MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

chg: [cmtmf-attack-pattern] various fixes to make JSON ok

pull/671/head
Alexandre Dulaunoy 2021-12-17 16:08:07 +01:00
parent 7b587710b1
commit ae7b7bd47d
No known key found for this signature in database
GPG Key ID: 09E2CD4944E6CBCD
2 changed files with 105 additions and 132 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

208
clusters/cmtmf-attack-pattern.json
View File

@ -1,7 +1,7 @@
{ {
"authors": [ "authors": [
"Bernardo Santos, OsloMet (Norway)", "Bernardo Santos, OsloMet (Norway)",
"Prof. Dr. Thanh van Do, Telenor Research (Norway)" , "Prof. Dr. Thanh van Do, Telenor Research (Norway)",
"Luis Barriga, Ericsson AB (Sweden)", "Luis Barriga, Ericsson AB (Sweden)",
"Prof. Boning Feng, OsloMet (Norway)", "Prof. Boning Feng, OsloMet (Norway)",
"Van Thuan Do, Wolffia AS (Norway)", "Van Thuan Do, Wolffia AS (Norway)",
@ -21,7 +21,7 @@
"external_id": "T0001", "external_id": "T0001",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:reconnaissance" "cmtmf-attack:reconnaissance"
], ]
}, },
"uuid": "92ac46f5-4356-427a-8863-2de3f974713f", "uuid": "92ac46f5-4356-427a-8863-2de3f974713f",
"value": "Active Scanning" "value": "Active Scanning"
@ -32,7 +32,7 @@
"external_id": "T0002", "external_id": "T0002",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:reconnaissance" "cmtmf-attack:reconnaissance"
], ]
}, },
"uuid": "dd601586-1102-4084-80ad-a6776d8e46b0", "uuid": "dd601586-1102-4084-80ad-a6776d8e46b0",
"value": "Gather UE Identity Information" "value": "Gather UE Identity Information"
@ -43,7 +43,7 @@
"external_id": "T0003", "external_id": "T0003",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:reconnaissance" "cmtmf-attack:reconnaissance"
], ]
}, },
"uuid": "f43b9606-aa17-4c51-a26c-6bdba0440e4a", "uuid": "f43b9606-aa17-4c51-a26c-6bdba0440e4a",
"value": "Gather UE Network Information" "value": "Gather UE Network Information"
@ -54,7 +54,7 @@
"external_id": "T0004", "external_id": "T0004",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:reconnaissance" "cmtmf-attack:reconnaissance"
], ]
}, },
"uuid": "668a9ba5-9bd2-4e51-ad7d-0846d992723b", "uuid": "668a9ba5-9bd2-4e51-ad7d-0846d992723b",
"value": "Phishing for Information" "value": "Phishing for Information"
@ -65,7 +65,7 @@
"external_id": "T0005", "external_id": "T0005",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:reconnaissance" "cmtmf-attack:reconnaissance"
], ]
}, },
"uuid": "d0140441-ebe0-4508-8572-ab91aa237980", "uuid": "d0140441-ebe0-4508-8572-ab91aa237980",
"value": "Social Media Reports" "value": "Social Media Reports"
@ -76,7 +76,7 @@
"external_id": "T0006", "external_id": "T0006",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:resource-development" "cmtmf-attack:resource-development"
], ]
}, },
"uuid": "a0224c49-b049-40eb-8012-e723c76aa841", "uuid": "a0224c49-b049-40eb-8012-e723c76aa841",
"value": "Develop Capabilities" "value": "Develop Capabilities"
@ -87,7 +87,7 @@
"external_id": "T0007", "external_id": "T0007",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:resource-development" "cmtmf-attack:resource-development"
], ]
}, },
"uuid": "37fc2d12-0e65-4e6c-a55f-0a24f818c6cb", "uuid": "37fc2d12-0e65-4e6c-a55f-0a24f818c6cb",
"value": "Obtain Capabilities" "value": "Obtain Capabilities"
@ -98,7 +98,7 @@
"external_id": "T0008", "external_id": "T0008",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:resource-development" "cmtmf-attack:resource-development"
], ]
}, },
"uuid": "71f1f231-f14b-417d-aa5b-dd0bcb76eefb", "uuid": "71f1f231-f14b-417d-aa5b-dd0bcb76eefb",
"value": "Stage Capabilities" "value": "Stage Capabilities"
@ -109,7 +109,7 @@
"external_id": "T0009", "external_id": "T0009",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:resource-development" "cmtmf-attack:resource-development"
], ]
}, },
"uuid": "eb793a3a-ca08-43ea-bf56-da4d06d5f273", "uuid": "eb793a3a-ca08-43ea-bf56-da4d06d5f273",
"value": "Compromise Accounts" "value": "Compromise Accounts"
@ -120,10 +120,10 @@
