mirror of https://github.com/MISP/misp-galaxy
chg: [att&ck] July ATT&CK release included in MISP galaxy
parent
aa7c6d0a22
commit
17452d31a7
|
|
@ -775,7 +775,7 @@
|
|||
"meta": {
|
||||
"external_id": "T1452",
|
||||
"kill_chain": [
|
||||
"mitre-mobile-attack:effects"
|
||||
"mitre-mobile-attack:impact"
|
||||
],
|
||||
"mitre_platforms": [
|
||||
"Android",
|
||||
|
|
@ -2072,7 +2072,7 @@
|
|||
"meta": {
|
||||
"external_id": "APP-28",
|
||||
"kill_chain": [
|
||||
"mitre-mobile-attack:effects"
|
||||
"mitre-mobile-attack:impact"
|
||||
],
|
||||
"mitre_platforms": [
|
||||
"Android",
|
||||
|
|
@ -3648,7 +3648,7 @@
|
|||
"meta": {
|
||||
"external_id": "T1472",
|
||||
"kill_chain": [
|
||||
"mitre-mobile-attack:effects"
|
||||
"mitre-mobile-attack:impact"
|
||||
],
|
||||
"mitre_platforms": [
|
||||
"Android",
|
||||
|
|
@ -3825,7 +3825,7 @@
|
|||
"meta": {
|
||||
"external_id": "T1448",
|
||||
"kill_chain": [
|
||||
"mitre-mobile-attack:effects"
|
||||
"mitre-mobile-attack:impact"
|
||||
],
|
||||
"mitre_platforms": [
|
||||
"Android"
|
||||
|
|
@ -7096,7 +7096,7 @@
|
|||
"meta": {
|
||||
"external_id": "T1447",
|
||||
"kill_chain": [
|
||||
"mitre-mobile-attack:effects"
|
||||
"mitre-mobile-attack:impact"
|
||||
],
|
||||
"mitre_platforms": [
|
||||
"Android"
|
||||
|
|
@ -9731,7 +9731,7 @@
|
|||
"meta": {
|
||||
"external_id": "APP-28",
|
||||
"kill_chain": [
|
||||
"mitre-mobile-attack:effects"
|
||||
"mitre-mobile-attack:impact"
|
||||
],
|
||||
"mitre_platforms": [
|
||||
"Android"
|
||||
|
|
@ -10263,7 +10263,7 @@
|
|||
"value": "Repackaged Application - T1444"
|
||||
},
|
||||
{
|
||||
"description": "Adversaries may destroy data data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)",
|
||||
"description": "Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as <code>del</code> and <code>rm</code> often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1488) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1487) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.\n\nAdversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018) In some cases politically oriented image files have been used to overwrite data.(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)\n\nTo maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [Credential Dumping](https://attack.mitre.org/techniques/T1003), and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077).(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Talos Olympic Destroyer 2018)",
|
||||
"meta": {
|
||||
"external_id": "T1485",
|
||||
"kill_chain": [
|
||||
|
|
@ -10637,7 +10637,7 @@
|
|||
"value": "Masquerading - T1036"
|
||||
},
|
||||
{
|
||||
"description": "Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and PowerShell but could also be in the form of command-line batch scripts.\n\nScripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.\n\nMany popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. (Citation: Metasploit) (Citation: Metasploit), (Citation: Veil) (Citation: Veil), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)",
|
||||
"description": "Adversaries may use scripts to aid in operations and perform multiple actions that would otherwise be manual. Scripting is useful for speeding up operational tasks and reducing the time required to gain access to critical resources. Some scripting languages may be used to bypass process monitoring mechanisms by directly interacting with the operating system at an API level instead of calling other programs. Common scripting languages for Windows include VBScript and PowerShell but could also be in the form of command-line batch scripts.\n\nScripts can be embedded inside Office documents as macros that can be set to execute when files used in [Spearphishing Attachment](https://attack.mitre.org/techniques/T1193) and other types of spearphishing are opened. Malicious embedded macros are an alternative means of execution than software exploitation through [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), where adversaries will rely on macros being allowed or that the user will accept to activate them.\n\nMany popular offensive frameworks exist which use forms of scripting for security testers and adversaries alike. Metasploit (Citation: Metasploit_Ref), Veil (Citation: Veil_Ref), and PowerSploit (Citation: Powersploit) are three examples that are popular among penetration testers for exploit and post-compromise operations and include many features for evading defenses. Some adversaries are known to use PowerShell. (Citation: Alperovitch 2014)",
|
||||
"meta": {
|
||||
"external_id": "T1064",
|
||||
"kill_chain": [
|
||||
|
|
@ -11083,5 +11083,5 @@
|
|||
"value": "DNSCalc - T1324"
|
||||
}
|
||||
],
|
||||
"version": 9
|
||||
"version": 10
|
||||
}
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -3672,5 +3672,5 @@
|
|||
"value": "Security Software Discovery Mitigation - T1063"
|
||||
}
|
||||
],
|
||||
"version": 7
|
||||
"version": 8
|
||||
}
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -1670,5 +1670,5 @@
|
|||
"value": "Malicious Software Development Tools - MOB-T1065"
|
||||
}
|
||||
],
|
||||
"version": 5
|
||||
"version": 6
|
||||
}
|
||||
|
|
|
|||
|
|
@ -274,6 +274,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "2204c371-6100-4ae0-82f3-25c07c29772a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "649f7268-4c12-483b-ac84-4b7bca9fe2ee",
|
||||
|
|
@ -304,5 +311,5 @@
|
|||
"value": "Encrypt Network Traffic - MOB-M1009"
|
||||
}
|
||||
],
|
||||
"version": 6
|
||||
"version": 7
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1117,5 +1117,5 @@
|
|||
"value": "XcodeGhost - MOB-S0013"
|
||||
}
|
||||
],
|
||||
"version": 8
|
||||
"version": 9
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2785,5 +2785,5 @@
|
|||
"value": "Data Hiding - PRE-T1097"
|
||||
}
|
||||
],
|
||||
"version": 6
|
||||
"version": 7
|
||||
}
|
||||
|
|
|
|||
|
|
@ -222,6 +222,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "c47f937f-1022-4f42-8525-e7a4779a14cb",
|
||||
|
|
@ -369,5 +376,5 @@
|
|||
"value": "APT17 - G0025"
|
||||
}
|
||||
],
|
||||
"version": 8
|
||||
"version": 9
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2493,8 +2493,8 @@
|
|||
"refs": [
|
||||
"https://attack.mitre.org/software/S0262",
|
||||
"https://github.com/quasar/QuasarRAT",
|
||||
"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf",
|
||||
"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"
|
||||
"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/",
|
||||
"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
|
||||
],
|
||||
"synonyms": [
|
||||
"QuasarRAT",
|
||||
|
|
@ -3724,5 +3724,5 @@
|
|||
"value": "Nltest - S0359"
|
||||
}
|
||||
],
|
||||
"version": 13
|
||||
"version": 15
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue