "attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9", + "name": "Transient Cyber Asset", + "type": "technique", + "id": "T0864", + "url": "https://attack.mitre.org/techniques/T0864", + "deprecated": false + }, + { + "stixId": "attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004", + "name": "Manipulate I/O Image", + "type": "technique", + "id": "T0835", + "url": "https://attack.mitre.org/techniques/T0835", + "deprecated": false + }, + { + "stixId": "attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c", + "name": "Network Sniffing", + "type": "technique", + "id": "T0842", + "url": "https://attack.mitre.org/techniques/T0842", + "deprecated": false + }, + { + "stixId": "attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9", + "name": "Rootkit", + "type": "technique", + "id": "T0851", + "url": "https://attack.mitre.org/techniques/T0851", + "deprecated": false + }, + { + "stixId": "attack-pattern--3de230d4-3e42-4041-b089-17e1128feded", + "name": "Automated Collection", + "type": "technique", + "id": "T0802", + "url": "https://attack.mitre.org/techniques/T0802", + "deprecated": false + }, + { + "stixId": "attack-pattern--3f1f4ccb-9be2-4ff8-8f69-dd972221169b", + "name": "Block Reporting Message", + "type": "technique", + "id": "T0804", + "url": "https://attack.mitre.org/techniques/T0804", + "deprecated": false + }, + { + "stixId": "attack-pattern--40b300ba-f553-48bf-862e-9471b220d455", + "name": "Unauthorized Command Message", + "type": "technique", + "id": "T0855", + "url": "https://attack.mitre.org/techniques/T0855", + "deprecated": false + }, + { + "stixId": "attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675", + "name": "Data Destruction", + "type": "technique", + "id": "T0809", + "url": "https://attack.mitre.org/techniques/T0809", + "deprecated": false + }, + { + "stixId": "attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec", + "name": "Manipulation of View", + "type": "technique", + "id": "T0832", + "url": "https://attack.mitre.org/techniques/T0832", + "deprecated": false + }, + { + "stixId": "attack-pattern--50d3222f-7550-4a3c-94e1-78cb6c81d064", + "name": "Data Historian Compromise", + "type": "technique", + "id": "T0810", + "url": "https://attack.mitre.org/techniques/T0810", + "deprecated": true + }, + { + "stixId": "attack-pattern--539d0484-fe95-485a-b654-86991c0d0d00", + "name": "Network Service Scanning", + "type": "technique", + "id": "T0841", + "url": "https://attack.mitre.org/techniques/T0841", + "deprecated": true + }, + { + "stixId": "attack-pattern--53a26eee-1080-4d17-9762-2027d5a1b805", + "name": "Indicator Removal on Host", + "type": "technique", + "id": "T0872", + "url": "https://attack.mitre.org/techniques/T0872", + "deprecated": false + }, + { + "stixId": "attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204", + "name": "I/O Image", + "type": "technique", + "id": "T0877", + "url": "https://attack.mitre.org/techniques/T0877", + "deprecated": false + }, + { + "stixId": "attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac", + "name": "Denial of View", + "type": "technique", + "id": "T0815", + "url": "https://attack.mitre.org/techniques/T0815", + "deprecated": false + }, + { + "stixId": "attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4", + "name": "Execution through API", + "type": "technique", + "id": "T0871", + "url": "https://attack.mitre.org/techniques/T0871", + "deprecated": false + }, + { + "stixId": "attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3", + "name": "Supply Chain Compromise", + "type": "technique", + "id": "T0862", + "url": "https://attack.mitre.org/techniques/T0862", + "deprecated": false + }, + { + "stixId": "attack-pattern--5f3da2f3-91c8-4d8b-a02f-bf43a11def55", + "name": "Serial Connection Enumeration", + "type": "technique", + "id": "T0854", + "url": "https://attack.mitre.org/techniques/T0854", + "deprecated": true + }, + { + "stixId": "attack-pattern--5fa00fdd-4a55-4191-94a0-564181d7fec2", + "name": "Loss of Safety", + "type": "technique", + "id": "T0880", + "url": "https://attack.mitre.org/techniques/T0880", + "deprecated": false + }, + { + "stixId": "attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee", + "name": "Loss of Productivity and Revenue", + "type": "technique", + "id": "T0828", + "url": "https://attack.mitre.org/techniques/T0828", + "deprecated": false + }, + { + "stixId": "attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426", + "name": "Spearphishing Attachment", + "type": "technique", + "id": "T0865", + "url": "https://attack.mitre.org/techniques/T0865", + "deprecated": false + }, + { + "stixId": "attack-pattern--7374ab87-0782-41f8-b415-678c0950bb2a", + "name": "Location Identification", + "type": "technique", + "id": "T0825", + "url": "https://attack.mitre.org/techniques/T0825", + "deprecated": true + }, + { + "stixId": "attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a", + "name": "Drive-by Compromise", + "type": "technique", + "id": "T0817", + "url": "https://attack.mitre.org/techniques/T0817", + "deprecated": false + }, + { + "stixId": "attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916", + "name": "Damage to Property", + "type": "technique", + "id": "T0879", + "url": "https://attack.mitre.org/techniques/T0879", + "deprecated": false + }, + { + "stixId": "attack-pattern--8535b71e-3c12-4258-a4ab-40257a1becc4", + "name": "Spoof Reporting Message", + "type": "technique", + "id": "T0856", + "url": "https://attack.mitre.org/techniques/T0856", + "deprecated": false + }, + { + "stixId": "attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee", + "name": "Exploitation of Remote Services", + "type": "technique", + "id": "T0866", + "url": "https://attack.mitre.org/techniques/T0866", + "deprecated": false + }, + { + "stixId": "attack-pattern--8bb4538f-f16f-49f0-a431-70b5444c7349", + "name": "Default Credentials", + "type": "technique", + "id": "T0812", + "url": "https://attack.mitre.org/techniques/T0812", + "deprecated": false + }, + { + "stixId": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c", + "name": "External Remote Services", + "type": "technique", + "id": "T0822", + "url": "https://attack.mitre.org/techniques/T0822", + "deprecated": false + }, + { + "stixId": "attack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4", + "name": "Brute Force I/O", + "type": "technique", + "id": "T0806", + "url": "https://attack.mitre.org/techniques/T0806", + "deprecated": false + }, + { + "stixId": "attack-pattern--94f042ae-3033-4a8d-9ec3-26396533a541", + "name": "Detect Program State", + "type": "technique", + "id": "T0870", + "url": "https://attack.mitre.org/techniques/T0870", + "deprecated": true + }, + { + "stixId": "attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b", + "name": "Adversary-in-the-Middle", + "type": "technique", + "id": "T0830", + "url": "https://attack.mitre.org/techniques/T0830", + "deprecated": false + }, + { + "stixId": "attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03", + "name": "Exploitation for Evasion", + "type": "technique", + "id": "T0820", + "url": "https://attack.mitre.org/techniques/T0820", + "deprecated": false + }, + { + "stixId": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb", + "name": "Loss of Control", + "type": "technique", + "id": "T0827", + "url": "https://attack.mitre.org/techniques/T0827", + "deprecated": false + }, + { + "stixId": "attack-pattern--a8cfd474-9358-464f-a169-9c6f099a8e8a", + "name": "Change Program State", + "type": "technique", + "id": "T0875", + "url": "https://attack.mitre.org/techniques/T0875", + "deprecated": true + }, + { + "stixId": "attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae", + "name": "Hooking", + "type": "technique", + "id": "T0874", + "url": "https://attack.mitre.org/techniques/T0874", + "deprecated": false + }, + { + "stixId": "attack-pattern--abb0a255-eb9c-48d0-8f5c-874bb84c0e45", + "name": "Control Device Identification", + "type": "technique", + "id": "T0808", + "url": "https://attack.mitre.org/techniques/T0808", + "deprecated": true + }, + { + "stixId": "attack-pattern--ae62fe1a-ea1a-479b-8dc0-65d250bd8bc7", + "name": "Program Organization Units", + "type": "technique", + "id": "T0844", + "url": "https://attack.mitre.org/techniques/T0844", + "deprecated": true + }, + { + "stixId": "attack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cf", + "name": "Graphical User Interface", + "type": "technique", + "id": "T0823", + "url": "https://attack.mitre.org/techniques/T0823", + "deprecated": false + }, + { + "stixId": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb", + "name": "Rogue Master", + "type": "technique", + "id": "T0848", + "url": "https://attack.mitre.org/techniques/T0848", + "deprecated": false + }, + { + "stixId": "attack-pattern--b52870cc-83f3-473c-b895-72d91751030b", + "name": "Native API", + "type": "technique", + "id": "T0834", + "url": "https://attack.mitre.org/techniques/T0834", + "deprecated": false + }, + { + "stixId": "attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95", + "name": "Loss of Availability", + "type": "technique", + "id": "T0826", + "url": "https://attack.mitre.org/techniques/T0826", + "deprecated": false + }, + { + "stixId": "attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54", + "name": "Theft of Operational Information", + "type": "technique", + "id": "T0882", + "url": "https://attack.mitre.org/techniques/T0882", + "deprecated": false + }, + { + "stixId": "attack-pattern--b9160e77-ea9e-4ba9-b1c8-53a3c466b13d", + "name": "System Firmware", + "type": "technique", + "id": "T0857", + "url": "https://attack.mitre.org/techniques/T0857", + "deprecated": false + }, + { + "stixId": "attack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61", + "name": "Masquerading", + "type": "technique", + "id": "T0849", + "url": "https://attack.mitre.org/techniques/T0849", + "deprecated": false + }, + { + "stixId": "attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068", + "name": "Program Download", + "type": "technique", + "id": "T0843", + "url": "https://attack.mitre.org/techniques/T0843", + "deprecated": false + }, + { + "stixId": "attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21", + "name": "Replication Through Removable Media", + "type": "technique", + "id": "T0847", + "url": "https://attack.mitre.org/techniques/T0847", + "deprecated": false + }, + { + "stixId": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377", + "name": "Screen Capture", + "type": "technique", + "id": "T0852", + "url": "https://attack.mitre.org/techniques/T0852", + "deprecated": false + }, + { + "stixId": "attack-pattern--c9a8d958-fcdb-40d2-af4c-461c8031651a", + "name": "Hardcoded Credentials", + "type": "technique", + "id": "T0891", + "url": "https://attack.mitre.org/techniques/T0891", + "deprecated": false + }, + { + "stixId": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101", + "name": "Valid Accounts", + "type": "technique", + "id": "T0859", + "url": "https://attack.mitre.org/techniques/T0859", + "deprecated": false + }, + { + "stixId": "attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618", + "name": "Exploitation for Privilege Escalation", + "type": "technique", + "id": "T0890", + "url": "https://attack.mitre.org/techniques/T0890", + "deprecated": false + }, + { + "stixId": "attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061", + "name": "Remote System Discovery", + "type": "technique", + "id": "T0846", + "url": "https://attack.mitre.org/techniques/T0846", + "deprecated": false + }, + { + "stixId": "attack-pattern--d614a9cf-18eb-4800-81e4-ab8ddf0baa73", + "name": "Engineering Workstation Compromise", + "type": "technique", + "id": "T0818", + "url": "https://attack.mitre.org/techniques/T0818", + "deprecated": true + }, + { + "stixId": "attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4", + "name": "Connection Proxy", + "type": "technique", + "id": "T0884", + "url": "https://attack.mitre.org/techniques/T0884", + "deprecated": false + }, + { + "stixId": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387", + "name": "Standard Application Layer Protocol", + "type": "technique", + "id": "T0869", + "url": "https://attack.mitre.org/techniques/T0869", + "deprecated": false + }, + { + "stixId": "attack-pattern--e0d74479-86d2-465d-bf36-903ebecef43e", + "name": "Modify Control Logic", + "type": "technique", + "id": "T0833", + "url": "https://attack.mitre.org/techniques/T0833", + "deprecated": true + }, + { + "stixId": "attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf", + "name": "Remote Services", + "type": "technique", + "id": "T0886", + "url": "https://attack.mitre.org/techniques/T0886", + "deprecated": false + }, + { + "stixId": "attack-pattern--e2994b6a-122b-4043-b654-7411c5198ec0", + "name": "I/O Module Discovery", + "type": "technique", + "id": "T0824", + "url": "https://attack.mitre.org/techniques/T0824", + "deprecated": true + }, + { + "stixId": "attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20", + "name": "Denial of Control", + "type": "technique", + "id": "T0813", + "url": "https://attack.mitre.org/techniques/T0813", + "deprecated": false + }, + { + "stixId": "attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92", + "name": "Modify Alarm Settings", + "type": "technique", + "id": "T0838", + "url": "https://attack.mitre.org/techniques/T0838", + "deprecated": false + }, + { + "stixId": "attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07", + "name": "Commonly Used Port", + "type": "technique", + "id": "T0885", + "url": "https://attack.mitre.org/techniques/T0885", + "deprecated": false + }, + { + "stixId": "attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722", + "name": "Project File Infection", + "type": "technique", + "id": "T0873", + "url": "https://attack.mitre.org/techniques/T0873", + "deprecated": false + }, + { + "stixId": "attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e", + "name": "Network Connection Enumeration", + "type": "technique", + "id": "T0840", + "url": "https://attack.mitre.org/techniques/T0840", + "deprecated": false + }, + { + "stixId": "attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d", + "name": "Lateral Tool Transfer", + "type": "technique", + "id": "T0867", + "url": "https://attack.mitre.org/techniques/T0867", + "deprecated": false + }, + { + "stixId": "attack-pattern--efbf7888-f61b-4572-9c80-7e2965c60707", + "name": "Module Firmware", + "type": "technique", + "id": "T0839", + "url": "https://attack.mitre.org/techniques/T0839", + "deprecated": false + }, + { + "stixId": "attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307", + "name": "Internet Accessible Device", + "type": "technique", + "id": "T0883", + "url": "https://attack.mitre.org/techniques/T0883", + "deprecated": false + }, + { + "stixId": "attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5", + "name": "Data from Local System", + "type": "technique", + "id": "T0893", + "url": "https://attack.mitre.org/techniques/T0893", + "deprecated": false + }, + { + "stixId": "attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f", + "name": "Change Credential", + "type": "technique", + "id": "T0892", + "url": "https://attack.mitre.org/techniques/T0892", + "deprecated": false + }, + { + "stixId": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2", + "name": "Modify Program", + "type": "technique", + "id": "T0889", + "url": "https://attack.mitre.org/techniques/T0889", + "deprecated": false + }, + { + "stixId": "attack-pattern--00290ac5-551e-44aa-bbd8-c4b913488a6d", + "name": "Scheduled Task/Job", + "type": "technique", + "id": "T1603", + "url": "https://attack.mitre.org/techniques/T1603", + "deprecated": false + }, + { + "stixId": "attack-pattern--039bc59c-ecc7-4997-b2b4-4ab728bd91aa", + "name": "Code Injection", + "type": "technique", + "id": "T1540", + "url": "https://attack.mitre.org/techniques/T1540", + "deprecated": true + }, + { + "stixId": "attack-pattern--08e22979-d320-48ed-8711-e7bf94aabb13", + "name": "Adversary-in-the-Middle", + "type": "technique", + "id": "T1638", + "url": "https://attack.mitre.org/techniques/T1638", + "deprecated": false + }, + { + "stixId": "attack-pattern--08ea902d-ecb5-47ed-a453-2798057bb2d3", + "name": "Abuse Elevation Control Mechanism", + "type": "technique", + "id": "T1626", + "url": "https://attack.mitre.org/techniques/T1626", + "deprecated": false + }, + { + "stixId": "attack-pattern--0bcc4ec1-a897-49a9-a9ff-c00df1d1209d", + "name": "Malicious SMS Message", + "type": "technique", + "id": "T1454", + "url": "https://attack.mitre.org/techniques/T1454", + "deprecated": true + }, + { + "stixId": "attack-pattern--0c71033e-401e-4b97-9309-7a7c95e43a5d", + "name": "Obtain Device Cloud Backups", + "type": "technique", + "id": "T1470", + "url": "https://attack.mitre.org/techniques/T1470", + "deprecated": true + }, + { + "stixId": "attack-pattern--0cdd66ad-26ac-4338-a764-4972a1e17ee3", + "name": "Uninstall Malicious Application", + "type": "technique", + "id": "T1630.001", + "url": "https://attack.mitre.org/techniques/T1630/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--0d4e3bbb-7af5-4c88-a215-0c0906bc1e8d", + "name": "Indicator Removal on Host", + "type": "technique", + "id": "T1630", + "url": "https://attack.mitre.org/techniques/T1630", + "deprecated": false + }, + { + "stixId": "attack-pattern--0d95940f-9583-4e0f-824c-a42c1be47fad", + "name": "Supply Chain Compromise", + "type": "technique", + "id": "T1474", + "url": "https://attack.mitre.org/techniques/T1474", + "deprecated": false + }, + { + "stixId": "attack-pattern--0f4fb01b-d57a-4375-b7a2-342c9d3248f7", + "name": "Impersonate SS7 