MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: [attack] fixes old MITRE relationships not being removed

pull/476/head
Christophe Vandeplas 2019-10-27 21:06:26 +01:00
parent 76668d0ebb
commit d32022b241
6 changed files with 1765 additions and 2280 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
clusters/mitre-attack-pattern.json
View File

@ -820,14 +820,14 @@
},
"related": [
{
"dest-uuid": "2b9a666e-bd59-4f67-9031-ed41b428e04a",
"dest-uuid": "028ad431-84c5-4eb7-a364-2b797c234f88",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "related-to"
},
{
"dest-uuid": "028ad431-84c5-4eb7-a364-2b797c234f88",
"dest-uuid": "2b9a666e-bd59-4f67-9031-ed41b428e04a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -1242,14 +1242,14 @@
},
"related": [
{
"dest-uuid": "7718e92f-b011-4f88-b822-ae245a1de407",
"dest-uuid": "0722cd65-0c83-4c89-9502-539198467ab1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "related-to"
},
{
"dest-uuid": "0722cd65-0c83-4c89-9502-539198467ab1",
"dest-uuid": "7718e92f-b011-4f88-b822-ae245a1de407",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -1300,14 +1300,14 @@
},
"related": [
{
"dest-uuid": "7718e92f-b011-4f88-b822-ae245a1de407",
"dest-uuid": "c721b235-679a-4d76-9ae9-e08921fccf84",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "related-to"
},
{
"dest-uuid": "c721b235-679a-4d76-9ae9-e08921fccf84",
"dest-uuid": "7718e92f-b011-4f88-b822-ae245a1de407",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -1330,14 +1330,14 @@
},
"related": [
{
"dest-uuid": "c721b235-679a-4d76-9ae9-e08921fccf84",
"dest-uuid": "0722cd65-0c83-4c89-9502-539198467ab1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "related-to"
},
{
"dest-uuid": "0722cd65-0c83-4c89-9502-539198467ab1",
"dest-uuid": "c721b235-679a-4d76-9ae9-e08921fccf84",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -1838,14 +1838,14 @@
},
"related": [
{
"dest-uuid": "092f05e3-f7c0-4cd2-91be-3a8d6ed3cadc",
"dest-uuid": "7baccb84-356c-4e89-8c5d-58e701f033fc",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "related-to"
},
{
"dest-uuid": "7baccb84-356c-4e89-8c5d-58e701f033fc",
"dest-uuid": "092f05e3-f7c0-4cd2-91be-3a8d6ed3cadc",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -7027,14 +7027,14 @@
},
"related": [
{
"dest-uuid": "7860e21e-7514-4a3f-8a9d-56405ccfdb0c",
"dest-uuid": "59369f72-3005-4e54-9095-3d00efcece73",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "related-to"
},
{
"dest-uuid": "59369f72-3005-4e54-9095-3d00efcece73",
"dest-uuid": "7860e21e-7514-4a3f-8a9d-56405ccfdb0c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -7280,14 +7280,14 @@
},
"related": [
{
"dest-uuid": "59369f72-3005-4e54-9095-3d00efcece73",
"dest-uuid": "78e41091-d10d-4001-b202-89612892b6ff",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "related-to"
},
{
"dest-uuid": "78e41091-d10d-4001-b202-89612892b6ff",
"dest-uuid": "59369f72-3005-4e54-9095-3d00efcece73",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -7310,14 +7310,14 @@
},
"related": [
{
"dest-uuid": "74a3288e-eee9-4f8e-973a-fbc128e033f1",
"dest-uuid": "a757670d-d600-48d9-8ae9-601d42c184a5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "related-to"
},
{
"dest-uuid": "a757670d-d600-48d9-8ae9-601d42c184a5",
"dest-uuid": "74a3288e-eee9-4f8e-973a-fbc128e033f1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -7721,15 +7721,7 @@
"https://attack.mitre.org/techniques/T1454"
]
},
"related": [
{
"dest-uuid": "2d646840-f6f5-4619-a5a8-29c8316bbac5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "revoked-by"
}
],
"related": [],
"uuid": "0bcc4ec1-a897-49a9-a9ff-c00df1d1209d",
"value": "Malicious SMS Message - T1454"
},
@ -12196,5 +12188,5 @@
"value": "DNSCalc - T1324"
}
],
"version": 11
"version": 12
}

