diff --git a/CODE/generate_DISARM_pages.py b/CODE/generate_DISARM_pages.py index 4f860d6..6c10938 100644 --- a/CODE/generate_DISARM_pages.py +++ b/CODE/generate_DISARM_pages.py @@ -107,6 +107,8 @@ class Disarm: self.df_techniques = metadata['techniques'] self.df_tasks = metadata['tasks'] self.df_incidents = metadata['incidents'] + self.df_urls = metadata['urls'] + #self.df_urls['url_id'] = self.df_urls['url_id'].str.rstrip # strip trailing spaces from urls to allow merge to work self.df_externalgroups = metadata['externalgroups'] self.df_tools = metadata['tools'] self.df_examples = metadata['examples'] @@ -210,19 +212,43 @@ class Disarm: GENERATED_PAGES_FUDGE, techstring) return incidentstr - - def create_incident_urls_string(self, incidentid): +# def create_technique_counters_string(self, technique_id): +# table_string = ''' +#| Counters | Response types | +#| -------- | -------------- | +#''' +# technique_counters = self.cross_counterid_techniqueid[self.cross_counterid_techniqueid['technique_id']==technique_id] +# technique_counters = pd.merge(technique_counters, self.df_counters[['disarm_id', 'name', 'responsetype']]) +# row_string = '| [{0} {1}]({2}counters/{0}.md) | {3} |\n' +# for index, row in technique_counters.sort_values('disarm_id').iterrows(): +# table_string += row_string.format(row['disarm_id'], row['name'], GENERATED_PAGES_FUDGE, row['responsetype']) +# return table_string + def create_incident_urls_string(self, incidentid): + urlsstr = ''' -| Reference(s) | -| --------- | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | ''' - - urlsrow = '| [{0}]({0}) |\n' incidentid_urls = self.cross_incidentid_urls[self.cross_incidentid_urls['disarm_id']==incidentid] + incidentid_urls = pd.merge(incidentid_urls, self.df_urls[['url_id', 'pub_date', 'authors', 'org', 'archive_link']]) + urlsrow = '| [{0}]({0}) | {1} | {2} | {3} | [{4}]({4}) |\n' for index, row in incidentid_urls.iterrows(): - urlsstr += urlsrow.format(row['url_id']) - return urlsstr + urlsstr += urlsrow.format(row['url_id'], row['pub_date'], row['authors'], row['org'], row['archive_link']) + return urlsstr + + #def create_incident_urls_string(self, incidentid, pub_date, authors, org, archive_link): + +# urlsstr = ''' +#| Reference | Pub Date | Authors | Org | Archive | +#| --------- | -------- | ------- | --- | ------- | +#''' + +# urlsrow = '| [{0}]({0}) | {1} | {2} | {3} | [{4}]({4}) |\n' +# incidentid_urls = self.cross_incidentid_urls[self.cross_incidentid_urls['disarm_id']==incidentid] +# for index, row in incidentid_urls.iterrows(): +# urlsstr += urlsrow.format(row['url_id'], pub_date, authors, org, archive_link) +# return urlsstr def create_incident_techniques_string(self, incidentid): diff --git a/DISARM_MASTER_DATA/DISARM_DATA_MASTER.xlsx b/DISARM_MASTER_DATA/DISARM_DATA_MASTER.xlsx index e626dea..d1b4acc 100644 Binary files a/DISARM_MASTER_DATA/DISARM_DATA_MASTER.xlsx and b/DISARM_MASTER_DATA/DISARM_DATA_MASTER.xlsx differ diff --git a/DISARM_MASTER_DATA/DISARM_FRAMEWORKS_MASTER.xlsx b/DISARM_MASTER_DATA/DISARM_FRAMEWORKS_MASTER.xlsx index 89e6e0c..4123a13 100644 Binary files a/DISARM_MASTER_DATA/DISARM_FRAMEWORKS_MASTER.xlsx and b/DISARM_MASTER_DATA/DISARM_FRAMEWORKS_MASTER.xlsx differ diff --git a/generated_files/DISARM_STIX/DISARM.json b/generated_files/DISARM_STIX/DISARM.json index 93d7ab5..83d4768 100644 --- a/generated_files/DISARM_STIX/DISARM.json +++ b/generated_files/DISARM_STIX/DISARM.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c3dfd6f0-fdc8-4288-a642-3ab03eb1a94e", + "id": "bundle--d51cac73-5edf-4cff-81e4-3c08d7e6efd4", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--b03163eb-7e81-4fed-9819-641bf7c99507", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.327787Z", - "modified": "2024-03-13T22:04:00.327787Z", + "created": "2024-08-02T17:12:32.315732Z", + "modified": "2024-08-02T17:12:32.315732Z", "name": "Plan Strategy", "description": "Define the desired end state, i.e. the set of required conditions that defines achievement of all objectives.", "external_references": [ @@ -28,8 +28,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--431af018-56ae-406c-9648-4857f074fffc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.328093Z", - "modified": "2024-03-13T22:04:00.328093Z", + "created": "2024-08-02T17:12:32.316693Z", + "modified": "2024-08-02T17:12:32.316693Z", "name": "Plan