Merge https://github.com/MISP/misp-galaxy

README.md

@@ -47,7 +47,7 @@ Category: *atrm* - source: *https://github.com/microsoft/Azure-Threat-Research-M
 
 [attck4fraud](https://www.misp-project.org/galaxy.html#_attck4fraud) - attck4fraud - Principles of MITRE ATT&CK in the fraud domain
 
-Category: *guidelines* - source: *Open Sources* - total: *31* elements
+Category: *guidelines* - source: *Open Sources* - total: *71* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_attck4fraud)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/attck4fraud.json)]
 
@@ -55,7 +55,7 @@ Category: *guidelines* - source: *Open Sources* - total: *31* elements
 
 [Backdoor](https://www.misp-project.org/galaxy.html#_backdoor) - A list of backdoor malware.
 
-Category: *tool* - source: *Open Sources* - total: *14* elements
+Category: *tool* - source: *Open Sources* - total: *16* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_backdoor)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/backdoor.json)]
 
@@ -159,7 +159,7 @@ Category: *first-dns* - source: *https://www.first.org/global/sigs/dns/* - total
 
 [Malpedia](https://www.misp-project.org/galaxy.html#_malpedia) - Malware galaxy cluster based on Malpedia.
 
-Category: *tool* - source: *Malpedia* - total: *2574* elements
+Category: *tool* - source: *Malpedia* - total: *2823* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_malpedia)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/malpedia.json)]
 
@@ -183,7 +183,7 @@ Category: *misinformation-pattern* - source: *https://github.com/misinfosecproje
 
 [Attack Pattern](https://www.misp-project.org/galaxy.html#_attack_pattern) - ATT&CK tactic
 
-Category: *attack-pattern* - source: *https://github.com/mitre/cti* - total: *1086* elements
+Category: *attack-pattern* - source: *https://github.com/mitre/cti* - total: *1099* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_attack_pattern)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/mitre-attack-pattern.json)]
 
@@ -287,7 +287,7 @@ Category: *attack-pattern* - source: *https://collaborate.mitre.org/attackics/in
 
 [Intrusion Set](https://www.misp-project.org/galaxy.html#_intrusion_set) - Name of ATT&CK Group
 
-Category: *actor* - source: *https://github.com/mitre/cti* - total: *148* elements
+Category: *actor* - source: *https://github.com/mitre/cti* - total: *151* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_intrusion_set)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/mitre-intrusion-set.json)]
 
@@ -295,7 +295,7 @@ Category: *actor* - source: *https://github.com/mitre/cti* - total: *148* elemen
 
 [Malware](https://www.misp-project.org/galaxy.html#_malware) - Name of ATT&CK software
 
-Category: *tool* - source: *https://github.com/mitre/cti* - total: *633* elements
+Category: *tool* - source: *https://github.com/mitre/cti* - total: *653* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_malware)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/mitre-malware.json)]
 
@@ -359,7 +359,7 @@ Category: *actor* - source: *https://github.com/mitre/cti* - total: *7* elements
 
 [Tool](https://www.misp-project.org/galaxy.html#_tool) - Name of ATT&CK software
 
-Category: *tool* - source: *https://github.com/mitre/cti* - total: *82* elements
+Category: *tool* - source: *https://github.com/mitre/cti* - total: *84* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_tool)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/mitre-tool.json)]
 
@@ -431,7 +431,7 @@ Category: *sector* - source: *CERT-EU* - total: *117* elements
 
 [Sigma-Rules](https://www.misp-project.org/galaxy.html#_sigma-rules) - MISP galaxy cluster based on Sigma Rules.
 
-Category: *rules* - source: *https://github.com/jstnk9/MISP/tree/main/misp-galaxy/sigma* - total: *2703* elements
+Category: *rules* - source: *https://github.com/jstnk9/MISP/tree/main/misp-galaxy/sigma* - total: *2568* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_sigma-rules)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/sigma-rules.json)]
 
@@ -495,7 +495,7 @@ Category: *tea-matrix* - source: ** - total: *7* elements
 
 [Threat Actor](https://www.misp-project.org/galaxy.html#_threat_actor) - Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign. threat-actor-classification meta can be used to clarify the understanding of the threat-actor if also considered as operation, campaign or activity group.
 
-Category: *actor* - source: *MISP Project* - total: *419* elements
+Category: *actor* - source: *MISP Project* - total: *420* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_threat_actor)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/threat-actor.json)]
 
@@ -503,7 +503,7 @@ Category: *actor* - source: *MISP Project* - total: *419* elements
 
 [Tool](https://www.misp-project.org/galaxy.html#_tool) - threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.
 
