mirror of
https://github.com/DISARMFoundation/DISARMframeworks.git
synced 2025-03-20 13:56:34 -04:00
Update STIX Bundle for v1.5
This commit is contained in:
Stephen Campbell
parent
9c2735869d
commit
4227d24f41
File diff suppressed because it is too large
Load Diff
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--96866e90-4a43-44b5-ad9c-948c09670963",
|
||||
"id": "bundle--217d8c4d-82ef-4208-a42a-81b437d84c93",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.256885Z",
|
||||
"modified": "2023-09-28T21:25:13.256885Z",
|
||||
"created": "2024-08-02T17:12:32.39972Z",
|
||||
"modified": "2024-08-02T17:12:32.39972Z",
|
||||
"name": "Video Livestream",
|
||||
"description": "A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--7e0b8688-d125-484c-a4f9-13137341b898",
|
||||
"id": "bundle--9e5d8720-341f-4d99-8e5d-fa7f245ef873",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0102376a-e896-4191-b3fb-e58188301822",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.212125Z",
|
||||
"modified": "2023-09-28T21:25:13.212125Z",
|
||||
"created": "2024-08-02T17:12:32.351843Z",
|
||||
"modified": "2024-08-02T17:12:32.351843Z",
|
||||
"name": "Organise Events",
|
||||
"description": "Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--6bdc0034-a9ad-43e7-91b0-c54757577c9e",
|
||||
"id": "bundle--40da46c0-9a28-494e-b8a8-e22b09910e17",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.266843Z",
|
||||
"modified": "2023-09-28T21:25:13.266843Z",
|
||||
"created": "2024-08-02T17:12:32.406119Z",
|
||||
"modified": "2024-08-02T17:12:32.406119Z",
|
||||
"name": "Deliver Ads",
|
||||
"description": "Delivering content via any form of paid media or advertising.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--482fef6d-55ff-4da9-a49e-ceb149aae6ea",
|
||||
"id": "bundle--35be0875-c21a-44f2-be60-c3c4ee5cb39f",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.273066Z",
|
||||
"modified": "2023-09-28T21:25:13.273066Z",
|
||||
"created": "2024-08-02T17:12:32.409015Z",
|
||||
"modified": "2024-08-02T17:12:32.409015Z",
|
||||
"name": "Post across Platform",
|
||||
"description": "An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--9325ea08-ba9a-444a-ab34-842dcc82d190",
|
||||
"id": "bundle--63e73074-11b1-45ee-ab42-127e90ba2d27",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.201279Z",
|
||||
"modified": "2023-09-28T21:25:13.201279Z",
|
||||
"created": "2024-08-02T17:12:32.34226Z",
|
||||
"modified": "2024-08-02T17:12:32.34226Z",
|
||||
"name": "Reframe Context",
|
||||
"description": "Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--2942a238-1b75-45e3-9022-ad5e15b3dd6c",
|
||||
"id": "bundle--3c0daaa1-a910-4eed-9f58-91a47656c595",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.214551Z",
|
||||
"modified": "2023-09-28T21:25:13.214551Z",
|
||||
"created": "2024-08-02T17:12:32.355426Z",
|
||||
"modified": "2024-08-02T17:12:32.355426Z",
|
||||
"name": "Segment Audiences",
|
||||
"description": "Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--d4a83f50-42d8-434f-95a7-f36433f65d3a",
|
||||
"id": "bundle--d62aacf5-75f8-439a-8dad-4cfe8232954b",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.257984Z",
|
||||
"modified": "2023-09-28T21:25:13.257984Z",
|
||||
"created": "2024-08-02T17:12:32.400959Z",
|
||||
"modified": "2024-08-02T17:12:32.400959Z",
|
||||
"name": "Private/Closed Social Networks",
|
||||
"description": "Social networks that are not open to people outside of family, friends, neighbours, or co-workers. Non-work-related examples include Couple, FamilyWall, 23snaps, and Nextdoor. Some of the larger social network platforms enable closed communities: examples are Instagram Close Friends and Twitter (X) Circle. Work-related examples of private social networks include LinkedIn, Facebook Workplace, and enterprise communication platforms such as Slack or Microsoft Teams.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--d6e00044-58a7-4ddb-bf88-30f8653b5f09",
|
||||
"id": "bundle--f3eee90c-eaba-4fe4-bc69-1e48f329772e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.279115Z",
|
||||
"modified": "2023-09-28T21:25:13.279115Z",
|
||||
"created": "2024-08-02T17:12:32.415084Z",
|
||||
"modified": "2024-08-02T17:12:32.415084Z",
|
||||
"name": "Conceal Operational Activity",
|
||||
"description": "Conceal the campaign's operational activity to avoid takedown and attribution.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c1247e3b-818a-4a71-b381-cbedbde5efe1",
|
||||
"id": "bundle--9ff46e68-6a01-4053-92e6-0abd694f8d69",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.211835Z",
|
||||
"modified": "2023-09-28T21:25:13.211835Z",
|
||||
"created": "2024-08-02T17:12:32.350844Z",
|
||||
"modified": "2024-08-02T17:12:32.350844Z",
|
||||
"name": "Conduct Keyword Squatting",
|
||||
"description": "Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--869a9a71-029c-4338-8243-0d7ee648acaa",
|
||||
"id": "bundle--3940f8c5-8b74-480b-97a9-9246f9a439d4",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.247708Z",
|
||||
"modified": "2023-09-28T21:25:13.247708Z",
|
||||
"created": "2024-08-02T17:12:32.382258Z",
|
||||
"modified": "2024-08-02T17:12:32.382258Z",
|
||||
"name": "Leverage Content Farms",
|
||||
"description": "Using the services of large-scale content providers for creating and amplifying campaign artefacts at scale.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--806c52c7-049a-4309-9cc4-54e8ef929b0c",
|
||||
"id": "bundle--2af4cfde-2a63-497e-bdb2-a5abdb6e7bbb",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.27669Z",
|
||||
"modified": "2023-09-28T21:25:13.27669Z",
|
||||
"created": "2024-08-02T17:12:32.412914Z",
|
||||
"modified": "2024-08-02T17:12:32.412914Z",
|
||||
"name": "Encourage Attendance at Events",
|
||||
"description": "Operation encourages attendance at existing real world event.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,16 +1,16 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--6ac57769-ec69-4864-9538-3087bbba30c8",
|
||||
"id": "bundle--af67a6d7-fd4e-496d-aaad-7c9eb0bb0f2a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.21044Z",
|
||||
"modified": "2023-09-28T21:25:13.21044Z",
|
||||
"name": "Flooding the Information Space",
|
||||
"description": "Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.",
|
||||
"created": "2024-08-02T17:12:32.347894Z",
|
||||
"modified": "2024-08-02T17:12:32.347894Z",
|
||||
"name": "Flood Information Space",
|
||||
"description": "Flooding sources of information (e.g. Social Media feeds) with a high volume of inauthentic content.<br /> <br />This can be done to control/shape online conversations, drown out opposing points of view, or make it harder to find legitimate information.<br /> <br />Bots and/or patriotic trolls are effective tools to achieve this effect.<br /> <br />This Technique previously used the name Flooding the Information Space.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--df5f361a-9a5c-46e4-a3b9-3c67065697c5",
|
||||
"id": "bundle--6bc8d3c5-c0a8-49e4-9941-75104d2435a9",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.272851Z",
|
||||
"modified": "2023-09-28T21:25:13.272851Z",
|
||||
"created": "2024-08-02T17:12:32.408822Z",
