MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-23 15:27:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
misp-galaxy/clusters/mitre-tool.json

5328 lines
174 KiB
JSON
Raw Normal View History

add mitre based galaxies
2017-08-16 10:17:00 +00:00
{
jq
2017-10-26 08:28:53 +00:00
"authors": [
"MITRE"
],
jq
2018-10-19 08:23:09 +00:00
"category": "tool",
jq
2017-10-26 08:28:53 +00:00
"description": "Name of ATT&CK software",
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"name": "Tool",
jq
2017-10-26 08:28:53 +00:00
"source": "https://github.com/mitre/cti",
no change: dump files with sort_keys=True This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 15:06:29 +00:00
"type": "mitre-tool",
"uuid": "d700dc5c-78f6-11e7-a476-5f748c8e4fe0",
jq
2017-10-26 08:28:53 +00:00
"values": [
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[Windows Credential Editor](https://attack.mitre.org/software/S0005) is a password dumping tool. (Citation: Amplia WCE)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0005",
"mitre_platforms": [
"Windows"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0005",
jq
2017-10-26 08:28:53 +00:00
"http://www.ampliasecurity.com/research/wcefaq.html"
],
"synonyms": [
"Windows Credential Editor",
"WCE"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "242f3da3-4425-4d11-8f5c-b842886da966",
"value": "Windows Credential Editor - S0005"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[Pass-The-Hash Toolkit](https://attack.mitre.org/software/S0122) is a toolkit that allows an adversary to \"pass\" a password hash (without knowing the original password) to log in to systems. (Citation: Mandiant APT1)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0122",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0122",
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
jq
2017-10-26 08:28:53 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"synonyms": [
"Pass-The-Hash Toolkit"
]
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "a52edc76-328d-4596-85e7-d56ef5a9eb69",
"value": "Pass-The-Hash Toolkit - S0122"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
},
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
{
"description": "[CSPY Downloader](https://attack.mitre.org/software/S0527) is a tool designed to evade analysis and download additional payloads used by [Kimsuky](https://attack.mitre.org/groups/G0094).(Citation: Cybereason Kimsuky November 2020)",
"meta": {
"external_id": "S0527",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0527",
"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
],
"synonyms": [
"CSPY Downloader"
]
},
"related": [
{
"dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "5256c0f8-9108-4c92-8b09-482dfacdcd94",
"value": "CSPY Downloader - S0527"
},
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
{
"description": "[Imminent Monitor](https://attack.mitre.org/software/S0434) was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked versions and variations of this RAT are still in circulation.(Citation: Imminent Unit42 Dec2019)",
"meta": {
"external_id": "S0434",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0434",
"https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/"
],
"synonyms": [
"Imminent Monitor"
]
},
"related": [
{
"dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "cd25c1b4-935c-4f0e-ba8d-552f28bc4783",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "8f8cd191-902c-4e83-bf20-b57c8c4640e9",
"value": "Imminent Monitor - S0434"
},
jq
2017-10-26 08:28:53 +00:00
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[Invoke-PSImage](https://attack.mitre.org/software/S0231) takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords. (Citation: GitHub Invoke-PSImage)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0231",
"mitre_platforms": [
"Windows"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0231",
"https://github.com/peewpw/Invoke-PSImage"
jq
2017-10-26 08:28:53 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"synonyms": [
"Invoke-PSImage"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: magical mapping with malpedia
2018-10-12 09:00:00 +00:00
"related": [
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
chg: magical mapping with malpedia
2018-10-12 09:00:00 +00:00
"tags": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"estimative-language:likelihood-probability=\"almost-certain\""
chg: magical mapping with malpedia
2018-10-12 09:00:00 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"type": "uses"
chg: magical mapping with malpedia
2018-10-12 09:00:00 +00:00
}
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"uuid": "b52d6583-14a2-4ddc-8527-87fd2142558f",
"value": "Invoke-PSImage - S0231"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. (Citation: TechNet Ipconfig)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0100",
"mitre_platforms": [
"Windows"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0100",
"https://technet.microsoft.com/en-us/library/bb490921.aspx"
jq
2017-10-26 08:28:53 +00:00
],
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"synonyms": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"ipconfig",
"ipconfig.exe"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
"related": [
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
"tags": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"estimative-language:likelihood-probability=\"almost-certain\""
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"type": "uses"
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
}
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"uuid": "294e2560-bd48-44b2-9da2-833b5588ad11",
"value": "ipconfig - S0100"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. (Citation: Deply Mimikatz) (Citation: Adsecurity Mimikatz Guide)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0002",
"mitre_platforms": [
"Windows"
jq
2017-10-26 08:28:53 +00:00
],
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0002",
"https://github.com/gentilkiwi/mimikatz",
"https://adsecurity.org/?page_id=1821"
jq
2017-10-26 08:28:53 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"synonyms": [
"Mimikatz"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: magical mapping with malpedia
2018-10-12 09:00:00 +00:00
"related": [
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"dest-uuid": "7f3a035d-d83a-45b8-8111-412aa8ade802",
chg: magical mapping with malpedia
2018-10-12 09:00:00 +00:00
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "564998d8-ab3e-4123-93fb-eccaa6b9714a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "f303a39a-6255-4b89-aecc-18c4d8ca7163",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
},
{
"dest-uuid": "d336b553-5da9-46ca-98a8-0b23f49fb447",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: magical mapping with malpedia
2018-10-12 09:00:00 +00:00
}
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
"value": "Mimikatz - S0002"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"description": "[HTRAN](https://attack.mitre.org/software/S0040) is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks. (Citation: Operation Quantum Entanglement)(Citation: NCSC Joint Report Public Tools)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0040",
"mitre_platforms": [
"Linux",
"Windows"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0040",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf",