Objectives", "description": "Set clearly defined, measurable, and achievable objectives. In some cases achieving objectives ties execution of tactical tasks to reaching the desired strategic end state. In other cases, where there is no clearly defined strategic end state, the tactical objective may stand on its own. The objective statement should not specify the way and means of accomplishment but rather the goal the threat actor wishes to achieve. ", "external_references": [ @@ -49,8 +49,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--acaf8903-418f-425a-93dc-8e1bfb626876", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.328269Z", - "modified": "2024-03-13T22:04:00.328269Z", + "created": "2024-08-02T17:12:32.317385Z", + "modified": "2024-08-02T17:12:32.317385Z", "name": "Microtarget", "description": "Actions taken which help target content to specific audiences identified and analysed as part of TA13: Target Audience Analysis.", "external_references": [ @@ -70,8 +70,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--82039146-59a3-4353-b328-a422da34db6b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.32843Z", - "modified": "2024-03-13T22:04:00.32843Z", + "created": "2024-08-02T17:12:32.318087Z", + "modified": "2024-08-02T17:12:32.318087Z", "name": "Develop Content", "description": "Create or acquire text, images, and other content", "external_references": [ @@ -91,8 +91,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--3c73d309-b066-44f9-ad81-866a64e438c9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.328595Z", - "modified": "2024-03-13T22:04:00.328595Z", + "created": "2024-08-02T17:12:32.319152Z", + "modified": "2024-08-02T17:12:32.319152Z", "name": "Select Channels and Affordances", "description": "Selecting platforms and affordances assesses which online or offline platforms and their associated affordances maximise an influence operation\u2019s ability to reach its target audience. To select the most appropriate platform(s), an operation may assess the technological affordances including platform algorithms, terms of service, permitted content types, or other attributes that determine platform usability and accessibility. Selecting platforms includes both choosing platforms on which the operation will publish its own content and platforms on which the operation will attempt to restrict adversarial content.", "external_references": [ @@ -112,8 +112,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--8a96b3ce-332e-4685-8ec6-5140eef192a4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.328764Z", - "modified": "2024-03-13T22:04:00.328764Z", + "created": "2024-08-02T17:12:32.319623Z", + "modified": "2024-08-02T17:12:32.319623Z", "name": "Conduct Pump Priming", "description": "Release content on a targetted small scale, prior to general release, including releasing seed. Used for preparation before broader release, and as message honing. Used for preparation before broader release, and as message honing.", "external_references": [ @@ -133,8 +133,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--4a9c3d11-801b-4ee9-a5bc-b5bc042a92f9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.329342Z", - "modified": "2024-03-13T22:04:00.329342Z", + "created": "2024-08-02T17:12:32.319893Z", + "modified": "2024-08-02T17:12:32.319893Z", "name": "Deliver Content", "description": "Release content to general public or larger population", "external_references": [ @@ -154,8 +154,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--3fa1ad18-ca09-40ed-be45-f210b9c07e0b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.329481Z", - "modified": "2024-03-13T22:04:00.329481Z", + "created": "2024-08-02T17:12:32.320208Z", + "modified": "2024-08-02T17:12:32.320208Z", "name": "Drive Offline Activity", "description": "Move incident/campaign from online to offline. Encouraging users to move from the platform on which they initially viewed operation content and engage in the physical information space or offline world. This may include operation-aligned rallies or protests, radio, newspaper, or billboards. An influence operation may drive to physical forums to diversify its information channels and facilitate spaces where the target audience can engage with both operation content and like-minded