|
||||
"modified": "2024-08-02T17:12:32.408822Z",
|
||||
"name": "Post across Groups",
|
||||
"description": "An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--3a92da8a-6f8d-4cee-a3f1-c71f43c3cd5a",
|
||||
"id": "bundle--49eee4c9-4f69-4fb3-8c3b-8e45da598a06",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.206512Z",
|
||||
"modified": "2023-09-28T21:25:13.206512Z",
|
||||
"created": "2024-08-02T17:12:32.344715Z",
|
||||
"modified": "2024-08-02T17:12:32.344715Z",
|
||||
"name": "Use Fake Experts",
|
||||
"description": "Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give \"credility\" to misinformation. Take advantage of credential bias",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--d03b0d2a-e3bd-4077-8b6a-e0a3b8c23a76",
|
||||
"id": "bundle--fb40e740-8007-4e6e-977a-7dcd7c3e05e6",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.256347Z",
|
||||
"modified": "2023-09-28T21:25:13.256347Z",
|
||||
"created": "2024-08-02T17:12:32.399545Z",
|
||||
"modified": "2024-08-02T17:12:32.399545Z",
|
||||
"name": "Livestream",
|
||||
"description": "A livestream refers to an online broadcast capability that allows for real-time communication to closed or open networks.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--92bb24f3-0189-4c1b-8650-52ee3c63e2fa",
|
||||
"id": "bundle--deb25743-ee30-42c8-a86d-7368e5fa0cd8",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.254922Z",
|
||||
"modified": "2023-09-28T21:25:13.254922Z",
|
||||
"created": "2024-08-02T17:12:32.396562Z",
|
||||
"modified": "2024-08-02T17:12:32.396562Z",
|
||||
"name": "Create Localised Content",
|
||||
"description": "Localised content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localised content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localised content may help an operation increase legitimacy, avoid detection, and complicate external attribution.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--815c8801-b5bf-4ce1-9cc8-8502206826eb",
|
||||
"id": "bundle--52fca5ca-b49e-4b9e-ad30-21b67ebf5ef4",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.2094Z",
|
||||
"modified": "2023-09-28T21:25:13.2094Z",
|
||||
"created": "2024-08-02T17:12:32.346525Z",
|
||||
"modified": "2024-08-02T17:12:32.346525Z",
|
||||
"name": "Threaten to Dox",
|
||||
"description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--16d67122-d992-4258-9654-4e144f7db6a3",
|
||||
"id": "bundle--c3d7ea01-fc3c-4177-b13c-e4e52587459e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.227448Z",
|
||||
"modified": "2023-09-28T21:25:13.227448Z",
|
||||
"created": "2024-08-02T17:12:32.368028Z",
|
||||
"modified": "2024-08-02T17:12:32.368028Z",
|
||||
"name": "Develop New Narratives",
|
||||
"description": "Actors may develop new narratives to further strategic or tactical goals, especially when existing narratives adequately align with the campaign goals. New narratives provide more control in terms of crafting the message to achieve specific goals. However, new narratives may require more effort to disseminate than adapting or adopting existing narratives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--ce822db7-2c37-44b2-bb15-40bfcf69c926",
|
||||
"id": "bundle--551cc2bb-8ed4-4f30-82c8-bda74bdc7899",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.274372Z",
|
||||
"modified": "2023-09-28T21:25:13.274372Z",
|
||||
"created": "2024-08-02T17:12:32.410743Z",
|
||||
"modified": "2024-08-02T17:12:32.410743Z",
|
||||
"name": "Control Information Environment through Offensive Cyberspace Operations",
|
||||
"description": "Controlling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of content in the information space to either prioritise operation messaging or block opposition messaging.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,16 +1,16 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f217bf9f-cbe8-40f1-b842-2c589fa35221",
|
||||
"id": "bundle--3ed4b837-7930-4492-baff-965cdc582ef7",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.230922Z",
|
||||
"modified": "2023-09-28T21:25:13.230922Z",
|
||||
"created": "2024-08-02T17:12:32.370771Z",
|
||||
"modified": "2024-08-02T17:12:32.370771Z",
|
||||
"name": "Develop AI-Generated Text",
|
||||
"description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.",
|
||||
"description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.<br><br><b>Associated Techniques and Sub-techniques:</b><br><b>T0085.008: Machine Translated Text:</b> Use this sub-technique when AI has been used to generate a translation of a piece of text.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--80ec494f-bad1-4f84-85b0-cf9cfde169f7",
|
||||
"id": "bundle--1f5ef84b-c3a1-4714-97b6-2a1ad201a911",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1997947a-7e08-4ea9-802c-85391d561266",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.268338Z",
|
||||
"modified": "2023-09-28T21:25:13.268338Z",
|
||||
"created": "2024-08-02T17:12:32.406924Z",
|
||||
"modified": "2024-08-02T17:12:32.406924Z",
|
||||
"name": "Post Content",
|
||||
"description": "Delivering content by posting via owned media (assets that the operator controls).",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--1fe5fb34-dbda-44e4-acac-d0e5f45ebf40",
|
||||
"id": "bundle--ee098dbb-4ee9-46d3-a5a6-9cfe4b0307fd",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.22009Z",
|
||||
"modified": "2023-09-28T21:25:13.22009Z",
|
||||
"created": "2024-08-02T17:12:32.361233Z",
|
||||
"modified": "2024-08-02T17:12:32.361233Z",
|
||||
"name": "Distort",
|
||||
"description": "Twist the narrative. Take information, or artefacts like images, and change the framing around them.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--305e5346-1792-4b24-baa9-68ccbcf07386",
|
||||
"id": "bundle--80a6cb32-48e5-4423-a547-751e93db2b94",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.289879Z",
|
||||
"modified": "2023-09-28T21:25:13.289879Z",
|
||||
"created": "2024-08-02T17:12:32.420979Z",
|
||||
"modified": "2024-08-02T17:12:32.420979Z",
|
||||
"name": "Action/Attitude",
|
||||
"description": "Measure current system state with respect to the effectiveness of influencing action/attitude.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--6110421d-886d-4664-87e0-fe3072ad1829",
|
||||
"id": "bundle--b3389001-36a8-411e-b389-837bb7db12da",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.210665Z",
|
||||
"modified": "2023-09-28T21:25:13.210665Z",
|
||||
"created": "2024-08-02T17:12:32.348471Z",
|
||||
"modified": "2024-08-02T17:12:32.348471Z",
|
||||
"name": "Trolls Amplify and Manipulate",
|
||||
"description": "Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--3fcf4a8d-335e-4e1f-9906-9bde08ced2fe",
|
||||
"id": "bundle--ba497caf-d32f-40c0-9237-78680cb25ae9",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.221608Z",
|
||||
"modified": "2023-09-28T21:25:13.221608Z",
|
||||
"created": "2024-08-02T17:12:32.362521Z",
|
||||
"modified": "2024-08-02T17:12:32.362521Z",
|
||||
"name": "Divide",
|
||||
"description": "Create conflict between subgroups, to widen divisions in a community",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--885db17d-b390-4455-9431-59a8034e8fc2",