682
clusters/mitre-course-of-action.json
View File

@ -565,14 +565,14 @@
},
"related": [
{
"dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f",
"dest-uuid": "9d7c32f4-ab39-49dc-8055-8106bc2294a1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "9d7c32f4-ab39-49dc-8055-8106bc2294a1",
"dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -735,6 +735,13 @@
],
"type": "mitigates"
},
{
"dest-uuid": "723e3a2b-ca0d-4daa-ada8-82ea35d3733a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "aa8bfbc9-78dc-41a4-a03b-7453e0fdccda",
"tags": [
@ -903,13 +910,6 @@
],
"type": "mitigates"
},
{
"dest-uuid": "723e3a2b-ca0d-4daa-ada8-82ea35d3733a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "3298ce88-1628-43b1-87d9-0b5336b193d7",
"tags": [
@ -1718,13 +1718,6 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
}
],
"uuid": "16f144e4-c780-4ed2-98b4-55d14e2dfa44",
@ -1839,20 +1832,6 @@
]
},
"related": [
{
"dest-uuid": "a0464539-e1b7-4455-a355-12495987c300",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "2204c371-6100-4ae0-82f3-25c07c29772a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "cde2cb84-455e-410c-8aa9-086f2788bcd2",
"tags": [
@ -1986,6 +1965,13 @@
],
"type": "mitigates"
},
{
"dest-uuid": "2204c371-6100-4ae0-82f3-25c07c29772a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "667e5707-3843-4da8-bd34-88b922526f0d",
"tags": [
@ -1993,6 +1979,13 @@
],
"type": "mitigates"
},
{
"dest-uuid": "a0464539-e1b7-4455-a355-12495987c300",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "e399430e-30b7-48c5-b70a-f44dc8c175cb",
"tags": [
@ -4052,20 +4045,6 @@
]
},
"related": [
{
"dest-uuid": "393e8c12-a416-4575-ba90-19cc85656796",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "a5de0540-73e7-4c67-96da-4143afedc7ed",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "633baf01-6de4-4963-bb54-ff6c6357bed3",
"tags": [
@ -4087,6 +4066,20 @@
],
"type": "mitigates"
},
{
"dest-uuid": "393e8c12-a416-4575-ba90-19cc85656796",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "a5de0540-73e7-4c67-96da-4143afedc7ed",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d731c21e-f27d-4756-b418-0e2aaabd6d63",
"tags": [
@ -4202,14 +4195,14 @@
},
"related": [
{
"dest-uuid": "29e07491-8947-43a3-8d4e-9a787c45f3d3",
"dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81",
"dest-uuid": "29e07491-8947-43a3-8d4e-9a787c45f3d3",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -5543,6 +5536,13 @@
],
"type": "mitigates"
},
{
"dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "327f3cc5-eea1-42d4-a6cd-ed34b7ce8f61",
"tags": [
@ -5613,13 +5613,6 @@
],
"type": "mitigates"
},
{
"dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "4fd8a28b-4b3a-4cd6-a8cf-85ba5f824a7f",
"tags": [
@ -5737,13 +5730,6 @@
],
"type": "mitigates"
},
{
"dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "44dca04b-808d-46ca-b25f-d85236d4b9f8",
"tags": [
@ -5806,6 +5792,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
}
],
"uuid": "2f316f6c-ae42-44fe-adf8-150989e0f6d3",
@ -7667,21 +7660,14 @@
},
"related": [
{
"dest-uuid": "f296fc9c-2ff5-43ee-941e-6b49c438270a",
"dest-uuid": "79eec66a-9bd0-4a3f-ac82-19159e94bd44",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "3b0b604f-10db-41a0-b54c-493124d455b9",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "ef771e03-e080-43b4-a619-ac6f84899884",
"dest-uuid": "29e07491-8947-43a3-8d4e-9a787c45f3d3",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -7695,21 +7681,7 @@
"type": "mitigates"
},
{
"dest-uuid": "f1c3d071-0c24-483d-aca0-e8b8496ce468",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "2d646840-f6f5-4619-a5a8-29c8316bbac5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0",
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -7729,34 +7701,6 @@
],
"type": "mitigates"
},
{