individuals offline.", "external_references": [ @@ -175,8 +175,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--dffcf337-d4d9-449b-aa9c-6a97a891c5a9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.329598Z", - "modified": "2024-03-13T22:04:00.329598Z", + "created": "2024-08-02T17:12:32.320492Z", + "modified": "2024-08-02T17:12:32.320492Z", "name": "Persist in the Information Environment", "description": "Persist in the Information Space refers to taking measures that allow an operation to maintain its presence and avoid takedown by an external entity. Techniques in Persist in the Information Space help campaigns operate without detection and appear legitimate to the target audience and platform monitoring services. Influence operations on social media often persist online by varying the type of information assets and platforms used throughout the campaign.", "external_references": [ @@ -196,8 +196,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--19886784-0e07-474f-803c-30c443e65347", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.32971Z", - "modified": "2024-03-13T22:04:00.32971Z", + "created": "2024-08-02T17:12:32.320822Z", + "modified": "2024-08-02T17:12:32.320822Z", "name": "Assess Effectiveness", "description": "Assess effectiveness of action, for use in future plans", "external_references": [ @@ -217,8 +217,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--1e005da9-56cc-4802-af90-b267d17a1ad1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.329821Z", - "modified": "2024-03-13T22:04:00.329821Z", + "created": "2024-08-02T17:12:32.321082Z", + "modified": "2024-08-02T17:12:32.321082Z", "name": "Target Audience Analysis", "description": "Identifying and analysing the target audience examines target audience member locations, political affiliations, financial situations, and other attributes that an influence operation may incorporate into its messaging strategy. During this tactic, influence operations may also identify existing similarities and differences between target audience members to unite like groups and divide opposing groups. Identifying and analysing target audience members allows influence operations to tailor operation strategy and content to their analysis.", "external_references": [ @@ -238,8 +238,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--fd1e7dd3-63d0-4040-808e-3e61b9ddca86", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.329933Z", - "modified": "2024-03-13T22:04:00.329933Z", + "created": "2024-08-02T17:12:32.32137Z", + "modified": "2024-08-02T17:12:32.32137Z", "name": "Develop Narratives", "description": "The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a \"\"whole of society\"\" perspective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives centre more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion constitutes an ongoing tactical struggle carried out at a whole-of-society level. Tactically, their promotion covers a broad spectrum of activities both on- and offline.", "external_references": [ @@ -257,10 +257,10 @@ { "type": "x-mitre-tactic", "spec_version": "2.1", - "id": "x-mitre-tactic--8fc5e05d-c61d-41bc-a009-c9235ec420fb", + "id": "x-mitre-tactic--c6c75568-5369-4f9e-89c1-43307702a19c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.330044Z", - "modified": "2024-03-13T22:04:00.330044Z", + "created": "2024-08-02T17:12:32.322106Z", + "modified": "2024-08-02T17:12:32.322106Z", "name": "Establish Assets", "description": "Establishing information assets generates messaging tools, including social media accounts, operation personnel, and organisations, including directly and indirectly managed assets. For assets under their direct control, the operation can add, change, or remove these assets at will. Establishing information assets allows an influence operation to promote messaging directly to the target audience without navigating through external entities. Many online influence operations create or compromise social media accounts as a primary vector of information dissemination.