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"
jq
2017-10-26 08:28:53 +00:00
],
"synonyms": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"HTRAN",
"HUC Packet Transmit Tool"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
"dest-uuid": "3fb18a77-91ef-4c68-a9a9-fa6bdbea38e8",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
},
{
"dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
}
],
"uuid": "d5e96a35-7b0b-4c6a-9533-d63ecbda563e",
"value": "HTRAN - S0040"
jq
2017-10-26 08:28:53 +00:00
},
chg: [att&ck] update to latest MITRE ATT&CK version
2020-11-25 06:45:48 +00:00
{
"description": "[MCMD](https://attack.mitre.org/software/S0500) is a remote access tool that provides remote command shell capability used by [Dragonfly 2.0](https://attack.mitre.org/groups/G0074).(Citation: Secureworks MCMD July 2019)",
"meta": {
"external_id": "S0500",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0500",
"https://www.secureworks.com/research/mcmd-malware-analysis"
],
"synonyms": [
"MCMD"
]
},
"related": [
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "975737f1-b10d-476f-8bda-3ec26ea57172",
"value": "MCMD - S0500"
},
jq
2017-10-26 08:28:53 +00:00
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[pwdump](https://attack.mitre.org/software/S0006) is a credential dumper. (Citation: Wikipedia pwdump)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0006",
"mitre_platforms": [
"Windows"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0006",
"https://en.wikipedia.org/wiki/Pwdump"
jq
2017-10-26 08:28:53 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"synonyms": [
"pwdump"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "9de2308e-7bed-43a3-8e58-f194b3586700",
"value": "pwdump - S0006"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0008",
"mitre_platforms": [
"Windows"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0008",
"https://www.truesec.se/sakerhet/verktyg/saakerhet/gsecdump_v2.0b5"
jq
2017-10-26 08:28:53 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"synonyms": [
"gsecdump"
]
jq
2017-10-26 08:28:53 +00:00
},
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"related": [
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"dest-uuid": "8410d208-7450-407d-b56c-e5c1ced19632",
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
}
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"uuid": "b07c2c47-fefb-4d7c-a69e-6a3296171f54",
"value": "gsecdump - S0008"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[at](https://attack.mitre.org/software/S0110) is used to schedule tasks on a system to run at a specified date or time. (Citation: TechNet At)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0110",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
jq
2017-10-26 08:28:53 +00:00
],
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0110",
"https://technet.microsoft.com/en-us/library/bb490866.aspx"
jq
2017-10-26 08:28:53 +00:00
],
"synonyms": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"at",
"at.exe"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "0c8465c0-d0b4-4670-992e-4eee8d7ff952",
"value": "at - S0110"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[ifconfig](https://attack.mitre.org/software/S0101) is a Unix-based utility used to gather information about and interact with the TCP/IP settings on a system. (Citation: Wikipedia Ifconfig)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0101",
"mitre_platforms": [
"Linux"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0101",
"https://en.wikipedia.org/wiki/Ifconfig"
jq
2017-10-26 08:28:53 +00:00
],
"synonyms": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"ifconfig"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "362dc67f-4e85-4562-9dac-1b6b7f3ec4b5",
"value": "ifconfig - S0101"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[Fgdump](https://attack.mitre.org/software/S0120) is a Windows password hash dumper. (Citation: Mandiant APT1)",
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0120",
"mitre_platforms": [
"Windows"
],
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0120",
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
],
"synonyms": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"Fgdump"
]
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "4f45dfeb-fe51-4df0-8db3-edf7dd0513fe",
"value": "Fgdump - S0120"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[nbtstat](https://attack.mitre.org/software/S0102) is a utility used to troubleshoot NetBIOS name resolution. (Citation: TechNet Nbtstat)",
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0102",
"mitre_platforms": [
"Windows"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0102",
jq
2017-10-26 08:28:53 +00:00
"https://technet.microsoft.com/en-us/library/cc940106.aspx"
],
"synonyms": [
"nbtstat",
"nbtstat.exe"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
"dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "b35068ec-107a-4266-bda8-eb7036267aea",
"value": "nbtstat - S0102"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[route](https://attack.mitre.org/software/S0103) can be used to find or change information within the local system IP routing table. (Citation: TechNet Route)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0103",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0103",
"https://technet.microsoft.com/en-us/library/bb490991.aspx"
jq
2017-10-26 08:28:53 +00:00
],
"synonyms": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"route",
"route.exe"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "c11ac61d-50f4-444f-85d8-6f006067f0de",
"value": "route - S0103"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[netstat](https://attack.mitre.org/software/S0104) is an operating system utility that displays active TCP connections, listening ports, and network statistics. (Citation: TechNet Netstat)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0104",
"mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0104",
jq
2017-10-26 08:28:53 +00:00
"https://technet.microsoft.com/en-us/library/bb490947.aspx"
],
"synonyms": [
"netstat",
"netstat.exe"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
"dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "4664b683-f578-434f-919b-1c1aad2a1111",
"value": "netstat - S0104"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[dsquery](https://attack.mitre.org/software/S0105) is a command-line utility that can be used to query Active Directory for information from a system within a domain. (Citation: TechNet Dsquery) It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0105",
"mitre_platforms": [
"Windows"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0105",
"https://technet.microsoft.com/en-us/library/cc732952.aspx"
jq
2017-10-26 08:28:53 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"synonyms": [
"dsquery",
"dsquery.exe"
]
jq
2017-10-26 08:28:53 +00:00
},
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c",
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"tags": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"estimative-language:likelihood-probability=\"almost-certain\""
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
},
{
"dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
}
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"uuid": "38952eac-cb1b-4a71-bad2-ee8223a1c8fe",