|
||||
"id": "bundle--b2012feb-cb7f-4b42-a231-92ef6cf84b42",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.260018Z",
|
||||
"modified": "2023-09-28T21:25:13.260018Z",
|
||||
"created": "2024-08-02T17:12:32.403282Z",
|
||||
"modified": "2024-08-02T17:12:32.403282Z",
|
||||
"name": "Video Sharing",
|
||||
"description": "Examples include Youtube, TikTok, ShareChat, Rumble, etc",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f8a98b0c-d415-42ed-bd09-d92bbede864d",
|
||||
"id": "bundle--f663935c-16a2-4811-b67e-3944b29e5c65",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1d917530-027d-4f82-b380-404c320dc783",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.216032Z",
|
||||
"modified": "2023-09-28T21:25:13.216032Z",
|
||||
"created": "2024-08-02T17:12:32.356564Z",
|
||||
"modified": "2024-08-02T17:12:32.356564Z",
|
||||
"name": "Economic Segmentation",
|
||||
"description": "An influence operation may target populations based on their income bracket, wealth, or other financial or economic division.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--b902ec75-3655-428a-b579-e421b5f22f6e",
|
||||
"id": "bundle--734a0d99-4aa6-4d47-90cf-46582be43356",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.276828Z",
|
||||
"modified": "2023-09-28T21:25:13.276828Z",
|
||||
"created": "2024-08-02T17:12:32.413057Z",
|
||||
"modified": "2024-08-02T17:12:32.413057Z",
|
||||
"name": "Call to Action to Attend",
|
||||
"description": "Call to action to attend an event",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--4f658070-6407-496d-9da4-52ffdff60192",
|
||||
"id": "bundle--d9571e7a-2b61-4400-8834-5d08863d0d1e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.27818Z",
|
||||
"modified": "2023-09-28T21:25:13.27818Z",
|
||||
"created": "2024-08-02T17:12:32.414283Z",
|
||||
"modified": "2024-08-02T17:12:32.414283Z",
|
||||
"name": "Conceal Network Identity",
|
||||
"description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--47a925ff-1268-4aa7-b09f-adb1dd5ac364",
|
||||
"id": "bundle--72d4cdda-ecd9-4ff5-806c-658e265db5c6",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.195168Z",
|
||||
"modified": "2023-09-28T21:25:13.195168Z",
|
||||
"created": "2024-08-02T17:12:32.335027Z",
|
||||
"modified": "2024-08-02T17:12:32.335027Z",
|
||||
"name": "Prepare Fundraising Campaigns",
|
||||
"description": "Fundraising campaigns refer to an influence operation\u2019s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--bd956c8e-2b1e-4b2d-9d3b-7a72a2bf0b9f",
|
||||
"id": "bundle--040db928-c41c-4eb7-9788-3024186c191c",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.204367Z",
|
||||
"modified": "2023-09-28T21:25:13.204367Z",
|
||||
"created": "2024-08-02T17:12:32.343925Z",
|
||||
"modified": "2024-08-02T17:12:32.343925Z",
|
||||
"name": "Chat Apps",
|
||||
"description": "Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--6932f059-0b1f-4ac7-9479-aa083f500e32",
|
||||
"id": "bundle--7eeb1560-5bf0-4f48-951e-f7ff3b36a3d7",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.266341Z",
|
||||
"modified": "2023-09-28T21:25:13.266341Z",
|
||||
"created": "2024-08-02T17:12:32.405913Z",
|
||||
"modified": "2024-08-02T17:12:32.405913Z",
|
||||
"name": "Employ Commercial Analytic Firms",
|
||||
"description": "Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "conduct-pump-priming"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--b8903b69-42ef-4c7f-8d29-e0664ebf3893",
|
||||
"id": "bundle--37701d8b-9802-463a-94bd-88beef82ff4e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.265297Z",
|
||||
"modified": "2023-09-28T21:25:13.265297Z",
|
||||
"created": "2024-08-02T17:12:32.405517Z",
|
||||
"modified": "2024-08-02T17:12:32.405517Z",
|
||||
"name": "Radio",
|
||||
"description": "Radio",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--793cc6ec-dc65-4bf2-a3a5-425e83da0a68",
|
||||
"id": "bundle--ef89e3d2-02a9-46a0-b179-3fda040b6499",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--283333f5-e161-4195-9070-5a7c22505adf",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.252865Z",
|
||||
"modified": "2023-09-28T21:25:13.252865Z",
|
||||
"created": "2024-08-02T17:12:32.394819Z",
|
||||
"modified": "2024-08-02T17:12:32.394819Z",
|
||||
"name": "Co-Opt Trusted Sources",
|
||||
"description": "An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: - National or local new outlets - Research or academic publications - Online blogs or websites",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--6217b633-fcd8-470f-bf91-16f51d9b02db",
|
||||
"id": "bundle--003c54f5-0c77-4697-8e79-502d89eba65c",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.24035Z",
|
||||
"modified": "2023-09-28T21:25:13.24035Z",
|
||||
"created": "2024-08-02T17:12:32.377423Z",
|
||||
"modified": "2024-08-02T17:12:32.377423Z",
|
||||
"name": "Create Anonymous Accounts",
|
||||
"description": "Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--d2c4d87c-409f-4f32-9a31-9e337e970741",
|
||||
"id": "bundle--9e5e873e-0bbc-4f26-a402-3e23c6485c76",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.273283Z",
|
||||
"modified": "2023-09-28T21:25:13.273283Z",
|
||||
"created": "2024-08-02T17:12:32.409219Z",
|
||||
"modified": "2024-08-02T17:12:32.409219Z",
|
||||
"name": "Post across Disciplines",
|
||||
"description": "Post Across Disciplines",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--707137b3-6225-472e-a07c-4a92d0a22b6c",
|
||||
"id": "bundle--42842123-6a10-4b1b-84ff-4e826a17a3e2",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.277436Z",
|
||||
"modified": "2023-09-28T21:25:13.277436Z",
|
||||
"created": "2024-08-02T17:12:32.413845Z",
|
||||
"modified": "2024-08-02T17:12:32.413845Z",
|
||||
"name": "Encourage Physical Violence",
|
||||
"description": "An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--44f9daac-a4fc-4e7e-9682-03efa042ab82",
|
||||
"id": "bundle--a7887cf0-e79d-4f64-9943-ded469cee484",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.222968Z",
|
||||
"modified": "2023-09-28T21:25:13.222968Z",
|
||||
"created": "2024-08-02T17:12:32.363691Z",
|
||||
"modified": "2024-08-02T17:12:32.363691Z",
|
||||
"name": "Evaluate Media Surveys",
|
||||
"description": "An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience\u2019s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c7ea2d2f-edf4-491f-9d18-8a26b73d30ff",
|
||||
"id": "bundle--33704128-7b3a-40df-b6d7-2a3e3a67f3d4",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.205471Z",
|
||||
"modified": "2023-09-28T21:25:13.205471Z",
|
||||
"created": "2024-08-02T17:12:32.344274Z",
|
||||
"modified": "2024-08-02T17:12:32.344274Z",
|
||||
"name": "Use Unencrypted Chats Apps",
|
||||
"description": "Examples include SMS, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--386d5b67-da78-41e2-a782-36e8d364c8bd",
|
||||
"id": "bundle--2212b83b-6b9c-4dd4-bc40-17d1798d55e1",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.250986Z",
|
||||
"modified": "2023-09-28T21:25:13.250986Z",
|
||||
"created": "2024-08-02T17:12:32.394405Z",
|
||||
"modified": "2024-08-02T17:12:32.394405Z",
|
||||
"name": "Leverage Existing Inauthentic News Sites",
|
||||