-Category: *tool* - source: *MISP Project* - total: *552* elements
+Category: *tool* - source: *MISP Project* - total: *557* elements
 
 [[HTML](https://www.misp-project.org/galaxy.html#_tool)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/tool.json)]
 
@@ -515,6 +515,7 @@ Category: *military equipment* - source: *Popular Mechanics* - total: *36* eleme
 
 [[HTML](https://www.misp-project.org/galaxy.html#_uavs/ucavs)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/uavs.json)]
 
+
 # Online documentation 
 
 A [readable PDF overview of the MISP galaxy is available](https://www.misp.software/galaxy.pdf) or [HTML](https://www.misp.software/galaxy.html) and generated from the JSON.
@@ -532,12 +533,12 @@ The MISP galaxy (JSON files) are dual-licensed under:
 or
 
 ~~~~
- Copyright (c) 2015-2022 Alexandre Dulaunoy - a@foo.be
+ Copyright (c) 2015-2023 Alexandre Dulaunoy - a@foo.be
- Copyright (c) 2015-2022 CIRCL - Computer Incident Response Center Luxembourg
+ Copyright (c) 2015-2023 CIRCL - Computer Incident Response Center Luxembourg
- Copyright (c) 2015-2022 Andras Iklody
+ Copyright (c) 2015-2023 Andras Iklody
- Copyright (c) 2015-2022 Raphael Vinot
+ Copyright (c) 2015-2023 Raphael Vinot
- Copyright (c) 2015-2022 Deborah Servili
+ Copyright (c) 2015-2023 Deborah Servili
- Copyright (c) 2016-2022 Various contributors to MISP Project
+ Copyright (c) 2016-2023 Various contributors to MISP Project
 
  Redistribution and use in source and binary forms, with or without modification,
  are permitted provided that the following conditions are met:

clusters/attck4fraud.json

@@ -1,6 +1,7 @@
 {
   "authors": [
-    "Francesco Bigarella"
+    "Francesco Bigarella",
+    "Christophe Vandeplas"
   ],
   "category": "guidelines",
   "description": "attck4fraud - Principles of MITRE ATT&CK in the fraud domain",
@@ -24,7 +25,8 @@
         "mitigation": "Implementation of DKIM and SPF authentication to detected spoofed email senders; anti-phishing solutions.",
         "refs": [
           "https://blog.malwarebytes.com/cybercrime/2015/02/amazon-notice-ticket-number-phish-seeks-card-details/",
-          "https://www.bleepingcomputer.com/news/security/widespread-apple-id-phishing-attack-pretends-to-be-app-store-receipts/"
+          "https://www.bleepingcomputer.com/news/security/widespread-apple-id-phishing-attack-pretends-to-be-app-store-receipts/",
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
         ],
         "victim": "end customer, enterprise"
       },
@@ -46,7 +48,11 @@
         "mitigation": "Implementation of DKIM and SPF authentication to detected spoofed email senders; flagging email coming from outside the enterprise (enterprise); anti-phishing solutions; awareness training (enterprise).",
         "refs": [
           "http://fortune.com/2017/04/27/facebook-google-rimasauskas/",
-          "https://www.ibtimes.co.uk/russian-hackers-fancy-bear-likely-breached-olympic-drug-testing-agency-dnc-experts-say-1577508"
+          "https://www.ibtimes.co.uk/russian-hackers-fancy-bear-likely-breached-olympic-drug-testing-agency-dnc-experts-say-1577508",
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ],
+        "synonyms": [
+          "Spear-phishing"
         ],
         "victim": "end customer, enterprise"
       },
@@ -77,7 +83,11 @@
           "https://krebsonsecurity.com/2014/11/skimmer-innovation-wiretapping-atms/",
           "https://krebsonsecurity.com/2016/09/secret-service-warns-of-periscope-skimmers/",
           "https://krebsonsecurity.com/2011/03/green-skimmers-skimming-green",
-          "https://blog.dieboldnixdorf.com/have-you-asked-yourself-this-question-about-skimming/"
+          "https://blog.dieboldnixdorf.com/have-you-asked-yourself-this-question-about-skimming/",
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ],
+        "synonyms": [
+          "Skimming - CPP ATM"
         ],
         "victim": "end customer, enterprise"
       },
@@ -91,7 +101,11 @@
           "fraud-tactics:Initiation"
         ],
         "refs": [
-          "https://medium.com/@netsentries/beware-of-atm-cash-trapping-9421e498dfcf"
+          "https://medium.com/@netsentries/beware-of-atm-cash-trapping-9421e498dfcf",
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ],
+        "synonyms": [
+          "Cash Trapping"
         ]
       },
       "uuid": "1e709b6e-ff4a-4645-adec-42f9636d38f8",
@@ -122,20 +136,29 @@
       "value": "ATM Shimming"
     },
     {
-      "description": "Vishing",
+      "description": "Also known as voice phishing, is the criminal practice of using social engineering over the telephone system to gain access to private personal and financial information from the public for the purpose of financial reward. It is also employed by attackers for reconnaissance purposes to gather more detailed intelligence on a target organisation.",
       "meta": {
         "kill_chain": [
           "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
         ]
       },
       "uuid": "308fb88c-412a-4468-91ed-468d07fe4170",
       "value": "Vishing"
     },
     {
-      "description": "POS Skimming",
+      "description": "CPP analysis identifies the likely merchant, POS or ATM location from where card numbers were stolen so that banks can mitigate fraud on other compromised cards.",
       "meta": {
         "kill_chain": [
           "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ],