"external_id": "T0010", "external_id": "T0010",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:resource-development" "cmtmf-attack:resource-development"
], ]
}, },
"uuid": "51060d01-ef29-40ab-8965-8031d0941811", "uuid": "51060d01-ef29-40ab-8965-8031d0941811",
"value": "Aquire Infrastructure" "value": "Acquire Infrastructure"
}, },
{ {
"description": "TBD", "description": "TBD",
@ -131,7 +131,7 @@
"external_id": "T0011", "external_id": "T0011",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:resource-development" "cmtmf-attack:resource-development"
], ]
}, },
"uuid": "53e344f4-fa6c-4d42-9c65-1ffe1e093120", "uuid": "53e344f4-fa6c-4d42-9c65-1ffe1e093120",
"value": "Compromise Infrastructure" "value": "Compromise Infrastructure"
@ -142,7 +142,7 @@
"external_id": "T0012", "external_id": "T0012",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "92ac46f5-4356-427a-8863-2de3f974713f", "uuid": "92ac46f5-4356-427a-8863-2de3f974713f",
"value": "Exploit Public-Facing Application" "value": "Exploit Public-Facing Application"
@ -153,7 +153,7 @@
"external_id": "T0013", "external_id": "T0013",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "dd601586-1102-4084-80ad-a6776d8e46b0", "uuid": "dd601586-1102-4084-80ad-a6776d8e46b0",
"value": "Malicious App from App Store" "value": "Malicious App from App Store"
@ -164,7 +164,7 @@
"external_id": "T0014", "external_id": "T0014",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "f43b9606-aa17-4c51-a26c-6bdba0440e4a", "uuid": "f43b9606-aa17-4c51-a26c-6bdba0440e4a",
"value": "Malicious App from Third Party" "value": "Malicious App from Third Party"
@ -175,7 +175,7 @@
"external_id": "T0015", "external_id": "T0015",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "668a9ba5-9bd2-4e51-ad7d-0846d992723b", "uuid": "668a9ba5-9bd2-4e51-ad7d-0846d992723b",
"value": "Install Insecure or Malicious Configuration" "value": "Install Insecure or Malicious Configuration"
@ -186,7 +186,7 @@
"external_id": "T0016", "external_id": "T0016",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "d0140441-ebe0-4508-8572-ab91aa237980", "uuid": "d0140441-ebe0-4508-8572-ab91aa237980",
"value": "Masquerade as Legitimate Application" "value": "Masquerade as Legitimate Application"
@ -197,7 +197,7 @@
"external_id": "T0017", "external_id": "T0017",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "a0224c49-b049-40eb-8012-e723c76aa841", "uuid": "a0224c49-b049-40eb-8012-e723c76aa841",
"value": "Exploit via Charging Station or PC" "value": "Exploit via Charging Station or PC"
@ -208,7 +208,7 @@
"external_id": "T0018", "external_id": "T0018",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "37fc2d12-0e65-4e6c-a55f-0a24f818c6cb", "uuid": "37fc2d12-0e65-4e6c-a55f-0a24f818c6cb",
"value": "Exploit via Radio Interfaces" "value": "Exploit via Radio Interfaces"
@ -219,7 +219,7 @@
"external_id": "T0019", "external_id": "T0019",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "71f1f231-f14b-417d-aa5b-dd0bcb76eefb", "uuid": "71f1f231-f14b-417d-aa5b-dd0bcb76eefb",
"value": "Rogue Cellular Base Station" "value": "Rogue Cellular Base Station"
@ -230,7 +230,7 @@
"external_id": "T0020", "external_id": "T0020",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "eb793a3a-ca08-43ea-bf56-da4d06d5f273", "uuid": "eb793a3a-ca08-43ea-bf56-da4d06d5f273",
"value": "Insider attacks and human errors" "value": "Insider attacks and human errors"
@ -241,7 +241,7 @@
"external_id": "T0021", "external_id": "T0021",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "2781ceb6-fff9-4e0e-8e58-4c970911f87a", "uuid": "2781ceb6-fff9-4e0e-8e58-4c970911f87a",
"value": "Trusted Relationship" "value": "Trusted Relationship"
@ -252,7 +252,7 @@
"external_id": "T0022", "external_id": "T0022",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:initial-access" "cmtmf-attack:initial-access"
], ]
}, },
"uuid": "fa6f94a8-d5f9-462a-883c-f5e4317a54dd", "uuid": "fa6f94a8-d5f9-462a-883c-f5e4317a54dd",
"value": "Supply Chain Compromise" "value": "Supply Chain Compromise"
@ -263,7 +263,7 @@
"external_id": "T0023", "external_id": "T0023",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:execution" "cmtmf-attack:execution"