"value": "dsquery - S0105"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd)\n\nCmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., <code>dir</code> (Citation: TechNet Dir)), deleting files (e.g., <code>del</code> (Citation: TechNet Del)), and copying files (e.g., <code>copy</code> (Citation: TechNet Copy)).",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0106",
"mitre_platforms": [
"Windows"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0106",
"https://technet.microsoft.com/en-us/library/bb490880.aspx",
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"https://technet.microsoft.com/en-us/library/cc755121.aspx",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://technet.microsoft.com/en-us/library/cc771049.aspx",
"https://technet.microsoft.com/en-us/library/bb490886.aspx"
jq
2017-10-26 08:28:53 +00:00
],
"synonyms": [
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"cmd",
"cmd.exe"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
}
],
"uuid": "bba595da-b73a-4354-aa6c-224d4de7cb4e",
"value": "cmd - S0106"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[certutil](https://attack.mitre.org/software/S0160) is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. (Citation: TechNet Certutil)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0160",
"mitre_platforms": [
"Windows"
],
jq
2017-10-26 08:28:53 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0160",
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"https://technet.microsoft.com/library/cc732443.aspx"
jq
2017-10-26 08:28:53 +00:00
],
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"synonyms": [
"certutil",
"certutil.exe"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
"dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 07:32:24 +00:00
}
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"uuid": "0a68f1f1-da74-4d28-8d9a-696c082706cc",
"value": "certutil - S0160"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[netsh](https://attack.mitre.org/software/S0108) is a scripting utility used to interact with networking components on local or remote systems. (Citation: TechNet Netsh)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0108",
"mitre_platforms": [
"Windows"
jq
2017-10-26 08:28:53 +00:00
],
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0108",
"https://technet.microsoft.com/library/bb490939.aspx"
jq
2017-10-26 08:28:53 +00:00
],
"synonyms": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"netsh",
"netsh.exe"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f63fe421-b1d1-45c0-b8a7-02cd16ff2bed",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "5a63f900-5e7e-4928-a746-dd4558e1df71",
"value": "netsh - S0108"
jq
2017-10-26 08:28:53 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[BITSAdmin](https://attack.mitre.org/software/S0190) is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/T1197). (Citation: Microsoft BITSAdmin)",
jq
2017-10-26 08:28:53 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0190",
"mitre_platforms": [
"Windows"
jq
2017-10-26 08:28:53 +00:00
],
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0190",
"https://msdn.microsoft.com/library/aa362813.aspx"
jq
2017-10-26 08:28:53 +00:00
],
"synonyms": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"BITSAdmin"
]
jq
2017-10-26 08:28:53 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
},
{
"dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
},
{
"dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
}
],
"uuid": "64764dc6-a032-495f-8250-1e4c06bdc163",
"value": "BITSAdmin - S0190"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
},
{
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"description": "[Koadic](https://attack.mitre.org/software/S0250) is a Windows post-exploitation framework and penetration testing tool. [Koadic](https://attack.mitre.org/software/S0250) is publicly available on GitHub and the tool is executed via the command-line. [Koadic](https://attack.mitre.org/software/S0250) has several options for staging payloads and creating implants. [Koadic](https://attack.mitre.org/software/S0250) performs most of its operations using Windows Script Host. (Citation: Github Koadic) (Citation: Palo Alto Sofacy 06-2018)",
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"meta": {
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"external_id": "S0250",
"mitre_platforms": [
"Windows"
],
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
"refs": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"https://attack.mitre.org/software/S0250",
"https://github.com/zerosum0x0/koadic",
"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
],
"synonyms": [
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"Koadic"
]
MITRE sorted While dicts were sorted, lists were not yet sorted. This current sort algo is not yet the best, but is a good start. A good sort is needed for better comparison afterwards with automated tools. In a next stage tt will also be needed in the validate_all scripts.
2018-12-09 07:32:48 +00:00
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
},
{
"dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
}
],
"uuid": "c8655260-9f4b-44e3-85e1-6538a5f6e4f4",
"value": "Koadic - S0250"
},
{
"description": "[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers. (Citation: Russinovich Sysinternals) (Citation: SANS PsExec)",
"meta": {
"external_id": "S0029",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0029",
"https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx",
"https://digital-forensics.sans.org/blog/2012/12/17/protecting-privileged-domain-accounts-psexec-deep-dive"
],
"synonyms": [
"PsExec"
]
},
"related": [
{
"dest-uuid": "6dd05630-9bd8-11e8-a8b9-47ce338a4367",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
},
{
"dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
}
],
"uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db",
"value": "PsExec - S0029"
},
{
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
"description": "The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft Net Utility)\n\n[Net](https://attack.mitre.org/software/S0039) has a great deal of functionality, (Citation: Savill 1999) much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) using <code>net use</code> commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as <code>net1 user</code>.",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"meta": {
"external_id": "S0039",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0039",
"https://msdn.microsoft.com/en-us/library/aa939914",
"http://windowsitpro.com/windows/netexe-reference"
],
"synonyms": [
"Net",
"net.exe"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "635cbe30-392d-4e27-978e-66774357c762",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
{
"dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "a750a9f6-0bde-4bb3-9aae-1e2786e9780c",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
},
{
"dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "03342581-f790-4f03-ba41-e82e67392e23",
"value": "Net - S0039"
},
{
"description": "[esentutl](https://attack.mitre.org/software/S0404) is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.(Citation: Microsoft Esentutl)",
"meta": {
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"external_id": "S0404",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0404",
"https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh875546(v=ws.11)"
],
"synonyms": [
"esentutl",
"esentutl.exe"
]
},
"related": [