Nodes", + "type": "technique", + "id": "T1430.002", + "url": "https://attack.mitre.org/techniques/T1430/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--11bd699b-f2c2-4e48-bf46-fb3f8acd9799", + "name": "Insecure Third-Party Libraries", + "type": "technique", + "id": "T1425", + "url": "https://attack.mitre.org/techniques/T1425", + "deprecated": true + }, + { + "stixId": "attack-pattern--11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e", + "name": "Protected User Data", + "type": "technique", + "id": "T1636", + "url": "https://attack.mitre.org/techniques/T1636", + "deprecated": false + }, + { + "stixId": "attack-pattern--16d73b64-5681-4ea0-9af4-4ad86f7c96e8", + "name": "Asymmetric Cryptography", + "type": "technique", + "id": "T1521.002", + "url": "https://attack.mitre.org/techniques/T1521/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--198ce408-1470-45ee-b47f-7056050d4fc2", + "name": "Software Discovery", + "type": "technique", + "id": "T1418", + "url": "https://attack.mitre.org/techniques/T1418", + "deprecated": false + }, + { + "stixId": "attack-pattern--1b51f5bc-b97a-498a-8dbd-bc6b1901bf19", + "name": "Process Discovery", + "type": "technique", + "id": "T1424", + "url": "https://attack.mitre.org/techniques/T1424", + "deprecated": false + }, + { + "stixId": "attack-pattern--1d1b1558-c833-482e-aabb-d07ef6eae63d", + "name": "Call Log", + "type": "technique", + "id": "T1636.002", + "url": "https://attack.mitre.org/techniques/T1636/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--1d44f529-6fe6-489f-8a01-6261ac43f05e", + "name": "Security Software Discovery", + "type": "technique", + "id": "T1418.001", + "url": "https://attack.mitre.org/techniques/T1418/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--1f96d624-8409-4472-ad8a-30618ee6b2e2", + "name": "App Delivered via Email Attachment", + "type": "technique", + "id": "T1434", + "url": "https://attack.mitre.org/techniques/T1434", + "deprecated": true + }, + { + "stixId": "attack-pattern--1ff89c1b-7615-4fe8-b9cb-63aaf52e6dee", + "name": "Ptrace System Calls", + "type": "technique", + "id": "T1631.001", + "url": "https://attack.mitre.org/techniques/T1631/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--20b0931a-8952-42ca-975f-775bad295f1a", + "name": "Impair Defenses", + "type": "technique", + "id": "T1629", + "url": "https://attack.mitre.org/techniques/T1629", + "deprecated": false + }, + { + "stixId": "attack-pattern--2204c371-6100-4ae0-82f3-25c07c29772a", + "name": "Abuse Accessibility Features", + "type": "technique", + "id": "T1453", + "url": "https://attack.mitre.org/techniques/T1453", + "deprecated": true + }, + { + "stixId": "attack-pattern--22379609-a99f-4a01-bd7e-70f3e105859d", + "name": "Exploitation of Remote Services", + "type": "technique", + "id": "T1428", + "url": "https://attack.mitre.org/techniques/T1428", + "deprecated": false + }, + { + "stixId": "attack-pattern--2282a98b-5049-4f61-9381-55baca7c1add", + "name": "Web Protocols", + "type": "technique", + "id": "T1437.001", + "url": "https://attack.mitre.org/techniques/T1437/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--233fe2c0-cb41-4765-b454-e0087597fbce", + "name": "Steal Application Access Token", + "type": "technique", + "id": "T1635", + "url": "https://attack.mitre.org/techniques/T1635", + "deprecated": false + }, + { + "stixId": "attack-pattern--24a77e53-0751-46fc-b207-99378fb35c08", + "name": "User Evasion", + "type": "technique", + "id": "T1628.002", + "url": "https://attack.mitre.org/techniques/T1628/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--27d18e87-8f32-4be1-b456-39b90454360f", + "name": "Virtualization/Sandbox Evasion", + "type": "technique", + "id": "T1633", + "url": "https://attack.mitre.org/techniques/T1633", + "deprecated": false + }, + { + "stixId": "attack-pattern--27f483c6-6666-44fa-8532-ffd5fc7dab38", + "name": "Keychain", + "type": "technique", + "id": "T1579", + "url": "https://attack.mitre.org/techniques/T1579", + "deprecated": true + }, + { + "stixId": "attack-pattern--29e07491-8947-43a3-8d4e-9a787c45f3d3", + "name": "Access Sensitive Data in Device Logs", + "type": "technique", + "id": "T1413", + "url": "https://attack.mitre.org/techniques/T1413", + "deprecated": true + }, + { + "stixId": "attack-pattern--29f1f56c-7b7a-4c14-9e39-59577ea2743c", + "name": "Command and Scripting Interpreter", + "type": "technique", + "id": "T1623", + "url": "https://attack.mitre.org/techniques/T1623", + "deprecated": false + }, + { + "stixId": "attack-pattern--2aa78dfd-cb6f-4c70-9408-137cfd96be49", + "name": "Disable or Modify Tools", + "type": "technique", + "id": "T1629.003", + "url": "https://attack.mitre.org/techniques/T1629/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--2bb20118-e6c0-41dc-a07c-283ea4dd0fb8", + "name": "Ingress Tool Transfer", + "type": "technique", + "id": "T1544", + "url": "https://attack.mitre.org/techniques/T1544", + "deprecated": false + }, + { + "stixId": "attack-pattern--2ccc3d39-9598-4d32-9657-42e1c7095d26", + "name": "Dynamic Resolution", + "type": "technique", + "id": "T1637", + "url": "https://attack.mitre.org/techniques/T1637", + "deprecated": false + }, + { + "stixId": "attack-pattern--2d646840-f6f5-4619-a5a8-29c8316bbac5", + "name": "Exploit via Radio Interfaces", + "type": "technique", + "id": "T1477", + "url": "https://attack.mitre.org/techniques/T1477", + "deprecated": true + }, + { + "stixId": "attack-pattern--2de38279-043e-47e8-aaad-1b07af6d0790", + "name": "Network Service Scanning", + "type": "technique", + "id": "T1423", + "url": "https://attack.mitre.org/techniques/T1423", + "deprecated": false + }, + { + "stixId": "attack-pattern--2f0e8d80-4b8b-4f4a-b5cc-132afe7e057d", + "name": "User Evasion", + "type": "technique", + "id": "T1618", + "url": "https://attack.mitre.org/techniques/T1618", + "deprecated": true + }, + { + "stixId": "attack-pattern--32063d7f-0a39-440d-a4a3-2694488f96cc", + "name": "Exfiltration Over C2 Channel", + "type": "technique", + "id": "T1646", + "url": "https://attack.mitre.org/techniques/T1646", + "deprecated": false + }, + { + "stixId": "attack-pattern--351c0927-2fc1-4a2c-ad84-cbbee7eb8172", + "name": "Exploitation for Privilege Escalation", + "type": "technique", + "id": "T1404", + "url": "https://attack.mitre.org/techniques/T1404", + "deprecated": false + }, + { + "stixId": "attack-pattern--351ddf79-2d3a-41b4-9bef-82ea5d3ccd69", + "name": "Call Control", + "type": "technique", + "id": "T1616", + "url": "https://attack.mitre.org/techniques/T1616", + "deprecated": false + }, + { + "stixId": "attack-pattern--37047267-3e56-453c-833e-d92b68118120", + "name": "Exfiltration Over Unencrypted Non-C2 Protocol", + "type": "technique", + "id": "T1639.001", + "url": "https://attack.mitre.org/techniques/T1639/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--3775a580-a1d1-46c4-8147-c614a715f2e9", + "name": "Broadcast Receivers", + "type": "technique", + "id": "T1624.001", + "url": "https://attack.mitre.org/techniques/T1624/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--3911658a-6506-4deb-9ab4-595a51ae71ad", + "name": "Commonly Used Port", + "type": "technique", + "id": "T1436", + "url": "https://attack.mitre.org/techniques/T1436", + "deprecated": true + }, + { + "stixId": "attack-pattern--393e8c12-a416-4575-ba90-19cc85656796", + "name": "Eavesdrop on Insecure Network Communication", + "type": "technique", + "id": "T1439", + "url": "https://attack.mitre.org/techniques/T1439", + "deprecated": true + }, + { + "stixId": "attack-pattern--39dd7871-f59b-495f-a9a5-3cb8cc50c9b2", + "name": "Access Notifications", + "type": "technique", + "id": "T1517", + "url": "https://attack.mitre.org/techniques/T1517", + "deprecated": false + }, + { + "stixId": "attack-pattern--3b0b604f-10db-41a0-b54c-493124d455b9", + "name": "Network Traffic Capture or Redirection", + "type": "technique", + "id": "T1410", + "url": "https://attack.mitre.org/techniques/T1410", + "deprecated": true + }, + { + "stixId": "attack-pattern--3dd58c80-4c2e-458c-9503-1b2cd273c4d2", + "name": "Input Prompt", + "type": "technique", + "id": "T1411", + "url": "https://attack.mitre.org/techniques/T1411", + "deprecated": true + }, + { + "stixId": "attack-pattern--3e091a89-a493-4a6c-8e88-d57be19bb98d", + "name": "Exfiltration Over Alternative Protocol", + "type": "technique", + "id": "T1639", + "url": "https://attack.mitre.org/techniques/T1639", + "deprecated": false + }, + { + "stixId": "attack-pattern--45dcbc83-4abc-4de1-b643-e528d1e9df09", + "name": "Biometric Spoofing", + "type": "technique", + "id": "T1460", + "url": "https://attack.mitre.org/techniques/T1460", + "deprecated": true + }, + { + "stixId": "attack-pattern--46d818a5-67fa-4585-a7fc-ecf15376c8d5", + "name": "Boot or Logon Initialization Scripts", + "type": "technique", + "id": "T1398", + "url": "https://attack.mitre.org/techniques/T1398", + "deprecated": false + }, + { + "stixId": "attack-pattern--498e7b81-238d-404c-aa5e-332904d63286", + "name": "Execution Guardrails", + "type": "technique", + "id": "T1627", + "url": "https://attack.mitre.org/techniques/T1627", + "deprecated": false + }, + { + "stixId": "attack-pattern--4c58b7c6-a839-4789-bda9-9de33e4d4512", + "name": "GUI Input Capture", + "type": "technique", + "id": "T1417.002", + "url": "https://attack.mitre.org/techniques/T1417/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--4e6620ac-c30c-4f6d-918e-fa20cae7c1ce", + "name": "Access Contact List", + "type": "technique", + "id": "T1432", + "url": "https://attack.mitre.org/techniques/T1432", + "deprecated": true + }, + { + "stixId": "attack-pattern--4f14e30b-8b57-4a7b-9093-2c0778ea99cf", + "name": "Compromise Client Software Binary", + "type": "technique", + "id": "T1645", + "url": "https://attack.mitre.org/techniques/T1645", + "deprecated": false + }, + { + "stixId": "attack-pattern--51636761-2e35-44bf-9e56-e337adf97174", + "name": "Software Packing", + "type": "technique", + "id": "T1406.002", + "url": "https://attack.mitre.org/techniques/T1406/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--51aedbd6-2837-4d15-aeb0-cb09f2bf22ac", + "name": "Abuse of iOS Enterprise App Signing Key", + "type": "technique", + "id": "T1445", + "url": "https://attack.mitre.org/techniques/T1445", + "deprecated": true + }, + { + "stixId": "attack-pattern--52651225-0b3a-482d-aa7e-10618fd063b5", + "name": "Exploit SS7 to Track Device Location", + "type": "technique", + "id": "T1450", + "url": "https://attack.mitre.org/techniques/T1450", + "deprecated": true + }, + { + "stixId": "attack-pattern--52eff1c7-dd30-4121-b762-24ae6fa61bbb", + "name": "Native API", + "type": "technique", + "id": "T1575", + "url": "https://attack.mitre.org/techniques/T1575", + "deprecated": false + }, + { + "stixId": "attack-pattern--53263a67-075e-48fa-974b-91c5b5445db7", + "name": "Deliver Malicious App via Other Means", + "type": "technique", + "id": "T1476", + "url": "https://attack.mitre.org/techniques/T1476", + "deprecated": true + }, + { + "stixId": "attack-pattern--537ea573-8a1c-468c-956b-d16d2ed9d067", + "name": "Remotely Wipe Data Without Authorization", + "type": "technique", + "id": "T1469", + "url": "https://attack.mitre.org/techniques/T1469", + "deprecated": true + }, + { + "stixId": "attack-pattern--5ca3c7ec-55b2-4587-9376-cf6c96f8047a", + "name": "Proxy Through Victim", + "type": "technique", + "id": "T1604", + "url": "https://attack.mitre.org/techniques/T1604", + "deprecated": false + }, + { + "stixId": "attack-pattern--60623164-ccd8-4508-a141-b5a34820b3de", + "name": "Domain Generation Algorithms", + "type": "technique", + "id": "T1520", + "url": "https://attack.mitre.org/techniques/T1520", + "deprecated": true + }, + { + "stixId": "attack-pattern--62adb627-f647-498e-b4cc-41499361bacb", + "name": "Access Calendar Entries", + "type": "technique", + "id": "T1435", + "url": "https://attack.mitre.org/techniques/T1435", + "deprecated": true + }, + { + "stixId": "attack-pattern--633baf01-6de4-4963-bb54-ff6c6357bed3", + "name": "Rogue Wi-Fi Access Points", + "type": "technique", + "id": "T1465", + "url": "https://attack.mitre.org/techniques/T1465", + "deprecated": true + }, + { + "stixId": "attack-pattern--648f8051-1a35-46d3-b1d8-3a3f5cf2cc8e", + "name": "Foreground Persistence", + "type": "technique", + "id": "T1541", + "url": "https://attack.mitre.org/techniques/T1541", + "deprecated": false + }, + { + "stixId": "attack-pattern--667e5707-3843-4da8-bd34-88b922526f0d", + "name": "Replication Through Removable Media", + "type": "technique", + "id": "T1458", + "url": "https://attack.mitre.org/techniques/T1458", + "deprecated": false + }, + { + "stixId": "attack-pattern--6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "name": "Audio Capture", + "type": "technique", + "id": "T1429", + "url": "https://attack.mitre.org/techniques/T1429", + "deprecated": false + }, + { + "stixId": "attack-pattern--670a4d75-103b-4b14-8a9e-4652fa795edd", + "name": "Hijack Execution Flow", + "type": "technique", + "id": "T1625", + "url": "https://attack.mitre.org/techniques/T1625", + "deprecated": false + }, + { + "stixId": "attack-pattern--693cdbff-ea73-49c6-ac3f-91e7285c31d1", + "name": "Unix Shell", + "type": "technique", + "id": "T1623.001", + "url": "https://attack.mitre.org/techniques/T1623/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--6a3f6490-9c44-40de-b059-e5940f246673", + "name": "Application Layer Protocol", + "type": "technique", + "id": "T1437", + "url": "https://attack.mitre.org/techniques/T1437", + "deprecated": false + }, + { + "stixId": "attack-pattern--6b846ad0-cc20-4db6-aa34-91561397c5e2", + "name": "App Delivered via Web Download", + "type": "technique", + "id": "T1431", + "url": "https://attack.mitre.org/techniques/T1431", + "deprecated": true + }, + { + "stixId": "attack-pattern--6c49d50f-494d-4150-b774-a655022d20a6", + "name": "Download New Code at Runtime", + "type": "technique", + "id": "T1407", + "url": "https://attack.mitre.org/techniques/T1407", + "deprecated": false + }, + { + "stixId": "attack-pattern--6f86d346-f092-4abc-80df-8558a90c426a", + "name": "Remotely Track Device Without Authorization", + "type": "technique", + "id": "T1468", + "url": "https://attack.mitre.org/techniques/T1468", + "deprecated": true + }, + { + "stixId": "attack-pattern--6ffad4be-bfe0-424f-abde-4d9a84a800ad", + "name": "System Checks", + "type": "technique", + "id": "T1633.001", + "url": "https://attack.mitre.org/techniques/T1633/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--702055ac-4e54-4ae9-9527-e23a38e0b160", + "name": "Stored Application Data", + "type": "technique", + "id": "T1409", + "url": "https://attack.mitre.org/techniques/T1409", + "deprecated": false + }, + { + "stixId": "attack-pattern--73c26732-6422-4081-8b63-6d0ae93d449e", + "name": "Screen Capture", + "type": "technique", + "id": "T1513", + "url": "https://attack.mitre.org/techniques/T1513", + "deprecated": false + }, + { + "stixId": "attack-pattern--74e6003f-c7f4-4047-983b-708cc19b96b6", + "name": "Transmitted Data Manipulation", + "type": "technique", + "id": "T1641.001", + "url": "https://attack.mitre.org/techniques/T1641/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--76c12fc8-a4eb-45d6-a3b7-e371a7248f69", + "name": "Manipulate App Store Rankings or Ratings", + "type": "technique", + "id": "T1452", + "url": "https://attack.mitre.org/techniques/T1452", + "deprecated": true + }, + { + "stixId": "attack-pattern--77e30eee-fd48-40b4-99ec-73e97c158b58", + "name": "URI Hijacking", + "type": "technique", + "id": "T1416", + "url": "https://attack.mitre.org/techniques/T1416", + "deprecated": true + }, + { + "stixId": "attack-pattern--7827ced0-95e7-4d05-bdcf-0d8f2d37a3d3", + "name": "Compromise Software Dependencies and Development Tools", + "type": "technique", + "id": "T1474.001", + "url": "https://attack.mitre.org/techniques/T1474/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--786f488c-cb1f-4602-89c5-86d982ee326b", + "name": "Evade Analysis Environment", + "type": "technique", + "id": "T1523", + "url": "https://attack.mitre.org/techniques/T1523", + "deprecated": true + }, + { + "stixId": "attack-pattern--789ef15a-34d9-4b32-a779-8cbbc9eb32f5", + "name": "URI Hijacking", + "type": "technique", + "id": "T1635.001", + "url": "https://attack.mitre.org/techniques/T1635/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--79cb02f4-ac4e-4335-8b51-425c9573cce1", + "name": "Subvert Trust Controls", + "type": "technique", + "id": "T1632", + "url": "https://attack.mitre.org/techniques/T1632", + "deprecated": false + }, + { + "stixId": "attack-pattern--79eec66a-9bd0-4a3f-ac82-19159e94bd44", + "name": "Access Call Log", + "type": "technique", + "id": "T1433", + "url": "https://attack.mitre.org/techniques/T1433", + "deprecated": true + }, + { + "stixId": "attack-pattern--8197f026-64da-4700-93b9-b55ba55f3b31", + "name": "Geofencing", + "type": "technique", + "id": "T1581", + "url": "https://attack.mitre.org/techniques/T1581", + "deprecated": true + }, + { + "stixId": "attack-pattern--82f04b1e-5371-4a6f-be06-411f0f43b483", + "name": "Device Administrator Permissions", + "type": "technique", + "id": "T1401", + "url": "https://attack.mitre.org/techniques/T1401", + "deprecated": true + }, + { + "stixId": "attack-pattern--831e3269-da49-48ac-94dc-948008e8fd16", + "name": "Remotely Install Application", + "type": "technique", + "id": "T1443", + "url": "https://attack.mitre.org/techniques/T1443", + "deprecated": true + }, + { + "stixId": "attack-pattern--8605a0ec-b44a-4e98-a7fc-87d4bd3acb66", + "name": "Keychain", + "type": "technique", + "id": "T1634.001", + "url": "https://attack.mitre.org/techniques/T1634/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--88932a8c-3a17-406f-9431-1da3ff19f6d6", + "name": "Modify