], ]
}, },
"uuid": "870e8141-ad9a-435e-bf10-835d96348973", "uuid": "870e8141-ad9a-435e-bf10-835d96348973",
"value": "Native Code" "value": "Native Code"
@ -274,7 +274,7 @@
"external_id": "T0024", "external_id": "T0024",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:execution" "cmtmf-attack:execution"
], ]
}, },
"uuid": "7ac81844-d442-4d93-b922-59a44ca79454", "uuid": "7ac81844-d442-4d93-b922-59a44ca79454",
"value": "Scheduled Task/Job" "value": "Scheduled Task/Job"
@ -285,7 +285,7 @@
"external_id": "T0025", "external_id": "T0025",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:execution" "cmtmf-attack:execution"
], ]
}, },
"uuid": "c1cffc56-217e-42cb-8330-49269dde8054", "uuid": "c1cffc56-217e-42cb-8330-49269dde8054",
"value": "Command-Line Interface" "value": "Command-Line Interface"
@ -296,7 +296,7 @@
"external_id": "T0026", "external_id": "T0026",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:execution" "cmtmf-attack:execution"
], ]
}, },
"uuid": "a47e9e97-87f9-450e-84f0-ca628a33d0ce", "uuid": "a47e9e97-87f9-450e-84f0-ca628a33d0ce",
"value": "Command and Scripting Interpreter" "value": "Command and Scripting Interpreter"
@ -307,7 +307,7 @@
"external_id": "T0027", "external_id": "T0027",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "3b3c1a0b-512c-44a7-93ea-1f64501acb4d", "uuid": "3b3c1a0b-512c-44a7-93ea-1f64501acb4d",
"value": "Boot or Logon Autostart Execution" "value": "Boot or Logon Autostart Execution"
@ -318,7 +318,7 @@
"external_id": "T0028", "external_id": "T0028",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "2cb0bb08-0ded-410d-b0de-baa5b6e65bf7", "uuid": "2cb0bb08-0ded-410d-b0de-baa5b6e65bf7",
"value": "Foreground Persistence" "value": "Foreground Persistence"
@ -329,7 +329,7 @@
"external_id": "T0029", "external_id": "T0029",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "8f908951-f95f-4c23-bda1-124030df1478", "uuid": "8f908951-f95f-4c23-bda1-124030df1478",
"value": "Modify Cached Executable Code" "value": "Modify Cached Executable Code"
@ -340,7 +340,7 @@
"external_id": "T0030", "external_id": "T0030",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "5dfc5ad7-ee6b-462b-ad51-4656c2f75003", "uuid": "5dfc5ad7-ee6b-462b-ad51-4656c2f75003",
"value": "Modify Trusted Execution Environment" "value": "Modify Trusted Execution Environment"
@ -351,7 +351,7 @@
"external_id": "T0031", "external_id": "T0031",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "387d2448-73de-4d17-a236-1264c7d4b4d5", "uuid": "387d2448-73de-4d17-a236-1264c7d4b4d5",
"value": "Schedule Task/Job" "value": "Schedule Task/Job"
@ -362,7 +362,7 @@
"external_id": "T0032", "external_id": "T0032",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "981fc4a0-f704-42d5-b938-e6d0428177d3", "uuid": "981fc4a0-f704-42d5-b938-e6d0428177d3",
"value": "Compromise Application Executable" "value": "Compromise Application Executable"
@ -373,7 +373,7 @@
"external_id": "T0033", "external_id": "T0033",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "ad487281-8e08-432e-ac8c-1012c1bd15e3", "uuid": "ad487281-8e08-432e-ac8c-1012c1bd15e3",
"value": "Modify OS Kernel or Boot Partition" "value": "Modify OS Kernel or Boot Partition"
@ -384,7 +384,7 @@
"external_id": "T0034", "external_id": "T0034",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "885fb448-33de-4223-b1ec-1c03a2e2f599", "uuid": "885fb448-33de-4223-b1ec-1c03a2e2f599",
"value": "Event Triggered Execution" "value": "Event Triggered Execution"
@ -395,7 +395,7 @@
"external_id": "T0035", "external_id": "T0035",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "de82ce3e-bbaf-4bbb-aa93-5a67d476c867", "uuid": "de82ce3e-bbaf-4bbb-aa93-5a67d476c867",
"value": "Spoofed radio network" "value": "Spoofed radio network"
@ -406,7 +406,7 @@
"external_id": "T0036", "external_id": "T0036",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:persistence" "cmtmf-attack:persistence"
], ]
}, },
"uuid": "e999a2f8-96cc-41b4-8199-66afc4e19919", "uuid": "e999a2f8-96cc-41b4-8199-66afc4e19919",
"value": "Infecting network nodes" "value": "Infecting network nodes"