\n\nThis Tactic was previously called Establish Social Assets.", "external_references": [ @@ -280,8 +280,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--8f32bafc-edb2-4d3c-9b7e-e42a9147123b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.33016Z", - "modified": "2024-03-13T22:04:00.33016Z", + "created": "2024-08-02T17:12:32.323279Z", + "modified": "2024-08-02T17:12:32.323279Z", "name": "Establish Legitimacy", "description": "Establish assets that create trust", "external_references": [ @@ -299,10 +299,10 @@ { "type": "x-mitre-tactic", "spec_version": "2.1", - "id": "x-mitre-tactic--51a3f349-b77f-4e84-9fa8-765f8aa8b695", + "id": "x-mitre-tactic--03e4259c-83fc-40d6-9e20-1269a7adaac8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.33027Z", - "modified": "2024-03-13T22:04:00.33027Z", + "created": "2024-08-02T17:12:32.324177Z", + "modified": "2024-08-02T17:12:32.324177Z", "name": "Maximise Exposure", "description": "Maximise exposure of the target audience to incident/campaign content via flooding, amplifying, and cross-posting.", "external_references": [ @@ -322,8 +322,8 @@ "spec_version": "2.1", "id": "x-mitre-tactic--f0505ac9-8979-49e4-a87c-d1109536a7db", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.330414Z", - "modified": "2024-03-13T22:04:00.330414Z", + "created": "2024-08-02T17:12:32.324963Z", + "modified": "2024-08-02T17:12:32.324963Z", "name": "Drive Online Harms", "description": "Actions taken by an influence operation to harm their opponents in online spaces through harassment, suppression, releasing private information, and controlling the information space through offensive cyberspace operations.", "external_references": [ @@ -343,8 +343,8 @@ "spec_version": "2.1", "id": "attack-pattern--70717452-f7e3-4ce8-956f-39a4d34c5cfb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.331247Z", - "modified": "2024-03-13T22:04:00.331247Z", + "created": "2024-08-02T17:12:32.328302Z", + "modified": "2024-08-02T17:12:32.328302Z", "name": "Facilitate State Propaganda", "description": "Organise citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda.", "kill_chain_phases": [ @@ -376,8 +376,8 @@ "spec_version": "2.1", "id": "attack-pattern--9cf02828-bd4c-4b04-a9f0-bb67ec3b0493", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.331576Z", - "modified": "2024-03-13T22:04:00.331576Z", + "created": "2024-08-02T17:12:32.329903Z", + "modified": "2024-08-02T17:12:32.329903Z", "name": "Leverage Existing Narratives", "description": "Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices.", "kill_chain_phases": [ @@ -409,8 +409,8 @@ "spec_version": "2.1", "id": "attack-pattern--75a5c211-2590-498c-ad3a-129c912d5cd2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.331775Z", - "modified": "2024-03-13T22:04:00.331775Z", + "created": "2024-08-02T17:12:32.331268Z", + "modified": "2024-08-02T17:12:32.331268Z", "name": "Develop Competing Narratives", "description": "Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centred on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the \"firehose of misinformation\" approach.", "kill_chain_phases": [ @@ -442,8 +442,8 @@ "spec_version": "2.1", "id": "attack-pattern--d1ad0738-1f52-4fab-b0d1-640b551d7f6a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.332045Z", - "modified": "2024-03-13T22:04:00.332045Z", + "created": "2024-08-02T17:12:32.33212Z", + "modified": "2024-08-02T17:12:32.33212Z", "name": "Create Inauthentic Social Media Pages and Groups", "description": "Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.", "kill_chain_phases": [ @@ -470,79 +470,13 @@ ], "x_mitre_version": "2.1" }, - { - "type": "attack-pattern", - "spec_version": "2.1", - "id": "attack-pattern--7981d39a-01be-46f6-b9f9-507d0c03e919", - "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.332349Z", - "modified": "2024-03-13T22:04:00.332349Z", - "name": "Create Fake Experts", - "description": "Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself.", - "kill_chain_phases": [ - { - "kill_chain_name": "mitre-attack", - "phase_name": "establish-legitimacy" - } - ], - "external_references": [ - { - "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0009.md", - "external_id": "T0009" - } - ], - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ], - "x_mitre_is_subtechnique": false, - "x_mitre_platforms": [ - "Windows", - "Linux", - "Mac" - ], - "x_mitre_version": "2.1" - }, - { - "type": "attack-pattern", - "spec_version": "2.1", - "id": "attack-pattern--ec740173-f964-47cc-b849-06a1b134ee4f", - "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.332592Z", - "modified": "2024-03-13T22:04:00.332592Z", - "name": "Utilise