+        "synonyms": [
+          "Skimming - CPP POS"
         ]
       },
       "uuid": "c33778e5-b5cc-4d12-8e4e-a329156d988c",
@@ -152,10 +175,13 @@
       "value": "Social Media Scams"
     },
     {
-      "description": "Malware",
+      "description": "Software which is specifically designed to disrupt, damage, or gain authorised access to a computer system.",
       "meta": {
         "kill_chain": [
           "fraud-tactics:Target Compromise"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
         ]
       },
       "uuid": "6ee0f7cd-a0ef-46c5-9d80-f0fbac2a9140",
@@ -172,10 +198,16 @@
       "value": "Account-Checking Services"
     },
     {
-      "description": "ATM Black Box Attack",
+      "description": "Type of Jackpotting attack. Connection of an unauthorized device which sends dispense commands directly to the ATM cash dispenser in order to “cash out” the ATM.",
       "meta": {
         "kill_chain": [
           "fraud-tactics:Target Compromise"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ],
+        "synonyms": [
+          "Black Box Attack"
         ]
       },
       "uuid": "6bec22cb-9aed-426a-bffc-b0a78db6527a",
@@ -192,20 +224,29 @@
       "value": "Insider Trading"
     },
     {
-      "description": "Investment Fraud",
+      "description": "A deceptive practice in the stock or commodities markets that induces investors to make purchase or sale decisions on the basis of false information, frequently resulting in losses, in violation of securities laws.",
       "meta": {
         "kill_chain": [
           "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
         ]
       },
       "uuid": "92f5f46f-c506-45de-9a7f-f1128e40d47c",
       "value": "Investment Fraud"
     },
     {
-      "description": "Romance Scam",
+      "description": "Romance scam is a confidence trick involving feigning romantic intentions towards a victim, gaining their affection, and then using that goodwill to commit fraud. Fraudulent acts may involve access to the victim's money, bank accounts, credit cards, passports, e-mail accounts, or national identification numbers; or forcing the victims to commit financial fraud on their behalf.",
       "meta": {
         "kill_chain": [
           "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ],
+        "synonyms": [
+          "Romance Fraud"
         ]
       },
       "uuid": "8ac64815-52c0-4d14-a4e4-4a19b2a6057d",
@@ -232,10 +273,16 @@
       "value": "Cash Recovery Scam"
     },
     {
-      "description": "Fake Invoice Fraud",
+      "description": "Invoice fraud happens when a company or organisation is tricked into changing bank account payee details for a payment. Criminals pose as regular suppliers to the company or organisation and will make a formal request for bank account details to be changed or emit false invoices.",
       "meta": {
         "kill_chain": [
           "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ],
+        "synonyms": [
+          "Invoice Fraud"
         ]
       },
       "uuid": "a0f764d1-b541-4ee7-bb30-21b9a735f644",
@@ -272,20 +319,32 @@
       "value": "CxO Fraud"
     },
     {
-      "description": "Compromised Payment Cards",
+      "description": "The loss of or theft of a card, which is subsequently used for illegal purposes until blocked by the card issuer.",
       "meta": {
         "kill_chain": [
           "fraud-tactics:Obtain Fraudulent Assets"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ],
+        "synonyms": [
+          "Lost/Stolen Card"
         ]
       },
       "uuid": "d46e397f-8957-41f1-8736-13400b9e82fc",
       "value": "Compromised Payment Cards"
     },
     {
-      "description": "Compromised Account Credentials",
+      "description": "Account takeover fraud is a form of identity theft in which the fraudster gets access to a victim's bank or credit card accounts -- through a data breach, malware or phishing -- and uses them to make unauthorised transaction.",
       "meta": {
         "kill_chain": [
           "fraud-tactics:Obtain Fraudulent Assets"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ],
+        "synonyms": [
+          "Account Takeover Fraud"
         ]
       },
       "uuid": "7d71e71c-502f-412a-8fc7-584de8a9d203",
@@ -391,7 +450,514 @@
       },
       "uuid": "9bfd2f4f-39a7-43fe-b5cd-a345a065276d",
       "value": "ATM Explosive Attack"
+    },
+    {
+      "description": "A card not present transaction (CNP, MO/TO, Mail Order / Telephone Order, MOTOEC) is a payment card transaction made where the cardholder does not or cannot physically present the card for a merchant's visual examination at the time that an order is given and payment effected",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "a13829f4-be4b-5ada-8be4-3515b080cf6c",
+      "value": "CNP – Card Not Present"
+    },
+    {
+      "description": "A card present transaction occurs when a cardholder physically presents a card to request and authorise a financial transaction",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "422f283a-19e0-56da-b348-98b5d31fcea6",
+      "value": "CP – Card Present"
+    },
+    {
+      "description": "Fraud that occurs when a merchant account is used without the intention of operating a legitimate business transaction.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "ccd0dcc5-5f86-52fb-8e72-7aa6e8f55f8a",
+      "value": "Merchant Fraud"
+    },