@ -417,7 +417,7 @@
"external_id": "T0037", "external_id": "T0037",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:privilege-escalation" "cmtmf-attack:privilege-escalation"
], ]
}, },
"uuid": "7b487a20-faa0-441d-8e31-44d872d12b3d", "uuid": "7b487a20-faa0-441d-8e31-44d872d12b3d",
"value": "Code Injection" "value": "Code Injection"
@ -428,7 +428,7 @@
"external_id": "T0038", "external_id": "T0038",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:privilege-escalation" "cmtmf-attack:privilege-escalation"
], ]
}, },
"uuid": "5ce17e6a-44aa-415a-864e-c7b45409350e", "uuid": "5ce17e6a-44aa-415a-864e-c7b45409350e",
"value": "Process Injection" "value": "Process Injection"
@ -439,7 +439,7 @@
"external_id": "T0039", "external_id": "T0039",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:privilege-escalation" "cmtmf-attack:privilege-escalation"
], ]
}, },
"uuid": "ba7ec530-57d1-42ea-94ce-32922d3a82b8", "uuid": "ba7ec530-57d1-42ea-94ce-32922d3a82b8",
"value": "Schedule Task/Job" "value": "Schedule Task/Job"
@ -450,7 +450,7 @@
"external_id": "T0040", "external_id": "T0040",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "546cf539-733a-45d2-b112-297e920bdfe5", "uuid": "546cf539-733a-45d2-b112-297e920bdfe5",
"value": "Masquerading" "value": "Masquerading"
@ -461,7 +461,7 @@
"external_id": "T0041", "external_id": "T0041",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "59111ac3-8f51-4974-b72d-51ae64902b3d", "uuid": "59111ac3-8f51-4974-b72d-51ae64902b3d",
"value": "Disguise Root/Jailbreak Indicators" "value": "Disguise Root/Jailbreak Indicators"
@ -472,7 +472,7 @@
"external_id": "T0042", "external_id": "T0042",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "20b446a7-214f-4709-80d3-6c1426b57a00", "uuid": "20b446a7-214f-4709-80d3-6c1426b57a00",
"value": "Evade Analysis Environment" "value": "Evade Analysis Environment"
@ -483,7 +483,7 @@
"external_id": "T0043", "external_id": "T0043",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "2ce9d395-501f-4b7c-9106-14ac33c27765", "uuid": "2ce9d395-501f-4b7c-9106-14ac33c27765",
"value": "Modify Trusted Execution Environment" "value": "Modify Trusted Execution Environment"
@ -494,7 +494,7 @@
"external_id": "T0044", "external_id": "T0044",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "2e04955b-296a-43cd-8994-ccd7ae882230", "uuid": "2e04955b-296a-43cd-8994-ccd7ae882230",
"value": "Obfuscated Files or Information" "value": "Obfuscated Files or Information"
@ -505,7 +505,7 @@
"external_id": "T0045", "external_id": "T0045",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "9b6de21d-8583-4efd-bcbc-3aa66b9dbf68", "uuid": "9b6de21d-8583-4efd-bcbc-3aa66b9dbf68",
"value": "Suppress Application Icon" "value": "Suppress Application Icon"
@ -516,7 +516,7 @@
"external_id": "T0046", "external_id": "T0046",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "d166bb9a-63d0-4555-a571-eeaef97a39d1", "uuid": "d166bb9a-63d0-4555-a571-eeaef97a39d1",
"value": "Uninstall Malicious Application" "value": "Uninstall Malicious Application"
@ -527,7 +527,7 @@
"external_id": "T0047", "external_id": "T0047",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "173d8221-a5b4-4efa-b3aa-902c6e7b7ead", "uuid": "173d8221-a5b4-4efa-b3aa-902c6e7b7ead",
"value": "Install Insecure or Malicious Configuration" "value": "Install Insecure or Malicious Configuration"
@ -538,7 +538,7 @@
"external_id": "T0048", "external_id": "T0048",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "a0ffe349-849b-4c6e-9f4c-10eef819d124", "uuid": "a0ffe349-849b-4c6e-9f4c-10eef819d124",
"value": "Geofencing" "value": "Geofencing"
@ -549,7 +549,7 @@
"external_id": "T0049", "external_id": "T0049",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "8b204308-e643-4fdb-a337-92d372bd917a", "uuid": "8b204308-e643-4fdb-a337-92d372bd917a",
"value": "Shutdown Remote Device" "value": "Shutdown Remote Device"
@ -560,7 +560,7 @@
"external_id": "T0050", "external_id": "T0050",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "f301abc6-6590-4ab2-93ef-d8ca435179c4", "uuid": "f301abc6-6590-4ab2-93ef-d8ca435179c4",