"description": "Leverage Existing Inauthentic News Sites",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--597df03d-5951-42b5-a04b-a2aab5bc9ecf",
|
||||
"id": "bundle--496df3e6-88a6-4c59-88ae-66a25293731e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.263697Z",
|
||||
"modified": "2023-09-28T21:25:13.263697Z",
|
||||
"created": "2024-08-02T17:12:32.404876Z",
|
||||
"modified": "2024-08-02T17:12:32.404876Z",
|
||||
"name": "Traditional Media",
|
||||
"description": "Examples include TV, Newspaper, Radio, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--411884ce-8862-403a-ac58-1ebf7cb5fb49",
|
||||
"id": "bundle--2964be6a-3bd9-42cd-84b3-e509dcbd1673",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.270307Z",
|
||||
"modified": "2023-09-28T21:25:13.270307Z",
|
||||
"created": "2024-08-02T17:12:32.407759Z",
|
||||
"modified": "2024-08-02T17:12:32.407759Z",
|
||||
"name": "Comment or Reply on Content",
|
||||
"description": "Delivering content by replying or commenting via owned media (assets that the operator controls).",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--9f1138e3-d221-4fb8-9853-210f71b9fd2e",
|
||||
"id": "bundle--42a8c8de-5c27-4fd0-b5e4-16cc5208614a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.203339Z",
|
||||
"modified": "2023-09-28T21:25:13.203339Z",
|
||||
"created": "2024-08-02T17:12:32.343565Z",
|
||||
"modified": "2024-08-02T17:12:32.343565Z",
|
||||
"name": "Demand Insurmountable Proof",
|
||||
"description": "Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the \"firehose of misinformation\". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of \"questions\" while the truth teller is burdened with higher and higher standards of proof.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c25a4ed5-ff5c-4184-af40-63185fd027f0",
|
||||
"id": "bundle--76eee4c5-b6e3-4149-a33e-b3a542c5bcaf",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.282451Z",
|
||||
"modified": "2023-09-28T21:25:13.282451Z",
|
||||
"created": "2024-08-02T17:12:32.416684Z",
|
||||
"modified": "2024-08-02T17:12:32.416684Z",
|
||||
"name": "Redirect URLs",
|
||||
"description": "An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--4d5be5ab-9066-40d6-af57-347d231e4fb6",
|
||||
"id": "bundle--37168ac0-549c-403a-9d31-41fe19a3ea17",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.231884Z",
|
||||
"modified": "2023-09-28T21:25:13.231884Z",
|
||||
"created": "2024-08-02T17:12:32.371128Z",
|
||||
"modified": "2024-08-02T17:12:32.371128Z",
|
||||
"name": "Develop Inauthentic News Articles",
|
||||
"description": "An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--dedb20af-a3ed-4eb4-8daf-16cd2e08c1e6",
|
||||
"id": "bundle--782f4bc8-b4e3-47c5-a57e-07b1c7ff3d1b",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.285122Z",
|
||||
"modified": "2023-09-28T21:25:13.285122Z",
|
||||
"created": "2024-08-02T17:12:32.417607Z",
|
||||
"modified": "2024-08-02T17:12:32.417607Z",
|
||||
"name": "Utilise Bulletproof Hosting",
|
||||
"description": "Hosting refers to services through which storage and computing resources are provided to an individual or organisation for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilise bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--eeaf0531-be7c-45b6-afc0-dbed1617f77c",
|
||||
"id": "bundle--42dd1428-e91b-4115-b7f2-1708f01f77e1",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3437993c-c521-4145-a2d8-b860399876b0",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.2801Z",
|
||||
"modified": "2023-09-28T21:25:13.2801Z",
|
||||
"created": "2024-08-02T17:12:32.415535Z",
|
||||
"modified": "2024-08-02T17:12:32.415535Z",
|
||||
"name": "Break Association with Content",
|
||||
"description": "Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--a6d496d1-d241-4852-b5d4-327c5ffd64e2",
|
||||
"id": "bundle--9a378790-917c-4006-851f-8de2ffa81c4c",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.195892Z",
|
||||
"modified": "2023-09-28T21:25:13.195892Z",
|
||||
"created": "2024-08-02T17:12:32.336169Z",
|
||||
"modified": "2024-08-02T17:12:32.336169Z",
|
||||
"name": "Create Clickbait",
|
||||
"description": "Create attention grabbing headlines (outrage, doubt, humour) required to drive traffic & engagement. This is a key asset.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--bcd1ecab-1563-4d85-8e3b-80064349facd",
|
||||
"id": "bundle--35b0650e-99bb-404c-a54c-bb48d9d22b2c",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.267305Z",
|
||||
"modified": "2023-09-28T21:25:13.267305Z",
|
||||
"created": "2024-08-02T17:12:32.406496Z",
|
||||
"modified": "2024-08-02T17:12:32.406496Z",
|
||||
"name": "Social Media",
|
||||
"description": "Social Media",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--1d1a0b5f-1be3-4c52-8c8c-6f7466953698",
|
||||
"id": "bundle--22d772ff-e5f6-4ace-b4eb-116b885c22e7",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.258959Z",
|
||||
"modified": "2023-09-28T21:25:13.258959Z",
|
||||
"created": "2024-08-02T17:12:32.402241Z",
|
||||
"modified": "2024-08-02T17:12:32.402241Z",
|
||||
"name": "Create Dedicated Hashtag",
|
||||
"description": "Create a campaign/incident specific hashtag.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--3713c941-49b8-4f24-8083-6c506a11ce72",
|
||||
"id": "bundle--bdc125c5-3611-4532-b229-2944ab0c001a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.275328Z",
|
||||
"modified": "2023-09-28T21:25:13.275328Z",
|
||||
"created": "2024-08-02T17:12:32.411564Z",
|
||||
"modified": "2024-08-02T17:12:32.411564Z",
|
||||
"name": "Conduct Server Redirect",
|
||||
"description": "A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side or client-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--6a0de0a1-88d4-4005-8a2c-e41f4063bb91",
|
||||
"id": "bundle--d21e749a-399c-40b4-9c7b-209f278ef8c2",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.204899Z",
|
||||
"modified": "2023-09-28T21:25:13.204899Z",
|
||||
"created": "2024-08-02T17:12:32.344084Z",
|
||||
"modified": "2024-08-02T17:12:32.344084Z",
|
||||
"name": "Use Encrypted Chat Apps",
|
||||
"description": "Examples include Signal, WhatsApp, Discord, Wire, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f9bab428-c384-4942-b2de-195baf6ac01b",
|
||||
"id": "bundle--59297cc3-eb4a-44e7-ad66-2cd6992a7cad",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.243236Z",
|
||||
"modified": "2023-09-28T21:25:13.243236Z",
|
||||
"created": "2024-08-02T17:12:32.379779Z",
|
||||
"modified": "2024-08-02T17:12:32.379779Z",
|
||||
"name": "Use Follow Trains",
|
||||
"description": "A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,16 +1,16 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--597354a2-caf2-4a4f-937b-3ba4210154dd",
|
||||
"id": "bundle--68a42eb4-50cb-4b46-8c13-b9cc08efa754",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.239371Z",
|
||||
"modified": "2023-09-28T21:25:13.239371Z",
|
||||
"created": "2024-08-02T17:12:32.37699Z",
|
||||
"modified": "2024-08-02T17:12:32.37699Z",
|
||||
"name": "Alter Authentic Documents",
|
||||
"description": "Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic can be \"leaked\" during later stages in the operation.",
|
||||
