mirror of https://github.com/MISP/misp-galaxy
chg: [attack] update to latest ATT&CK data
Christophe Vandeplas
parent
1581827875
commit
4ab9bbbfa3
File diff suppressed because one or more lines are too long
|
|
@ -246,6 +246,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d376668f-b208-42de-b1f5-fdfe0ad4b753",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "eb88d97c-32f1-40be-80f0-d61a4b0b4b31",
|
||||
|
|
@ -895,6 +902,20 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "723e3a2b-ca0d-4daa-ada8-82ea35d3733a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "3298ce88-1628-43b1-87d9-0b5336b193d7",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "987988f0-cf86-4680-a875-2f6456ab2448",
|
||||
|
|
@ -1612,26 +1633,6 @@
|
|||
"uuid": "82c21600-ccb6-4232-8c04-ef3792b56628",
|
||||
"value": "Endpoint Denial of Service Mitigation - T1499"
|
||||
},
|
||||
{
|
||||
"description": "Application developers should use device-provided credential storage mechanisms such as Android's KeyStore or iOS's KeyChain. These can prevent credentials from being exposed to an adversary.",
|
||||
"meta": {
|
||||
"external_id": "M1008",
|
||||
"refs": [
|
||||
"https://attack.mitre.org/mitigations/M1008"
|
||||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "d2a199d2-dfea-4d0c-987d-6195ed17be9c",
|
||||
"value": "Use Device-Provided Credential Storage - M1008"
|
||||
},
|
||||
{
|
||||
"description": "Application isolation and least privilege help lesson the impact of an exploit. Application isolation will limit what other processes and system features the exploited target can access, and least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system. Web Application Firewalls may be used to limit exposure of applications.\n\nSegment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.\n\nUse secure coding best practices when designing custom software that is meant for deployment to externally facing systems. Avoid issues documented by OWASP, CWE, and other software weakness identification efforts.\n\nRegularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.",
|
||||
"meta": {
|
||||
|
|
@ -1991,6 +1992,41 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e399430e-30b7-48c5-b70a-f44dc8c175cb",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "c4b96c0b-cb58-497a-a1c2-bb447d79d692",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "0beabf44-e8d8-4ae4-9122-ef56369a2564",
|
||||
|
|
@ -3509,6 +3545,20 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "27960489-4e7f-461d-a62a-f5c0cb521e4a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "21da4fd4-27ad-4e9c-b93d-0b9b14d02c96",
|
||||
|
|
@ -4157,6 +4207,27 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "39dd7871-f59b-495f-a9a5-3cb8cc50c9b2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "25dc1ce8-eb55-4333-ae30-a7cb4f5894a1",
|
||||
|
|
@ -4479,6 +4550,20 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "27960489-4e7f-461d-a62a-f5c0cb521e4a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "3298ce88-1628-43b1-87d9-0b5336b193d7",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "feff9142-e8c2-46f4-842b-bd6fb3d41157",
|
||||
|
|
@ -4898,6 +4983,41 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "3298ce88-1628-43b1-87d9-0b5336b193d7",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d4bdbdea-eaec-4071-b4f9-5105e12ea4b6",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e49920b0-6c54-40c1-9571-73723653205f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "93e7968a-9074-4eac-8ae9-9f5200ec3317",
|
||||
|
|
@ -5492,6 +5612,20 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4fd8a28b-4b3a-4cd6-a8cf-85ba5f824a7f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "9bb9e696-bff8-4ae1-9454-961fc7d91d5f",
|
||||
|
|
@ -5945,7 +6079,7 @@
|
|||
"value": "Account Use Policies - M1036"
|
||||
},
|
||||
{
|
||||
"description": "Use network appliances to filter ingress or egress traffic and perform protocol-based filtering.",
|
||||
"description": "Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.",
|
||||
"meta": {
|
||||
"external_id": "M1037",
|
||||
"refs": [
|
||||
|
|