"value": "Exploitation for Defense Evasion" "value": "Exploitation for Defense Evasion"
@ -571,7 +571,7 @@
"external_id": "T0051", "external_id": "T0051",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "cf685f28-fc43-4cf6-b91c-9dbcc42ddc02", "uuid": "cf685f28-fc43-4cf6-b91c-9dbcc42ddc02",
"value": "Security Audit Camouflage" "value": "Security Audit Camouflage"
@ -582,7 +582,7 @@
"external_id": "T0052", "external_id": "T0052",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "30e03f2f-ae68-436f-b677-e41457def8ac", "uuid": "30e03f2f-ae68-436f-b677-e41457def8ac",
"value": "Overload Avoidance" "value": "Overload Avoidance"
@ -593,7 +593,7 @@
"external_id": "T0053", "external_id": "T0053",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:defense-evasion" "cmtmf-attack:defense-evasion"
], ]
}, },
"uuid": "36d3aadd-48e6-49e3-89b7-894074179059", "uuid": "36d3aadd-48e6-49e3-89b7-894074179059",
"value": "Traffic Distribution" "value": "Traffic Distribution"
@ -604,7 +604,7 @@
"external_id": "T0054", "external_id": "T0054",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:credential-access" "cmtmf-attack:credential-access"
], ]
}, },
"uuid": "e26c80cd-6c94-4a17-bef6-272d5fdeec0d", "uuid": "e26c80cd-6c94-4a17-bef6-272d5fdeec0d",
"value": "URI Hijacking" "value": "URI Hijacking"
@ -615,7 +615,7 @@
"external_id": "T0055", "external_id": "T0055",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:credential-access" "cmtmf-attack:credential-access"
], ]
}, },
"uuid": "c32c2fb2-056d-4b4f-a44d-1728858f6aeb", "uuid": "c32c2fb2-056d-4b4f-a44d-1728858f6aeb",
"value": "Access Sensitive Data in Device Logs" "value": "Access Sensitive Data in Device Logs"
@ -626,7 +626,7 @@
"external_id": "T0056", "external_id": "T0056",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:credential-access" "cmtmf-attack:credential-access"
], ]
}, },
"uuid": "eed66957-03d7-472e-bfce-7fbc833295af", "uuid": "eed66957-03d7-472e-bfce-7fbc833295af",
"value": "Modify Authentication Process" "value": "Modify Authentication Process"
@ -637,7 +637,7 @@
"external_id": "T0057", "external_id": "T0057",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:credential-access" "cmtmf-attack:credential-access"
], ]
}, },
"uuid": "5f26a03f-b603-46b1-a8ee-91eb02023059", "uuid": "5f26a03f-b603-46b1-a8ee-91eb02023059",
"value": "Forced Authentication" "value": "Forced Authentication"
@ -648,7 +648,7 @@
"external_id": "T0058", "external_id": "T0058",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:discovery" "cmtmf-attack:discovery"
], ]
}, },
"uuid": "941608a1-3058-465f-91f0-ee4f2a40f81e", "uuid": "941608a1-3058-465f-91f0-ee4f2a40f81e",
"value": "System Network Connections Discovery" "value": "System Network Connections Discovery"
@ -659,7 +659,7 @@
"external_id": "T0059", "external_id": "T0059",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:discovery" "cmtmf-attack:discovery"
], ]
}, },
"uuid": "6e9807b1-2505-4ebe-a6f9-3348d3d60a2c", "uuid": "6e9807b1-2505-4ebe-a6f9-3348d3d60a2c",
"value": "UE knocking" "value": "UE knocking"
@ -670,7 +670,7 @@
"external_id": "T0060", "external_id": "T0060",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:discovery" "cmtmf-attack:discovery"
], ]
}, },
"uuid": "eb40555d-aa7b-42d3-b998-b613460818b1", "uuid": "eb40555d-aa7b-42d3-b998-b613460818b1",
"value": "Internal Resource Search" "value": "Internal Resource Search"
@ -681,7 +681,7 @@
"external_id": "T0061", "external_id": "T0061",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:discovery" "cmtmf-attack:discovery"
], ]
}, },
"uuid": "0753376d-1027-451a-b398-35e2700722d4", "uuid": "0753376d-1027-451a-b398-35e2700722d4",
"value": "Network Sniffing" "value": "Network Sniffing"
@ -692,7 +692,7 @@
"external_id": "T0062", "external_id": "T0062",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:lateral-movement" "cmtmf-attack:lateral-movement"
], ]
}, },
"uuid": "c026638d-2c10-45f2-a52b-3c82e06f3355", "uuid": "c026638d-2c10-45f2-a52b-3c82e06f3355",
"value": "Rogue Cellular Base Station" "value": "Rogue Cellular Base Station"