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5",
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
},
{
"dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
}
],
"uuid": "c256da91-6dd5-40b2-beeb-ee3b22ab3d27",
"value": "esentutl - S0404"
},
{
"description": "[FlexiSpy](https://attack.mitre.org/software/S0408) is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version.(Citation: FortiGuard-FlexiSpy)(Citation: CyberMerchants-FlexiSpy)\n\n[FlexiSpy](https://attack.mitre.org/software/S0408) markets itself as a parental control and employee monitoring application.(Citation: FlexiSpy-Website)",
"meta": {
"external_id": "S0408",
"mitre_platforms": [
"Android"
],
"refs": [
"https://attack.mitre.org/software/S0408",
"https://d3gpjj9d20n0p3.cloudfront.net/fortiguard/research/Dig%20Deep%20into%20FlexiSpy%20for%20Android%28white%20paper%29_KaiLu.pdf",
"http://www.cybermerchantsofdeath.com/blog/2017/04/22/FlexiSpy.html",
"https://www.flexispy.com/"
],
"synonyms": [
"FlexiSpy"
]
},
"related": [
{
"dest-uuid": "948a447c-d783-4ba0-8516-a64140fcacd5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "62adb627-f647-498e-b4cc-41499361bacb",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e4c347e9-fb91-4bc5-83b8-391e389131e2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "1622fd3d-fcfc-4d02-ac49-f2d786f79b81",
"value": "FlexiSpy - S0408"
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
{
"description": "[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg)\n\nUtilities such as [Reg](https://attack.mitre.org/software/S0075) are known to be used by persistent threats. (Citation: Windows Commands JPCERT)",
"meta": {
"external_id": "S0075",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0075",
"https://technet.microsoft.com/en-us/library/cc732643.aspx",
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
"https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
],
"synonyms": [
"Reg",
"reg.exe"
]
},
"related": [
{
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
"dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "cde2d700-9ed1-46cf-9bce-07364fe8b24f",
"value": "Reg - S0075"
},
{
"description": "The [Tasklist](https://attack.mitre.org/software/S0057) utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. (Citation: Microsoft Tasklist)",
"meta": {
"external_id": "S0057",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0057",
"https://technet.microsoft.com/en-us/library/bb491010.aspx"
],
"synonyms": [
"Tasklist"
]
},
"related": [
{
"dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "2e45723a-31da-4a7e-aaa6-e01998a6788f",
"value": "Tasklist - S0057"
},
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
{
"description": "[NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)(Citation: Symantec Waterbug Jun 2019)(Citation: FireEye APT39 Jan 2019)",
"meta": {
"external_id": "S0590",
"mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0590",
"https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html",
"https://sectools.org/tool/nbtscan/",
"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments",
"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"
],
"synonyms": [
"NBTscan"
]
},
"related": [
{
"dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "b63970b7-ddfb-4aee-97b1-80d335e033a8",
"value": "NBTscan - S0590"
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
{
"description": "[FTP](https://attack.mitre.org/software/S0095) is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data. (Citation: Wikipedia FTP)",
"meta": {
"external_id": "S0095",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0095",
"https://en.wikipedia.org/wiki/File_Transfer_Protocol"
],
"synonyms": [
"FTP",
"ftp.exe"
]
},
"related": [
{
"dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "cf23bf4a-e003-4116-bbae-1ea6c558d565",
"value": "FTP - S0095"
},
{
"description": "[Systeminfo](https://attack.mitre.org/software/S0096) is a Windows utility that can be used to gather detailed information about a computer. (Citation: TechNet Systeminfo)",
"meta": {
"external_id": "S0096",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0096",
"https://technet.microsoft.com/en-us/library/bb491007.aspx"
],
"synonyms": [
"systeminfo.exe",
"Systeminfo"
]
},
"related": [
{
"dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "7fcbc4e8-1989-441f-9ac5-e7b6ff5806f1",
"value": "Systeminfo - S0096"
},
{
"description": "[Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)",
"meta": {
"external_id": "S0097",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0097",
"https://technet.microsoft.com/en-us/library/bb490968.aspx"
],
"synonyms": [
"ping.exe",
"Ping"
]
},
"related": [
{
"dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "b77b563c-34bb-4fb8-86a3-3694338f7b47",
"value": "Ping - S0097"
},
{
"description": "[Arp](https://attack.mitre.org/software/S0099) displays information about a system's Address Resolution Protocol (ARP) cache. (Citation: TechNet Arp)",
"meta": {
"external_id": "S0099",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0099",
"https://technet.microsoft.com/en-us/library/bb490864.aspx"
],
"synonyms": [
"Arp",
"arp.exe"
]
},
"related": [
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "30489451-5886-4c46-90c9-0dff9adc5252",
"value": "Arp - S0099"
},
{
"description": "[schtasks](https://attack.mitre.org/software/S0111) is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. (Citation: TechNet Schtasks)",
"meta": {
"external_id": "S0111",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0111",
"https://technet.microsoft.com/en-us/library/bb490996.aspx"
],
"synonyms": [
"schtasks",
"schtasks.exe"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "c9703cd3-141c-43a0-a926-380082be5d04",
"value": "schtasks - S0111"
},
{
"description": "[Lslsass](https://attack.mitre.org/software/S0121) is a publicly-available tool that can dump active logon session password hashes from the lsass process. (Citation: Mandiant APT1)",
"meta": {
"external_id": "S0121",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0121",
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
],
"synonyms": [
"Lslsass"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "2fab555f-7664-4623-b4e0-1675ae38190b",
"value": "Lslsass - S0121"
},
{
"description": "[UACMe](https://attack.mitre.org/software/S0116) is an open source assessment tool that contains many methods for bypassing Windows User Account Control on multiple versions of the operating system. (Citation: Github UACMe)",
"meta": {
"external_id": "S0116",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0116",
"https://github.com/hfiref0x/UACME"
],
"synonyms": [
"UACMe"
]
},
"related": [
{
"dest-uuid": "ccde5b0d-fe13-48e6-a6f4-4e434ce29371",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "102c3898-85e0-43ee-ae28-62a0a3ed9507",
"value": "UACMe - S0116"
},
{
"description": "[Cachedump](https://attack.mitre.org/software/S0119) is a publicly-available tool that program extracts cached password hashes from a system’s registry. (Citation: Mandiant APT1)",
"meta": {
"external_id": "S0119",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0119",
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
],
"synonyms": [
"Cachedump"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "c9cd7ec9-40b7-49db-80be-1399eddd9c52",
"value": "Cachedump - S0119"
},
{