"description": "Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic and can be \"leaked\" during later stages in the operation.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--9763ce34-ff06-439f-9e5a-6189eb3500d7",
|
||||
"id": "bundle--8d0c90be-850b-4d32-8460-c499ca709224",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.248135Z",
|
||||
"modified": "2023-09-28T21:25:13.248135Z",
|
||||
"created": "2024-08-02T17:12:32.382597Z",
|
||||
"modified": "2024-08-02T17:12:32.382597Z",
|
||||
"name": "Create Content Farms",
|
||||
"description": "An influence operation may create an organisation for creating and amplifying campaign artefacts at scale.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--7930ed30-e163-4178-b29d-60e7e54310ff",
|
||||
"id": "bundle--308050af-565a-4fa0-82d9-b0587771b5e9",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.276967Z",
|
||||
"modified": "2023-09-28T21:25:13.276967Z",
|
||||
"created": "2024-08-02T17:12:32.413199Z",
|
||||
"modified": "2024-08-02T17:12:32.413199Z",
|
||||
"name": "Facilitate Logistics or Support for Attendance",
|
||||
"description": "Facilitate logistics or support for travel, food, housing, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--7b84f97c-4639-43b1-a7b5-a15b77650011",
|
||||
"id": "bundle--db232d51-2359-4ae5-a4e3-3e0c741ded1a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.255837Z",
|
||||
"modified": "2023-09-28T21:25:13.255837Z",
|
||||
"created": "2024-08-02T17:12:32.398558Z",
|
||||
"modified": "2024-08-02T17:12:32.398558Z",
|
||||
"name": "Use Existing Echo Chambers/Filter Bubbles",
|
||||
"description": "Use existing Echo Chambers/Filter Bubbles",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--524c667d-ba42-44dc-99ff-f0341f294492",
|
||||
"id": "bundle--42db14eb-21c4-4415-85ff-6ea4a0b6988b",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.195475Z",
|
||||
"modified": "2023-09-28T21:25:13.195475Z",
|
||||
"created": "2024-08-02T17:12:32.335422Z",
|
||||
"modified": "2024-08-02T17:12:32.335422Z",
|
||||
"name": "Raise Funds from Malign Actors",
|
||||
"description": "Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e270b35a-fd95-4c34-879c-ef98af69a7a2",
|
||||
"id": "bundle--4bc6311d-569a-4924-aec6-c9ececa708f4",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.216489Z",
|
||||
"modified": "2023-09-28T21:25:13.216489Z",
|
||||
"created": "2024-08-02T17:12:32.356931Z",
|
||||
"modified": "2024-08-02T17:12:32.356931Z",
|
||||
"name": "Psychographic Segmentation",
|
||||
"description": "An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--8df61d22-73e4-42fe-81f8-88f17e1f440a",
|
||||
"id": "bundle--d78866cf-2eef-4cd3-8dff-bb863f6c5282",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.257668Z",
|
||||
"modified": "2023-09-28T21:25:13.257668Z",
|
||||
"created": "2024-08-02T17:12:32.400306Z",
|
||||
"modified": "2024-08-02T17:12:32.400306Z",
|
||||
"name": "Mainstream Social Networks",
|
||||
"description": "Examples include Facebook, Twitter, LinkedIn, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--b83086c0-b76a-45b4-b775-b336e4f5b623",
|
||||
"id": "bundle--b6b0bec9-0362-4844-b4e7-9dcc47d85ee8",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.256193Z",
|
||||
"modified": "2023-09-28T21:25:13.256193Z",
|
||||
"created": "2024-08-02T17:12:32.399364Z",
|
||||
"modified": "2024-08-02T17:12:32.399364Z",
|
||||
"name": "Exploit Data Voids",
|
||||
"description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--d36d25dd-ffcd-4218-853b-23d09e3325d4",
|
||||
"id": "bundle--14414258-fd23-4684-9630-c08c108445f6",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.223959Z",
|
||||
"modified": "2023-09-28T21:25:13.223959Z",
|
||||
"created": "2024-08-02T17:12:32.365103Z",
|
||||
"modified": "2024-08-02T17:12:32.365103Z",
|
||||
"name": "Identify Social and Technical Vulnerabilities",
|
||||
"description": "Identifying social and technical vulnerabilities determines weaknesses within the target audience information environment for later exploitation. Vulnerabilities include decisive political issues, weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment. Identifying social and technical vulnerabilities facilitates the later exploitation of the identified weaknesses to advance operation objectives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--790268d5-f369-403b-a46d-5ad509c30df0",
|
||||
"id": "bundle--94d03a1c-720e-4f9a-a17d-56c3863d7e6d",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4282febe-c8a6-46da-863c-f19081615d80",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.21143Z",
|
||||
"modified": "2023-09-28T21:25:13.21143Z",
|
||||
"created": "2024-08-02T17:12:32.350087Z",
|
||||
"modified": "2024-08-02T17:12:32.350087Z",
|
||||
"name": "Utilise Spamoflauge",
|
||||
"description": "Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, \"you've w0n our jackp0t!\". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--38165465-d447-4aad-8084-f23ebfbfb2da",
|
||||
"id": "bundle--f8685817-1428-4ab4-9c6f-1816985d82d7",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.247214Z",
|
||||
"modified": "2023-09-28T21:25:13.247214Z",
|
||||
"created": "2024-08-02T17:12:32.381825Z",
|
||||
"modified": "2024-08-02T17:12:32.381825Z",
|
||||
"name": "Develop Owned Media Assets",
|
||||
"description": "An owned media asset refers to an agency or organisation through which an influence operation may create, develop, and host content and narratives. Owned media assets include websites, blogs, social media pages, forums, and other platforms that facilitate the creation and organisation of content.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--8d9d6aaf-d143-4278-b601-05613e12dfcb",
|
||||
"id": "bundle--ca9241d9-8bc9-4609-9f9c-7772037cfb9f",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.223372Z",
|
||||
"modified": "2023-09-28T21:25:13.223372Z",
|
||||
"created": "2024-08-02T17:12:32.364425Z",
|
||||
"modified": "2024-08-02T17:12:32.364425Z",
|
||||
"name": "Conduct Web Traffic Analysis",
|
||||
"description": "An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--fdec7679-d363-46e2-b4f0-eb885fcec3d2",
|
||||
"id": "bundle--738b5d9f-1406-4dc5-8c4e-cb5139826f7c",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.224398Z",
|
||||
"modified": "2023-09-28T21:25:13.224398Z",
|
||||
"created": "2024-08-02T17:12:32.365448Z",
|
||||
"modified": "2024-08-02T17:12:32.365448Z",
|
||||
"name": "Find Echo Chambers",
|
||||
"description": "Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--254ab946-c35a-4f26-9e74-9ad45e2ff842",
|
||||
"id": "bundle--1c441fbd-06b6-4111-ba16-87d8c1e0ac65",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.200791Z",
|
||||
"modified": "2023-09-28T21:25:13.200791Z",
|
||||
"created": "2024-08-02T17:12:32.342026Z",
|
||||
"modified": "2024-08-02T17:12:32.342026Z",
|
||||
"name": "Distort Facts",
|
||||
"description": "Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--af941b53-2a08-4b7e-8300-dd82dc395059",
|
||||
"id": "bundle--7c940633-a4aa-449b-be9d-5b90cf125997",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.243054Z",
|
||||
"modified": "2023-09-28T21:25:13.243054Z",
|
||||