Academic/Pseudoscientific Justifications", - "description": "Utilise Academic/Pseudoscientific Justifications", - "kill_chain_phases": [ - { - "kill_chain_name": "mitre-attack", - "phase_name": "establish-legitimacy" - } - ], - "external_references": [ - { - "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0009.001.md", - "external_id": "T0009.001" - } - ], - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ], - "x_mitre_is_subtechnique": true, - "x_mitre_platforms": [ - "Windows", - "Linux", - "Mac" - ], - "x_mitre_version": "2.1" - }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bacbdfd3-f8c2-4126-a9f3-1b75576fa5e7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.332778Z", - "modified": "2024-03-13T22:04:00.332778Z", + "created": "2024-08-02T17:12:32.333012Z", + "modified": "2024-08-02T17:12:32.333012Z", "name": "Cultivate Ignorant Agents", "description": "Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state\u2019s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as \"useful idiots\" or \"unwitting agents\".", "kill_chain_phases": [ @@ -574,8 +508,8 @@ "spec_version": "2.1", "id": "attack-pattern--95e3e261-2f42-4ff0-a1f9-4eb2c5998284", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.332915Z", - "modified": "2024-03-13T22:04:00.332915Z", + "created": "2024-08-02T17:12:32.333954Z", + "modified": "2024-08-02T17:12:32.333954Z", "name": "Create Inauthentic Websites", "description": "Create media assets to support inauthentic organisations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations.", "kill_chain_phases": [ @@ -607,8 +541,8 @@ "spec_version": "2.1", "id": "attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.333337Z", - "modified": "2024-03-13T22:04:00.333337Z", + "created": "2024-08-02T17:12:32.335027Z", + "modified": "2024-08-02T17:12:32.335027Z", "name": "Prepare Fundraising Campaigns", "description": "Fundraising campaigns refer to an influence operation\u2019s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities.", "kill_chain_phases": [ @@ -640,8 +574,8 @@ "spec_version": "2.1", "id": "attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.333792Z", - "modified": "2024-03-13T22:04:00.333792Z", + "created": "2024-08-02T17:12:32.335422Z", + "modified": "2024-08-02T17:12:32.335422Z", "name": "Raise Funds from Malign Actors", "description": "Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.", "kill_chain_phases": [ @@ -673,8 +607,8 @@ "spec_version": "2.1", "id": "attack-pattern--e0b7c795-eae2-4494-a3c9-52bc68c6df06", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.334386Z", - "modified": "2024-03-13T22:04:00.334386Z", + "created": "2024-08-02T17:12:32.335744Z", + "modified": "2024-08-02T17:12:32.335744Z", "name": "Raise Funds from Ignorant Agents", "description": "Raising funds from ignorant agents may include scams, donations intended for one stated purpose but then used for another, etc.", "kill_chain_phases": [ @@ -706,8 +640,8 @@ "spec_version": "2.1", "id": "attack-pattern--e0acfceb-4541-438f-ba33-734f9a666c7d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.334691Z", - "modified": "2024-03-13T22:04:00.334691Z", + "created": "2024-08-02T17:12:32.335938Z", + "modified": "2024-08-02T17:12:32.335938Z", "name": "Create Hashtags and Search Artefacts", "description": "Create one or more hashtags and/or hashtag groups. Many incident-based campaigns will create hashtags to promote their fabricated event. Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only \"real\" events would be discussed in a hashtag. After all, the event has a name!, and 2. Publicise the story more widely through trending lists and search behaviour. Asset needed to direct/control/manage \"conversation\" connected to launching new incident/campaign with new hashtag for applicable social media sites).", "kill_chain_phases": [ @@ -739,8 +673,8 @@ "spec_version": "2.1", "id": "attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.334826Z", - "modified": "2024-03-13T22:04:00.334826Z", + "created": "2024-08-02T17:12:32.336169Z", + "modified": "2024-08-02T17:12:32.336169Z", "name": "Create Clickbait", "description": "Create attention grabbing headlines (outrage, doubt, humour) required to drive traffic & engagement. This is a key asset.", "kill_chain_phases": [ @@ -772,8 +706,8 @@ "spec_version": "2.1", "id": "attack-pattern--61df6490-ca2c-41b7-a251-ded790a03a71", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.335181Z", - "modified": "2024-03-13T22:04:00.335181Z", + "created": "2024-08-02T17:12:32.336388Z", + "modified": "2024-08-02T17:12:32.336388Z", "name": "Conduct Fundraising", "description": "Fundraising campaigns refer to an influence operation\u2019s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services166 on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns to promote operation messaging while raising money to support its activities.", "kill_chain_phases": [ @@ -805,8 +739,8 @@ "spec_version": "2.1", "id": "attack-pattern--72207f73-5b54-4cd4-b453-746a61eb3e28", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.335407Z", - "modified": "2024-03-13T22:04:00.335407Z", + "created": "2024-08-02T17:12:32.336655Z", + "modified": "2024-08-02T17:12:32.336655Z", "name": "Conduct Crowdfunding Campaigns", "description": "An influence operation may Conduct Crowdfunding Campaigns on platforms such as GoFundMe, GiveSendGo, Tipeee, Patreon, etc.", "kill_chain_phases": [ @@ -838,8 +772,8 @@ "spec_version": "2.1", "id": "attack-pattern--eef34262-0822-4727-83f5-2e608babc396", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.335607Z", - "modified": "2024-03-13T22:04:00.335607Z", + "created": "2024-08-02T17:12:32.336982Z", + "modified": "2024-08-02T17:12:32.336982Z", "name": "Purchase Targeted Advertisements", "description": "Create or fund advertisements targeted at specific populations", "kill_chain_phases": [ @@ -871,8 +805,8 @@ "spec_version": "2.1", "id": "attack-pattern--ea0d5988-af73-4b09-8040-7bb2fbadaa3c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.335906Z", - "modified": "2024-03-13T22:04:00.335906Z", + "created": "2024-08-02T17:12:32.337504Z", + "modified": "2024-08-02T17:12:32.337504Z", "name": "Trial Content", "description": "Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates", "kill_chain_phases": [ @@ -904,8 +838,8 @@ "spec_version": "2.1", "id": "attack-pattern--ea788455-90c6-4f47-97b1-862d30ef7d12", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.336137Z", - "modified": "2024-03-13T22:04:00.336137Z", + "created": "2024-08-02T17:12:32.337907Z", + "modified": "2024-08-02T17:12:32.337907Z", "name": "Leverage Conspiracy Theory Narratives", "description": "\"Conspiracy narratives\" appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalised or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the \"firehose of falsehoods\" model.", "kill_chain_phases": [ @@ -937,8 +871,8 @@ "spec_version": "2.1", "id": "attack-pattern--b4ed63e5-e8db-4057-989b-3ff5ad8c000c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.336281Z", - "modified": "2024-03-13T22:04:00.336281Z", + "created": "2024-08-02T17:12:32.341425Z", + "modified": "2024-08-02T17:12:32.341425Z", "name": "Amplify Existing Conspiracy Theory Narratives", "description": "An influence operation may amplify an existing conspiracy theory narrative that aligns with its incident or campaign goals. By amplifying existing conspiracy theory narratives, operators can leverage the power of the existing communities that support and propagate those theories without needing to expend resources creating new narratives or building momentum and buy in around new narratives.", "kill_chain_phases": [ @@ -970,8 +904,8 @@ "spec_version": "2.1", "id": "attack-pattern--eb63894c-aad1-47f0-98ee-0fa5e07ed3f3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.336553Z", - "modified": "2024-03-13T22:04:00.336553Z", + "created": "2024-08-02T17:12:32.341849Z", + "modified": "2024-08-02T17:12:32.341849Z", "name": "Develop Original Conspiracy Theory Narratives", "description": "While this requires more resources than amplifying existing conspiracy theory narratives, an influence operation may develop original conspiracy theory narratives in order to achieve greater control and alignment over the narrative and their campaign goals. Prominent examples include the USSR's Operation INFEKTION disinformation campaign run by the KGB in the 1980s to plant the idea that the United States had invented HIV/AIDS as part of a biological weapons research project at Fort Detrick, Maryland. More recently, Fort Detrick featured prominently in a new conspiracy