"description": "[Winexe](https://attack.mitre.org/software/S0191) is a lightweight, open source tool similar to [PsExec](https://attack.mitre.org/software/S0029) designed to allow system administrators to execute commands on remote servers. (Citation: Winexe Github Sept 2013) [Winexe](https://attack.mitre.org/software/S0191) is unique in that it is a GNU/Linux based client. (Citation: Überwachung APT28 Forfiles June 2015)",
"meta": {
"external_id": "S0191",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0191",
"https://github.com/skalkoto/winexe/",
"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"
],
"synonyms": [
"Winexe"
]
},
"related": [
{
"dest-uuid": "811bdec0-e236-48ae-b27c-1a8fe0bfc3a9",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "96fd6cc4-a693-4118-83ec-619e5352d07d",
"value": "Winexe - S0191"
},
{
"description": "[xCmd](https://attack.mitre.org/software/S0123) is an open source tool that is similar to [PsExec](https://attack.mitre.org/software/S0029) and allows the user to execute applications on remote systems. (Citation: xCmd)",
"meta": {
"external_id": "S0123",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0123",
"https://ashwinrayaprolu.wordpress.com/2011/04/12/xcmd-an-alternative-to-psexec/"
],
"synonyms": [
"xCmd"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "4fa49fc0-9162-4bdb-a37e-7aa3dcb6d38b",
"value": "xCmd - S0123"
},
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
{
"description": "[BloodHound](https://attack.mitre.org/software/S0521) is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrike BloodHound April 2018)(Citation: FoxIT Wocao December 2019)",
"meta": {
"external_id": "S0521",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0521",
"https://github.com/BloodHoundAD/BloodHound",
"https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/",
"https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf"
],
"synonyms": [
"BloodHound"
]
},
"related": [
{
"dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
},
{
"dest-uuid": "1b20efbf-8063-4fc3-a07d-b575318a301b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
}
],
"uuid": "066b057c-944e-4cfc-b654-e3dfba04b926",
"value": "BloodHound - S0521"
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
{
"description": "[Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). (Citation: GitHub Pupy) [Pupy](https://attack.mitre.org/software/S0192) is publicly available on GitHub. (Citation: GitHub Pupy)",
"meta": {
"external_id": "S0192",
"mitre_platforms": [
"Linux",
"Windows",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"macOS",
"Android"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
],
"refs": [
"https://attack.mitre.org/software/S0192",
"https://github.com/n1nj4sec/pupy"
],
"synonyms": [
"Pupy"
]
},
"related": [
{
"dest-uuid": "bdb420be-5882-41c8-b439-02bbef69d83f",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "635cbe30-392d-4e27-978e-66774357c762",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "cb69b20d-56d0-41ab-8440-4a4b251614d4",
"value": "Pupy - S0192"
},
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
{
"description": "MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.(Citation: GitHub MailSniper)",
"meta": {
"external_id": "S0413",
"mitre_platforms": [
"Office 365",
"Windows",
"Azure AD"
],
"refs": [
"https://attack.mitre.org/software/S0413",
"https://github.com/dafthack/MailSniper"
],
"synonyms": [
"MailSniper"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c",
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a",
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470",
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "999c4e6e-b8dc-4b4f-8d6e-1b829f29997e",
"value": "MailSniper - S0413"
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"description": "[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"meta": {
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"external_id": "S0361",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"mitre_platforms": [
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"Windows"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
],
"refs": [
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"https://attack.mitre.org/software/S0361",
"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand",
"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"
],
"synonyms": [
"Expand"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "ca656c25-44f1-471b-9d9f-e2a3bbb84973",
"value": "Expand - S0361"
},
{
"description": "[Tor](https://attack.mitre.org/software/S0183) is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the message and routing information. [Tor](https://attack.mitre.org/software/S0183) utilizes \"Onion Routing,\" in which messages are encrypted with multiple layers of encryption; at each step in the proxy network, the topmost layer is decrypted and the contents forwarded on to the next node until it reaches its destination. (Citation: Dingledine Tor The Second-Generation Onion Router)",
"meta": {
"external_id": "S0183",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0183",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"http://www.dtic.mil/dtic/tr/fulltext/u2/a465464.pdf"
],
"synonyms": [
"Tor"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "ed7d0cb1-87a6-43b4-9f46-ef1bc56d6c68",
"value": "Tor - S0183"
},
{
"description": "[Forfiles](https://attack.mitre.org/software/S0193) is a Windows utility commonly used in batch jobs to execute commands on one or more selected files or directories (ex: list all directories in a drive, read the first line of all files created yesterday, etc.). Forfiles can be executed from either the command line, Run window, or batch files/scripts. (Citation: Microsoft Forfiles Aug 2016)",
"meta": {
"external_id": "S0193",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0193",
"https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)"
],
"synonyms": [
"Forfiles"
]
},
"related": [
{
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
"dest-uuid": "3b0e52ce-517a-4614-a523-1bd5deef6c5e",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
fix: [attack] fixes old MITRE relationships not being removed
2019-10-27 20:06:26 +00:00
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "90ec2b22-7061-4469-b539-0989ec4f96c2",
"value": "Forfiles - S0193"
},
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
{
"description": "[Out1](https://attack.mitre.org/software/S0594) is a remote access tool written in python and used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least 2021.(Citation: Trend Micro Muddy Water March 2021)",
"meta": {
"external_id": "S0594",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0594",
"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
],
"synonyms": [
"Out1"
]
},
"related": [
{
"dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "80c815bb-b24a-4b9c-9d73-ff4c075a278d",
"value": "Out1 - S0594"
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
{
"description": "Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. (Citation: GitHub Responder)",
"meta": {
"external_id": "S0174",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0174",
"https://github.com/SpiderLabs/Responder"
],
"synonyms": [
"Responder"
]
},
"related": [
{
"dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "a1dd2dbd-1550-44bf-abcc-1a4c52e97719",
"value": "Responder - S0174"
},
{
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