"created": "2024-08-02T17:12:32.379547Z",
|
||||
"modified": "2024-08-02T17:12:32.379547Z",
|
||||
"name": "Create Organisations",
|
||||
"description": "Influence operations may establish organisations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--a66a21ef-a173-4cde-ba42-d60759c41c57",
|
||||
"id": "bundle--f6237991-625a-4716-8183-16180d053d73",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.255442Z",
|
||||
"modified": "2023-09-28T21:25:13.255442Z",
|
||||
"created": "2024-08-02T17:12:32.397193Z",
|
||||
"modified": "2024-08-02T17:12:32.397193Z",
|
||||
"name": "Leverage Echo Chambers/Filter Bubbles",
|
||||
"description": "An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with \u201cothers with which they are already in agreement.\u201d A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--24d6d0eb-2e4c-41d5-bcd0-d96a3588d467",
|
||||
"id": "bundle--35d106c2-5fae-42cf-a024-34d124bc5bf0",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.290171Z",
|
||||
"modified": "2023-09-28T21:25:13.290171Z",
|
||||
"created": "2024-08-02T17:12:32.421381Z",
|
||||
"modified": "2024-08-02T17:12:32.421381Z",
|
||||
"name": "Message Reach",
|
||||
"description": "Monitor and evaluate message reach in misinformation incidents.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--43f7eb05-0876-4b49-a574-4dd94a243847",
|
||||
"id": "bundle--1924b4ec-2ce7-4d51-809d-baeb832b2758",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.246267Z",
|
||||
"modified": "2023-09-28T21:25:13.246267Z",
|
||||
"created": "2024-08-02T17:12:32.380974Z",
|
||||
"modified": "2024-08-02T17:12:32.380974Z",
|
||||
"name": "Identify Susceptible Targets in Networks",
|
||||
"description": "When seeking to infiltrate an existing network, an influence operation may identify individuals and groups that might be susceptible to being co-opted or influenced.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c8b9df5e-59ba-4442-8f92-91cde7dbcba9",
|
||||
"id": "bundle--553c753b-15bd-4e7d-9e8b-62616d7148ff",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.228328Z",
|
||||
"modified": "2023-09-28T21:25:13.228328Z",
|
||||
"created": "2024-08-02T17:12:32.369011Z",
|
||||
"modified": "2024-08-02T17:12:32.369011Z",
|
||||
"name": "Use Copypasta",
|
||||
"description": "Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta\u2019s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--b85c35ca-6b6b-4157-a1d0-3d17eb612378",
|
||||
"id": "bundle--af83a6a2-c444-4483-98f5-5927461d0804",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--50f92bc8-f6ad-4267-bd00-f4c572370a72",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.206965Z",
|
||||
"modified": "2023-09-28T21:25:13.206965Z",
|
||||
"created": "2024-08-02T17:12:32.344897Z",
|
||||
"modified": "2024-08-02T17:12:32.344897Z",
|
||||
"name": "Use Search Engine Optimisation",
|
||||
"description": "Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka \"Black-hat SEO\"",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--76846529-cada-411b-bd11-af4b98c3f1f4",
|
||||
"id": "bundle--443a036d-c12e-4cad-bd05-42ddc7627882",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.270783Z",
|
||||
"modified": "2023-09-28T21:25:13.270783Z",
|
||||
"created": "2024-08-02T17:12:32.408023Z",
|
||||
"modified": "2024-08-02T17:12:32.408023Z",
|
||||
"name": "Post Inauthentic Social Media Comment",
|
||||
"description": "Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--bbd7a8b3-9663-4632-8a4d-b8bdd7f2f8e8",
|
||||
"id": "bundle--1fe89da0-e37c-4504-848a-d7dc6ddc6f47",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5414f74d-0b10-4562-ad9d-e5e1093e255a",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.219041Z",
|
||||
"modified": "2023-09-28T21:25:13.219041Z",
|
||||
"created": "2024-08-02T17:12:32.360306Z",
|
||||
"modified": "2024-08-02T17:12:32.360306Z",
|
||||
"name": "Dismiss",
|
||||
"description": "Push back against criticism by dismissing your critics. This might be arguing that the critics use a different standard for you than with other actors or themselves; or arguing that their criticism is biassed.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c1b1845f-f5b0-4d07-abe1-d98f26c7c32f",
|
||||
"id": "bundle--d650442f-22ab-42d3-bea3-c13f4165fc2a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.27495Z",
|
||||
"modified": "2023-09-28T21:25:13.27495Z",
|
||||
"created": "2024-08-02T17:12:32.411369Z",
|
||||
"modified": "2024-08-02T17:12:32.411369Z",
|
||||
"name": "Destroy Information Generation Capabilities",
|
||||
"description": "Destroying information generation capabilities refers to actions taken to limit, degrade, or otherwise incapacitate an actor\u2019s ability to generate conflicting information. An influence operation may destroy an actor\u2019s information generation capabilities by physically dismantling the information infrastructure, disconnecting resources needed for information generation, or redirecting information generation personnel. An operation may destroy an adversary\u2019s information generation capabilities to limit conflicting content exposure to the target audience and crowd the information space with its own narratives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--9383febc-dd7c-454b-a110-1ccfd70d3b91",
|
||||
"id": "bundle--c83cb969-86df-4bc6-80c5-a850cd7f899d",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.289474Z",
|
||||
"modified": "2023-09-28T21:25:13.289474Z",
|
||||
"created": "2024-08-02T17:12:32.420557Z",
|
||||
"modified": "2024-08-02T17:12:32.420557Z",
|
||||
"name": "Awareness",
|
||||
"description": "Measure current system state with respect to the effectiveness of influencing awareness.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--a4edde62-06aa-4210-a2ed-4ab9cd239c55",
|
||||
"id": "bundle--01fe8aad-c800-4ddc-966c-cd9729c938a7",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.224906Z",
|
||||
"modified": "2023-09-28T21:25:13.224906Z",
|
||||
"created": "2024-08-02T17:12:32.36588Z",
|
||||
"modified": "2024-08-02T17:12:32.36588Z",
|
||||
"name": "Identify Data Voids",
|
||||
"description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--edd394c2-0676-4441-b36d-8883b9eb6ccf",
|
||||
"id": "bundle--f417b352-242c-49c9-b667-9186c9f18444",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.277105Z",
|
||||
"modified": "2023-09-28T21:25:13.277105Z",
|
||||
"created": "2024-08-02T17:12:32.413349Z",
|
||||
"modified": "2024-08-02T17:12:32.413349Z",
|
||||
"name": "Physical Violence",
|
||||
"description": "Physical violence refers to the use of force to injure, abuse, damage, or destroy. An influence operation may conduct or encourage physical violence to discourage opponents from promoting conflicting content or draw attention to operation narratives using shock value.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--354801d3-22ba-4123-ab59-e8facb7b8800",
|
||||
"id": "bundle--ef61da7d-7f1e-41a7-a034-4e9ed9c137b4",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.277243Z",
|
||||
"modified": "2023-09-28T21:25:13.277243Z",
|
||||
"created": "2024-08-02T17:12:32.413648Z",
|
||||
"modified": "2024-08-02T17:12:32.413648Z",
|
||||
"name": "Conduct Physical Violence",