"dest-uuid": "29e07491-8947-43a3-8d4e-9a787c45f3d3",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "88932a8c-3a17-406f-9431-1da3ff19f6d6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "dfe29258-ce59-421c-9dee-e85cb9fa90cd",
"tags": [
@ -7765,7 +7709,14 @@
"type": "mitigates"
},
{
"dest-uuid": "79eec66a-9bd0-4a3f-ac82-19159e94bd44",
"dest-uuid": "ef771e03-e080-43b4-a619-ac6f84899884",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "351c0927-2fc1-4a2c-ad84-cbbee7eb8172",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -7778,6 +7729,20 @@
],
"type": "mitigates"
},
{
"dest-uuid": "2d646840-f6f5-4619-a5a8-29c8316bbac5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "88932a8c-3a17-406f-9431-1da3ff19f6d6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "46d818a5-67fa-4585-a7fc-ecf15376c8d5",
"tags": [
@ -7786,7 +7751,21 @@
"type": "mitigates"
},
{
"dest-uuid": "351c0927-2fc1-4a2c-ad84-cbbee7eb8172",
"dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "f1c3d071-0c24-483d-aca0-e8b8496ce468",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "3b0b604f-10db-41a0-b54c-493124d455b9",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -7805,6 +7784,13 @@
]
},
"related": [
{
"dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "46d818a5-67fa-4585-a7fc-ecf15376c8d5",
"tags": [
@ -7818,13 +7804,6 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
}
],
"uuid": "8ccd428d-39da-4e8f-a55b-d48ea1d56e58",
@ -8007,77 +7986,7 @@
},
"related": [
{
"dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "79eec66a-9bd0-4a3f-ac82-19159e94bd44",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "89fcd02f-62dc-40b9-a54b-9ac4b1baef05",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "351c0927-2fc1-4a2c-ad84-cbbee7eb8172",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d731c21e-f27d-4756-b418-0e2aaabd6d63",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "62adb627-f647-498e-b4cc-41499361bacb",
"dest-uuid": "2204c371-6100-4ae0-82f3-25c07c29772a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -8090,6 +7999,20 @@
],
"type": "mitigates"
},
{
"dest-uuid": "62adb627-f647-498e-b4cc-41499361bacb",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "79eec66a-9bd0-4a3f-ac82-19159e94bd44",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
"tags": [
@ -8097,111 +8020,6 @@
],
"type": "mitigates"
},
{
"dest-uuid": "ef771e03-e080-43b4-a619-ac6f84899884",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "8f142a25-f6c3-4520-bd50-2ae3ab50ed3e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "29e07491-8947-43a3-8d4e-9a787c45f3d3",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d9e88203-2b5d-405f-a406-2933b1e3d7e4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "9d7c32f4-ab39-49dc-8055-8106bc2294a1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "8f0e39c6-82c9-41ec-9f93-5696c0f2e274",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "2204c371-6100-4ae0-82f3-25c07c29772a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "77e30eee-fd48-40b4-99ec-73e97c158b58",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "f981d199-2720-467e-9dc9-eea04dbe05cf",
"tags": [
@ -8209,6 +8027,41 @@
],
"type": "mitigates"
},
{
"dest-uuid": "1b51f5bc-b97a-498a-8dbd-bc6b1901bf19",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "ef771e03-e080-43b4-a619-ac6f84899884",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "dd818ea5-adf5-41c7-93b5-f3b839a219fb",
"tags": [
@ -8217,7 +8070,21 @@
"type": "mitigates"
},
{
"dest-uuid": "1b51f5bc-b97a-498a-8dbd-bc6b1901bf19",
"dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "351c0927-2fc1-4a2c-ad84-cbbee7eb8172",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -8230,6 +8097,13 @@
],
"type": "mitigates"
},
{
"dest-uuid": "29e07491-8947-43a3-8d4e-9a787c45f3d3",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "c4b96c0b-cb58-497a-a1c2-bb447d79d692",