"description": "[PowerSploit](https://attack.mitre.org/software/S0194) is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. (Citation: GitHub PowerSploit May 2012) (Citation: PowerShellMagazine PowerSploit July 2014) (Citation: PowerSploit Documentation)",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"meta": {
"external_id": "S0194",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0194",
"https://github.com/PowerShellMafia/PowerSploit",
"http://www.powershellmagazine.com/2014/07/08/powersploit/",
"http://powersploit.readthedocs.io"
],
"synonyms": [
"PowerSploit"
]
},
"related": [
{
"dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
"dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "8d7bd4f5-3a89-4453-9c82-2c8894d5655e",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "c4ad009b-6e13-4419-8d21-918a1652de02",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
},
{
"dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0c2d00da-7742-49e7-9928-4514e5075d32",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "58af3705-8740-4c68-9329-ec015a7013c2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
"dest-uuid": "d336b553-5da9-46ca-98a8-0b23f49fb447",
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
}
],
"uuid": "13cd9151-83b7-410d-9f98-25d0f0d1d80d",
"value": "PowerSploit - S0194"
},
{
"description": "[meek](https://attack.mitre.org/software/S0175) is an open-source Tor plugin that tunnels Tor traffic through HTTPS connections.",
"meta": {
"external_id": "S0175",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0175"
],
"synonyms": [
"meek"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "ca9d3402-ada3-484d-876a-d717bd6e05f2",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "65370d0b-3bd4-4653-8cf9-daf56f6be830",
"value": "meek - S0175"
},
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
{
"description": "[IronNetInjector](https://attack.mitre.org/software/S0581) is a [Turla](https://attack.mitre.org/groups/G0010) toolchain that utilizes scripts from the open-source IronPython implementation of Python with a .NET injector to drop one or more payloads including [ComRAT](https://attack.mitre.org/software/S0126).(Citation: Unit 42 IronNetInjector February 2021 )",
"meta": {
"external_id": "S0581",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0581",
" https://unit42.paloaltonetworks.com/ironnetinjector/"
],
"synonyms": [
"IronNetInjector"
]
},
"related": [
{
"dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "b1595ddd-a783-482a-90e1-8afc8d48467e",
"value": "IronNetInjector - S0581"
},
{
"description": "[ConnectWise](https://attack.mitre.org/software/S0591) is a legitimate remote administration tool that has been used since at least 2016 by threat actors including [MuddyWater](https://attack.mitre.org/groups/G0069) and [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) to connect to and conduct lateral movement in target environments.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)",
"meta": {
"external_id": "S0591",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0591",
"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies",
"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
],
"synonyms": [
"ConnectWise",
"ScreenConnect"
]
},
"related": [
{
"dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "842976c7-f9c8-41b2-8371-41dc64fbe261",
"value": "ConnectWise - S0591"
},
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
{
"description": "[SDelete](https://attack.mitre.org/software/S0195) is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. (Citation: Microsoft SDelete July 2016)",
"meta": {
"external_id": "S0195",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0195",
"https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete"
],
"synonyms": [
"SDelete"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
},
{
"dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
}
],
"uuid": "d8d19e33-94fd-4aa3-b94a-08ee801a2153",
"value": "SDelete - S0195"
},
{
"description": "[MimiPenguin](https://attack.mitre.org/software/S0179) is a credential dumper, similar to [Mimikatz](https://attack.mitre.org/software/S0002), designed specifically for Linux platforms. (Citation: MimiPenguin GitHub May 2017)",
"meta": {
"external_id": "S0179",
"mitre_platforms": [
"Linux"
],
"refs": [
"https://attack.mitre.org/software/S0179",
"https://github.com/huntergregal/mimipenguin"
],
"synonyms": [
"MimiPenguin"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "3120b9fa-23b8-4500-ae73-09494f607b7d",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "5a33468d-844d-4b1f-98c9-0e786c556b27",
"value": "MimiPenguin - S0179"
},
{
"description": "[Havij](https://attack.mitre.org/software/S0224) is an automatic SQL Injection tool distributed by the Iranian ITSecTeam security company. Havij has been used by penetration testers and adversaries. (Citation: Check Point Havij Analysis)",
"meta": {
"external_id": "S0224",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0224",
"https://blog.checkpoint.com/2015/05/14/analysis-havij-sql-injection-tool/"
],
"synonyms": [
"Havij"
]
},
"related": [
{
"dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "fbd727ea-c0dc-42a9-8448-9e12962d1ab5",
"value": "Havij - S0224"
},
{
"description": "[sqlmap](https://attack.mitre.org/software/S0225) is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws. (Citation: sqlmap Introduction)",
"meta": {
"external_id": "S0225",
"mitre_platforms": [
"Linux",
"Windows",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0225",
"http://sqlmap.org/"
],
"synonyms": [
"sqlmap"
]
},
"related": [
{
"dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "9a2640c2-9f43-46fe-b13f-bde881e55555",
"value": "sqlmap - S0225"
},
{
"description": "[QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that is publicly available on GitHub. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language. (Citation: GitHub QuasarRAT) (Citation: Volexity Patchwork June 2018)",
"meta": {
"external_id": "S0262",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0262",
"https://github.com/quasar/QuasarRAT",
chg: [att&ck] July ATT&CK release included in MISP galaxy
2019-08-01 13:51:03 +00:00
"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/",
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf",
"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
],
"synonyms": [
"QuasarRAT",
"xRAT"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
}
],
"uuid": "da04ac30-27da-4959-a67d-450ce47d9470",
"value": "QuasarRAT - S0262"
},
{
"description": "[spwebmember](https://attack.mitre.org/software/S0227) is a Microsoft SharePoint enumeration and data dumping tool written in .NET. (Citation: NCC Group APT15 Alive and Strong)",
"meta": {
"external_id": "S0227",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0227",
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
],
"synonyms": [
"spwebmember"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "0c4b4fda-9062-47da-98b9-ceae2dcf052a",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "33b9e38f-103c-412d-bdcf-904a91fff1e4",
"value": "spwebmember - S0227"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"description": "[Remcos](https://attack.mitre.org/software/S0332) is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. [Remcos](https://attack.mitre.org/software/S0332) has been observed being used in malware campaigns.(Citation: Riskiq Remcos Jan 2018)(Citation: Talos Remcos Aug 2018)",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"meta": {
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"external_id": "S0332",
chg: [mitre] bump to latest MITRE ATT&CK dataset
2018-12-29 17:40:21 +00:00
"mitre_platforms": [
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"Windows"
chg: [mitre] bump to latest MITRE ATT&CK dataset
2018-12-29 17:40:21 +00:00
],
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"refs": [
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"https://attack.mitre.org/software/S0332",
"https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/",
"https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html",
"https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
],
"synonyms": [
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"Remcos"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"estimative-language:likelihood-probability=\"almost-certain\""
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
],
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"estimative-language:likelihood-probability=\"almost-certain\""
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
],
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"estimative-language:likelihood-probability=\"almost-certain\""
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
],
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"type": "uses"
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
chg: [mitre] re-generated galaxies and values using the MITRE sources and also using the MISP version to keep manually created relationships and such
2018-12-09 08:16:03 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"uuid": "7cd0bc75-055b-4098-a00e-83dc8beaff14",
"value": "Remcos - S0332"
},
{
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
"description": "[PoshC2](https://attack.mitre.org/software/S0378) is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in [PowerShell](https://attack.mitre.org/techniques/T1059/001). Although [PoshC2](https://attack.mitre.org/software/S0378) is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.(Citation: GitHub PoshC2)",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"meta": {
"external_id": "S0378",
"mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0378",
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"https://github.com/nettitude/PoshC2_Python"
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
],
"synonyms": [
"PoshC2"
]
},
"related": [
{
"dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "4b57c098-f043-4da2-83ef-7588a6d426bc",
"value": "PoshC2 - S0378"
},
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
{
"description": "[AdFind](https://attack.mitre.org/software/S0552) is a free command-line query tool that can be used for gathering information from Active Directory.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)(Citation: FireEye Ryuk and Trickbot January 2019)",
"meta": {
"external_id": "S0552",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0552",
"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ ",
"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html",
"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"
],
"synonyms": [
"AdFind"
]
},
"related": [
{
"dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "f59508a6-3615-47c3-b493-6676e1a39a87",
"value": "AdFind - S0552"
},
{
"description": "[RemoteUtilities](https://attack.mitre.org/software/S0592) is a legitimate remote administration tool that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least 2021 for execution on target machines.(Citation: Trend Micro Muddy Water March 2021)",
"meta": {
"external_id": "S0592",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0592",
"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
],
"synonyms": [
"RemoteUtilities"
]
},
"related": [
{
"dest-uuid": "365be77f-fc0e-42ee-bac8-4faf806d9336",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "03c6e0ea-96d3-4b23-9afb-05055663cf4b",
"value": "RemoteUtilities - S0592"
},
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
{
"description": "[Xbot](https://attack.mitre.org/software/S0298) is an Android malware family that was observed in 2016 primarily targeting Android users in Russia and Australia. (Citation: PaloAlto-Xbot)",
"meta": {
"external_id": "S0298",
"mitre_platforms": [
"Android"
],
"refs": [
"https://attack.mitre.org/software/S0298",
"http://researchcenter.paloaltonetworks.com/2016/02/new-android-trojan-xbot-phishes-credit-cards-and-bank-accounts-encrypts-devices-for-ransom/"
],
"synonyms": [
"Xbot"
]
},
"related": [
{
"dest-uuid": "e683cd91-40b4-4e1c-be25-34a27610a22e",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "4cfa42a3-71d9-43e2-bf23-daa79f326387",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "5a78ec38-8b93-4dde-a99e-0c9b77674838",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "9d7c32f4-ab39-49dc-8055-8106bc2294a1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d9e88203-2b5d-405f-a406-2933b1e3d7e4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "da21929e-40c0-443d-bdf4-6b60d15448b4",
"value": "Xbot - S0298"
},
{
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
"description": "[Empire](https://attack.mitre.org/software/S0363) is an open source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1059/001) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"meta": {
"external_id": "S0363",
"mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0363",
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools",
"https://github.com/EmpireProject/Empire",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"https://github.com/dstepanic/attck_empire"
],
"synonyms": [
"Empire",
"EmPyre",
"PowerShell Empire"
]
},
"related": [
{
"dest-uuid": "5e4a2073-9643-44cb-a0b5-e7f4048446c7",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "635cbe30-392d-4e27-978e-66774357c762",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
"dest-uuid": "5d2be8b9-d24c-4e98-83bf-2f5f79477163",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "86a96bf6-cf8b-411c-aaeb-8959944d64f7",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0c2d00da-7742-49e7-9928-4514e5075d32",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "58af3705-8740-4c68-9329-ec015a7013c2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "c92e3d68-2349-49e4-a341-7edca2deff96",
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
},
{
"dest-uuid": "fc742192-19e3-466c-9eb5-964a97b29490",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
},
{
"dest-uuid": "1b20efbf-8063-4fc3-a07d-b575318a301b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
}
],
"uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3",
"value": "Empire - S0363"
},
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
{
"description": "[Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control framework written in Golang.(Citation: Bishop Fox Sliver Framework August 2019)",
"meta": {
"external_id": "S0633",
"mitre_platforms": [
"Windows",
"Linux",
"macOS"
],
"refs": [
"https://attack.mitre.org/software/S0633",
"https://labs.bishopfox.com/tech-blog/sliver"
],
"synonyms": [
"Sliver"
]
},
"related": [
{
"dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "eec23884-3fa1-4d8a-ac50-6f104d51e235",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "11f8d7eb-1927-4806-9267-3a11d4d4d6be",
"value": "Sliver - S0633"
},
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
{