@ -6029,6 +6163,34 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "1c2fd73a-e634-44ed-b1b5-9e7cf7404e9f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d4bdbdea-eaec-4071-b4f9-5105e12ea4b6",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "3298ce88-1628-43b1-87d9-0b5336b193d7",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "20f6a9df-37c4-4e20-9e47-025983b1b39d",
|
||||
|
|
@ -7402,6 +7564,27 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "3298ce88-1628-43b1-87d9-0b5336b193d7",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "b045d015-6bed-4490-bd38-56b41ece59a0",
|
||||
|
|
@ -8053,6 +8236,55 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "948a447c-d783-4ba0-8516-a64140fcacd5",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d1f1337e-aea7-454c-86bd-482a98ffaf62",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "786f488c-cb1f-4602-89c5-86d982ee326b",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e399430e-30b7-48c5-b70a-f44dc8c175cb",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "1553b156-6767-47f7-9eb4-2a692505666d",
|
||||
|
|
@ -8219,6 +8451,20 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d1f1337e-aea7-454c-86bd-482a98ffaf62",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "653492e3-27be-4a0e-b08c-938dd2b7e0e1",
|
||||
|
|
@ -8274,6 +8520,41 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d1f1337e-aea7-454c-86bd-482a98ffaf62",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "39dd7871-f59b-495f-a9a5-3cb8cc50c9b2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "649f7268-4c12-483b-ac84-4b7bca9fe2ee",
|
||||
|
|
@ -8631,6 +8912,20 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a",
|
||||
|
|
@ -8831,6 +9126,20 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d4bdbdea-eaec-4071-b4f9-5105e12ea4b6",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "90c218c3-fbf8-4830-98a7-e8cfb7eaa485",
|
||||
|
|
@ -9162,6 +9471,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "101c3a64-9ba5-46c9-b573-5c501053cbca",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "47e0e9fe-96ce-4f65-8bb1-8be1feacb5db",
|
||||
|
|
@ -9203,6 +9519,34 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "723e3a2b-ca0d-4daa-ada8-82ea35d3733a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "59bd0dec-f8b2-4b9a-9141-37a1e6899761",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "10ffac09-e42d-4f56-ab20-db94c67d76ff",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "c5e31fb5-fcbd-48a4-af8c-5a6ed5b932e5",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "b5dbb4c5-b0b1-40b1-80b6-e9e84ab90067",
|
||||
|
|
@ -9265,6 +9609,27 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "723e3a2b-ca0d-4daa-ada8-82ea35d3733a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4fd8a28b-4b3a-4cd6-a8cf-85ba5f824a7f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "590777b3-b475-4c7c-aaf8-f4a73b140312",
|
||||
|
|
@ -9813,11 +10178,60 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "27960489-4e7f-461d-a62a-f5c0cb521e4a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4fd8a28b-4b3a-4cd6-a8cf-85ba5f824a7f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "3298ce88-1628-43b1-87d9-0b5336b193d7",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "mitigates"
|
||||
}
|
||||
],
|
||||
"uuid": "cc2399fd-3cd3-4319-8d0a-fbd6420cdaf8",
|
||||
"value": "Audit - M1047"
|
||||
}
|
||||
],
|
||||
"version": 14
|
||||
"version": 15
|
||||
}
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -361,6 +361,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "9ddc2534-e91c-4dab-a8f6-43dab81e8142",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "aafea02e-ece5-4bb2-91a6-3bf8c7f38a39",
|
||||
|
|
@ -1031,6 +1038,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "64764dc6-a032-495f-8250-1e4c06bdc163",
|
||||
|
|
@ -1338,6 +1352,196 @@
|
|||
"uuid": "03342581-f790-4f03-ba41-e82e67392e23",
|
||||
"value": "Net - S0039"
|
||||
},
|
||||
{
|
||||
"description": "[esentutl](https://attack.mitre.org/software/S0404) is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.(Citation: Microsoft Esentutl)",
|
||||
"meta": {
|
||||
"external_id": "S0404",
|
||||
"mitre_platforms": [
|
||||
"Windows"
|
||||
],
|
||||
"refs": [
|
||||
"https://attack.mitre.org/software/S0404",
|
||||
"https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh875546(v=ws.11)"
|
||||
],
|
||||
"synonyms": [
|
||||
"esentutl",
|
||||
"esentutl.exe"
|
||||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "f2d44246-91f1-478a-b6c8-1227e0ca109d",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "c256da91-6dd5-40b2-beeb-ee3b22ab3d27",
|
||||
"value": "esentutl - S0404"
|
||||
},
|
||||
{
|
||||
"description": "[FlexiSpy](https://attack.mitre.org/software/S0408) is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version.(Citation: FortiGuard-FlexiSpy)(Citation: CyberMerchants-FlexiSpy)\n\n[FlexiSpy](https://attack.mitre.org/software/S0408) markets itself as a parental control and employee monitoring application.(Citation: FlexiSpy-Website)",
|
||||
"meta": {
|
||||
"external_id": "S0408",
|
||||
"mitre_platforms": [
|
||||
"Android"
|
||||
],
|
||||
"refs": [
|
||||
"https://attack.mitre.org/software/S0408",
|
||||
"https://d3gpjj9d20n0p3.cloudfront.net/fortiguard/research/Dig%20Deep%20into%20FlexiSpy%20for%20Android%28white%20paper%29_KaiLu.pdf",
|
||||
"http://www.cybermerchantsofdeath.com/blog/2017/04/22/FlexiSpy.html",
|
||||
"https://www.flexispy.com/"
|
||||
],
|
||||
"synonyms": [
|
||||
"FlexiSpy"
|
||||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "948a447c-d783-4ba0-8516-a64140fcacd5",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "62adb627-f647-498e-b4cc-41499361bacb",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e4c347e9-fb91-4bc5-83b8-391e389131e2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "1622fd3d-fcfc-4d02-ac49-f2d786f79b81",
|
||||
"value": "FlexiSpy - S0408"
|
||||
},
|
||||
{
|
||||
"description": "[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg)\n\nUtilities such as [Reg](https://attack.mitre.org/software/S0075) are known to be used by persistent threats. (Citation: Windows Commands JPCERT)",
|
||||
"meta": {
|
||||
|
|
@ -1993,6 +2197,49 @@
|
|||
"uuid": "cb69b20d-56d0-41ab-8440-4a4b251614d4",
|
||||
"value": "Pupy - S0192"
|
||||
},
|
||||
{
|
||||
"description": "MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.(Citation: GitHub MailSniper)",
|
||||
"meta": {
|
||||
"external_id": "S0413",
|
||||
"mitre_platforms": [
|
||||
"Office 365",
|
||||
"Windows",
|
||||
"Azure AD"
|
||||
],
|
||||
"refs": [
|
||||
"https://attack.mitre.org/software/S0413",
|
||||
"https://github.com/dafthack/MailSniper"
|
||||
],
|
||||
"synonyms": [
|
||||
"MailSniper"
|
||||
]
|
||||
},
|
||||
"related": [
|
||||
{
|
||||
"dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "999c4e6e-b8dc-4b4f-8d6e-1b829f29997e",
|
||||
"value": "MailSniper - S0413"
|
||||
},
|
||||
{
|
||||
"description": "[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)",
|
||||
"meta": {
|
||||
|
|
@ -2599,6 +2846,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "da04ac30-27da-4959-a67d-450ce47d9470",
|
||||
|
|
@ -2776,7 +3030,7 @@
|
|||
],
|
||||
"refs": [
|
||||
"https://attack.mitre.org/software/S0378",
|
||||
"https://github.com/nettitude/PoshC2"
|
||||
"https://github.com/nettitude/PoshC2_Python"
|
||||
],
|
||||
"synonyms": [
|
||||
"PoshC2"
|
||||
|
|
@ -3500,6 +3754,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3",
|
||||
|
|
@ -3578,6 +3839,13 @@
|
|||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
},
|
||||
{
|
||||
"dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f",
|
||||
"tags": [
|
||||
"estimative-language:likelihood-probability=\"almost-certain\""
|
||||
],
|
||||
"type": "uses"
|
||||
}
|
||||
],
|
||||
"uuid": "b76b2d94-60e4-4107-a903-4a3a7622fb3b",
|
||||
|
|
@ -3724,5 +3992,5 @@
|
|||
"value": "Nltest - S0359"
|
||||
}
|
||||
],
|
||||
"version": 15
|
||||
"version": 16
|
||||
}
|
||||
|
|
|
|||
|
|
@ -18,35 +18,29 @@ types = ['attack-pattern', 'course-of-action', 'intrusion-set', 'malware', 'tool
|
|||
all_data = {} # variable that will contain everything
|
||||
|
||||
# read in existing data
|
||||
# THIS IS FOR MIGRATION - reading the data from the enterprise-attack, mobile-attack, pre-attack
|
||||
# first build a data set of the MISP Galaxy ATT&CK elements by using the UUID as reference, this speeds up lookups later on.
