DISARMframeworks/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e41b04e4-b8c2-4f66-93d7-c148f3378008.json

{
    "type": "bundle",
    "id": "bundle--b3b188d6-3ac7-4529-b27b-95edf54abad9",
    "objects": [
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--e41b04e4-b8c2-4f66-93d7-c148f3378008",
            "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
            "created": "2024-08-02T17:12:32.38815Z",
            "modified": "2024-08-02T17:12:32.38815Z",
            "name": "Government Official Persona",
            "description": "A person who presents as an active or previous government official has the government official persona. These are officials serving in government, such as heads of government departments, leaders of countries, and members of government selected to represent constituents.<br><br> Presenting as a government official is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in government to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.111: Government Official Persona). They may also impersonate existing members of government (T0143.003: Impersonated Persona, T0097.111: Government Official Persona).<br><br> Legitimate government officials could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.111: Government Official Persona). For example, a government official could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.<br><br> <b>Associated Techniques and Sub-techniques</b><br> <b>T0097.110: Party Official Persona:</b> Analysts should use this sub-technique to catalogue cases where an individual is presenting as a member of a political party.\u00a0<br><br> Not all government officials are political party officials (such as outside experts brought into government) and not all political party officials are government officials (such as people standing for office who are not yet working in government).<br><br> <b>T0097.206: Government Institution Persona:</b> People presenting as members of a government may also represent a government institution which they are associated with.<br><br> <b>T0097.112: Government Employee Persona:</b> Analysts should use this sub-technique to document people presenting as professionals hired to serve in government institutions and departments, not officials selected to represent constituents, or assigned official roles in government (such as heads of departments).",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-attack",
                    "phase_name": "establish-legitimacy"
                }
            ],
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.111.md",
                    "external_id": "T0097.111"
                }
            ],
            "object_marking_refs": [
                "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_platforms": [
                "Windows",
                "Linux",
                "Mac"
            ],
            "x_mitre_version": "2.1"
        }
    ]
}