Cached Executable Code", + "type": "technique", + "id": "T1403", + "url": "https://attack.mitre.org/techniques/T1403", + "deprecated": true + }, + { + "stixId": "attack-pattern--89fcd02f-62dc-40b9-a54b-9ac4b1baef05", + "name": "Device Type Discovery", + "type": "technique", + "id": "T1419", + "url": "https://attack.mitre.org/techniques/T1419", + "deprecated": true + }, + { + "stixId": "attack-pattern--8c7862ff-3449-4ac6-b0fd-ac1298a822a5", + "name": "Uninstall Malicious Application", + "type": "technique", + "id": "T1576", + "url": "https://attack.mitre.org/techniques/T1576", + "deprecated": true + }, + { + "stixId": "attack-pattern--8e27551a-5080-4148-a584-c64348212e4f", + "name": "Delete Device Data", + "type": "technique", + "id": "T1447", + "url": "https://attack.mitre.org/techniques/T1447", + "deprecated": true + }, + { + "stixId": "attack-pattern--8f0e39c6-82c9-41ec-9f93-5696c0f2e274", + "name": "Carrier Billing Fraud", + "type": "technique", + "id": "T1448", + "url": "https://attack.mitre.org/techniques/T1448", + "deprecated": true + }, + { + "stixId": "attack-pattern--8f142a25-f6c3-4520-bd50-2ae3ab50ed3e", + "name": "URL Scheme Hijacking", + "type": "technique", + "id": "T1415", + "url": "https://attack.mitre.org/techniques/T1415", + "deprecated": true + }, + { + "stixId": "attack-pattern--939808a7-121d-467a-b028-4441ee8b7cee", + "name": "Bidirectional Communication", + "type": "technique", + "id": "T1481.002", + "url": "https://attack.mitre.org/techniques/T1481/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--948a447c-d783-4ba0-8516-a64140fcacd5", + "name": "Non-Standard Port", + "type": "technique", + "id": "T1509", + "url": "https://attack.mitre.org/techniques/T1509", + "deprecated": false + }, + { + "stixId": "attack-pattern--9558a84e-2d5e-4872-918e-d847494a8ffc", + "name": "Compromise Software Supply Chain", + "type": "technique", + "id": "T1474.003", + "url": "https://attack.mitre.org/techniques/T1474/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--986f80f7-ff0e-4f48-87bd-0394814bbce5", + "name": "Dead Drop Resolver", + "type": "technique", + "id": "T1481.001", + "url": "https://attack.mitre.org/techniques/T1481/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--99e6295e-741b-4857-b6e5-64989eb039b4", + "name": "Location Tracking", + "type": "technique", + "id": "T1430", + "url": "https://attack.mitre.org/techniques/T1430", + "deprecated": false + }, + { + "stixId": "attack-pattern--9c049d7b-c92a-4733-9381-27e2bd2ccadc", + "name": "Device Administrator Permissions", + "type": "technique", + "id": "T1626.001", + "url": "https://attack.mitre.org/techniques/T1626/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--9d7c32f4-ab39-49dc-8055-8106bc2294a1", + "name": "Device Lockout", + "type": "technique", + "id": "T1446", + "url": "https://attack.mitre.org/techniques/T1446", + "deprecated": true + }, + { + "stixId": "attack-pattern--9ef05e3d-52db-4c12-be4f-519214bbe91f", + "name": "Remote Device Management Services", + "type": "technique", + "id": "T1430.001", + "url": "https://attack.mitre.org/techniques/T1430/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--a0464539-e1b7-4455-a355-12495987c300", + "name": "Attack PC via USB Connection", + "type": "technique", + "id": "T1427", + "url": "https://attack.mitre.org/techniques/T1427", + "deprecated": true + }, + { + "stixId": "attack-pattern--a21a6a79-f9a1-4c87-aed9-ba2d79536881", + "name": "Stolen Developer Credentials or Signing Keys", + "type": "technique", + "id": "T1441", + "url": "https://attack.mitre.org/techniques/T1441", + "deprecated": true + }, + { + "stixId": "attack-pattern--a5de0540-73e7-4c67-96da-4143afedc7ed", + "name": "Rogue Cellular Base Station", + "type": "technique", + "id": "T1467", + "url": "https://attack.mitre.org/techniques/T1467", + "deprecated": true + }, + { + "stixId": "attack-pattern--a64a820a-cb21-471f-920c-506a2ff04fa5", + "name": "SIM Card Swap", + "type": "technique", + "id": "T1451", + "url": "https://attack.mitre.org/techniques/T1451", + "deprecated": true + }, + { + "stixId": "attack-pattern--a8c31121-852b-46bd-9ba4-674ae5afe7ad", + "name": "Input Capture", + "type": "technique", + "id": "T1417", + "url": "https://attack.mitre.org/techniques/T1417", + "deprecated": false + }, + { + "stixId": "attack-pattern--a8e971b8-8dc7-4514-8249-ae95427ec467", + "name": "Generate Traffic from Victim", + "type": "technique", + "id": "T1643", + "url": "https://attack.mitre.org/techniques/T1643", + "deprecated": false + }, + { + "stixId": "attack-pattern--a91262d5-b9ff-463f-b8d2-12e4ea1eb3c9", + "name": "Disguise Root/Jailbreak Indicators", + "type": "technique", + "id": "T1630.003", + "url": "https://attack.mitre.org/techniques/T1630/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--a93ccb8f-3996-42e2-b7c7-bb599d4e205f", + "name": "Masquerade as Legitimate Application", + "type": "technique", + "id": "T1444", + "url": "https://attack.mitre.org/techniques/T1444", + "deprecated": true + }, + { + "stixId": "attack-pattern--a9cab8f6-4c94-4c9b-9e7d-9d863ff53431", + "name": "Malicious Media Content", + "type": "technique", + "id": "T1457", + "url": "https://attack.mitre.org/techniques/T1457", + "deprecated": true + }, + { + "stixId": "attack-pattern--a9fa0d30-a8ff-45bf-922e-7720da0b7922", + "name": "Calendar Entries", + "type": "technique", + "id": "T1636.001", + "url": "https://attack.mitre.org/techniques/T1636/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--ab7400b7-3476-4776-9545-ef3fa373de63", + "name": "File Deletion", + "type": "technique", + "id": "T1630.002", + "url": "https://attack.mitre.org/techniques/T1630/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--acf8fd2a-dc98-43b4-8d37-64e10728e591", + "name": "Device Lockout", + "type": "technique", + "id": "T1629.002", + "url": "https://attack.mitre.org/techniques/T1629/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--b1c95426-2550-4621-8028-ceebf28b3a47", + "name": "Keylogging", + "type": "technique", + "id": "T1417.001", + "url": "https://attack.mitre.org/techniques/T1417/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--b327a9c0-e709-495c-aa6e-00b042136e2b", + "name": "SMS Control", + "type": "technique", + "id": "T1582", + "url": "https://attack.mitre.org/techniques/T1582", + "deprecated": false + }, + { + "stixId": "attack-pattern--b332a960-3c04-495a-827f-f17a5daed3a6", + "name": "Disguise Root/Jailbreak Indicators", + "type": "technique", + "id": "T1408", + "url": "https://attack.mitre.org/techniques/T1408", + "deprecated": true + }, + { + "stixId": "attack-pattern--b3c2e5de-0941-4b57-ba61-af029eb5517a", + "name": "Exfiltration Over Other Network Medium", + "type": "technique", + "id": "T1438", + "url": "https://attack.mitre.org/techniques/T1438", + "deprecated": true + }, + { + "stixId": "attack-pattern--b765efd1-02e6-4e67-aebf-0fef5c37e54b", + "name": "Detect App Analysis Environment", + "type": "technique", + "id": "T1440", + "url": "https://attack.mitre.org/techniques/T1440", + "deprecated": true + }, + { + "stixId": "attack-pattern--b7c0e45f-0206-4f75-96e7-fe7edad3aaff", + "name": "Process Injection", + "type": "technique", + "id": "T1631", + "url": "https://attack.mitre.org/techniques/T1631", + "deprecated": false + }, + { + "stixId": "attack-pattern--b928b94a-4966-4e2a-9e61-36505b896ebc", + "name": "Malicious Software Development Tools", + "type": "technique", + "id": "T1462", + "url": "https://attack.mitre.org/techniques/T1462", + "deprecated": true + }, + { + "stixId": "attack-pattern--bb4387ab-7a51-468b-bf5f-a9a8612f0303", + "name": "Symmetric Cryptography", + "type": "technique", + "id": "T1521.001", + "url": "https://attack.mitre.org/techniques/T1521/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--bd4d32f5-eed4-4018-a649-40b229dd1d69", + "name": "Broadcast Receivers", + "type": "technique", + "id": "T1402", + "url": "https://attack.mitre.org/techniques/T1402", + "deprecated": true + }, + { + "stixId": "attack-pattern--c08366bb-8d11-4921-853f-f0a3b6a2a1da", + "name": "Compromise Hardware Supply Chain", + "type": "technique", + "id": "T1474.002", + "url": "https://attack.mitre.org/techniques/T1474/002", + "deprecated": false + }, + { + "stixId": "attack-pattern--c4b96c0b-cb58-497a-a1c2-bb447d79d692", + "name": "Clipboard Data", + "type": "technique", + "id": "T1414", + "url": "https://attack.mitre.org/techniques/T1414", + "deprecated": false + }, + { + "stixId": "attack-pattern--c5089859-b21f-40a3-8be4-63e381b8b1c0", + "name": "Modify System Partition", + "type": "technique", + "id": "T1400", + "url": "https://attack.mitre.org/techniques/T1400", + "deprecated": true + }, + { + "stixId": "attack-pattern--c548d8c4-a0a3-4a24-bb79-2a84abbc7b36", + "name": "Data Manipulation", + "type": "technique", + "id": "T1641", + "url": "https://attack.mitre.org/techniques/T1641", + "deprecated": false + }, + { + "stixId": "attack-pattern--c6421411-ae61-42bb-9098-73fddb315002", + "name": "SMS Messages", + "type": "technique", + "id": "T1636.004", + "url": "https://attack.mitre.org/techniques/T1636/004", + "deprecated": false + }, + { + "stixId": "attack-pattern--c6a146ae-9c63-4606-97ff-e261e76e8380", + "name": "Web Service", + "type": "technique", + "id": "T1481", + "url": "https://attack.mitre.org/techniques/T1481", + "deprecated": false + }, + { + "stixId": "attack-pattern--c6e17ca2-08b5-4379-9786-89bd05241831", + "name": "System Runtime API Hijacking", + "type": "technique", + "id": "T1625.001", + "url": "https://attack.mitre.org/techniques/T1625/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--c91c304a-975d-4501-9789-0db1c57afd3f", + "name": "Exploit Baseband Vulnerability", + "type": "technique", + "id": "T1455", + "url": "https://attack.mitre.org/techniques/T1455", + "deprecated": true + }, + { + "stixId": "attack-pattern--cc6e0637-76d2-4af3-a604-9d8d3ff8a6b3", + "name": "Credentials from Password Store", + "type": "technique", + "id": "T1634", + "url": "https://attack.mitre.org/techniques/T1634", + "deprecated": false + }, + { + "stixId": "attack-pattern--ccde43e4-78f9-4f32-b401-c081e7db71ea", + "name": "Hooking", + "type": "technique", + "id": "T1617", + "url": "https://attack.mitre.org/techniques/T1617", + "deprecated": false + }, + { + "stixId": "attack-pattern--cde2cb84-455e-410c-8aa9-086f2788bcd2", + "name": "Install Insecure or Malicious Configuration", + "type": "technique", + "id": "T1478", + "url": "https://attack.mitre.org/techniques/T1478", + "deprecated": true + }, + { + "stixId": "attack-pattern--cf28ca46-1fd3-46b4-b1f6-ec0b72361848", + "name": "File and Directory Discovery", + "type": "technique", + "id": "T1420", + "url": "https://attack.mitre.org/techniques/T1420", + "deprecated": false + }, + { + "stixId": "attack-pattern--d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a", + "name": "Obfuscated Files or Information", + "type": "technique", + "id": "T1406", + "url": "https://attack.mitre.org/techniques/T1406", + "deprecated": false + }, + { + "stixId": "attack-pattern--d1f1337e-aea7-454c-86bd-482a98ffaf62", + "name": "Input Injection", + "type": "technique", + "id": "T1516", + "url": "https://attack.mitre.org/techniques/T1516", + "deprecated": false + }, + { + "stixId": "attack-pattern--d2e112dc-f6d4-488d-b8df-ecbfb57a0a2d", + "name": "Network Denial of Service", + "type": "technique", + "id": "T1464", + "url": "https://attack.mitre.org/techniques/T1464", + "deprecated": false + }, + { + "stixId": "attack-pattern--d3bc5020-f6a2-41c0-8ccb-5e563101b60c", + "name": "Compromise Application Executable", + "type": "technique", + "id": "T1577", + "url": "https://attack.mitre.org/techniques/T1577", + "deprecated": false + }, + { + "stixId": "attack-pattern--d446b9f0-06a9-4a8d-97ee-298cfee84f14", + "name": "Event Triggered Execution", + "type": "technique", + "id": "T1624", + "url": "https://attack.mitre.org/techniques/T1624", + "deprecated": false + }, + { + "stixId": "attack-pattern--d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "name": "System Network Configuration Discovery", + "type": "technique", + "id": "T1422", + "url": "https://attack.mitre.org/techniques/T1422", + "deprecated": false + }, + { + "stixId": "attack-pattern--d731c21e-f27d-4756-b418-0e2aaabd6d63", + "name": "Manipulate Device Communication", + "type": "technique", + "id": "T1463", + "url": "https://attack.mitre.org/techniques/T1463", + "deprecated": true + }, + { + "stixId": "attack-pattern--d8940e76-f9c1-4912-bea6-e21c251370b6", + "name": "Video Capture", + "type": "technique", + "id": "T1512", + "url": "https://attack.mitre.org/techniques/T1512", + "deprecated": false + }, + { + "stixId": "attack-pattern--d916f176-a1ca-4a78-9fdd-4058bc28162e", + "name": "One-Way Communication", + "type": "technique", + "id": "T1481.003", + "url": "https://attack.mitre.org/techniques/T1481/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "name": "Deliver Malicious App via Authorized App Store", + "type": "technique", + "id": "T1475", + "url": "https://attack.mitre.org/techniques/T1475", + "deprecated": true + }, + { + "stixId": "attack-pattern--d9e88203-2b5d-405f-a406-2933b1e3d7e4", + "name": "Data Encrypted for Impact", + "type": "technique", + "id": "T1471", + "url": "https://attack.mitre.org/techniques/T1471", + "deprecated": false + }, + { + "stixId": "attack-pattern--dc01774a-d1c1-45fb-b506-0a5d1d6593d9", + "name": "Prevent Application Removal", + "type": "technique", + "id": "T1629.001", + "url": "https://attack.mitre.org/techniques/T1629/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--dd818ea5-adf5-41c7-93b5-f3b839a219fb", + "name": "System Network Connections Discovery", + "type": "technique", + "id": "T1421", + "url": "https://attack.mitre.org/techniques/T1421", + "deprecated": false + }, + { + "stixId": "attack-pattern--dfe29258-ce59-421c-9dee-e85cb9fa90cd", + "name": "Lockscreen Bypass", + "type": "technique", + "id": "T1461", + "url": "https://attack.mitre.org/techniques/T1461", + "deprecated": false + }, + { + "stixId": "attack-pattern--e083305c-49e7-4c87-aae8-9689213bffbe", + "name": "Command-Line Interface", + "type": "technique", + "id": "T1605", + "url": "https://attack.mitre.org/techniques/T1605", + "deprecated": true + }, + { + "stixId": "attack-pattern--e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86", + "name": "Contact List", + "type": "technique", + "id": "T1636.003", + "url": "https://attack.mitre.org/techniques/T1636/003", + "deprecated": false + }, + { + "stixId": "attack-pattern--e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "name": "Data from Local System", + "type": "technique", + "id": "T1533", + "url": "https://attack.mitre.org/techniques/T1533", + "deprecated": false + }, + { + "stixId": "attack-pattern--e2c2249a-eb82-4614-8dd4-9c514dde65e2", + "name": "Account Access Removal", + "type": "technique", + "id": "T1640", + "url": "https://attack.mitre.org/techniques/T1640", + "deprecated": false + }, + { + "stixId": "attack-pattern--e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "name": "System Information Discovery", + "type": "technique", + "id": "T1426", + "url": "https://attack.mitre.org/techniques/T1426", + "deprecated": false + }, + { + "stixId": "attack-pattern--e30cc912-7ea1-4683-9219-543b86cbdec9", + "name": "Fake Developer Accounts", + "type": "technique", + "id": "T1442", + "url": "https://attack.mitre.org/techniques/T1442", + "deprecated": true + }, + { + "stixId": "attack-pattern--e399430e-30b7-48c5-b70a-f44dc8c175cb", + "name": "Clipboard Modification", + "type": "technique", + "id": "T1510", + "url": "https://attack.mitre.org/techniques/T1510", + "deprecated": true + }, + { + "stixId": "attack-pattern--e3b936a4-6321-4172-9114-038a866362ec", + "name": "Archive Collected Data", + "type": "technique", + "id": "T1532", + "url": "https://attack.mitre.org/techniques/T1532", + "deprecated": false + }, + { + "stixId": "attack-pattern--e422b6fa-4739-46b9-992e-82f1b350c780", + "name": "Geofencing", + "type": "technique", + "id": "T1627.001", + "url": "https://attack.mitre.org/techniques/T1627/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--e4c347e9-fb91-4bc5-83b8-391e389131e2", + "name": "Network Information Discovery", + "type": "technique", + "id": "T1507", + "url": "https://attack.mitre.org/techniques/T1507", + "deprecated": true + }, + { + "stixId": "attack-pattern--e8b4e1ec-8e3b-484c-9038-4459b1ed8060", + "name": "Capture SMS Messages", + "type": "technique", + "id": "T1412", + "url": "https://attack.mitre.org/techniques/T1412", + "deprecated": true + }, + { + "stixId": "attack-pattern--eb6cf439-1bcb-4d10-bc68-1eed844ed7b3", + "name": "Endpoint Denial of Service", + "type": "technique", + "id": "T1642", + "url": "https://attack.mitre.org/techniques/T1642", + "deprecated": false + }, + { + "stixId": "attack-pattern--ec4c4baa-026f-43e8-8f56-58c36f3162dd", + "name": "Out of Band Data", + "type": "technique", + "id": "T1644", + "url": "https://attack.mitre.org/techniques/T1644", + "deprecated": false + }, + { + "stixId": "attack-pattern--ed2c05a1-4f81-4d97-9e1b-aff01c34ae84", + "name": "Encrypted Channel", + "type": "technique", + "id": "T1521", + "url": "https://attack.mitre.org/techniques/T1521", + "deprecated": false + }, + { + "stixId": "attack-pattern--ef771e03-e080-43b4-a619-ac6f84899884", + "name": "Exploit TEE Vulnerability", + "type": "technique", + "id": "T1405", + "url": "https://attack.mitre.org/techniques/T1405", + "deprecated": true + }, + { + "stixId": "attack-pattern--f05fc151-aa62-47e3-ae57-2d1b23d64bf6", + "name": "Suppress Application