|
||||
# at the end we will convert everything again to separate datasets
|
||||
all_data_uuid = {}
|
||||
for domain in domains:
|
||||
for t in types:
|
||||
fname = os.path.join(misp_dir, 'clusters', 'mitre-{}-{}.json'.format(domain, t))
|
||||
if os.path.exists(fname):
|
||||
# print("##### {}".format(fname))
|
||||
with open(fname) as f:
|
||||
file_data = json.load(f)
|
||||
# print(file_data)
|
||||
for value in file_data['values']:
|
||||
if value['uuid'] in all_data_uuid:
|
||||
# exit("ERROR: Something is really wrong, we seem to have duplicates.")
|
||||
# if it already exists we need to copy over all the data manually to merge it
|
||||
# on the other hand, from a manual analysis it looks like it's mostly the relations that are different
|
||||
# so now we will just copy over the relationships
|
||||
# actually, at time of writing the code below results in no change as the new items always contained more than the previously seen items
|
||||
value_orig = all_data_uuid[value['uuid']]
|
||||
if 'related' in value_orig:
|
||||
for related_item in value_orig['related']:
|
||||
if related_item not in value['related']:
|
||||
value['related'].append(related_item)
|
||||
all_data_uuid[value['uuid']] = value
|
||||
|
||||
# THIS IS FOR NORMAL OPERATIONS - reading from the very old and new models - one model per type
|
||||
# FIXME implement this (copy paste above or put above in function and call function)
|
||||
|
||||
for t in types:
|
||||
fname = os.path.join(misp_dir, 'clusters', 'mitre-{}.json'.format(t))
|
||||
if os.path.exists(fname):
|
||||
# print("##### {}".format(fname))
|
||||
with open(fname) as f:
|
||||
file_data = json.load(f)
|
||||
# print(file_data)
|
||||
for value in file_data['values']:
|
||||
if value['uuid'] in all_data_uuid:
|
||||
# exit("ERROR: Something is really wrong, we seem to have duplicates.")
|
||||
# if it already exists we need to copy over all the data manually to merge it
|
||||
# on the other hand, from a manual analysis it looks like it's mostly the relations that are different
|
||||
# so now we will just copy over the relationships
|
||||
# actually, at time of writing the code below results in no change as the new items always contained more than the previously seen items
|
||||
value_orig = all_data_uuid[value['uuid']]
|
||||
if 'related' in value_orig:
|
||||
for related_item in value_orig['related']:
|
||||
if related_item not in value['related']:
|
||||
value['related'].append(related_item)
|
||||
all_data_uuid[value['uuid']] = value
|
||||
|
||||
# now load the MITRE ATT&CK
|
||||
for domain in domains:
|
||||
|
|
@ -136,6 +130,7 @@ for domain in domains:
|
|||
|
||||
# LATER find the opposite word of "rel_type" and build the relation in the opposite direction
|
||||
|
||||
|
||||
# dump all_data to their respective file
|
||||
for t in types:
|
||||
fname = os.path.join(misp_dir, 'clusters', 'mitre-{}.json'.format(t))
|
||||
|
|
@ -147,7 +142,7 @@ for t in types:
|
|||
file_data['values'] = []
|
||||
for item in all_data_uuid.values():
|
||||
# print(json.dumps(item, sort_keys=True, indent=2))
|
||||
if item['type'] != t:
|
||||
if 'type' not in item or item['type'] != t: # drop old data or not from the right type
|
||||
continue
|
||||
item_2 = item.copy()
|
||||
item_2.pop('type', None)
|
||||
|
|
|
|||
Loading…
Reference in New Issue