"tags": [
@ -8238,7 +8112,63 @@
"type": "mitigates"
},
{
"dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77",
"dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "8f0e39c6-82c9-41ec-9f93-5696c0f2e274",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "8f142a25-f6c3-4520-bd50-2ae3ab50ed3e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "77e30eee-fd48-40b4-99ec-73e97c158b58",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d9e88203-2b5d-405f-a406-2933b1e3d7e4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d731c21e-f27d-4756-b418-0e2aaabd6d63",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -8258,6 +8188,34 @@
],
"type": "mitigates"
},
{
"dest-uuid": "9d7c32f4-ab39-49dc-8055-8106bc2294a1",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "786f488c-cb1f-4602-89c5-86d982ee326b",
"tags": [
@ -8285,6 +8243,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
}
],
"uuid": "1553b156-6767-47f7-9eb4-2a692505666d",
@ -8383,14 +8348,7 @@
},
"related": [
{
"dest-uuid": "a0464539-e1b7-4455-a355-12495987c300",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "6f86d346-f092-4abc-80df-8558a90c426a",
"dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -8403,6 +8361,13 @@
],
"type": "mitigates"
},
{
"dest-uuid": "d1f1337e-aea7-454c-86bd-482a98ffaf62",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad",
"tags": [
@ -8410,6 +8375,27 @@
],
"type": "mitigates"
},
{
"dest-uuid": "a0464539-e1b7-4455-a355-12495987c300",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "0c71033e-401e-4b97-9309-7a7c95e43a5d",
"tags": [
@ -8432,14 +8418,7 @@
"type": "mitigates"
},
{
"dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7",
"dest-uuid": "6f86d346-f092-4abc-80df-8558a90c426a",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -8451,20 +8430,6 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d1f1337e-aea7-454c-86bd-482a98ffaf62",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
}
],
"uuid": "653492e3-27be-4a0e-b08c-938dd2b7e0e1",
@ -8479,20 +8444,6 @@
]
},
"related": [
{
"dest-uuid": "51aedbd6-2837-4d15-aeb0-cb09f2bf22ac",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "667e5707-3843-4da8-bd34-88b922526f0d",
"tags": [
@ -8514,6 +8465,13 @@
],
"type": "mitigates"
},
{
"dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "2204c371-6100-4ae0-82f3-25c07c29772a",
"tags": [
@ -8571,14 +8529,14 @@
},
"related": [
{
"dest-uuid": "fb3fa94a-3aee-4ab0-b7e7-abdf0a51286d",
"dest-uuid": "52651225-0b3a-482d-aa7e-10618fd063b5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "52651225-0b3a-482d-aa7e-10618fd063b5",
"dest-uuid": "fb3fa94a-3aee-4ab0-b7e7-abdf0a51286d",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -9099,6 +9057,13 @@
],
"type": "mitigates"
},
{
"dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "ba8e391f-14b5-496f-81f2-2d5ecd646c1c",
"tags": [
@ -9127,13 +9092,6 @@
],
"type": "mitigates"
},
{
"dest-uuid": "4579d9c9-d5b9-45e0-9848-0104637b579f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d4bdbdea-eaec-4071-b4f9-5105e12ea4b6",
"tags": [
@ -9388,13 +9346,6 @@
],
"type": "mitigates"
},
{
"dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "6fb6408c-0db3-41d9-a3a1-a32e5f16454e",
"tags": [
@ -9478,6 +9429,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "04ee0cb7-dac3-4c6c-9387-4c6aa096f4cf",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
}
],
"uuid": "47e0e9fe-96ce-4f65-8bb1-8be1feacb5db",
@ -9604,14 +9562,14 @@
"type": "mitigates"
},
{
"dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0",
"dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "mitigates"
},
{
"dest-uuid": "d456de47-a16f-4e46-8980-e67478a12dcb",
"dest-uuid": "f4882e23-8aa7-4b12-b28a-b349c12ee9e0",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -10233,5 +10191,5 @@
"value": "Audit - M1047"
}
],
"version": 15
"version": 16
}