@ -703,7 +703,7 @@
"external_id": "T0063", "external_id": "T0063",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:lateral-movement" "cmtmf-attack:lateral-movement"
], ]
}, },
"uuid": "3a40f88e-bcf8-4b6e-919f-229ee48b5a1a", "uuid": "3a40f88e-bcf8-4b6e-919f-229ee48b5a1a",
"value": "Abusing Inter-working Functionalities" "value": "Abusing Inter-working Functionalities"
@ -714,7 +714,7 @@
"external_id": "T0064", "external_id": "T0064",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:lateral-movement" "cmtmf-attack:lateral-movement"
], ]
}, },
"uuid": "5210f87e-7111-4f42-a941-de7649378670", "uuid": "5210f87e-7111-4f42-a941-de7649378670",
"value": "Replication Through SMS" "value": "Replication Through SMS"
@ -725,7 +725,7 @@
"external_id": "T0065", "external_id": "T0065",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:lateral-movement" "cmtmf-attack:lateral-movement"
], ]
}, },
"uuid": "ef3eb056-73fa-405b-aa8c-f1777454c1c5", "uuid": "ef3eb056-73fa-405b-aa8c-f1777454c1c5",
"value": "Replication Through Bluetooth" "value": "Replication Through Bluetooth"
@ -736,7 +736,7 @@
"external_id": "T0066", "external_id": "T0066",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:lateral-movement" "cmtmf-attack:lateral-movement"
], ]
}, },
"uuid": "87ced388-2de0-4a71-b4b7-18de07d7aab7", "uuid": "87ced388-2de0-4a71-b4b7-18de07d7aab7",
"value": "Replication Through WLAN" "value": "Replication Through WLAN"
@ -747,7 +747,7 @@
"external_id": "T0067", "external_id": "T0067",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:lateral-movement" "cmtmf-attack:lateral-movement"
], ]
}, },
"uuid": "c27db767-e8fa-4ff6-afe2-2b311bf6401d", "uuid": "c27db767-e8fa-4ff6-afe2-2b311bf6401d",
"value": "Replication Through IP" "value": "Replication Through IP"
@ -758,7 +758,7 @@
"external_id": "T0068", "external_id": "T0068",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:lateral-movement" "cmtmf-attack:lateral-movement"
], ]
}, },
"uuid": "063e1ff2-0af8-4431-b886-83463c5880a8", "uuid": "063e1ff2-0af8-4431-b886-83463c5880a8",
"value": "Exploit platform & service specific vulnerabilites" "value": "Exploit platform & service specific vulnerabilites"
@ -769,7 +769,7 @@
"external_id": "T0069", "external_id": "T0069",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:collection" "cmtmf-attack:collection"
], ]
}, },
"uuid": "2b5fd58f-09b6-4af9-a3d5-21e65617bf6f", "uuid": "2b5fd58f-09b6-4af9-a3d5-21e65617bf6f",
"value": "Access Sensitive Data in Device Logs" "value": "Access Sensitive Data in Device Logs"
@ -780,7 +780,7 @@
"external_id": "T0070", "external_id": "T0070",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:collection" "cmtmf-attack:collection"
], ]
}, },
"uuid": "831eb5b3-bcd9-4a1e-b587-bc0b4dc42059", "uuid": "831eb5b3-bcd9-4a1e-b587-bc0b4dc42059",
"value": "Network Traffic Capture or Redirection" "value": "Network Traffic Capture or Redirection"
@ -791,7 +791,7 @@
"external_id": "T0071", "external_id": "T0071",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:collection" "cmtmf-attack:collection"
], ]
}, },
"uuid": "39aff570-7266-40d3-975e-a63838404a67", "uuid": "39aff570-7266-40d3-975e-a63838404a67",
"value": "Network-specific identifiers" "value": "Network-specific identifiers"
@ -802,7 +802,7 @@
"external_id": "T0072", "external_id": "T0072",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:collection" "cmtmf-attack:collection"
], ]
}, },
"uuid": "b706e308-6c75-457f-9d9f-fff37c60e1db", "uuid": "b706e308-6c75-457f-9d9f-fff37c60e1db",
"value": "Network-specific data" "value": "Network-specific data"
@ -813,7 +813,7 @@
"external_id": "T0073", "external_id": "T0073",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "17983470-8ddb-47d2-9675-e25371a1b1ad", "uuid": "17983470-8ddb-47d2-9675-e25371a1b1ad",
"value": "Application Layer Protocol" "value": "Application Layer Protocol"
@ -824,7 +824,7 @@
"external_id": "T0074", "external_id": "T0074",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "0e114cd1-0f0e-4d5d-88e6-e7e31bb6040f", "uuid": "0e114cd1-0f0e-4d5d-88e6-e7e31bb6040f",