|
||||
"description": "An influence operation may directly Conduct Physical Violence to achieve campaign goals.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e04715f0-b252-4db3-977c-9e34cb387ab3",
|
||||
"id": "bundle--8f5582d0-279a-4c82-9fa5-0d6b6bd170a2",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.235858Z",
|
||||
"modified": "2023-09-28T21:25:13.235858Z",
|
||||
"created": "2024-08-02T17:12:32.37578Z",
|
||||
"modified": "2024-08-02T17:12:32.37578Z",
|
||||
"name": "Deceptively Edit Video (Cheap Fakes)",
|
||||
"description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--a3187df7-ce39-4a67-83cc-72bb0e1896b1",
|
||||
"id": "bundle--e6a64ec2-eb52-4b7e-80e6-672961344919",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.242366Z",
|
||||
"modified": "2023-09-28T21:25:13.242366Z",
|
||||
"created": "2024-08-02T17:12:32.378557Z",
|
||||
"modified": "2024-08-02T17:12:32.378557Z",
|
||||
"name": "Recruit Contractors",
|
||||
"description": "Operators recruit paid contractor to support the campaign.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--29c900a0-3d71-4a1c-9708-126f036c3635",
|
||||
"id": "bundle--8672b5dd-5b08-4c32-9681-df167578faaf",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--58b169c1-7e9a-4300-a98f-eb7baee8967f",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.23435Z",
|
||||
"modified": "2023-09-28T21:25:13.23435Z",
|
||||
"created": "2024-08-02T17:12:32.374865Z",
|
||||
"modified": "2024-08-02T17:12:32.374865Z",
|
||||
"name": "Aggregate Information into Evidence Collages",
|
||||
"description": "Image files that aggregate positive evidence (Joan Donovan)",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--fc23689c-583c-4a27-8169-a3e25ef68e3c",
|
||||
"id": "bundle--f2ed5491-1539-4e78-aa21-2e341b0e8db7",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--594993b4-86a3-455b-af59-61f167d7fd93",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.226785Z",
|
||||
"modified": "2023-09-28T21:25:13.226785Z",
|
||||
"created": "2024-08-02T17:12:32.367108Z",
|
||||
"modified": "2024-08-02T17:12:32.367108Z",
|
||||
"name": "Identify Wedge Issues",
|
||||
"description": "A wedge issue is a divisive political issue, usually concerning a social phenomenon, that divides individuals along a defined line. An influence operation may exploit wedge issues by intentionally polarising the public along the wedge issue line and encouraging opposition between factions.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--60871686-5e84-4b0f-9984-8a4b1c278af3",
|
||||
"id": "bundle--3f4e0f21-97a5-4747-815b-e9028eebf371",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5a279d23-6ba2-425c-bf72-20c6411ca5a7",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.223169Z",
|
||||
"modified": "2023-09-28T21:25:13.223169Z",
|
||||
"created": "2024-08-02T17:12:32.364042Z",
|
||||
"modified": "2024-08-02T17:12:32.364042Z",
|
||||
"name": "Identify Trending Topics/Hashtags",
|
||||
"description": "An influence operation may identify trending hashtags on social media platforms for later use in boosting operation content. A hashtag40 refers to a word or phrase preceded by the hash symbol (#) on social media used to identify messages and posts relating to a specific topic. All public posts that use the same hashtag are aggregated onto a centralised page dedicated to the word or phrase and sorted either chronologically or by popularity.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--8e15485e-1631-4178-8da2-e86150b9d873",
|
||||
"id": "bundle--8c4e5ccf-06b0-434d-b9ce-a9de90240c74",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5b6aaad5-7166-4321-ae82-b9300a2ddad7",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.236325Z",
|
||||
"modified": "2023-09-28T21:25:13.236325Z",
|
||||
"created": "2024-08-02T17:12:32.375987Z",
|
||||
"modified": "2024-08-02T17:12:32.375987Z",
|
||||
"name": "Develop Audio-Based Content",
|
||||
"description": "Creating and editing false or misleading audio artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include creating completely new audio content, repurposing existing audio artefacts (including cheap fakes), or using AI-generated audio creation and editing technologies (including deepfakes).",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--a387b741-b82e-4d20-8103-66107fb30e72",
|
||||
"id": "bundle--c3876de9-7079-46e1-9bf6-1cc71613610b",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5bbea132-9da6-42f7-93e9-71f0a9cf311d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.273641Z",
|
||||
"modified": "2023-09-28T21:25:13.273641Z",
|
||||
"created": "2024-08-02T17:12:32.409621Z",
|
||||
"modified": "2024-08-02T17:12:32.409621Z",
|
||||
"name": "Use Affiliate Marketing Programmes",
|
||||
"description": "Use Affiliate Marketing Programmes",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--b72ed1a8-650b-4630-ace2-3cf62bb3b7e9",
|
||||
"id": "bundle--d823ed68-575e-430b-b9f8-869e20f4e75d",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5bc895e8-eb26-43ec-8469-ab665092970d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.21013Z",
|
||||
"modified": "2023-09-28T21:25:13.21013Z",
|
||||
"created": "2024-08-02T17:12:32.347214Z",
|
||||
"modified": "2024-08-02T17:12:32.347214Z",
|
||||
"name": "Dox",
|
||||
"description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--978ff4cd-1e44-405b-a442-00e2316ef23c",
|
||||
"id": "bundle--5388c880-5f56-4dc6-8f2d-d99188993717",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5bca3084-f5b0-48a8-934c-7f2c03bfd2c3",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.278976Z",
|
||||
"modified": "2023-09-28T21:25:13.278976Z",
|
||||
"created": "2024-08-02T17:12:32.414942Z",
|
||||
"modified": "2024-08-02T17:12:32.414942Z",
|
||||
"name": "Change Names of Information Assets",
|
||||
"description": "Changing names or brand names of information assets such as accounts, channels, pages etc. An operation may change the names or brand names of its assets throughout an operation to avoid detection or alter the names of newly acquired or repurposed assets to fit operational narratives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--80f1b645-a5bc-4172-b736-c96f9e8872d3",
|
||||
"id": "bundle--35dd4d54-8557-42d5-acc5-c60aac924f17",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5d4cafe2-42cc-4c41-8ce7-41256e1383f7",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.202853Z",
|
||||
"modified": "2023-09-28T21:25:13.202853Z",
|
||||
"name": "Bait Legitimate Influencers",
|
||||
"description": "Credibility in a social media environment is often a function of the size of a user's network. \"Influencers\" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial. By targeting high-influence people and organisations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders.",
|
||||
"created": "2024-08-02T17:12:32.343367Z",
|
||||
"modified": "2024-08-02T17:12:32.343367Z",
|
||||
"name": "Bait Influencer",
|
||||