+    {
+      "description": "Fraud that involves virtual currency, or virtual money, which is a type of unregulated, digital money, issued and usually controlled by its developers and used and accepted among the members of a specific virtual community.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Monetisation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "69273dd2-cc8d-5a83-9544-1b6f6a8f8a53",
+      "value": "Virtual Currency Fraud"
+    },
+    {
+      "description": "A category of criminal acts that involve making the unlawful use of cheques in order to illegally acquire or borrow funds that do not exist within the account balance or account-holder's legal ownership. Most methods involve taking advantage the time between the negotiation of the cheque and its clearance at the cheque writer's financial institution to draw out these funds.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Monetisation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "b70d490e-7eef-5219-ab93-4ea085bf9361",
+      "value": "Cheque Fraud"
+    },
+    {
+      "description": "Fraud perpetrated via omni- channel means to digital banking or payments channels such as home banking or other electronic services.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "39de6438-4c1f-5bdc-b9a8-5cc3e889eaaf",
+      "value": "Digital Fraud"
+    },
+    {
+      "description": "Fraud perpetrated via mobile devices to digital banking, payments channels such as home banking or other electronic services, or online merchants",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "147b0d04-933c-5244-8c67-33914426d47b",
+      "value": "Mobile Fraud"
+    },
+    {
+      "description": "Fraud perpetrated via land line telephone means to banking or payments channels such as home banking or other electronic services or merchants",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "5e28b366-d9f0-5079-b796-3fa424ec365a",
+      "value": "Telephone Fraud"
+    },
+    {
+      "description": "Fraud occurs when a standing order is falsely created or adulterated. A standing order is an automated method of making payments, where a person or business instructs their bank to pay another person or business, a fixed amount of money at regular intervals. Fraud occurs when a standing order is falsely created or adulterated.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Assets Transfer"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "86e2f55d-cf76-5be8-9cf3-7bfa24d0ea2a",
+      "value": "Standing Order Fraud"
+    },
+    {
+      "description": "A scam in which cybercriminals spoof company email accounts and impersonate executives to try and fool an employee in accounting or HR into executing unauthorized wire transfers, or sending out confidential information",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "55a413e3-5eba-5eac-a36b-575bdb2e7cd7",
+      "value": "CEO/BEC Fraud"
+    },
+    {
+      "description": "An illegal process of concealing the origins of money obtained illegally by passing it through a complex sequence of banking transfers or commercial transactions. The overall scheme of this process returns the money to the launderer in an obscure and indirect way.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Monetisation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "d0492296-9ba7-59ad-a510-f8a0526c114a",
+      "value": "Money laundering"
+    },
+    {
+      "description": "Credit cards are produced in BIN ranges. Where an issuer does not use random generation of the card number, it is possible for an attacker to obtain one good card number and generate valid card numbers",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "37ff3b85-80f5-5380-8ce0-defee3ba819f",
+      "value": "BIN Attack"
+    },
+    {
+      "description": "In computing, a denial-of-service attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "7ca098c2-9f6e-56be-8b32-7f36833803ee",
+      "value": "DoS - Denial of Service Attack"
+    },
+    {
+      "description": "In cryptography and computer security, a man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "bcd23dee-c9da-548d-9d74-2ed7d71133be",
+      "value": "MITM - Man-in-the-Middle Attack"
+    },
+    {
+      "description": "Unauthorized physical manipulation of ATM cash withdrawal. Appears that cash has not been dispensed – a reversal message generated – SEE FULL TERMINAL FRAUD DEFINITION",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Target Compromise"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "2ac0d577-7de1-5cbd-bf8a-30b79cd7f6cc",
+      "value": "Transaction Reversal Fraud"
+    },
+    {
+      "description": "The data contained in an authorisation message is manipulated to try to fool the payment processor.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Target Compromise"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "fb5b4715-5e6b-5134-a99a-b154b8f2cb84",
+      "value": "Transaction Message Adulteration"
+    },
+    {
+      "description": "Fraud committed against a financial institution by one of its own customers",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Obtain Fraudulent Assets"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "09ac2614-d332-51b4-b7b0-ce3f9a74539b",
+      "value": "First Party (Friendly) Fraud"
+    },
+    {