"value": "Communication via SMS" "value": "Communication via SMS"
@ -835,7 +835,7 @@
"external_id": "T0075", "external_id": "T0075",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "6581316b-abab-4791-8821-92837688ec7f", "uuid": "6581316b-abab-4791-8821-92837688ec7f",
"value": "Communication via Bluetooth" "value": "Communication via Bluetooth"
@ -846,7 +846,7 @@
"external_id": "T0076", "external_id": "T0076",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "99743297-6bd4-467e-8fca-841b43c88dd2", "uuid": "99743297-6bd4-467e-8fca-841b43c88dd2",
"value": "Communication via WLAN" "value": "Communication via WLAN"
@ -857,7 +857,7 @@
"external_id": "T0077", "external_id": "T0077",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "284abb74-49be-4a51-85a0-a1f68286bca7", "uuid": "284abb74-49be-4a51-85a0-a1f68286bca7",
"value": "Exploit SS7 to Redirect Phone Calls/SMS" "value": "Exploit SS7 to Redirect Phone Calls/SMS"
@ -868,7 +868,7 @@
"external_id": "T0078", "external_id": "T0078",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "e6e16b6f-c692-4b21-8eb0-6c2890d6e28a", "uuid": "e6e16b6f-c692-4b21-8eb0-6c2890d6e28a",
"value": "Exploit SS7 to Track Device Location" "value": "Exploit SS7 to Track Device Location"
@ -879,7 +879,7 @@
"external_id": "T0079", "external_id": "T0079",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "85e2973b-8b37-4811-9406-f0c4db9fe44d", "uuid": "85e2973b-8b37-4811-9406-f0c4db9fe44d",
"value": "SS7-based attacks" "value": "SS7-based attacks"
@ -890,7 +890,7 @@
"external_id": "T0080", "external_id": "T0080",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "89005def-29bc-44cf-8002-e781b1596b1f", "uuid": "89005def-29bc-44cf-8002-e781b1596b1f",
"value": "Diameter-based attacks" "value": "Diameter-based attacks"
@ -901,7 +901,7 @@
"external_id": "T0081", "external_id": "T0081",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "3d4c4144-9a7e-4e92-9a10-731a31013628", "uuid": "3d4c4144-9a7e-4e92-9a10-731a31013628",
"value": "GTP-based attacks" "value": "GTP-based attacks"
@ -912,7 +912,7 @@
"external_id": "T0082", "external_id": "T0082",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "47a84cf2-839e-4ff1-9de5-ee3314a5e173", "uuid": "47a84cf2-839e-4ff1-9de5-ee3314a5e173",
"value": "NAS-based attacks" "value": "NAS-based attacks"
@ -923,7 +923,7 @@
"external_id": "T0083", "external_id": "T0083",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "c474ff9d-92e5-47c3-af19-4fcb85827fa1", "uuid": "c474ff9d-92e5-47c3-af19-4fcb85827fa1",
"value": "MEC-based attacks" "value": "MEC-based attacks"
@ -934,7 +934,7 @@
"external_id": "T0084", "external_id": "T0084",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:command-and-control" "cmtmf-attack:command-and-control"
], ]
}, },
"uuid": "3f76efaa-8881-4dab-ae50-d298206301ab", "uuid": "3f76efaa-8881-4dab-ae50-d298206301ab",
"value": "Network Slice" "value": "Network Slice"
@ -945,7 +945,7 @@
"external_id": "T0085", "external_id": "T0085",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:exfiltration" "cmtmf-attack:exfiltration"
], ]
}, },
"uuid": "670cd16f-50a3-4fd3-8ca5-31bfaa1fd5ff", "uuid": "670cd16f-50a3-4fd3-8ca5-31bfaa1fd5ff",
"value": "Automated Exfiltration" "value": "Automated Exfiltration"
@ -956,7 +956,7 @@
"external_id": "T0086", "external_id": "T0086",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:exfiltration" "cmtmf-attack:exfiltration"
], ]
}, },
"uuid": "d5f814f7-a53c-4747-b780-bd8e43364648", "uuid": "d5f814f7-a53c-4747-b780-bd8e43364648",
"value": "Data Encrypted" "value": "Data Encrypted"
@ -967,7 +967,7 @@
"external_id": "T0087", "external_id": "T0087",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:exfiltration" "cmtmf-attack:exfiltration"
], ]
}, },
"uuid": "ab3f1c6a-2b14-44e4-b27b-3b482204977f", "uuid": "ab3f1c6a-2b14-44e4-b27b-3b482204977f",
"value": "Alternate Network Mediums" "value": "Alternate Network Mediums"
@ -978,7 +978,7 @@
"external_id": "T0088", "external_id": "T0088",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "ae23f6b2-5c3a-4d0c-9fd7-cacffcc0f08b", "uuid": "ae23f6b2-5c3a-4d0c-9fd7-cacffcc0f08b",