Icon", + "type": "technique", + "id": "T1628.001", + "url": "https://attack.mitre.org/techniques/T1628/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--f1c3d071-0c24-483d-aca0-e8b8496ce468", + "name": "Modify Trusted Execution Environment", + "type": "technique", + "id": "T1399", + "url": "https://attack.mitre.org/techniques/T1399", + "deprecated": true + }, + { + "stixId": "attack-pattern--f296fc9c-2ff5-43ee-941e-6b49c438270a", + "name": "Device Unlock Code Guessing or Brute Force", + "type": "technique", + "id": "T1459", + "url": "https://attack.mitre.org/techniques/T1459", + "deprecated": true + }, + { + "stixId": "attack-pattern--f58cd69a-e548-478b-9248-8a9af881dc34", + "name": "Downgrade to Insecure Protocols", + "type": "technique", + "id": "T1466", + "url": "https://attack.mitre.org/techniques/T1466", + "deprecated": true + }, + { + "stixId": "attack-pattern--f981d199-2720-467e-9dc9-eea04dbe05cf", + "name": "Generate Fraudulent Advertising Revenue", + "type": "technique", + "id": "T1472", + "url": "https://attack.mitre.org/techniques/T1472", + "deprecated": true + }, + { + "stixId": "attack-pattern--f9e4f526-ac9d-4df5-8949-833a82a1d2df", + "name": "Malicious or Vulnerable Built-in Device Functionality", + "type": "technique", + "id": "T1473", + "url": "https://attack.mitre.org/techniques/T1473", + "deprecated": true + }, + { + "stixId": "attack-pattern--fa801609-ca8e-415e-815e-65f3826ff4df", + "name": "Steganography", + "type": "technique", + "id": "T1406.001", + "url": "https://attack.mitre.org/techniques/T1406/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--fb3fa94a-3aee-4ab0-b7e7-abdf0a51286d", + "name": "Exploit SS7 to Redirect Phone Calls/SMS", + "type": "technique", + "id": "T1449", + "url": "https://attack.mitre.org/techniques/T1449", + "deprecated": true + }, + { + "stixId": "attack-pattern--fc53309d-ebd5-4573-9242-57024ebdad4f", + "name": "Hide Artifacts", + "type": "technique", + "id": "T1628", + "url": "https://attack.mitre.org/techniques/T1628", + "deprecated": false + }, + { + "stixId": "attack-pattern--fcb11f06-ce0e-490b-bcc1-04a1623579f0", + "name": "Code Signing Policy Modification", + "type": "technique", + "id": "T1632.001", + "url": "https://attack.mitre.org/techniques/T1632/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--fd211238-f767-4599-8c0d-9dca36624626", + "name": "Domain Generation Algorithms", + "type": "technique", + "id": "T1637.001", + "url": "https://attack.mitre.org/techniques/T1637/001", + "deprecated": false + }, + { + "stixId": "attack-pattern--fd339382-bfec-4bf0-8d47-1caedc9e7e57", + "name": "Drive-By Compromise", + "type": "technique", + "id": "T1456", + "url": "https://attack.mitre.org/techniques/T1456", + "deprecated": false + }, + { + "stixId": "attack-pattern--fd658820-cbba-4c95-8ac9-0fac6b1099e2", + "name": "Suppress Application Icon", + "type": "technique", + "id": "T1508", + "url": "https://attack.mitre.org/techniques/T1508", + "deprecated": true + } + ], + "technique_recs": [ + "T0800 - Activate Firmware Update Mode", + "T0801 - Monitor Process State", + "T0802 - Automated Collection", + "T0803 - Block Command Message", + "T0804 - Block Reporting Message", + "T0805 - Block Serial COM", + "T0806 - Brute Force I/O", + "T0807 - Command-Line Interface", + "T0808 - Control Device Identification", + "T0809 - Data Destruction", + "T0810 - Data Historian Compromise", + "T0811 - Data from Information Repositories", + "T0812 - Default Credentials", + "T0813 - Denial of Control", + "T0814 - Denial of Service", + "T0815 - Denial of View", + "T0816 - Device Restart/Shutdown", + "T0817 - Drive-by Compromise", + "T0818 - Engineering Workstation Compromise", + "T0819 - Exploit Public-Facing Application", + "T0820 - Exploitation for Evasion", + "T0821 - Modify Controller Tasking", + "T0822 - External Remote Services", + "T0823 - Graphical User Interface", + "T0824 - I/O Module Discovery", + "T0825 - Location Identification", + "T0826 - Loss of Availability", + "T0827 - Loss of Control", + "T0828 - Loss of Productivity and Revenue", + "T0829 - Loss of View", + "T0830 - Adversary-in-the-Middle", + "T0831 - Manipulation of Control", + "T0832 - Manipulation of View", + "T0833 - Modify Control Logic", + "T0834 - Native API", + "T0835 - Manipulate I/O Image", + "T0836 - Modify Parameter", + "T0837 - Loss of Protection", + "T0838 - Modify Alarm Settings", + "T0839 - Module Firmware", + "T0840 - Network Connection Enumeration", + "T0841 - Network Service Scanning", + "T0842 - Network Sniffing", + "T0843 - Program Download", + "T0844 - Program Organization Units", + "T0845 - Program Upload", + "T0846 - Remote System Discovery", + "T0847 - Replication Through Removable Media", + "T0848 - Rogue Master", + "T0849 - Masquerading", + "T0850 - Role Identification", + "T0851 - Rootkit", + "T0852 - Screen Capture", + "T0853 - Scripting", + "T0854 - Serial Connection Enumeration", + "T0855 - Unauthorized Command Message", + "T0856 - Spoof Reporting Message", + "T0857 - System Firmware", + "T0858 - Change Operating Mode", + "T0859 - Valid Accounts", + "T0860 - Wireless Compromise", + "T0861 - Point & Tag Identification", + "T0862 - Supply Chain Compromise", + "T0863 - User Execution", + "T0864 - Transient Cyber Asset", + "T0865 - Spearphishing Attachment", + "T0866 - Exploitation of Remote Services", + "T0867 - Lateral Tool Transfer", + "T0868 - Detect Operating Mode", + "T0869 - Standard Application Layer Protocol", + "T0870 - Detect Program State", + "T0871 - Execution through API", + "T0872 - Indicator Removal on Host", + "T0873 - Project File Infection", + "T0874 - Hooking", + "T0875 - Change Program State", + "T0877 - I/O Image", + "T0878 - Alarm Suppression", + "T0879 - Damage to Property", + "T0880 - Loss of Safety", + "T0881 - Service Stop", + "T0882 - Theft of Operational Information", + "T0883 - Internet Accessible Device", + "T0884 - Connection Proxy", + "T0885 - Commonly Used Port", + "T0886 - Remote Services", + "T0887 - Wireless Sniffing", + "T0888 - Remote System Information Discovery", + "T0889 - Modify Program", + "T0890 - Exploitation for Privilege Escalation", + "T0891 - Hardcoded Credentials", + "T0892 - Change Credential", + "T0893 - Data from Local System", + "T1001 - Data Obfuscation", + "T1001.001 - Junk Data", + "T1001.002 - Steganography", + "T1001.003 - Protocol Impersonation", + "T1002 - Data Compressed", + "T1003 - OS Credential Dumping", + "T1003.001 - LSASS Memory", + "T1003.002 - Security Account Manager", + "T1003.003 - NTDS", + "T1003.004 - LSA Secrets", + "T1003.005 - Cached Domain Credentials", + "T1003.006 - DCSync", + "T1003.007 - Proc Filesystem", + "T1003.008 - /etc/passwd and /etc/shadow", + "T1004 - Winlogon Helper DLL", + "T1005 - Data from Local System", + "T1006 - Direct Volume Access", + "T1007 - System Service Discovery", + "T1008 - Fallback Channels", + "T1009 - Binary Padding", + "T1010 - Application Window Discovery", + "T1011 - Exfiltration Over Other Network Medium", + "T1011.001 - Exfiltration Over Bluetooth", + "T1012 - Query Registry", + "T1013 - Port Monitors", + "T1014 - Rootkit", + "T1015 - Accessibility Features", + "T1016 - System Network Configuration Discovery", + "T1016.001 - Internet Connection Discovery", + "T1017 - Application Deployment Software", + "T1018 - Remote System Discovery", + "T1019 - System Firmware", + "T1020 - Automated Exfiltration", + "T1020.001 - Traffic Duplication", + "T1021 - Remote Services", + "T1021.001 - Remote Desktop Protocol", + "T1021.002 - SMB/Windows Admin Shares", + "T1021.003 - Distributed Component Object Model", + "T1021.004 - SSH", + "T1021.005 - VNC", + "T1021.006 - Windows Remote Management", + "T1021.007 - Cloud Services", + "T1022 - Data Encrypted", + "T1023 - Shortcut Modification", + "T1024 - Custom Cryptographic Protocol", + "T1025 - Data from Removable Media", + "T1026 - Multiband Communication", + "T1027 - Obfuscated Files or Information", + "T1027.001 - Binary Padding", + "T1027.002 - Software Packing", + "T1027.003 - Steganography", + "T1027.004 - Compile After Delivery", + "T1027.005 - Indicator Removal from Tools", + "T1027.006 - HTML Smuggling", + "T1027.007 - Dynamic API Resolution", + "T1027.008 - Stripped Payloads", + "T1027.009 - Embedded Payloads", + "T1027.010 - Command Obfuscation", + "T1027.011 - Fileless Storage", + "T1028 - Windows Remote Management", + "T1029 - Scheduled Transfer", + "T1030 - Data Transfer Size Limits", + "T1031 - Modify Existing Service", + "T1032 - Standard Cryptographic Protocol", + "T1033 - System Owner/User Discovery", + "T1034 - Path Interception", + "T1035 - Service Execution", + "T1036 - Masquerading", + "T1036.001 - Invalid Code Signature", + "T1036.002 - Right-to-Left Override", + "T1036.003 - Rename System Utilities", + "T1036.004 - Masquerade Task or Service", + "T1036.005 - Match Legitimate Name or Location", + "T1036.006 - Space after Filename", + "T1036.007 - Double File Extension", + "T1036.008 - Masquerade File Type", + "T1037 - Boot or Logon Initialization Scripts", + "T1037.001 - Logon Script (Windows)", + "T1037.002 - Login Hook", + "T1037.003 - Network Logon Script", + "T1037.004 - RC Scripts", + "T1037.005 - Startup Items", + "T1038 - DLL Search Order Hijacking", + "T1039 - Data from Network Shared Drive", + "T1040 - Network Sniffing", + "T1041 - Exfiltration Over C2 Channel", + "T1042 - Change Default File Association", + "T1043 - Commonly Used Port", + "T1044 - File System Permissions Weakness", + "T1045 - Software Packing", + "T1046 - Network Service Discovery", + "T1047 - Windows Management Instrumentation", + "T1048 - Exfiltration Over Alternative Protocol", + "T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol", + "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol", + "T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol", + "T1049 - System Network Connections Discovery", + "T1050 - New Service", + "T1051 - Shared Webroot", + "T1052 - Exfiltration Over Physical Medium", + "T1052.001 - Exfiltration over USB", + "T1053 - Scheduled Task/Job", + "T1053.001 - At (Linux)", + "T1053.002 - At", + "T1053.003 - Cron", + "T1053.004 - Launchd", + "T1053.005 - Scheduled Task", + "T1053.006 - Systemd Timers", + "T1053.007 - Container Orchestration Job", + "T1054 - Indicator Blocking", + "T1055 - Process Injection", + "T1055.001 - Dynamic-link Library Injection", + "T1055.002 - Portable Executable Injection", + "T1055.003 - Thread Execution Hijacking", + "T1055.004 - Asynchronous Procedure Call", + "T1055.005 - Thread Local Storage", + "T1055.008 - Ptrace System Calls", + "T1055.009 - Proc Memory", + "T1055.011 - Extra Window Memory Injection", + "T1055.012 - Process Hollowing", + "T1055.013 - Process Doppelgänging", + "T1055.014 - VDSO Hijacking", + "T1055.015 - ListPlanting", + "T1056 - Input Capture", + "T1056.001 - Keylogging", + "T1056.002 - GUI Input Capture", + "T1056.003 - Web Portal Capture", + "T1056.004 - Credential API Hooking", + "T1057 - Process Discovery", + "T1058 - Service Registry Permissions Weakness", + "T1059 - Command and Scripting Interpreter", + "T1059.001 - PowerShell", + "T1059.002 - AppleScript", + "T1059.003 - Windows Command Shell", + "T1059.004 - Unix Shell", + "T1059.005 - Visual Basic", + "T1059.006 - Python", + "T1059.007 - JavaScript", + "T1059.008 - Network Device CLI", + "T1059.009 - Cloud API", + "T1060 - Registry Run Keys / Startup Folder", + "T1061 - Graphical User Interface", + "T1062 - Hypervisor", + "T1063 - Security Software Discovery", + "T1064 - Scripting", + "T1065 - Uncommonly Used Port", + "T1066 - Indicator Removal from Tools", + "T1067 - Bootkit", + "T1068 - Exploitation for Privilege Escalation", + "T1069 - Permission Groups Discovery", + "T1069.001 - Local Groups", + "T1069.002 - Domain Groups", + "T1069.003 - Cloud Groups", + "T1070 - Indicator Removal", + "T1070.001 - Clear Windows Event Logs", + "T1070.002 - Clear Linux or Mac System Logs", + "T1070.003 - Clear Command History", + "T1070.004 - File Deletion", + "T1070.005 - Network Share Connection Removal", + "T1070.006 - Timestomp", + "T1070.007 - Clear Network Connection History and Configurations", + "T1070.008 - Clear Mailbox Data", + "T1070.009 - Clear Persistence", + "T1071 - Application Layer Protocol", + "T1071.001 - Web Protocols", + "T1071.002 - File Transfer Protocols", + "T1071.003 - Mail Protocols", + "T1071.004 - DNS", + "T1072 - Software Deployment Tools", + "T1073 - DLL Side-Loading", + "T1074 - Data Staged", + "T1074.001 - Local Data Staging", + "T1074.002 - Remote Data Staging", + "T1075 - Pass the Hash", + "T1076 - Remote Desktop Protocol", + "T1077 - Windows Admin Shares", + "T1078 - Valid Accounts", + "T1078.001 - Default Accounts", + "T1078.002 - Domain Accounts", + "T1078.003 - Local Accounts", + "T1078.004 - Cloud Accounts", + "T1079 - Multilayer Encryption", + "T1080 - Taint Shared Content", + "T1081 - Credentials in Files", + "T1082 - System Information Discovery", + "T1083 - File and Directory Discovery", + "T1084 - Windows Management Instrumentation Event Subscription", + "T1085 - Rundll32", + "T1086 - PowerShell", + "T1087 - Account Discovery", + "T1087.001 - Local Account", + "T1087.002 - Domain Account", + "T1087.003 - Email Account", + "T1087.004 - Cloud Account", + "T1088 - Bypass User Account Control", + "T1089 - Disabling Security Tools", + "T1090 - Proxy", + "T1090.001 - Internal Proxy", + "T1090.002 - External Proxy", + "T1090.003 - Multi-hop Proxy", + "T1090.004 - Domain Fronting", + "T1091 - Replication Through Removable Media", + "T1092 - Communication Through Removable Media", + "T1093 - Process Hollowing", + "T1094 - Custom Command and Control Protocol", + "T1095 - Non-Application Layer Protocol", + "T1096 - NTFS File Attributes", + "T1097 - Pass the Ticket", + "T1098 - Account Manipulation", + "T1098.001 - Additional Cloud Credentials", + "T1098.002 - Additional Email Delegate Permissions", + "T1098.003 - Additional Cloud Roles", + "T1098.004 - SSH Authorized Keys", + "T1098.005 - Device Registration", + "T1099 - Timestomp", + "T1100 - Web Shell", + "T1101 - Security Support Provider", + "T1102 - Web Service", + "T1102.001 - Dead Drop Resolver", + "T1102.002 - Bidirectional Communication", + "T1102.003 - One-Way Communication", + "T1103 - AppInit DLLs", + "T1104 - Multi-Stage Channels", + "T1105 - Ingress Tool Transfer", + "T1106 - Native API", + "T1107 - File Deletion", + "T1108 - Redundant Access", + "T1109 - Component Firmware", + "T1110 - Brute Force", + "T1110.001 - Password Guessing", + "T1110.002 - Password Cracking", + "T1110.003 - Password Spraying", + "T1110.004 - Credential Stuffing", + "T1111 - Multi-Factor Authentication Interception", + "T1112 - Modify Registry", + "T1113 - Screen Capture", + "T1114 - Email Collection", + "T1114.001 - Local Email Collection", + "T1114.002 - Remote Email Collection", + "T1114.003 - Email Forwarding Rule", + "T1115 - Clipboard Data", + "T1116 - Code Signing", + "T1117 - Regsvr32", + "T1118 - InstallUtil", + "T1119 - Automated Collection", + "T1120 - Peripheral Device Discovery", + "T1121 - Regsvcs/Regasm", + "T1122 - Component Object Model Hijacking", + "T1123 - Audio Capture", + "T1124 - System Time Discovery", + "T1125 - Video Capture", + "T1126 - Network Share Connection Removal", + "T1127 - Trusted Developer Utilities Proxy Execution", + "T1127.001 - MSBuild", + "T1128 - Netsh Helper DLL", + "T1129 - Shared Modules", + "T1130 - Install Root Certificate", + "T1131 - Authentication Package", + "T1132 - Data Encoding", + "T1132.001 - Standard Encoding", + "T1132.002 - Non-Standard Encoding", + "T1133 - External Remote Services", + "T1134 - Access Token Manipulation", + "T1134.001 - Token Impersonation/Theft", + "T1134.002 - Create Process with Token", + "T1134.003 - Make and Impersonate Token", + "T1134.004 - Parent PID Spoofing", + "T1134.005 - SID-History Injection", + "T1135 - Network Share Discovery", + "T1136 - Create Account", + "T1136.001 - Local Account", + "T1136.002 - Domain Account", + "T1136.003 - Cloud Account", + "T1137 - Office Application Startup", + "T1137.001 - Office Template Macros", + "T1137.002 - Office Test", + "T1137.003 - Outlook Forms", + "T1137.004 - Outlook Home Page", + "T1137.005 - Outlook Rules", + "T1137.006 - Add-ins", + "T1138 - Application Shimming", + "T1139 - Bash History", + "T1140 - Deobfuscate/Decode Files or Information", + "T1141 - Input Prompt", + "T1142 - Keychain", + "T1143 - Hidden Window", + "T1144 - Gatekeeper Bypass", + "T1145 - Private Keys", + "T1146 - Clear Command History", + "T1147 - Hidden Users", + "T1148 - HISTCONTROL", + "T1149 - LC_MAIN Hijacking", + "T1150 - Plist Modification", + "T1151 - Space after Filename", + "T1152 - Launchctl", + "T1153 - Source", + "T1154 - Trap", + "T1155 - AppleScript", + "T1156 - Malicious Shell Modification", + "T1157 - Dylib Hijacking", + "T1158 - Hidden Files and Directories", + "T1159 - Launch Agent", + "T1160 - Launch Daemon", + "T1161 - LC_LOAD_DYLIB Addition", + "T1162 - Login Item", + "T1163 - Rc.common", + "T1164 - Re-opened Applications", + "T1165 - Startup Items", + "T1166 - Setuid and Setgid", + "T1167 - Securityd Memory", + "T1168 - Local Job Scheduling", + "T1169 - Sudo", + "T1170 - Mshta", + "T1171 - LLMNR/NBT-NS Poisoning and Relay", + "T1172 - Domain Fronting", + "T1173 - Dynamic Data Exchange", + "T1174 - Password Filter DLL", + "T1175 - Component Object Model and Distributed COM", + "T1176 - Browser Extensions", + "T1177 - LSASS Driver", + "T1178 - SID-History Injection", + "T1179 - Hooking", + "T1180 - Screensaver", + "T1181 - Extra Window Memory Injection", + "T1182 - AppCert DLLs", + "T1183 - Image File Execution Options Injection", + "T1184 - SSH Hijacking", + "T1185 - Browser Session Hijacking", + "T1186 - Process Doppelgänging", + "T1187 - Forced Authentication", + "T1188 - Multi-hop Proxy", + "T1189 - Drive-by Compromise", + "T1190 - Exploit Public-Facing Application", + "T1191 - CMSTP", + "T1192 - Spearphishing Link", + "T1193 - Spearphishing Attachment", + "T1194 - Spearphishing via Service", + "T1195 - Supply Chain Compromise", + "T1195.001 - Compromise Software Dependencies and Development Tools", + "T1195.002 - Compromise Software Supply Chain", + "T1195.003 - Compromise Hardware Supply Chain", + "T1196 - Control Panel Items", + "T1197 - BITS Jobs", + "T1198 - SIP and Trust Provider Hijacking", + "T1199 - Trusted Relationship", + "T1200 - Hardware Additions", + "T1201 - Password Policy Discovery", + "T1202 - Indirect Command Execution", + "T1203 - Exploitation for Client Execution", + "T1204 - User Execution", + "T1204.001 - Malicious Link", + "T1204.002 - Malicious File", + "T1204.003 - Malicious Image", + "T1205 - Traffic Signaling", + "T1205.001 - Port Knocking", + "T1205.002 - Socket Filters", + "T1206 - Sudo Caching", + "T1207 - Rogue Domain Controller", + "T1208 - Kerberoasting", + "T1209 - Time Providers", + "T1210 - Exploitation of Remote Services", + "T1211 - Exploitation for Defense Evasion", + "T1212 - Exploitation for Credential Access", + "T1213 - Data from Information Repositories", + "T1213.001 - Confluence", + "T1213.002 - Sharepoint", + "T1213.003 - Code Repositories", + "T1214 - Credentials in Registry", + "T1215 - Kernel Modules and Extensions", + "T1216 - System Script Proxy Execution", + "T1216.001 - PubPrn", + "T1217 - Browser Information Discovery", + "T1218 - System Binary Proxy Execution", + "T1218.001 - Compiled HTML File", + "T1218.002 - Control Panel", + "T1218.003 - CMSTP", + "T1218.004 - InstallUtil", + "T1218.005 - Mshta", + "T1218.007 - Msiexec", + "T1218.008 - Odbcconf", + "T1218.009 - Regsvcs/Regasm", + "T1218.010 - Regsvr32", + "T1218.011 - Rundll32", + "T1218.012 - Verclsid", + "T1218.013 - Mavinject", + "T1218.014 - MMC", + "T1219 - Remote Access Software", + "T1220 - XSL Script Processing", + "T1221 - Template Injection", + "T1222 - File and Directory Permissions Modification", + "T1222.001 - Windows File and Directory Permissions Modification", + "T1222.002 - Linux and Mac File and Directory Permissions Modification", + "T1223 - Compiled HTML File", + "T1398 - Boot or Logon Initialization Scripts", + "T1399 - Modify Trusted Execution Environment", + "T1400 - Modify System Partition", + "T1401 - Device Administrator Permissions", + "T1402 - Broadcast Receivers", + "T1403 - Modify Cached Executable Code", + "T1404 - Exploitation for Privilege Escalation", + "T1405 - Exploit TEE Vulnerability", + "T1406 - Obfuscated Files or Information", + "T1406.001 - Steganography", + "T1406.002 - Software Packing", + "T1407 - Download New Code at Runtime", + "T1408 - Disguise Root/Jailbreak Indicators", + "T1409 - Stored Application Data", + "T1410 - Network Traffic Capture or Redirection", + "T1411 - Input Prompt", + "T1412 - Capture SMS Messages", + "T1413 - Access Sensitive Data in Device Logs", + "T1414 - Clipboard Data", + "T1415 - URL Scheme Hijacking", + "T1416 - URI Hijacking", + "T1417 - Input Capture", + "T1417.001 - Keylogging", + "T1417.002 - GUI Input Capture", + "T1418 - Software Discovery", + "T1418.001 - Security Software Discovery", + "T1419 - Device Type Discovery", + "T1420 - File and Directory Discovery", + "T1421 - System Network Connections Discovery", + "T1422 - System Network Configuration Discovery", + "T1423 - Network Service Scanning", + "T1424 - Process Discovery", + "T1425 - Insecure Third-Party Libraries", + "T1426 - System Information Discovery", + "T1427 - Attack PC via USB Connection", + "T1428 - Exploitation of Remote Services", + "T1429 - Audio Capture", + "T1430 - Location Tracking", + "T1430.001 - Remote Device Management Services", + "T1430.002 - Impersonate SS7 Nodes", + "T1431 - App Delivered via Web Download", + "T1432 - Access Contact List", + "T1433 - Access Call Log", + "T1434 - App Delivered via Email Attachment", + "T1435 - Access Calendar Entries", + "T1436 - Commonly Used Port", + "T1437 - Application Layer Protocol", + "T1437.001 - Web Protocols", + "T1438 - Exfiltration Over Other Network Medium", + "T1439 - Eavesdrop on Insecure Network Communication", + "T1440 - Detect App Analysis Environment", + "T1441 - Stolen Developer Credentials or Signing Keys", + "T1442 - Fake Developer Accounts", + "T1443 - Remotely Install Application", + "T1444 - Masquerade as Legitimate Application", + "T1445 - Abuse of iOS Enterprise App Signing Key", + "T1446 - Device Lockout", + "T1447 - Delete Device Data", + "T1448 - Carrier Billing Fraud", + "T1449 - Exploit SS7 to Redirect Phone Calls/SMS", + "T1450 - Exploit SS7 to Track Device Location", + "T1451 - SIM Card Swap", + "T1452 - Manipulate App Store Rankings or Ratings", + "T1453 - Abuse Accessibility Features", + "T1454 - Malicious SMS Message", + "T1455 - Exploit Baseband Vulnerability", + "T1456 - Drive-By Compromise", + "T1457 - Malicious Media Content", + "T1458 - Replication Through Removable Media", + "T1459 - Device Unlock Code Guessing or Brute Force", + "T1460 - Biometric Spoofing", + "T1461 - Lockscreen Bypass", + "T1462 - Malicious Software Development Tools", + "T1463 - Manipulate Device Communication", + "T1464 - Network Denial of Service", + "T1465 - Rogue Wi-Fi Access Points", + "T1466 - Downgrade to Insecure Protocols", + "T1467 - Rogue Cellular Base Station", + "T1468 - Remotely Track Device Without Authorization", + "T1469 - Remotely Wipe Data Without Authorization", + "T1470 - Obtain Device Cloud Backups", + "T1471 - Data Encrypted for Impact", + "T1472 - Generate Fraudulent Advertising Revenue", + "T1473 - Malicious or Vulnerable Built-in Device Functionality", + "T1474 - Supply Chain Compromise", + "T1474.001 - Compromise Software Dependencies and Development Tools", + "T1474.002 - Compromise Hardware Supply Chain", + "T1474.003 - Compromise Software Supply Chain", + "T1475 - Deliver Malicious App via Authorized App Store", + "T1476 - Deliver Malicious App via Other Means", + "T1477 - Exploit via Radio Interfaces", + "T1478 - Install Insecure or Malicious Configuration", + "T1480 - Execution Guardrails", + "T1480.001 - Environmental Keying", + "T1481 - Web Service", + "T1481.001 - Dead Drop Resolver", + "T1481.002 - Bidirectional Communication", + "T1481.003 - One-Way Communication", + "T1482 - Domain Trust Discovery", + "T1483 - Domain Generation Algorithms", + "T1484 - Domain Policy Modification", + "T1484.001 - Group Policy Modification", + "T1484.002 - Domain Trust Modification", + "T1485 - Data Destruction", + "T1486 - Data Encrypted for Impact", + "T1487 - Disk Structure Wipe", + "T1488 - Disk Content Wipe", + "T1489 - Service Stop", + "T1490 - Inhibit System Recovery", + "T1491 - Defacement", + "T1491.001 - Internal Defacement", + "T1491.002 - External Defacement", + "T1492 - Stored Data Manipulation", + "T1493 - Transmitted Data Manipulation", + "T1494 - Runtime Data Manipulation", + "T1495 - Firmware Corruption", + "T1496 - Resource Hijacking", + "T1497 - Virtualization/Sandbox Evasion", + "T1497.001 - System Checks", + "T1497.002 - User Activity Based Checks", + "T1497.003 - Time Based Evasion", + "T1498 - Network Denial of Service", + "T1498.001 - Direct Network Flood", + "T1498.002 - Reflection Amplification", + "T1499 - Endpoint Denial of Service", + "T1499.001 - OS Exhaustion Flood", + "T1499.002 - Service Exhaustion Flood", + "T1499.003 - Application Exhaustion Flood", + "T1499.004 - Application or System Exploitation", + "T1500 - Compile After Delivery", + "T1501 - Systemd Service", + "T1502 - Parent PID Spoofing", + "T1503 - Credentials from Web Browsers", + "T1504 - PowerShell Profile", + "T1505 - Server Software Component", + "T1505.001 - SQL Stored Procedures", + "T1505.002 - Transport Agent", + "T1505.003 - Web Shell", + "T1505.004 - IIS Components", + "T1505.005 - Terminal Services DLL", + "T1506 - Web Session Cookie", + "T1507 - Network Information Discovery", + "T1508 - Suppress Application Icon", + "T1509 - Non-Standard Port", + "T1510 - Clipboard Modification", + "T1512 - Video Capture", + "T1513 - Screen Capture", + "T1514 - Elevated Execution with Prompt", + "T1516 - Input Injection", + "T1517 - Access Notifications", + "T1518 - Software Discovery", + "T1518.001 - Security Software Discovery", + "T1519 - Emond", + "T1520 - Domain Generation Algorithms", + "T1521 - Encrypted Channel", + "T1521.001 - Symmetric Cryptography", + "T1521.002 - Asymmetric Cryptography", + "T1522 - Cloud Instance Metadata API", + "T1523 - Evade Analysis Environment", + "T1525 - Implant Internal Image", + "T1526 - Cloud Service Discovery", + "T1527 - Application Access Token", + "T1528 - Steal Application Access Token", + "T1529 - System Shutdown/Reboot", + "T1530 - Data from Cloud Storage", + "T1531 - Account Access Removal", + "T1532 - Archive Collected Data", + "T1533 - Data from Local System", + "T1534 - Internal Spearphishing", + "T1535 - Unused/Unsupported Cloud Regions", + "T1536 - Revert Cloud Instance", + "T1537 - Transfer Data to Cloud Account", + "T1538 - Cloud Service Dashboard", + "T1539 - Steal Web Session Cookie", + "T1540 - Code Injection", + "T1541 - Foreground Persistence", + "T1542 - Pre-OS Boot", + "T1542.001 - System Firmware", + "T1542.002 - Component Firmware", + "T1542.003 - Bootkit", + "T1542.004 - ROMMONkit", + "T1542.005 - TFTP Boot", + "T1543 - Create or Modify System Process", + "T1543.001 - Launch Agent", + "T1543.002 - Systemd Service", + "T1543.003 - Windows Service", + "T1543.004 - Launch Daemon", + "T1544 - Ingress Tool Transfer", + "T1546 - Event Triggered Execution", + "T1546.001 - Change Default File Association", + "T1546.002 - Screensaver", + "T1546.003 - Windows Management Instrumentation Event Subscription", + "T1546.004 - Unix Shell Configuration Modification", + "T1546.005 - Trap", + "T1546.006 - LC_LOAD_DYLIB Addition", + "T1546.007 - Netsh Helper DLL", + "T1546.008 - Accessibility Features", + "T1546.009 - AppCert DLLs", + "T1546.010 - AppInit DLLs", + "T1546.011 - Application Shimming", + "T1546.012 - Image File Execution Options Injection", + "T1546.013 - PowerShell Profile", + "T1546.014 - Emond", + "T1546.015 - Component Object Model Hijacking", + "T1546.016 - Installer Packages", + "T1547 - Boot or Logon Autostart Execution", + "T1547.001 - Registry Run Keys / Startup Folder", + "T1547.002 - Authentication Package", + "T1547.003 - Time Providers", + "T1547.004 - Winlogon Helper DLL", + "T1547.005 - Security Support Provider", + "T1547.006 - Kernel Modules and Extensions", + "T1547.007 - Re-opened Applications", + "T1547.008 - LSASS Driver", + "T1547.009 - Shortcut Modification", + "T1547.010 - Port Monitors", + "T1547.011 - Plist Modification", + "T1547.012 - Print Processors", + "T1547.013 - XDG Autostart Entries", + "T1547.014 - Active Setup", + "T1547.015 - Login Items", + "T1548 - Abuse Elevation Control Mechanism", + "T1548.001 - Setuid and Setgid", + "T1548.002 - Bypass User Account Control", + "T1548.003 - Sudo and Sudo Caching", + "T1548.004 - Elevated Execution with Prompt", + "T1550 - Use Alternate Authentication Material", + "T1550.001 - Application Access Token", + "T1550.002 - Pass the Hash", + "T1550.003 - Pass the Ticket", + "T1550.004 - Web Session Cookie", + "T1552 - Unsecured Credentials", + "T1552.001 - Credentials In Files", + "T1552.002 - Credentials in Registry", + "T1552.003 - Bash History", + "T1552.004 - Private Keys", + "T1552.005 - Cloud Instance Metadata API", + "T1552.006 - Group Policy Preferences", + "T1552.007 - Container API", + "T1552.008 - Chat Messages", + "T1553 - Subvert Trust Controls", + "T1553.001 - Gatekeeper Bypass", + "T1553.002 - Code Signing", + "T1553.003 - SIP and Trust Provider Hijacking", + "T1553.004 - Install Root Certificate", + "T1553.005 - Mark-of-the-Web Bypass", + "T1553.006 - Code Signing Policy Modification", + "T1554 - Compromise Client Software Binary", + "T1555 - Credentials from Password Stores", + "T1555.001 - Keychain", + "T1555.002 - Securityd Memory", + "T1555.003 - Credentials from Web Browsers", + "T1555.004 - Windows Credential Manager", + "T1555.005 - Password Managers", + "T1556 - Modify Authentication Process", + "T1556.001 - Domain Controller Authentication", + "T1556.002 - Password Filter DLL", + "T1556.003 - Pluggable Authentication Modules", + "T1556.004 - Network Device Authentication", + "T1556.005 - Reversible Encryption", + "T1556.006 - Multi-Factor Authentication", + "T1556.007 - Hybrid Identity", + "T1556.008 - Network Provider DLL", + "T1557 - Adversary-in-the-Middle", + "T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay", + "T1557.002 - ARP Cache Poisoning", + "T1557.003 - DHCP Spoofing", + "T1558 - Steal or Forge Kerberos Tickets", + "T1558.001 - Golden Ticket", + "T1558.002 - Silver Ticket", + "T1558.003 - Kerberoasting", + "T1558.004 - AS-REP Roasting", + "T1559 - Inter-Process Communication", + "T1559.001 - Component Object Model", + "T1559.002 - Dynamic Data Exchange", + "T1559.003 - XPC Services", + "T1560 - Archive Collected Data", + "T1560.001 - Archive via Utility", + "T1560.002 - Archive via Library", + "T1560.003 - Archive via Custom Method", + "T1561 - Disk Wipe", + "T1561.001 - Disk Content Wipe", + "T1561.002 - Disk Structure Wipe", + "T1562 - Impair Defenses", + "T1562.001 - Disable or Modify Tools", + "T1562.002 - Disable Windows Event Logging", + "T1562.003 - Impair Command History Logging", + "T1562.004 - Disable or Modify System Firewall", + "T1562.006 - Indicator Blocking", + "T1562.007 - Disable or Modify Cloud Firewall", + "T1562.008 - Disable Cloud Logs", + "T1562.009 - Safe Mode Boot", + "T1562.010 - Downgrade Attack", + "T1562.011 - Spoof Security Alerting", + "T1563 - Remote Service Session Hijacking", + "T1563.001 - SSH Hijacking", + "T1563.002 - RDP Hijacking", + "T1564 - Hide Artifacts", + "T1564.001 - Hidden Files and Directories", + "T1564.002 - Hidden Users", + "T1564.003 - Hidden Window", + "T1564.004 - NTFS File Attributes", + "T1564.005 - Hidden File System", + "T1564.006 - Run Virtual Instance", + "T1564.007 - VBA Stomping", + "T1564.008 - Email Hiding Rules", + "T1564.009 - Resource Forking", + "T1564.010 - Process Argument Spoofing", + "T1565 - Data Manipulation", + "T1565.001 - Stored Data Manipulation", + "T1565.002 - Transmitted Data Manipulation", + "T1565.003 - Runtime Data Manipulation", + "T1566 - Phishing", + "T1566.001 - Spearphishing Attachment", + "T1566.002 - Spearphishing Link", + "T1566.003 - Spearphishing via Service", + "T1567 - Exfiltration Over Web Service", + "T1567.001 - Exfiltration to Code Repository", + "T1567.002 - Exfiltration to Cloud Storage", + "T1567.003 - Exfiltration to Text Storage Sites", + "T1568 - Dynamic Resolution", + "T1568.001 - Fast Flux DNS", + "T1568.002 - Domain Generation Algorithms", + "T1568.003 - DNS Calculation", + "T1569 - System Services", + "T1569.001 - Launchctl", + "T1569.002 - Service Execution", + "T1570 - Lateral Tool Transfer", + "T1571 - Non-Standard Port", + "T1572 - Protocol Tunneling", + "T1573 - Encrypted Channel", + "T1573.001 - Symmetric Cryptography", + "T1573.002 - Asymmetric Cryptography", + "T1574 - Hijack Execution Flow", + "T1574.001 - DLL Search Order Hijacking", + "T1574.002 - DLL Side-Loading", + "T1574.004 - Dylib Hijacking", + "T1574.005 - Executable Installer File Permissions Weakness", + "T1574.006 - Dynamic Linker Hijacking", + "T1574.007 - Path Interception by PATH Environment Variable", + "T1574.008 - Path Interception by Search Order Hijacking", + "T1574.009 - Path Interception by Unquoted Path", + "T1574.010 - Services File Permissions Weakness", + "T1574.011 - Services Registry Permissions Weakness", + "T1574.012 - COR_PROFILER", + "T1574.013 - KernelCallbackTable", + "T1575 - Native API", + "T1576 - Uninstall Malicious Application", + "T1577 - Compromise Application Executable", + "T1578 - Modify Cloud Compute Infrastructure", + "T1578.001 - Create Snapshot", + "T1578.002 - Create Cloud Instance", + "T1578.003 - Delete Cloud Instance", + "T1578.004 - Revert Cloud Instance", + "T1579 - Keychain", + "T1580 - Cloud Infrastructure Discovery", + "T1581 - Geofencing", + "T1582 - SMS Control", + "T1583 - Acquire Infrastructure", + "T1583.001 - Domains", + "T1583.002 - DNS Server", + "T1583.003 - Virtual Private Server", + "T1583.004 - Server", + "T1583.005 - Botnet", + "T1583.006 - Web Services", + "T1583.007 - Serverless", + "T1583.008 - Malvertising", + "T1584 - Compromise Infrastructure", + "T1584.001 - Domains", + "T1584.002 - DNS Server", + "T1584.003 - Virtual Private Server", + "T1584.004 - Server", + "T1584.005 - Botnet", + "T1584.006 - Web Services", + "T1584.007 - Serverless", + "T1585 - Establish Accounts", + "T1585.001 - Social Media Accounts", + "T1585.002 - Email Accounts", + "T1585.003 - Cloud Accounts", + "T1586 - Compromise Accounts", + "T1586.001 - Social Media Accounts", + "T1586.002 - Email Accounts", + "T1586.003 - Cloud Accounts", + "T1587 - Develop Capabilities", + "T1587.001 - Malware", + "T1587.002 - Code Signing Certificates", + "T1587.003 - Digital Certificates", + "T1587.004 - Exploits", + "T1588 - Obtain Capabilities", + "T1588.001 - Malware", + "T1588.002 - Tool", + "T1588.003 - Code Signing Certificates", + "T1588.004 - Digital Certificates", + "T1588.005 - Exploits", + "T1588.006 - Vulnerabilities", + "T1589 - Gather Victim Identity Information", + "T1589.001 - Credentials", + "T1589.002 - Email Addresses", + "T1589.003 - Employee Names", + "T1590 - Gather Victim Network Information", + "T1590.001 - Domain Properties", + "T1590.002 - DNS", + "T1590.003 - Network Trust Dependencies", + "T1590.004 - Network Topology", + "T1590.005 - IP Addresses", + "T1590.006 - Network Security Appliances", + "T1591 - Gather Victim Org Information", + "T1591.001 - Determine Physical Locations", + "T1591.002 - Business Relationships", + "T1591.003 - Identify Business Tempo", + "T1591.004 - Identify Roles", + "T1592 - Gather Victim Host Information", + "T1592.001 - Hardware", + "T1592.002 - Software", + "T1592.003 - Firmware", + "T1592.004 - Client Configurations", + "T1593 - Search Open Websites/Domains", + "T1593.001 - Social Media", + "T1593.002 - Search Engines", + "T1593.003 - Code Repositories", + "T1594 - Search Victim-Owned Websites", + "T1595 - Active Scanning", + "T1595.001 - Scanning IP Blocks", + "T1595.002 - Vulnerability Scanning", + "T1595.003 - Wordlist Scanning", + "T1596 - Search Open Technical Databases", + "T1596.001 - DNS/Passive DNS", + "T1596.002 - WHOIS", + "T1596.003 - Digital Certificates", + "T1596.004 - CDNs", + "T1596.005 - Scan Databases", + "T1597 - Search Closed Sources", + "T1597.001 - Threat Intel Vendors", + "T1597.002 - Purchase Technical Data", + "T1598 - Phishing for Information", + "T1598.001 - Spearphishing Service", + "T1598.002 - Spearphishing Attachment", + "T1598.003 - Spearphishing Link", + "T1599 - Network Boundary Bridging", + "T1599.001 - Network Address Translation Traversal", + "T1600 - Weaken Encryption", + "T1600.001 - Reduce Key Space", + "T1600.002 - Disable Crypto Hardware", + "T1601 - Modify System Image", + "T1601.001 - Patch System Image", + "T1601.002 - Downgrade System Image", + "T1602 - Data from Configuration Repository", + "T1602.001 - SNMP (MIB Dump)", + "T1602.002 - Network Device Configuration Dump", + "T1603 - Scheduled Task/Job", + "T1604 - Proxy Through Victim", + "T1605 - Command-Line Interface", + "T1606 - Forge Web Credentials", + "T1606.001 - Web Cookies", + "T1606.002 - SAML Tokens", + "T1608 - Stage Capabilities", + "T1608.001 - Upload Malware", + "T1608.002 - Upload Tool", + "T1608.003 - Install Digital Certificate", + "T1608.004 - Drive-by Target", + "T1608.005 - Link Target", + "T1608.006 - SEO Poisoning", + "T1609 - Container Administration Command", + "T1610 - Deploy Container", + "T1611 - Escape to Host", + "T1612 - Build Image on Host", + "T1613 - Container and Resource Discovery", + "T1614 - System Location Discovery", + "T1614.001 - System Language Discovery", + "T1615 - Group Policy Discovery", + "T1616 - Call Control", + "T1617 - Hooking", + "T1618 - User Evasion", + "T1619 - Cloud Storage Object Discovery", + "T1620 - Reflective Code Loading", + "T1621 - Multi-Factor Authentication Request Generation", + "T1622 - Debugger Evasion", + "T1623 - Command and Scripting Interpreter", + "T1623.001 - Unix Shell", + "T1624 - Event Triggered Execution", + "T1624.001 - Broadcast Receivers", + "T1625 - Hijack Execution Flow", + "T1625.001 - System Runtime API Hijacking", + "T1626 - Abuse Elevation Control Mechanism", + "T1626.001 - Device Administrator Permissions", + "T1627 - Execution Guardrails", + "T1627.001 - Geofencing", + "T1628 - Hide Artifacts", + "T1628.001 - Suppress Application Icon", + "T1628.002 - User Evasion", + "T1629 - Impair Defenses", + "T1629.001 - Prevent Application Removal", + "T1629.002 - Device Lockout", + "T1629.003 - Disable or Modify Tools", + "T1630 - Indicator Removal on Host", + "T1630.001 - Uninstall Malicious Application", + "T1630.002 - File Deletion", + "T1630.003 - Disguise Root/Jailbreak Indicators", + "T1631 - Process Injection", + "T1631.001 - Ptrace System Calls", + "T1632 - Subvert Trust Controls", + "T1632.001 - Code Signing Policy Modification", + "T1633 - Virtualization/Sandbox Evasion", + "T1633.001 - System Checks", + "T1634 - Credentials from Password Store", + "T1634.001 - Keychain", + "T1635 - Steal Application Access Token", + "T1635.001 - URI Hijacking", + "T1636 - Protected User Data", + "T1636.001 - Calendar Entries", + "T1636.002 - Call Log", + "T1636.003 - Contact List", + "T1636.004 - SMS Messages", + "T1637 - Dynamic Resolution", + "T1637.001 - Domain Generation Algorithms", + "T1638 - Adversary-in-the-Middle", + "T1639 - Exfiltration Over Alternative Protocol", + "T1639.001 - Exfiltration Over Unencrypted Non-C2 Protocol", + "T1640 - Account Access Removal", + "T1641 - Data Manipulation", + "T1641.001 - Transmitted Data Manipulation", + "T1642 - Endpoint Denial of Service", + "T1643 - Generate Traffic from Victim", + "T1644 - Out of Band Data", + "T1645 - Compromise Client Software Binary", + "T1646 - Exfiltration Over C2 Channel", + "T1647 - Plist File Modification", + "T1648 - Serverless Execution", + "T1649 - Steal or Forge Authentication Certificates", + "T1650 - Acquire Access", + "T1651 - Cloud Administration Command", + "T1652 - Device Driver Discovery" + ] +}; + +export default intel; From 33bce8891c065ec68cd7ea7dac8b47bbca87fe52 Mon Sep 17 00:00:00 2001 From: Michael Carenzo <79934822+mikecarenzo@users.noreply.github.com> Date: Thu, 3 Aug 2023 13:42:33 -0400 Subject: [PATCH 04/18] autosuggest tactics and techniques from intel file --- .../src/assets/builder.config.ts | 1707 +++++++++-------- 1 file changed, 854 insertions(+), 853 deletions(-) diff --git a/src/attack_flow_builder/src/assets/builder.config.ts b/src/attack_flow_builder/src/assets/builder.config.ts index d6360d29..09b10ff1 100644 --- a/src/attack_flow_builder/src/assets/builder.config.ts +++ b/src/attack_flow_builder/src/assets/builder.config.ts @@ -1,853 +1,854 @@ -import validator from "./builder.config.validator"; -import publisher from "./builder.config.publisher"; -import { AppConfiguration } from "@/store/StoreTypes"; -import { Colors, DarkTheme } from "./scripts/BlockDiagram/DiagramFactory/Themes"; -import { - AnchorAngle, - EnumPropertyDescriptor, - PropertyType, - SemanticRole, - TemplateType -} from "./scripts/BlockDiagram"; - -const BoolEnum: EnumPropertyDescriptor = { - type: PropertyType.Enum, - options: { - type : PropertyType.List, - form : { type: PropertyType.String }, - value : [["true", "True"], ["false", "False"]] - } -}; - -const config: AppConfiguration = { - is_web_hosted: false, - application_name: "Attack Flow Builder", - file_type_name: "Attack Flow", - file_type_extension: "afb", - schema: { - page_template: "flow", - templates: [ - { - id: "flow", - type: TemplateType.Page, - role: SemanticRole.Node, - grid: [10, 10], - properties: { - name : { type: PropertyType.String, value: "Untitled Document", is_primary: true }, - description : { type: PropertyType.String }, - author : { - type: PropertyType.Dictionary, - form: { - name: { type: PropertyType.String, is_primary: true, is_required: true }, - identity_class: { - type: PropertyType.Enum, - options: { - type : PropertyType.List, - form : { type: PropertyType.String }, - value : [ - ["individual", "Individual"], - ["group", "Group"], - ["system", "System"], - ["organization", "Organization"], - ["class", "Class"], - ["unknown", "Unknown"] - ] - } - }, - contact_information: { type: PropertyType.String } - } - }, - scope : { - type: PropertyType.Enum, - options: { - type: PropertyType.List, - form: { type: PropertyType.String }, - value: [ - ["incident", "Incident"], - ["campaign", "Campaign"], - ["threat-actor", "Threat Actor"], - ["malware", "Malware"], - ["other", "Other"] - ] - }, - value: "incident" - }, - external_references : { - type: PropertyType.List, - form: { - type: PropertyType.Dictionary, - form: { - source_name: { type: PropertyType.String, is_primary: true, is_required: true }, - description: { type: PropertyType.String }, - url: { type: PropertyType.String }, - } - } - }, - created : { type: PropertyType.Date, value: new Date(), is_visible_chart: false, is_visible_sidebar: false } - }, - style: DarkTheme.Page() - }, - { - id: "true_anchor", - type: TemplateType.AnchorPoint, - role: SemanticRole.None, - radius: 10, - line_templates: { - [AnchorAngle.DEG_0] : `@__builtin__line_horizontal_elbow`, - [AnchorAngle.DEG_90]: `@__builtin__line_vertical_elbow` - }, - style: DarkTheme.AnchorPoint() - }, - { - id: "false_anchor", - type: TemplateType.AnchorPoint, - role: SemanticRole.None, - radius: 10, - line_templates: { - [AnchorAngle.DEG_0] : `@__builtin__line_horizontal_elbow`, - [AnchorAngle.DEG_90]: `@__builtin__line_vertical_elbow` - }, - style: DarkTheme.AnchorPoint() - }, - { - id: "action", - namespace: "attack_flow.action", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - tactic_id : { type: PropertyType.String }, - tactic_ref : { type: PropertyType.String, is_visible_chart: false, is_visible_sidebar: true }, - technique_id : { type: PropertyType.String }, - technique_ref : { type: PropertyType.String, is_visible_chart: false, is_visible_sidebar: true }, - description : { type: PropertyType.String }, - confidence : { - type: PropertyType.Enum, - options: { - type: PropertyType.List, - form: { - type: PropertyType.Dictionary, - form: { - text : { type: PropertyType.String, is_primary: true }, - value : { type: PropertyType.Int } - } - }, - value: [ - ["speculative", { text: "Speculative", value: 0 }], - ["very-doubtful", { text: "Very Doubtful", value: 10 }], - ["doubtful", { text: "Doubtful", value: 30 }], - ["even-odds", { text: "Even Odds", value: 50 }], - ["probable", { text: "Probable", value: 70 }], - ["very-probable", { text: "Very Probable", value: 90 }], - ["certain", { text: "Certain", value: 100 }] - ] - }, - value: null - }, - execution_start : { type: PropertyType.Date }, - execution_end : { type: PropertyType.Date }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Blue }}) - }, - { - id: "asset", - namespace: "attack_flow.asset", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true}, - description : { type: PropertyType.String } - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Orange }}) - }, - { - id: "condition", - namespace: "attack_flow.condition", - type: TemplateType.BranchBlock, - role: SemanticRole.Node, - properties: { - description : { type: PropertyType.String, is_primary: true, is_required: true }, - pattern : { type: PropertyType.String }, - pattern_type : { type: PropertyType.String }, - pattern_version : { type: PropertyType.String }, - date : { type: PropertyType.Date } - }, - branches: [ - { - text: "True", - anchor_template: "true_anchor", - }, - { - text: "False", - anchor_template: "false_anchor" - } - ], - anchor_template: "@__builtin__anchor", - style: DarkTheme.BranchBlock({ head: { ...Colors.Green }}) - }, - { - id: "or", - namespace: "attack_flow.OR_operator", - type: TemplateType.TextBlock, - role: SemanticRole.Node, - properties: { - operator: { - type: PropertyType.String, - value: "OR", - is_primary: true, - is_visible_chart: false, - is_visible_sidebar: false, - is_editable: false, - } - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.TextBlock({ ...Colors.Red, horizontal_padding: 35 }) - }, - { - id: "and", - namespace: "attack_flow.AND_operator", - type: TemplateType.TextBlock, - role: SemanticRole.Node, - properties: { - operator: { - type: PropertyType.String, - value: "AND", - is_primary: true, - is_visible_chart: false, - is_visible_sidebar: false, - is_editable: false, - } - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.TextBlock({ ...Colors.Red, horizontal_padding: 35 }) - }, - { - id: "attack_pattern", - namespace: "stix_object.attack_pattern", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - description : { type: PropertyType.String }, - aliases : { type: PropertyType.List, form: { type: PropertyType.String }}, - kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String }}, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "campaign", - namespace: "stix_object.campaign", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - description : { type: PropertyType.String }, - aliases : { type: PropertyType.List, form: { type: PropertyType.String } }, - first_seen : { type: PropertyType.Date }, - last_seen : { type: PropertyType.Date }, - objective : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "course_of_action", - namespace: "stix_object.course_of_action", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - description : { type: PropertyType.String }, - action_type : { type: PropertyType.String }, - os_execution_envs : { type: PropertyType.List, form: { type: PropertyType.String } }, - action_bin : { type: PropertyType.String } - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "grouping", - namespace: "stix_object.grouping", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true }, - description : { type: PropertyType.String }, - context : { type: PropertyType.String, is_required: true }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "identity", - namespace: "stix_object.identity", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_required: true, is_primary: true }, - description : { type: PropertyType.String }, - roles : { type: PropertyType.List, form: { type: PropertyType.String } }, - identity_class : { type: PropertyType.String, is_required: true }, - sectors : { type: PropertyType.List, form: { type: PropertyType.String } }, - contact_information : { type: PropertyType.String } - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "indicator", - namespace: "stix_object.indicator", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true }, - description : { type: PropertyType.String }, - indicator_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true } }, - pattern : { type: PropertyType.String, is_required: true }, - pattern_type : { type: PropertyType.String, is_required: true }, - patter_version : { type: PropertyType.String }, - valid_from : { type: PropertyType.Date, is_required: true}, - valid_until : { type: PropertyType.Date }, - kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String }}, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "infrastructure", - namespace: "stix_object.infrastructure", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - description : { type: PropertyType.String }, - infrastructure_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, - aliases : { type: PropertyType.List, form: { type: PropertyType.String }}, - kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String }}, - first_seen : { type: PropertyType.Date }, - last_seen : { type: PropertyType.Date } - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "intrusion_set", - namespace: "stix_object.intrusion_set", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - description : { type: PropertyType.String }, - aliases : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, - first_seen : { type: PropertyType.Date }, - last_seen : { type: PropertyType.Date }, - goals : { type: PropertyType.List, form: { type: PropertyType.String }}, - resource_level : { type: PropertyType.String}, - primary_motivation : { type: PropertyType.String}, - secondary_motivations : { type: PropertyType.List, form: { type: PropertyType.String }}, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "location", - namespace: "stix_object.location", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true }, - description : { type: PropertyType.String }, - latitude : { type: PropertyType.Float, min: -90, max: 90 }, - longitude : { type: PropertyType.Float, min: -180, max: 180 }, - precision : { type: PropertyType.Float }, - region : { type: PropertyType.String }, - country : { type: PropertyType.String }, - administrative_area : { type: PropertyType.String }, - city : { type: PropertyType.String }, - street_address : { type: PropertyType.String }, - postal_code : { type: PropertyType.String } - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "malware", - namespace: "stix_object.malware", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true }, - description : { type: PropertyType.String }, - malware_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, - is_family : { ...BoolEnum, is_required: true }, - aliases : { type: PropertyType.List, form: { type: PropertyType.String } }, - kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String } }, - first_seen : { type: PropertyType.Date }, - last_seen : { type: PropertyType.Date }, - os_execution_envs : { type: PropertyType.List, form: { type: PropertyType.String } }, - architecture_execution_envs : { type: PropertyType.List, form: { type: PropertyType.String } }, - implementation_languages : { type: PropertyType.List, form: { type: PropertyType.String } }, - capabilities : { type: PropertyType.List, form: { type: PropertyType.String } }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "malware_analysis", - namespace: "stix_object.malware_analysis", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - product : { type: PropertyType.String, is_primary: true, is_required: true }, - version : { type: PropertyType.String }, - configuration_version : { type: PropertyType.String }, - modules : { type: PropertyType.List, form: { type: PropertyType.String } }, - analysis_engine_version : { type: PropertyType.String }, - analysis_definition_version : { type: PropertyType.String }, - submitted : { type: PropertyType.Date }, - analysis_started : { type: PropertyType.Date }, - analysis_ended : { type: PropertyType.Date }, - result : { - type: PropertyType.Enum, - options: { - type: PropertyType.List, - form: { type: PropertyType.String }, - value: [ - ["malicious", "Malicious"], - ["suspicious", "Suspicious"], - ["benign", "Benign"], - ["unknown", "Unknown"] - ] - }, - value: null - }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "note", - namespace: "stix_object.note", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - abstract : { type: PropertyType.String, is_primary: true }, - content : { type: PropertyType.String, is_required: true }, - authors : { type: PropertyType.List, form: { type: PropertyType.String } }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "observed_data", - namespace: "stix_object.observed_data", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - first_observed : { type: PropertyType.Date, is_required: true }, - last_observed : { type: PropertyType.Date, is_required: true }, - number_observed : { type: PropertyType.Int, min: 0, is_required: true }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "opinion", - namespace: "stix_object.opinion", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - explanation : { type: PropertyType.String, is_primary: true }, - authors : { type: PropertyType.List, form: { type: PropertyType.String } }, - opinion : { - type: PropertyType.Enum, - options: { - type: PropertyType.List, - form: { type: PropertyType.String }, - value: [ - ["strongly-disagree", "Strongly Disagree"], - ["disagree", "Disagree"], - ["neutral", "Neutral"], - ["agree", "Agree"], - ["strongly-agree", "Strongly Agree"] - ] - }, - is_required: true - } - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "report", - namespace: "stix_object.report", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - description : { type: PropertyType.String }, - report_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, - published : { type: PropertyType.Date, is_required: true }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "threat_actor", - namespace: "stix_object.threat_actor", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - description : { type: PropertyType.String }, - threat_actor_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, - aliases : { type: PropertyType.List, form: { type: PropertyType.String }}, - first_seen : { type: PropertyType.Date }, - last_seen : { type: PropertyType.Date }, - roles : { type: PropertyType.List, form: { type: PropertyType.String }}, - goals : { type: PropertyType.List, form: { type: PropertyType.String }}, - sophistication : { type: PropertyType.String }, - resource_level : { type: PropertyType.String }, - primary_motivation : { type: PropertyType.String }, - secondary_motivations : { type: PropertyType.List, form: { type: PropertyType.String }}, - personal_motivations : { type: PropertyType.List, form: { type: PropertyType.String }}, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "tool", - namespace: "stix_object.tool", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - description : { type: PropertyType.String }, - tool_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, - aliases : { type: PropertyType.List, form: { type: PropertyType.String }}, - kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String }}, - tool_version : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "vulnerability", - namespace: "stix_object.vulnerability", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - description : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "artifact", - namespace: "stix_observable.artifact", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - mime_type : { type: PropertyType.String }, - payload_bin : { type: PropertyType.String }, - url : { type: PropertyType.String }, - hashes : { type: PropertyType.String }, - encryption_algorithm : { type: PropertyType.String }, - decryption_key : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "autonomous_system", - namespace: "stix_observable.autonomous_system", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - number : { type: PropertyType.Int, is_primary: true, is_required: true }, - name : { type: PropertyType.String }, - rir : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "directory", - namespace: "stix_observable.directory", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - path : { type: PropertyType.String, is_primary: true, is_required: true }, - path_enc : { type: PropertyType.String }, - ctime : { type: PropertyType.Date }, - mtime : { type: PropertyType.Date }, - atime : { type: PropertyType.Date }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "domain_name", - namespace: "stix_observable.domain_name", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - value : { type: PropertyType.String, is_required: true }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "email_address", - namespace: "stix_observable.email_address", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - value : { type: PropertyType.String, is_required: true }, - display_name : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "email_message", - namespace: "stix_observable.email_message", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - is_multipart : { ...BoolEnum, is_required: true }, - date : { type: PropertyType.String }, - content_type : { type: PropertyType.String }, - message_id : { type: PropertyType.String }, - subject : { type: PropertyType.String, is_primary: true }, - received_lines : { type: PropertyType.String }, - additional_header_fields : { type: PropertyType.String }, - body : { type: PropertyType.String }, - body_multipart : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "file", - namespace: "stix_observable.file", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - hashes : { type: PropertyType.String }, - size : { type: PropertyType.String }, - name : { type: PropertyType.String, is_primary: true }, - name_enc : { type: PropertyType.String }, - magic_number_hex : { type: PropertyType.String }, - mime_type : { type: PropertyType.String }, - ctime : { type: PropertyType.Date }, - mtime : { type: PropertyType.Date }, - atime : { type: PropertyType.Date }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "ipv4_addr", - namespace: "stix_observable.ipv4_addr", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - value : { type: PropertyType.String, is_required: true }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "ipv6_addr", - namespace: "stix_observable.ipv6_addr", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - value : { type: PropertyType.String, is_required: true }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "mac_addr", - namespace: "stix_observable.mac_addr", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - value : { type: PropertyType.String, is_required: true }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "mutex", - namespace: "stix_observable.mutex", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_required: true }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "network_traffic", - namespace: "stix_observable.network_traffic", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - start : { type: PropertyType.Date }, - end : { type: PropertyType.Date }, - is_active : BoolEnum, - src_port : { type: PropertyType.Int, min: 0, max: 65535 }, - dst_port : { type: PropertyType.Int, min: 0, max: 65535 }, - protocols : { type: PropertyType.List, min_items: 1, form: { type: PropertyType.String, is_required: true }}, - src_byte_count : { type: PropertyType.Int, min: 0 }, - dst_byte_count : { type: PropertyType.Int, min: 0 }, - src_packets : { type: PropertyType.Int, min: 0 }, - dst_packets : { type: PropertyType.Int, min: 0 }, - ipfix : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "process", - namespace: "stix_observable.process", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - is_hidden : BoolEnum, - pid : { type: PropertyType.Int, min: 0 }, - created_time : { type: PropertyType.Date }, - cwd : { type: PropertyType.String }, - command_line : { type: PropertyType.String, is_required: true }, - environment_variables : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "software", - namespace: "stix_observable.software", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - name : { type: PropertyType.String, is_primary: true, is_required: true }, - cpe : { type: PropertyType.String }, - languages : { type: PropertyType.List, form: {type: PropertyType.String}}, - vendor : { type: PropertyType.String }, - version : { type: PropertyType.String }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "url", - namespace: "stix_observable.url", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - value : { type: PropertyType.String, is_required: true }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "user_account", - namespace: "stix_observable.user_account", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - user_id : { type: PropertyType.String }, - credential : { type: PropertyType.String }, - account_login : { type: PropertyType.String }, - account_type : { type: PropertyType.String }, - display_name : { type: PropertyType.String, is_primary: true, is_required: true }, - is_service_account : BoolEnum, - is_privileged : BoolEnum, - can_escalate_privs : BoolEnum, - is_disabled : BoolEnum, - account_created : { type: PropertyType.Date }, - account_expires : { type: PropertyType.Date }, - credential_last_changed : { type: PropertyType.Date }, - account_first_login : { type: PropertyType.Date }, - account_last_login : { type: PropertyType.Date }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "windows_registry_key", - namespace: "stix_observable.windows_registry_key", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - key : { type: PropertyType.String, is_primary: true }, - values : { type: PropertyType.List, form: { type: PropertyType.String }}, - modified_time : { type: PropertyType.Date }, - number_of_subkeys : { type: PropertyType.Int, min: 0 }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - }, - { - id: "x509_certificate", - namespace: "stix_observable.x509_certificate", - type: TemplateType.DictionaryBlock, - role: SemanticRole.Node, - properties: { - subject : { type: PropertyType.String, is_primary: true, is_required: true }, - is_self_signed : BoolEnum, - hashes : { type: PropertyType.String }, - version : { type: PropertyType.String }, - serial_number : { type: PropertyType.String }, - signature_algorithm : { type: PropertyType.String }, - issuer : { type: PropertyType.String }, - validity_not_before : { type: PropertyType.Date }, - validity_not_after : { type: PropertyType.Date }, - subject_public_key_algorithm : { type: PropertyType.String }, - subject_public_key_modulus : { type: PropertyType.String }, - subject_public_key_exponent : { type: PropertyType.Int, min: 0 }, - }, - anchor_template: "@__builtin__anchor", - style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) - } - ] - }, - menus: { - help_menu: { - help_links: [ - { - text: "Attack Flow Website", - url: "https://center-for-threat-informed-defense.github.io/attack-flow/" - }, - { - text: "Attack Flow Builder Help", - url: "https://center-for-threat-informed-defense.github.io/attack-flow/builder/" - }, - { - text: "MITRE ATT&CK Framework", - url: "https://attack.mitre.org/" - }, - { - text: "GitHub Repository", - url: "https://github.com/center-for-threat-informed-defense/attack-flow" - }, - { - text: "Change Log", - url: "https://center-for-threat-informed-defense.github.io/attack-flow/builder/" - } - ] - } - }, - validator, - publisher -}; - -export default config; +import intel from "./builder.config.intel"; +import validator from "./builder.config.validator"; +import publisher from "./builder.config.publisher"; +import { AppConfiguration } from "@/store/StoreTypes"; +import { Colors, DarkTheme } from "./scripts/BlockDiagram/DiagramFactory/Themes"; +import { + AnchorAngle, + EnumPropertyDescriptor, + PropertyType, + SemanticRole, + TemplateType +} from "./scripts/BlockDiagram"; + +const BoolEnum: EnumPropertyDescriptor = { + type: PropertyType.Enum, + options: { + type : PropertyType.List, + form : { type: PropertyType.String }, + value : [["true", "True"], ["false", "False"]] + } +}; + +const config: AppConfiguration = { + is_web_hosted: false, + application_name: "Attack Flow Builder", + file_type_name: "Attack Flow", + file_type_extension: "afb", + schema: { + page_template: "flow", + templates: [ + { + id: "flow", + type: TemplateType.Page, + role: SemanticRole.Node, + grid: [10, 10], + properties: { + name : { type: PropertyType.String, value: "Untitled Document", is_primary: true }, + description : { type: PropertyType.String }, + author : { + type: PropertyType.Dictionary, + form: { + name: { type: PropertyType.String, is_primary: true, is_required: true }, + identity_class: { + type: PropertyType.Enum, + options: { + type : PropertyType.List, + form : { type: PropertyType.String }, + value : [ + ["individual", "Individual"], + ["group", "Group"], + ["system", "System"], + ["organization", "Organization"], + ["class", "Class"], + ["unknown", "Unknown"] + ] + } + }, + contact_information: { type: PropertyType.String } + } + }, + scope : { + type: PropertyType.Enum, + options: { + type: PropertyType.List, + form: { type: PropertyType.String }, + value: [ + ["incident", "Incident"], + ["campaign", "Campaign"], + ["threat-actor", "Threat Actor"], + ["malware", "Malware"], + ["other", "Other"] + ] + }, + value: "incident" + }, + external_references : { + type: PropertyType.List, + form: { + type: PropertyType.Dictionary, + form: { + source_name: { type: PropertyType.String, is_primary: true, is_required: true }, + description: { type: PropertyType.String }, + url: { type: PropertyType.String }, + } + } + }, + created : { type: PropertyType.Date, value: new Date(), is_visible_chart: false, is_visible_sidebar: false } + }, + style: DarkTheme.Page() + }, + { + id: "true_anchor", + type: TemplateType.AnchorPoint, + role: SemanticRole.None, + radius: 10, + line_templates: { + [AnchorAngle.DEG_0] : `@__builtin__line_horizontal_elbow`, + [AnchorAngle.DEG_90]: `@__builtin__line_vertical_elbow` + }, + style: DarkTheme.AnchorPoint() + }, + { + id: "false_anchor", + type: TemplateType.AnchorPoint, + role: SemanticRole.None, + radius: 10, + line_templates: { + [AnchorAngle.DEG_0] : `@__builtin__line_horizontal_elbow`, + [AnchorAngle.DEG_90]: `@__builtin__line_vertical_elbow` + }, + style: DarkTheme.AnchorPoint() + }, + { + id: "action", + namespace: "attack_flow.action", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + tactic_id : { type: PropertyType.String, suggestions: intel.tactic_recs }, + tactic_ref : { type: PropertyType.String, is_visible_chart: false, is_visible_sidebar: true }, + technique_id : { type: PropertyType.String, suggestions: intel.technique_recs }, + technique_ref : { type: PropertyType.String, is_visible_chart: false, is_visible_sidebar: true }, + description : { type: PropertyType.String }, + confidence : { + type: PropertyType.Enum, + options: { + type: PropertyType.List, + form: { + type: PropertyType.Dictionary, + form: { + text : { type: PropertyType.String, is_primary: true }, + value : { type: PropertyType.Int } + } + }, + value: [ + ["speculative", { text: "Speculative", value: 0 }], + ["very-doubtful", { text: "Very Doubtful", value: 10 }], + ["doubtful", { text: "Doubtful", value: 30 }], + ["even-odds", { text: "Even Odds", value: 50 }], + ["probable", { text: "Probable", value: 70 }], + ["very-probable", { text: "Very Probable", value: 90 }], + ["certain", { text: "Certain", value: 100 }] + ] + }, + value: null + }, + execution_start : { type: PropertyType.Date }, + execution_end : { type: PropertyType.Date }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Blue }}) + }, + { + id: "asset", + namespace: "attack_flow.asset", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true}, + description : { type: PropertyType.String } + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Orange }}) + }, + { + id: "condition", + namespace: "attack_flow.condition", + type: TemplateType.BranchBlock, + role: SemanticRole.Node, + properties: { + description : { type: PropertyType.String, is_primary: true, is_required: true }, + pattern : { type: PropertyType.String }, + pattern_type : { type: PropertyType.String }, + pattern_version : { type: PropertyType.String }, + date : { type: PropertyType.Date } + }, + branches: [ + { + text: "True", + anchor_template: "true_anchor", + }, + { + text: "False", + anchor_template: "false_anchor" + } + ], + anchor_template: "@__builtin__anchor", + style: DarkTheme.BranchBlock({ head: { ...Colors.Green }}) + }, + { + id: "or", + namespace: "attack_flow.OR_operator", + type: TemplateType.TextBlock, + role: SemanticRole.Node, + properties: { + operator: { + type: PropertyType.String, + value: "OR", + is_primary: true, + is_visible_chart: false, + is_visible_sidebar: false, + is_editable: false, + } + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.TextBlock({ ...Colors.Red, horizontal_padding: 35 }) + }, + { + id: "and", + namespace: "attack_flow.AND_operator", + type: TemplateType.TextBlock, + role: SemanticRole.Node, + properties: { + operator: { + type: PropertyType.String, + value: "AND", + is_primary: true, + is_visible_chart: false, + is_visible_sidebar: false, + is_editable: false, + } + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.TextBlock({ ...Colors.Red, horizontal_padding: 35 }) + }, + { + id: "attack_pattern", + namespace: "stix_object.attack_pattern", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + description : { type: PropertyType.String }, + aliases : { type: PropertyType.List, form: { type: PropertyType.String }}, + kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String }}, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "campaign", + namespace: "stix_object.campaign", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + description : { type: PropertyType.String }, + aliases : { type: PropertyType.List, form: { type: PropertyType.String } }, + first_seen : { type: PropertyType.Date }, + last_seen : { type: PropertyType.Date }, + objective : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "course_of_action", + namespace: "stix_object.course_of_action", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + description : { type: PropertyType.String }, + action_type : { type: PropertyType.String }, + os_execution_envs : { type: PropertyType.List, form: { type: PropertyType.String } }, + action_bin : { type: PropertyType.String } + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "grouping", + namespace: "stix_object.grouping", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true }, + description : { type: PropertyType.String }, + context : { type: PropertyType.String, is_required: true }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "identity", + namespace: "stix_object.identity", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_required: true, is_primary: true }, + description : { type: PropertyType.String }, + roles : { type: PropertyType.List, form: { type: PropertyType.String } }, + identity_class : { type: PropertyType.String, is_required: true }, + sectors : { type: PropertyType.List, form: { type: PropertyType.String } }, + contact_information : { type: PropertyType.String } + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "indicator", + namespace: "stix_object.indicator", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true }, + description : { type: PropertyType.String }, + indicator_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true } }, + pattern : { type: PropertyType.String, is_required: true }, + pattern_type : { type: PropertyType.String, is_required: true }, + patter_version : { type: PropertyType.String }, + valid_from : { type: PropertyType.Date, is_required: true}, + valid_until : { type: PropertyType.Date }, + kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String }}, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "infrastructure", + namespace: "stix_object.infrastructure", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + description : { type: PropertyType.String }, + infrastructure_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, + aliases : { type: PropertyType.List, form: { type: PropertyType.String }}, + kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String }}, + first_seen : { type: PropertyType.Date }, + last_seen : { type: PropertyType.Date } + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "intrusion_set", + namespace: "stix_object.intrusion_set", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + description : { type: PropertyType.String }, + aliases : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, + first_seen : { type: PropertyType.Date }, + last_seen : { type: PropertyType.Date }, + goals : { type: PropertyType.List, form: { type: PropertyType.String }}, + resource_level : { type: PropertyType.String}, + primary_motivation : { type: PropertyType.String}, + secondary_motivations : { type: PropertyType.List, form: { type: PropertyType.String }}, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "location", + namespace: "stix_object.location", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true }, + description : { type: PropertyType.String }, + latitude : { type: PropertyType.Float, min: -90, max: 90 }, + longitude : { type: PropertyType.Float, min: -180, max: 180 }, + precision : { type: PropertyType.Float }, + region : { type: PropertyType.String }, + country : { type: PropertyType.String }, + administrative_area : { type: PropertyType.String }, + city : { type: PropertyType.String }, + street_address : { type: PropertyType.String }, + postal_code : { type: PropertyType.String } + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "malware", + namespace: "stix_object.malware", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true }, + description : { type: PropertyType.String }, + malware_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, + is_family : { ...BoolEnum, is_required: true }, + aliases : { type: PropertyType.List, form: { type: PropertyType.String } }, + kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String } }, + first_seen : { type: PropertyType.Date }, + last_seen : { type: PropertyType.Date }, + os_execution_envs : { type: PropertyType.List, form: { type: PropertyType.String } }, + architecture_execution_envs : { type: PropertyType.List, form: { type: PropertyType.String } }, + implementation_languages : { type: PropertyType.List, form: { type: PropertyType.String } }, + capabilities : { type: PropertyType.List, form: { type: PropertyType.String } }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "malware_analysis", + namespace: "stix_object.malware_analysis", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + product : { type: PropertyType.String, is_primary: true, is_required: true }, + version : { type: PropertyType.String }, + configuration_version : { type: PropertyType.String }, + modules : { type: PropertyType.List, form: { type: PropertyType.String } }, + analysis_engine_version : { type: PropertyType.String }, + analysis_definition_version : { type: PropertyType.String }, + submitted : { type: PropertyType.Date }, + analysis_started : { type: PropertyType.Date }, + analysis_ended : { type: PropertyType.Date }, + result : { + type: PropertyType.Enum, + options: { + type: PropertyType.List, + form: { type: PropertyType.String }, + value: [ + ["malicious", "Malicious"], + ["suspicious", "Suspicious"], + ["benign", "Benign"], + ["unknown", "Unknown"] + ] + }, + value: null + }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "note", + namespace: "stix_object.note", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + abstract : { type: PropertyType.String, is_primary: true }, + content : { type: PropertyType.String, is_required: true }, + authors : { type: PropertyType.List, form: { type: PropertyType.String } }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "observed_data", + namespace: "stix_object.observed_data", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + first_observed : { type: PropertyType.Date, is_required: true }, + last_observed : { type: PropertyType.Date, is_required: true }, + number_observed : { type: PropertyType.Int, min: 0, is_required: true }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "opinion", + namespace: "stix_object.opinion", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + explanation : { type: PropertyType.String, is_primary: true }, + authors : { type: PropertyType.List, form: { type: PropertyType.String } }, + opinion : { + type: PropertyType.Enum, + options: { + type: PropertyType.List, + form: { type: PropertyType.String }, + value: [ + ["strongly-disagree", "Strongly Disagree"], + ["disagree", "Disagree"], + ["neutral", "Neutral"], + ["agree", "Agree"], + ["strongly-agree", "Strongly Agree"] + ] + }, + is_required: true + } + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "report", + namespace: "stix_object.report", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + description : { type: PropertyType.String }, + report_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, + published : { type: PropertyType.Date, is_required: true }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "threat_actor", + namespace: "stix_object.threat_actor", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + description : { type: PropertyType.String }, + threat_actor_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, + aliases : { type: PropertyType.List, form: { type: PropertyType.String }}, + first_seen : { type: PropertyType.Date }, + last_seen : { type: PropertyType.Date }, + roles : { type: PropertyType.List, form: { type: PropertyType.String }}, + goals : { type: PropertyType.List, form: { type: PropertyType.String }}, + sophistication : { type: PropertyType.String }, + resource_level : { type: PropertyType.String }, + primary_motivation : { type: PropertyType.String }, + secondary_motivations : { type: PropertyType.List, form: { type: PropertyType.String }}, + personal_motivations : { type: PropertyType.List, form: { type: PropertyType.String }}, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "tool", + namespace: "stix_object.tool", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + description : { type: PropertyType.String }, + tool_types : { type: PropertyType.List, form: { type: PropertyType.String, is_required: true }}, + aliases : { type: PropertyType.List, form: { type: PropertyType.String }}, + kill_chain_phases : { type: PropertyType.List, form: { type: PropertyType.String }}, + tool_version : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "vulnerability", + namespace: "stix_object.vulnerability", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + description : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "artifact", + namespace: "stix_observable.artifact", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + mime_type : { type: PropertyType.String }, + payload_bin : { type: PropertyType.String }, + url : { type: PropertyType.String }, + hashes : { type: PropertyType.String }, + encryption_algorithm : { type: PropertyType.String }, + decryption_key : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "autonomous_system", + namespace: "stix_observable.autonomous_system", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + number : { type: PropertyType.Int, is_primary: true, is_required: true }, + name : { type: PropertyType.String }, + rir : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "directory", + namespace: "stix_observable.directory", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + path : { type: PropertyType.String, is_primary: true, is_required: true }, + path_enc : { type: PropertyType.String }, + ctime : { type: PropertyType.Date }, + mtime : { type: PropertyType.Date }, + atime : { type: PropertyType.Date }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "domain_name", + namespace: "stix_observable.domain_name", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + value : { type: PropertyType.String, is_required: true }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "email_address", + namespace: "stix_observable.email_address", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + value : { type: PropertyType.String, is_required: true }, + display_name : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "email_message", + namespace: "stix_observable.email_message", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + is_multipart : { ...BoolEnum, is_required: true }, + date : { type: PropertyType.String }, + content_type : { type: PropertyType.String }, + message_id : { type: PropertyType.String }, + subject : { type: PropertyType.String, is_primary: true }, + received_lines : { type: PropertyType.String }, + additional_header_fields : { type: PropertyType.String }, + body : { type: PropertyType.String }, + body_multipart : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "file", + namespace: "stix_observable.file", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + hashes : { type: PropertyType.String }, + size : { type: PropertyType.String }, + name : { type: PropertyType.String, is_primary: true }, + name_enc : { type: PropertyType.String }, + magic_number_hex : { type: PropertyType.String }, + mime_type : { type: PropertyType.String }, + ctime : { type: PropertyType.Date }, + mtime : { type: PropertyType.Date }, + atime : { type: PropertyType.Date }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "ipv4_addr", + namespace: "stix_observable.ipv4_addr", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + value : { type: PropertyType.String, is_required: true }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "ipv6_addr", + namespace: "stix_observable.ipv6_addr", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + value : { type: PropertyType.String, is_required: true }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "mac_addr", + namespace: "stix_observable.mac_addr", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + value : { type: PropertyType.String, is_required: true }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "mutex", + namespace: "stix_observable.mutex", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_required: true }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "network_traffic", + namespace: "stix_observable.network_traffic", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + start : { type: PropertyType.Date }, + end : { type: PropertyType.Date }, + is_active : BoolEnum, + src_port : { type: PropertyType.Int, min: 0, max: 65535 }, + dst_port : { type: PropertyType.Int, min: 0, max: 65535 }, + protocols : { type: PropertyType.List, min_items: 1, form: { type: PropertyType.String, is_required: true }}, + src_byte_count : { type: PropertyType.Int, min: 0 }, + dst_byte_count : { type: PropertyType.Int, min: 0 }, + src_packets : { type: PropertyType.Int, min: 0 }, + dst_packets : { type: PropertyType.Int, min: 0 }, + ipfix : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "process", + namespace: "stix_observable.process", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + is_hidden : BoolEnum, + pid : { type: PropertyType.Int, min: 0 }, + created_time : { type: PropertyType.Date }, + cwd : { type: PropertyType.String }, + command_line : { type: PropertyType.String, is_required: true }, + environment_variables : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "software", + namespace: "stix_observable.software", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + name : { type: PropertyType.String, is_primary: true, is_required: true }, + cpe : { type: PropertyType.String }, + languages : { type: PropertyType.List, form: {type: PropertyType.String}}, + vendor : { type: PropertyType.String }, + version : { type: PropertyType.String }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "url", + namespace: "stix_observable.url", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + value : { type: PropertyType.String, is_required: true }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "user_account", + namespace: "stix_observable.user_account", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + user_id : { type: PropertyType.String }, + credential : { type: PropertyType.String }, + account_login : { type: PropertyType.String }, + account_type : { type: PropertyType.String }, + display_name : { type: PropertyType.String, is_primary: true, is_required: true }, + is_service_account : BoolEnum, + is_privileged : BoolEnum, + can_escalate_privs : BoolEnum, + is_disabled : BoolEnum, + account_created : { type: PropertyType.Date }, + account_expires : { type: PropertyType.Date }, + credential_last_changed : { type: PropertyType.Date }, + account_first_login : { type: PropertyType.Date }, + account_last_login : { type: PropertyType.Date }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "windows_registry_key", + namespace: "stix_observable.windows_registry_key", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + key : { type: PropertyType.String, is_primary: true }, + values : { type: PropertyType.List, form: { type: PropertyType.String }}, + modified_time : { type: PropertyType.Date }, + number_of_subkeys : { type: PropertyType.Int, min: 0 }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + }, + { + id: "x509_certificate", + namespace: "stix_observable.x509_certificate", + type: TemplateType.DictionaryBlock, + role: SemanticRole.Node, + properties: { + subject : { type: PropertyType.String, is_primary: true, is_required: true }, + is_self_signed : BoolEnum, + hashes : { type: PropertyType.String }, + version : { type: PropertyType.String }, + serial_number : { type: PropertyType.String }, + signature_algorithm : { type: PropertyType.String }, + issuer : { type: PropertyType.String }, + validity_not_before : { type: PropertyType.Date }, + validity_not_after : { type: PropertyType.Date }, + subject_public_key_algorithm : { type: PropertyType.String }, + subject_public_key_modulus : { type: PropertyType.String }, + subject_public_key_exponent : { type: PropertyType.Int, min: 0 }, + }, + anchor_template: "@__builtin__anchor", + style: DarkTheme.DictionaryBlock({ head: { ...Colors.Gray }}) + } + ] + }, + menus: { + help_menu: { + help_links: [ + { + text: "Attack Flow Website", + url: "https://center-for-threat-informed-defense.github.io/attack-flow/" + }, + { + text: "Attack Flow Builder Help", + url: "https://center-for-threat-informed-defense.github.io/attack-flow/builder/" + }, + { + text: "MITRE ATT&CK Framework", + url: "https://attack.mitre.org/" + }, + { + text: "GitHub Repository", + url: "https://github.com/center-for-threat-informed-defense/attack-flow" + }, + { + text: "Change Log", + url: "https://center-for-threat-informed-defense.github.io/attack-flow/builder/" + } + ] + } + }, + validator, + publisher +}; + +export default config; From d65fae7949455826921c3a2fca6fe0d1415f8ec6 Mon Sep 17 00:00:00 2001 From: Michael Carenzo <79934822+mikecarenzo@users.noreply.github.com> Date: Thu, 3 Aug 2023 17:41:00 -0400 Subject: [PATCH 05/18] update ScrollBox construct --- .../src/components/Containers/ScrollBox.vue | 69 ++++++++++++++----- .../Controls/Fields/OptionsList.vue | 6 +- 2 files changed, 54 insertions(+), 21 deletions(-) diff --git a/src/attack_flow_builder/src/components/Containers/ScrollBox.vue b/src/attack_flow_builder/src/components/Containers/ScrollBox.vue index 8a831c58..f80d2ee7 100644 --- a/src/attack_flow_builder/src/components/Containers/ScrollBox.vue +++ b/src/attack_flow_builder/src/components/Containers/ScrollBox.vue @@ -3,31 +3,31 @@