+      "description": "Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an adversary may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the apparent identity",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Obtain Fraudulent Assets"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "b105c344-448c-5d70-bb64-31f0f1246389",
+      "value": "Identity Spoofing (or entity hacking)"
+    },
+    {
+      "description": "A form of fraud in which victims are manipulated into making real-time payments to fraudsters, typically by social engineering attacks involving impersonation.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Assets Transfer"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "b36f88c8-3682-5cac-b89d-33f64f91fc94",
+      "value": "Authorised Push Payment Fraud"
+    },
+    {
+      "description": "Direct debit fraud can take place in several ways.  It is often associated with identity theft, where the scammer gains access to the bank account information by posing as the victim. They can pay for services and products via a direct debit option and use this account until its owner notices.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Assets Transfer"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "def44822-3b24-5612-b6a2-da77f84fb5d9",
+      "value": "Direct Debit Fraud"
+    },
+    {
+      "description": "Obtaining benefit through coercion",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Perform Fraud"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "e376947a-2e73-5c81-b8d5-7ac8a3ecc7a1",
+      "value": "Extortion"
+    },
+    {
+      "description": "Also known as \"SMS Phishing\", is a form of criminal activity using social engineering techniques. SMS phishing uses cell phone text messages to deliver information and/or requests to induce people to divulge or to take action that will compromise their personal or confidential information.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "7607cd1c-c237-55c8-8dc6-d552ca28b86f",
+      "value": "Smishing"
+    },
+    {
+      "description": "Technique used to obtain information such as personal identification numbers (PINs), passwords and other confidential data by looking over the victim's shoulder",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "7304230c-a2ba-5f85-915b-21ef2df62c0a",
+      "value": "Shoulder Surfing"
+    },
+    {
+      "description": "The process of diverting the attention of an individual or group from a desired area of focus and thereby blocking or diminishing the reception of desired information.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "cd4a2731-b691-5c91-a608-cf6c431be0ba",
+      "value": "Distraction"
+    },
+    {
+      "description": "Authorised push payment fraud happens when fraudsters deceive consumers or individuals at a business to send them a payment under false pretences to a bank account controlled by the fraudster. As payments made using real-time payment schemes are irrevocable, the victims cannot reverse a payment once they realise they have been conned.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "056a1cf1-0c75-59cc-9d73-f3b5b70ab77e",
+      "value": "Push Payments"
+    },
+    {
+      "description": "Unauthorised software, or authorises software run in an unauthorized manner on ATM PC - SEE FULL TERMINAL FRAUD DEFINITION",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "956593f4-ff08-523f-995a-6b8c56c101be",
+      "value": "ATM Malware"
+    },
+    {
+      "description": "A data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used from a PC or Computer Network by an entity unauthorised to do so.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "65c6719e-9daf-578a-8d86-0f65b3054e75",
+      "value": "Data Breach"
+    },
+    {
+      "description": "A type of malicious software designed to block access to a computer system until a sum of money is paid",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "73e1bbdc-1b73-5b84-9f6c-6d13c491bb47",
+      "value": "Ransomware"
+    },
+    {
+      "description": "A website that is not a legitimate venue, the site is designed to entice the visitor into revealing sensitive information, to download some form of malware or to purchase products that never arrive",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "d86ff26f-b9c3-5668-8eef-7a178b6fe158",
+      "value": "Fake Website"
+    },
+    {
+      "description": "Apps in mobile devices that trick users into downloading them. They may also pose as quirky and attractive apps, providing interesting services. Once installed on a mobile device, fake apps can perform a variety of malicious routines.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "8dba8e97-7af4-5e76-8dde-3be54c9e8a6c",
+      "value": "Fake App"
+    },
+    {
+      "description": "Cyber criminals introduce skimming code on e-commerce payment card processing web pages to capture credit card and personally identifiable information and send the stolen data to a domain under their control.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "7f5886b8-06a2-51cc-8428-5cb67615e3b2",
+      "value": "e-Skimming"
+    },
+    {
+      "description": "CPP analysis identifies Payment Terminal parking, transport, fuel, etc. locations, from where card numbers were stolen so that banks can mitigate fraud on other compromised cards.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "e89436a5-1b58-5676-a34d-d654c59a7d32",
+      "value": "Skimming - CPP UPT"
+    },
+    {