"value": "Data Manipulation" "value": "Data Manipulation"
@ -989,7 +989,7 @@
"external_id": "T0089", "external_id": "T0089",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "b82d3bbc-7fa0-4e48-8075-76bc22f80503", "uuid": "b82d3bbc-7fa0-4e48-8075-76bc22f80503",
"value": "Endpoint Denial of Service" "value": "Endpoint Denial of Service"
@ -1000,7 +1000,7 @@
"external_id": "T0090", "external_id": "T0090",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "ba42942b-7f37-4ff2-8fc8-0b640add131e", "uuid": "ba42942b-7f37-4ff2-8fc8-0b640add131e",
"value": "Carrier Billing Fraud" "value": "Carrier Billing Fraud"
@ -1011,7 +1011,7 @@
"external_id": "T0091", "external_id": "T0091",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "8f9ca72c-757c-4691-a779-921605c88a46", "uuid": "8f9ca72c-757c-4691-a779-921605c88a46",
"value": "SMS Fraud" "value": "SMS Fraud"
@ -1022,7 +1022,7 @@
"external_id": "T0092", "external_id": "T0092",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "73b37857-106b-40cc-b539-00fe1b8aefe3", "uuid": "73b37857-106b-40cc-b539-00fe1b8aefe3",
"value": "Manipulate Device Communication" "value": "Manipulate Device Communication"
@ -1033,7 +1033,7 @@
"external_id": "T0093", "external_id": "T0093",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "b4682597-2daf-4ab2-b333-6af83de0771b", "uuid": "b4682597-2daf-4ab2-b333-6af83de0771b",
"value": "Jamming or Denial of Service" "value": "Jamming or Denial of Service"
@ -1044,7 +1044,7 @@
"external_id": "T0094", "external_id": "T0094",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "93ead55c-9397-4a5b-aa37-2bf93fa9e1d0", "uuid": "93ead55c-9397-4a5b-aa37-2bf93fa9e1d0",
"value": "Rogue Cellular Base Station" "value": "Rogue Cellular Base Station"
@ -1055,7 +1055,7 @@
"external_id": "T0095", "external_id": "T0095",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "9df725d7-fe97-42da-9be8-da248393a5fa", "uuid": "9df725d7-fe97-42da-9be8-da248393a5fa",
"value": "Location Tracking" "value": "Location Tracking"
@ -1066,7 +1066,7 @@
"external_id": "T0096", "external_id": "T0096",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "7d89bb73-00e6-436c-96d6-f444b8f2ac15", "uuid": "7d89bb73-00e6-436c-96d6-f444b8f2ac15",
"value": "Identity Exploit" "value": "Identity Exploit"
@ -1077,7 +1077,7 @@
"external_id": "T0097", "external_id": "T0097",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "1ca0fa6e-0484-4e4f-a10e-857225bd4819", "uuid": "1ca0fa6e-0484-4e4f-a10e-857225bd4819",
"value": "Network Denial of Service" "value": "Network Denial of Service"
@ -1088,7 +1088,7 @@
"external_id": "T0098", "external_id": "T0098",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "0b6e114b-2ded-4bc5-84d2-25cc81e8724a", "uuid": "0b6e114b-2ded-4bc5-84d2-25cc81e8724a",
"value": "Resource Hijacking" "value": "Resource Hijacking"
@ -1099,7 +1099,7 @@
"external_id": "T0099", "external_id": "T0099",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "939f6c9d-bdb4-4877-89f0-716e346ef012", "uuid": "939f6c9d-bdb4-4877-89f0-716e346ef012",
"value": "SLA Breach" "value": "SLA Breach"
@ -1110,11 +1110,11 @@
"external_id": "T0100", "external_id": "T0100",
"kill_chain": [ "kill_chain": [
"cmtmf-attack:impact" "cmtmf-attack:impact"
], ]
}, },
"uuid": "75c4e3c7-8501-446d-b362-4134d035f7fa", "uuid": "75c4e3c7-8501-446d-b362-4134d035f7fa",
"value": "Customer Churn" "value": "Customer Churn"
}, }
], ],
"version": 4 "version": 5
} }

27
galaxies/cmtmf-attack-pattern.json
View File

@ -1,27 +0,0 @@
{
"description": "CONCORDIA Mobile Threat Modeling Framework - Tactics",
"icon": "",
"kill_chain_order": {
"cmtmf-attack": [
"reconnaissance",
"resource-development"
"initial-access",
"execution",
"persistence",
"privilege-escalation",
"defense-evasion",
"credential-access",
"discovery",
"lateral-movement",
"collection",
"command-and-control",
"exfiltration",
"impact"
]
},
"name": "CONCORDIA Mobile Threat Modelling Framework - Attack Pattern",
"namespace": "cmtmf-attack",
"type": "cmtmf-attack-pattern",
"uuid": "51060d01-ef29-40ab-8965-8031d0941811",
"version": 1
}