"description": "Influencers are people on social media platforms who have large audiences.<br /> <br />Threat Actors can try to trick Influencers such as celebrities, journalists, or local leaders who aren\u2019t associated with their campaign into amplifying campaign content. This gives them access to the Influencer\u2019s audience without having to go through the effort of building it themselves, and it helps legitimise their message by associating it with the Influencer, benefitting from their audience\u2019s trust in them.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "conduct-pump-priming"
|
||||
"phase_name": "maximise-exposure"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--1248df96-38fb-436f-a12e-c422f7877c8f",
|
||||
"id": "bundle--09d6d1d5-d274-43d7-b43f-8b54b24cc601",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5daa2f8a-2460-4cdd-ae55-b70f439a9f51",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.269813Z",
|
||||
"modified": "2023-09-28T21:25:13.269813Z",
|
||||
"created": "2024-08-02T17:12:32.407532Z",
|
||||
"modified": "2024-08-02T17:12:32.407532Z",
|
||||
"name": "One-Way Direct Posting",
|
||||
"description": "Direct posting refers to a method of posting content via a one-way messaging service, where the recipient cannot directly respond to the poster\u2019s messaging. An influence operation may post directly to promote operation narratives to the target audience without allowing opportunities for fact-checking or disagreement, creating a false sense of support for the narrative.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--a312ddbb-cff2-46ba-8251-c28251b91dfa",
|
||||
"id": "bundle--332a1517-7fc5-4f25-8679-b461f778b8f3",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5dc224b1-c69e-496d-91f7-e8ce4fd3f166",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.288478Z",
|
||||
"modified": "2023-09-28T21:25:13.288478Z",
|
||||
"created": "2024-08-02T17:12:32.419551Z",
|
||||
"modified": "2024-08-02T17:12:32.419551Z",
|
||||
"name": "Content Focused",
|
||||
"description": "Measure the performance of campaign content",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--0bbc8289-e38c-4a0d-a910-613213b96d98",
|
||||
"id": "bundle--2a022589-ca2c-432b-8ddc-39d06a24534f",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5e7541d8-2b43-4443-89d9-7362ca78944c",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.273494Z",
|
||||
"modified": "2023-09-28T21:25:13.273494Z",
|
||||
"created": "2024-08-02T17:12:32.409423Z",
|
||||
"modified": "2024-08-02T17:12:32.409423Z",
|
||||
"name": "Incentivize Sharing",
|
||||
"description": "Incentivizing content sharing refers to actions that encourage users to share content themselves, reducing the need for the operation itself to post and promote its own content.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--4db02a9a-26f2-454e-be56-3a043e3a6794",
|
||||
"id": "bundle--a98f4227-3754-4a70-b762-31824fb49e60",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.232379Z",
|
||||
"modified": "2023-09-28T21:25:13.232379Z",
|
||||
"created": "2024-08-02T17:12:32.3734Z",
|
||||
"modified": "2024-08-02T17:12:32.3734Z",
|
||||
"name": "Develop Image-Based Content",
|
||||
"description": "Creating and editing false or misleading visual artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include photographing staged real-life situations, repurposing existing digital images, or using image creation and editing technologies.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c267cae6-67ed-4bdf-844a-e71d1b6b6faa",
|
||||
"id": "bundle--404214ff-d4dc-42c9-b81f-bf2b6e2e6b13",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--61df6490-ca2c-41b7-a251-ded790a03a71",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.196042Z",
|
||||
"modified": "2023-09-28T21:25:13.196042Z",
|
||||
"created": "2024-08-02T17:12:32.336388Z",
|
||||
"modified": "2024-08-02T17:12:32.336388Z",
|
||||
"name": "Conduct Fundraising",
|
||||
"description": "Fundraising campaigns refer to an influence operation\u2019s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services166 on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns to promote operation messaging while raising money to support its activities.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f47cb1e5-935f-4a46-bc30-ea62bfd13d04",
|
||||
"id": "bundle--9f496bf0-5511-4290-b236-919760e8562d",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--62036130-6083-43e3-b1e0-8ab0822bedda",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.258527Z",
|
||||
"modified": "2023-09-28T21:25:13.258527Z",
|
||||
"created": "2024-08-02T17:12:32.401797Z",
|
||||
"modified": "2024-08-02T17:12:32.401797Z",
|
||||
"name": "Use Hashtags",
|
||||
"description": "Use a dedicated, existing hashtag for the campaign/incident.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f4eb45b9-d9f6-4f5d-9885-d74afc20cf6a",
|
||||
"id": "bundle--0c164a85-8945-4c03-b3ab-8d17b6a52cbf",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--625fe1a6-ee9d-45c8-9912-9e9f6e87dc85",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.226454Z",
|
||||
"modified": "2023-09-28T21:25:13.226454Z",
|
||||
"created": "2024-08-02T17:12:32.366827Z",
|
||||
"modified": "2024-08-02T17:12:32.366827Z",
|
||||
"name": "Identify Existing Conspiracy Narratives/Suspicions",
|
||||
"description": "An influence operation may assess preexisting conspiracy theories or suspicions in a population to identify existing narratives that support operational objectives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,20 +1,20 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--1bfb4da1-b2c7-4513-a1a0-ba3b41e7e8b4",
|
||||
"id": "bundle--36db7159-129e-40af-896e-6c70921f3880",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--64bcccb9-4d10-4eed-8c49-8816ecfd78a3",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.248612Z",
|
||||
"modified": "2023-09-28T21:25:13.248612Z",
|
||||
"created": "2024-08-02T17:12:32.382901Z",
|
||||
"modified": "2024-08-02T17:12:32.382901Z",
|
||||
"name": "Outsource Content Creation to External Organisations",
|
||||
"description": "An influence operation may outsource content creation to external companies to avoid attribution, increase the rate of content creation, or improve content quality, i.e., by employing an organisation that can create content in the target audience\u2019s native language. Employed organisations may include marketing companies for tailored advertisements or external content farms for high volumes of targeted media.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "establish-social-assets"
|
||||
"phase_name": "establish-assets"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--bd950293-02f9-4b39-8300-902ec3a625f1",
|
||||
"id": "bundle--7992d67b-9b2a-4b21-b9c0-1cab374a318a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--651a5188-f38a-42be-a253-d1b90cbd28e1",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.275963Z",
|
||||
"modified": "2023-09-28T21:25:13.275963Z",
|
||||
"created": "2024-08-02T17:12:32.412165Z",
|
||||
"modified": "2024-08-02T17:12:32.412165Z",
|
||||
"name": "Goad People into Harmful Action (Stop Hitting Yourself)",
|
||||
"description": "Goad people into actions that violate terms of service or will lead to having their content or accounts taken down.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user