+      "description": "Same as e-Skimming",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "80165f05-1c1d-5f41-96b6-464ac065b052",
+      "value": "Skimming - CPP Virtual Terminal"
+    },
+    {
+      "description": "Unauthorized physical ATM manipulation, preventing card from being returned to customer - SEE FULL TERMINAL FRAUD DEFINITION",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Initiation"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "493b35ed-9415-5de5-a5cb-298f169cc4f4",
+      "value": "Card Trapping"
+    },
+    {
+      "description": "Patch management is the best practice of upgrading existing software applications to remove any weak security patches that could be exploited by hackers. Lack of proper patching allows cyber criminals to exploit systems and networks.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Due Diligence"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "0e7a4057-d84b-5451-9006-5a5efe9e948a",
+      "value": "Lack of Patching / Security"
+    },
+    {
+      "description": "Process where an information system is deployed into a Production Environed with faults, errors or vulnerabilities",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Due Diligence"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "b132c566-7656-5b2b-b157-5734c9e30cc8",
+      "value": "Bad implementation"
+    },
+    {
+      "description": "Implementation of a system, solution or service not according to defined and tested best practices.",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Due Diligence"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "dd09e952-7992-5a37-a9c4-ed978d89a939",
+      "value": "Deployment Error"
+    },
+    {
+      "description": "Merchants not following best practice procedures to avoid criminal or fraudulent activity,",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Due Diligence"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "39a06139-ece8-5d8c-947e-cf0b4dbdccf6",
+      "value": "Merchant Negligence"
+    },
+    {
+      "description": "Implementation of a sstem, solution or service not according to defined and tested standards",
+      "meta": {
+        "kill_chain": [
+          "fraud-tactics:Due Diligence"
+        ],
+        "refs": [
+          "https://www.association-secure-transactions.eu/industry-information/fraud-definitions/"
+        ]
+      },
+      "uuid": "a52f8c2e-4a38-5b1b-a4b0-4710606cd86f",
+      "value": "Implementation not according to Standards"
     }
   ],
-  "version": 4
+  "version": 6
 }

clusters/mitre-tool.json

@@ -37,6 +37,262 @@
       "uuid": "242f3da3-4425-4d11-8f5c-b842886da966",
       "value": "Windows Credential Editor - S0005"
     },
+    {
+      "description": "[Brute Ratel C4](https://attack.mitre.org/software/S1063) is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. [Brute Ratel C4](https://attack.mitre.org/software/S1063) was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities, and deploys agents called badgers to enable arbitrary command execution for lateral movement, privilege escalation, and persistence. In September 2022, a cracked version of [Brute Ratel C4](https://attack.mitre.org/software/S1063) was leaked in the cybercriminal underground, leading to its use by threat actors.(Citation: Dark Vortex Brute Ratel C4)(Citation: Palo Alto Brute Ratel July 2022)(Citation: MDSec Brute Ratel August 2022)(Citation: SANS Brute Ratel October 2022)(Citation: Trend Micro Black Basta October 2022)",
+      "meta": {
+        "external_id": "S1063",
+        "mitre_platforms": [
+          "Windows"
+        ],
+        "refs": [
+          "https://attack.mitre.org/software/S1063",
+          "https://bruteratel.com/",
+          "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/",
+          "https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/",
+          "https://www.sans.org/blog/cracked-brute-ratel-c4-framework-proliferates-across-the-cybercriminal-underground/",
+          "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"
+        ],
+        "synonyms": [
+          "Brute Ratel C4",
+          "BRc4"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "208884f1-7b83-4473-ac22-4e1cf6c41471",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "74d2a63f-3c7b-4852-92da-02d8fbab16da",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "ea4c2f9c-9df1-477c-8c42-6da1118f2ac4",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        }
+      ],
+      "uuid": "75d8b521-6b6a-42ff-8af3-d97e20ce12a5",
+      "value": "Brute Ratel C4 - S1063"
+    },
     {
       "description": "[Pass-The-Hash Toolkit](https://attack.mitre.org/software/S0122) is a toolkit that allows an adversary to \"pass\" a password hash (without knowing the original password) to log in to systems. (Citation: Mandiant APT1)",
       "meta": {
@@ -1117,6 +1373,13 @@
           ],
           "type": "uses"
         },
+        {
+          "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
         {
           "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
           "tags": [
@@ -1211,6 +1474,13 @@
         ]
       },
       "related": [
+        {
+          "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
         {
           "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
           "tags": [
@@ -2292,6 +2562,64 @@
       "uuid": "102c3898-85e0-43ee-ae28-62a0a3ed9507",