898
clusters/mitre-intrusion-set.json
View File

File diff suppressed because it is too large Load Diff

2288
clusters/mitre-malware.json
View File

File diff suppressed because it is too large Load Diff

106
clusters/mitre-tool.json
View File

@ -89,13 +89,6 @@
],
"type": "similar"
},
{
"dest-uuid": "3da22160-12d9-4d27-a99f-338e8de3844a",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "1a1d3ea4-972e-4c48-8d85-08d9db8f1550",
"tags": [
@ -103,13 +96,6 @@
],
"type": "similar"
},
{
"dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
"tags": [
@ -320,6 +306,13 @@
],
"type": "uses"
},
{
"dest-uuid": "bb5a00de-e086-4859-a231-fa793f6797e2",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e",
"tags": [
@ -452,13 +445,6 @@
],
"type": "similar"
},
{
"dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "6c174520-beea-43d9-aac6-28fb77f3e446",
"tags": [
@ -514,6 +500,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
@ -873,14 +866,14 @@
},
"related": [
{
"dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59",
"dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
"dest-uuid": "56fca983-1cf1-4fd1-bda0-5e170a37ab59",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -928,20 +921,6 @@
]
},
"related": [
{
"dest-uuid": "3e205e84-9f90-4b4b-8896-c82189936a15",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "d519cfd5-f3a8-43a9-a846-ed0bb40672b1",
"tags": [
@ -955,6 +934,13 @@
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
}
],
"uuid": "0a68f1f1-da74-4d28-8d9a-696c082706cc",
@ -1026,14 +1012,14 @@
},
"related": [
{
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "a19e86f8-1c0a-4fea-8407-23b73d615776",
"dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -1264,13 +1250,6 @@
]
},
"related": [
{
"dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "f44731de-ea9f-406d-9b83-30ecbb9b4392",
"tags": [
@ -1334,6 +1313,13 @@
],
"type": "uses"
},
{
"dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
"tags": [
@ -1561,14 +1547,14 @@
},
"related": [
{
"dest-uuid": "2edd9d6a-5674-4326-a600-ba56de467286",
"dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
"dest-uuid": "2edd9d6a-5674-4326-a600-ba56de467286",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -1955,13 +1941,6 @@
],
"type": "similar"
},
{
"dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
"tags": [
@ -2144,6 +2123,13 @@
],
"type": "uses"
},
{
"dest-uuid": "7fd87010-3a00-4da3-b905-410525e8ec44",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "9422fc14-1c43-410d-ab0f-a709b76c72dc",
"tags": [
@ -2301,14 +2287,14 @@
},
"related": [
{
"dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c",
"dest-uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "428ca9f8-0e33-442a-be87-f869cb4cf73e",
"dest-uuid": "7d751199-05fa-4a72-920f-85df4506c76c",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -2335,14 +2321,14 @@
},
"related": [
{
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
"dest-uuid": "3b0e52ce-517a-4614-a523-1bd5deef6c5e",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "uses"
},
{
"dest-uuid": "3b0e52ce-517a-4614-a523-1bd5deef6c5e",
"dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
@ -3992,5 +3978,5 @@
"value": "Nltest - S0359"
}
],
"version": 16
"version": 17
}

27
tools/mitre-cti/v2.0/create_mitre-galaxy.py
View File

@ -17,7 +17,23 @@ domains = ['enterprise-attack', 'mobile-attack', 'pre-attack']
types = ['attack-pattern', 'course-of-action', 'intrusion-set', 'malware', 'tool']
all_data = {} # variable that will contain everything
# read in existing data
# read in the non-MITRE data
# we need this to be able to build a list of non-MITRE-UUIDs which we will use later on
# to remove relations that are from MITRE.
# the reasoning is that the new MITRE export might contain less relationships than it did before
# so we cannot migrate all existing relationships as such
non_mitre_uuids = set()
for fname in os.listdir(os.path.join(misp_dir, 'clusters')):
if 'mitre' in fname:
continue
if '.json' in fname:
# print(fname)
with open(os.path.join(misp_dir, 'clusters', fname)) as f_in:
cluster_data = json.load(f_in)
for cluster in cluster_data['values']:
non_mitre_uuids.add(cluster['uuid'])
# read in existing MITRE data
# first build a data set of the MISP Galaxy ATT&CK elements by using the UUID as reference, this speeds up lookups later on.
# at the end we will convert everything again to separate datasets
all_data_uuid = {}
@ -29,6 +45,15 @@ for t in types:
file_data = json.load(f)
# print(file_data)
for value in file_data['values']:
# remove (old)MITRE relations, and keep non-MITRE relations
if 'related' in value:
related_original = value['related']
related_new = []
for rel in related_original:
if rel['dest-uuid'] in non_mitre_uuids:
related_new.append(rel)
value['related'] = related_new
# find and handle duplicate uuids
if value['uuid'] in all_data_uuid:
# exit("ERROR: Something is really wrong, we seem to have duplicates.")
# if it already exists we need to copy over all the data manually to merge it