"description": "[RawDisk](https://attack.mitre.org/software/S0364) is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local computer's hard drive. In some cases, the tool can enact these raw disk modifications from user-mode processes, circumventing Windows operating system security features.(Citation: EldoS RawDisk ITpro)(Citation: Novetta Blockbuster Destructive Malware)",
"meta": {
"external_id": "S0364",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0364",
"https://www.itprotoday.com/windows-78/eldos-provides-raw-disk-access-vista-and-xp",
"https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"
],
"synonyms": [
"RawDisk"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "fb640c43-aa6b-431e-a961-a279010424ac",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "3ffbdc1f-d2bf-41ab-91a2-c7b857e98079",
"value": "RawDisk - S0364"
},
{
"description": "[LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. [LaZagne](https://attack.mitre.org/software/S0349) is publicly available on GitHub.(Citation: GitHub LaZagne Dec 2018)",
"meta": {
"external_id": "S0349",
"mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0349",
"https://github.com/AlessandroZ/LaZagne"
],
"synonyms": [
"LaZagne"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1eaebf46-e361-4437-bc23-d5d65a3b92e3",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "3120b9fa-23b8-4500-ae73-09494f607b7d",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4",
chg: [attack] update to latest ATT&CK data
2019-10-25 08:12:22 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [att&ck] bump to latest ATT&CK version from MITRE
2021-04-29 16:12:36 +00:00
},
{
"dest-uuid": "d336b553-5da9-46ca-98a8-0b23f49fb447",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
}
],
"uuid": "b76b2d94-60e4-4107-a903-4a3a7622fb3b",
"value": "LaZagne - S0349"
},
{
"description": "[Impacket](https://attack.mitre.org/software/S0357) is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. [Impacket](https://attack.mitre.org/software/S0357) contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.(Citation: Impacket Tools)",
"meta": {
"external_id": "S0357",
"mitre_platforms": [
"Linux",
"macOS",
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0357",
"https://www.secureauth.com/labs/open-source-tools/impacket"
],
"synonyms": [
"Impacket"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "26c87906-d750-42c5-946c-d4162c73fc7b",
"value": "Impacket - S0357"
},
{
"description": "[Ruler](https://attack.mitre.org/software/S0358) is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of [Ruler](https://attack.mitre.org/software/S0358) have also released a defensive tool, NotRuler, to detect its usage.(Citation: SensePost Ruler GitHub)(Citation: SensePost NotRuler)",
"meta": {
"external_id": "S0358",
"mitre_platforms": [
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"Windows",
"Office 365"
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
],
"refs": [
"https://attack.mitre.org/software/S0358",
"https://github.com/sensepost/ruler",
"https://github.com/sensepost/notruler"
],
"synonyms": [
"Ruler"
]
},
"related": [
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "bf147104-abf9-4221-95d1-e81585859441",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3d1b9d7e-3921-4d25-845a-7d9f15c0da44",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
"dest-uuid": "a9e2cea0-c805-4bf8-9e31-f5f0513a3634",
chg: [ATT&CK] updated to the latest version
2019-04-30 17:07:57 +00:00
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "90ac9266-68ce-46f2-b24f-5eb3b2a8ea38",
"value": "Ruler - S0358"
},
{
"description": "[Nltest](https://attack.mitre.org/software/S0359) is a Windows command-line utility used to list domain controllers and enumerate domain trusts.(Citation: Nltest Manual)",
"meta": {
"external_id": "S0359",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0359",
"https://ss64.com/nt/nltest.html"
],
"synonyms": [
"Nltest"
]
},
"related": [
{
"dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "981acc4c-2ede-4b56-be6e-fa1a75f37acf",
"value": "Nltest - S0359"
new: [att&ck] support for subtechniques
2020-10-18 18:00:48 +00:00
},
{
"description": "[ShimRatReporter](https://attack.mitre.org/software/S0445) is a tool used by suspected Chinese adversary [Mofang](https://attack.mitre.org/groups/G0103) to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as [ShimRat](https://attack.mitre.org/software/S0444)) as well as set up faux infrastructure which mimics the adversary's targets. [ShimRatReporter](https://attack.mitre.org/software/S0445) has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.(Citation: FOX-IT May 2016 Mofang)",
"meta": {
"external_id": "S0445",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0445",
"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
],
"synonyms": [
"ShimRatReporter"
]
},
"related": [
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "774a3188-6ba9-4dc4-879d-d54ee48a5ce9",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "115f88dd-0618-4389-83cb-98d33ae81848",
"value": "ShimRatReporter - S0445"
},
{
"description": "[CARROTBALL](https://attack.mitre.org/software/S0465) is an FTP downloader utility that has been in use since at least 2019. [CARROTBALL](https://attack.mitre.org/software/S0465) has been used as a downloader to install [SYSCON](https://attack.mitre.org/software/S0464).(Citation: Unit 42 CARROTBAT January 2020)",
"meta": {
"external_id": "S0465",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0465",
"https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"
],
"synonyms": [
"CARROTBALL"
]
},
"related": [
{
"dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "5fc81b43-62b5-41b1-9113-c79ae5f030c4",
"value": "CARROTBALL - S0465"
chg: [att&ck] update to latest MITRE ATT&CK version
2020-11-25 06:45:48 +00:00
},
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
{
"description": "[Wevtutil](https://attack.mitre.org/software/S0645) is a Windows command-line utility that enables administrators to retrieve information about event logs and publishers.(Citation: Wevtutil Microsoft Documentation)",
"meta": {
"external_id": "S0645",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0645",
"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"
],
"synonyms": [
"Wevtutil"
]
},
"related": [
{
"dest-uuid": "4eb28bed-d11a-4641-9863-c2ac017d910a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "f91162cc-1686-4ff8-8115-bf3f61a4cc7a",
"value": "Wevtutil - S0645"
},
chg: [att&ck] update to latest MITRE ATT&CK version
2020-11-25 06:45:48 +00:00
{
"description": "[CrackMapExec](https://attack.mitre.org/software/S0488), or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. [CrackMapExec](https://attack.mitre.org/software/S0488) collects Active Directory information to conduct lateral movement through targeted networks.(Citation: CME Github September 2018)",
"meta": {
"external_id": "S0488",
"mitre_platforms": [
"Windows"
],
"refs": [
"https://attack.mitre.org/software/S0488",
"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"
],
"synonyms": [
"CrackMapExec"
]
},
"related": [
{
"dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "c4810609-7da6-48ec-8057-1b70a7814db0",
"value": "CrackMapExec - S0488"
jq
2017-10-26 08:28:53 +00:00
}
],
chg: [att&ck] update to ATT&CK v10
2021-10-22 12:34:25 +00:00
"version": 21
fix: Make validate all happy
2019-03-20 11:58:18 +00:00
}
Reference in a new issue Copy permalink