       "value": "UACMe - S0116"
     },
+    {
+      "description": "[Rubeus](https://attack.mitre.org/software/S1071) is a C# toolset designed for raw Kerberos interaction that has been used since at least 2020, including in ransomware operations.(Citation: GitHub Rubeus March 2023)(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: DFIR Ryuk's Return October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)",
+      "meta": {
+        "external_id": "S1071",
+        "mitre_platforms": [
+          "Windows"
+        ],
+        "refs": [
+          "https://attack.mitre.org/software/S1071",
+          "https://github.com/GhostPack/Rubeus",
+          "https://thedfirreport.com/2020/10/08/ryuks-return/",
+          "https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/",
+          "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
+        ],
+        "synonyms": [
+          "Rubeus"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "3986e7fd-a8e9-4ecb-bfc6-55920855912b",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        }
+      ],
+      "uuid": "e33267fe-099f-4af2-8730-63d49f8813b2",
+      "value": "Rubeus - S1071"
+    },
     {
       "description": "[Cachedump](https://attack.mitre.org/software/S0119) is a publicly-available tool that program extracts cached password hashes from a system’s registry. (Citation: Mandiant APT1)",
       "meta": {
@@ -3003,6 +3331,9 @@
         "refs": [
           "https://attack.mitre.org/software/S0174",
           "https://github.com/SpiderLabs/Responder"
+        ],
+        "synonyms": [
+          "Responder"
         ]
       },
       "related": [
@@ -3189,13 +3520,6 @@
           ],
           "type": "uses"
         },
-        {
-          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "uses"
-        },
         {
           "dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b",
           "tags": [
@@ -3211,14 +3535,14 @@
           "type": "uses"
         },
         {
-          "dest-uuid": "c4ad009b-6e13-4419-8d21-918a1652de02",
+          "dest-uuid": "d336b553-5da9-46ca-98a8-0b23f49fb447",
           "tags": [
             "estimative-language:likelihood-probability=\"almost-certain\""
           ],
           "type": "uses"
         },
         {
-          "dest-uuid": "d336b553-5da9-46ca-98a8-0b23f49fb447",
+          "dest-uuid": "d511a6f6-4a33-41d5-bc95-c343875d1377",
           "tags": [
             "estimative-language:likelihood-probability=\"almost-certain\""
           ],
@@ -3728,8 +4052,8 @@
         "refs": [
           "https://attack.mitre.org/software/S0332",
           "https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html",
-          "https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html",
+          "https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/",
-          "https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"
+          "https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"
         ],
         "synonyms": [
           "Remcos"
@@ -5009,13 +5333,6 @@
           ],
           "type": "uses"
         },
-        {
-          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
-          "tags": [
-            "estimative-language:likelihood-probability=\"almost-certain\""
-          ],
-          "type": "uses"
-        },
         {
           "dest-uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023",
           "tags": [
@@ -5079,6 +5396,13 @@
           ],
           "type": "uses"
         },
+        {
+          "dest-uuid": "d511a6f6-4a33-41d5-bc95-c343875d1377",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
         {
           "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
           "tags": [
@@ -6393,6 +6717,13 @@
           ],
           "type": "uses"
         },
+        {
+          "dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
         {
           "dest-uuid": "b4409cd8-0da9-46e1-a401-a241afd4d1cc",
           "tags": [
@@ -6407,6 +6738,13 @@
           ],
           "type": "uses"
         },
+        {
+          "dest-uuid": "d94b3ae9-8059-4989-8e9f-ea0f601f80a7",
+          "tags": [
+            "estimative-language:likelihood-probability=\"almost-certain\""
+          ],
+          "type": "uses"
+        },
         {
           "dest-uuid": "e24fcba8-2557-4442-a139-1ee2f2e784db",
           "tags": [
@@ -6542,5 +6880,5 @@
       "value": "Mythic - S0699"
     }
   ],
-  "version": 27
+  "version": 28
 }

clusters/threat-actor.json

@@ -5235,14 +5235,16 @@
           "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/",
           "https://attack.mitre.org/groups/G0086/",
           "https://us-cert.cisa.gov/ncas/alerts/aa20-301a",
-          "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
+          "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite",
+          "https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report"
         ],
         "synonyms": [
           "Velvet Chollima",
           "Black Banshee",
           "Thallium",
           "Operation Stolen Pencil",
-          "G0086"
+          "G0086",
+          "APT43"
         ]
       },
       "related": [

galaxies/attck4fraud.json

@@ -8,12 +8,13 @@
       "Perform Fraud",
       "Obtain Fraudulent Assets",
       "Assets Transfer",
-      "Monetisation"
+      "Monetisation",
+      "Due Diligence"
     ]
   },
   "name": "attck4fraud",
   "namespace": "misp",
   "type": "financial-fraud",
   "uuid": "cc0c8ae9-aec2-42c6-9939-f4f82b051836",
-  "version": 1
+  "version": 2
 }

tools/gen_360net.py

@@ -40,7 +40,7 @@ for actor in list_data['data']['list']:
         refs = []
     for ref in actor['recommends']:
         refs.append(ref['url'])
-    refs = list(set(refs))
+    refs = sorted(list(set(refs)))
     cluster = {
         'value': f"{actor['name']} - {actor['code']}",
         'description': actor['description'],
@@ -67,9 +67,9 @@ json_galaxy = {
     'uuid': "20de4abf-f000-48ec-a929-3cdc5c2f3c23",
     'version': 1
 }
+
 with open(os.path.join('..', 'clusters', '360net.json'), 'r') as f:
     json_cluster = json.load(f)
-
 json_cluster['values'] = clusters
 json_cluster['version'] += 1
 

tools/gen_east_fraud.py

@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+#
+#    A simple convertor of the E.A.S.T. Fraud definitions to a MISP Galaxy datastructure.
+#    https://www.association-secure-transactions.eu/industry-information/fraud-definitions/
+#    Copyright (c) 2023 MISP Project
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as
+#    published by the Free Software Foundation, either version 3 of the
+#    License, or (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from bs4 import BeautifulSoup
+import json
+import requests
+import string
+import uuid
+import os
+
+url = 'https://www.association-secure-transactions.eu/industry-information/fraud-definitions/'
+
+try:
+    response = requests.get(url, timeout=3)
+except Exception:
+    exit("ERROR: Could not download the webpage. Are you sure you have internet connectivity?")
+
+with open(os.path.join('..', 'galaxies', 'attck4fraud.json'), 'r') as f:
+    tactics_options = json.load(f)['kill_chain_order']['fraud-tactics']
+
+with open(os.path.join('..', 'clusters', 'attck4fraud.json'), 'r') as f:
+    json_data = json.load(f)
+# build value/synonym based mapping to UUID allowing us to lookup what exists
+mapping = {}
+for cluster in json_data['values']:
+    mapping[cluster['value'].lower()] = cluster['uuid']
+    try:
+        for synonym in cluster['meta']['synonyms']:
+            mapping[synonym.lower()] = cluster['uuid']
+    except KeyError:
+        pass
+
+changed = False
+soup = BeautifulSoup(response.content, 'lxml')
+entry_content = soup.find('div', class_='entry-content')
+t_first = entry_content.find('table')
+p_start = t_first.find_previous_sibling()
+for child in entry_content.children:
+    if 'p' == child.name and child.find('strong'):
+        # new category
+        category = string.capwords(child.text)
+    elif 'table' == child.name:
+        # new sub-category with entries to parse
+        sub_category = string.capwords(child.find('th').text.split('\n')[0])
+        # print(f'{category} - {sub_category}')
+        for tr in child.find_all('tr'):
+            try:
+                k, v = tr.find_all('td')
+            except ValueError:
+                continue  # skip header row
+            value = k.text.strip()
+            description = v.text.strip()
+            # check by value or synonym if cluster is already known, and skip known
+            existing_uuid = mapping.get(value.lower())
+            if existing_uuid:
+                print(f'{category} # {sub_category} # {value} is already known as {existing_uuid}')
+                continue
+            # prompt as for a new cluster meta kill_chain is not known
+            print('Found new record:')
+            print(f'  {category} # {sub_category} # {value} # {description}')
+            while True:
+                tactic = input(f'What is the right fraud-tactic? options are {tactics_options}\n> ')
+                if tactic.strip() in tactics_options:
+                    tactic = tactic.strip()
+                    break
+                elif any(option.startswith(tactic.strip()) for option in tactics_options):
+                    for option in tactics_options:
+                        if option.startswith(tactic.strip()):
+                            tactic = option
+                            print(f'Chosen: {tactic}')
+                            found = True
+                            break
+                    break
+                else:
+                    print("Given option is not in the list. Please input again.")
+
+            cluster = {
+                'value': value,
+                'description': description,
+                'uuid': str(uuid.uuid5(uuid.UUID("9319371e-2504-4128-8410-3741cebbcfd3"), value)),
+                'meta': {
+                    'refs': ['https://www.association-secure-transactions.eu/industry-information/fraud-definitions/'],
+                    'kill_chain': [f'fraud-tactics:{tactic}'],
+                }
+            }
+            json_data['values'].append(cluster)
+            changed = True
+
+if changed:
+    json_data['version'] += 1
+    with open(os.path.join('..', 'clusters', 'attck4fraud.json'), 'w') as f:
+        json.dump(json_data, f, indent=2, sort_keys=True, ensure_ascii=False)
+        f.write('\n')
+
+print("All done, please don't forget to ./jq_all_the_things.sh, commit, and then ./validate_all.sh.")

validate_all.sh

@@ -85,5 +85,7 @@ do
   echo ''
 done
 
-# check for empyt strings in clusters
+# check for empty strings in clusters
 python3 -m tools.chk_empty_strings
+
+echo "If you see this message, all is probably well."