theory narratives around the origins of the COVID-19 outbreak and pandemic.", "kill_chain_phases": [ @@ -1003,8 +937,8 @@ "spec_version": "2.1", "id": "attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.336918Z", - "modified": "2024-03-13T22:04:00.336918Z", + "created": "2024-08-02T17:12:32.342026Z", + "modified": "2024-08-02T17:12:32.342026Z", "name": "Distort Facts", "description": "Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content", "kill_chain_phases": [ @@ -1036,8 +970,8 @@ "spec_version": "2.1", "id": "attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.337054Z", - "modified": "2024-03-13T22:04:00.337054Z", + "created": "2024-08-02T17:12:32.34226Z", + "modified": "2024-08-02T17:12:32.34226Z", "name": "Reframe Context", "description": "Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions.", "kill_chain_phases": [ @@ -1069,8 +1003,8 @@ "spec_version": "2.1", "id": "attack-pattern--84e0fdf7-3bba-4e66-a575-6a32a7f8eca6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.337189Z", - "modified": "2024-03-13T22:04:00.337189Z", + "created": "2024-08-02T17:12:32.342508Z", + "modified": "2024-08-02T17:12:32.342508Z", "name": "Edit Open-Source Content", "description": "An influence operation may edit open-source content, such as collaborative blogs or encyclopaedias, to promote its narratives on outlets with existing credibility and audiences. Editing open-source content may allow an operation to post content on platforms without dedicating resources to the creation and maintenance of its own assets.", "kill_chain_phases": [ @@ -1102,8 +1036,8 @@ "spec_version": "2.1", "id": "attack-pattern--77cb282d-d6e6-4d86-87bf-08a2483bdbb6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.337655Z", - "modified": "2024-03-13T22:04:00.337655Z", + "created": "2024-08-02T17:12:32.342854Z", + "modified": "2024-08-02T17:12:32.342854Z", "name": "Online Polls", "description": "Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well", "kill_chain_phases": [ @@ -1135,10 +1069,10 @@ "spec_version": "2.1", "id": "attack-pattern--5d4cafe2-42cc-4c41-8ce7-41256e1383f7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.338088Z", - "modified": "2024-03-13T22:04:00.338088Z", + "created": "2024-08-02T17:12:32.343367Z", + "modified": "2024-08-02T17:12:32.343367Z", "name": "Bait Influencer", - "description": "Influencers are people on social media platforms who have large audiences.\u00a0\n\nThreat Actors can try to trick Influencers such as celebrities, journalists, or local leaders who aren\u2019t associated with their campaign into amplifying campaign content. This gives them access to the Influencer\u2019s audience without having to go through the effort of building it themselves, and it helps legitimise their message by associating it with the Influencer, benefitting from their audience\u2019s trust in them.", + "description": "Influencers are people on social media platforms who have large audiences.

Threat Actors can try to trick Influencers such as celebrities, journalists, or local leaders who aren\u2019t associated with their campaign into amplifying campaign content. This gives them access to the Influencer\u2019s audience without having to go through the effort of building it themselves, and it helps legitimise their message by associating it with the Influencer, benefitting from their audience\u2019s trust in them.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -1168,8 +1102,8 @@ "spec_version": "2.1", "id": "attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.338343Z", - "modified": "2024-03-13T22:04:00.338343Z", + "created": "2024-08-02T17:12:32.343565Z", + "modified": "2024-08-02T17:12:32.343565Z", "name": "Demand Insurmountable Proof", "description": "Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the \"firehose of misinformation\". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of \"questions\" while the truth teller is burdened with higher and higher standards of proof.", "kill_chain_phases": [ @@ -1201,8 +1135,8 @@ "spec_version": "2.1", "id": "attack-pattern--bd1295e0-67b2-419d-b2b4-a832552dbcc6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.338862Z", - "modified": "2024-03-13T22:04:00.338862Z", + "created": "2024-08-02T17:12:32.343749Z", + "modified": "2024-08-02T17:12:32.343749Z", "name": "Seed Kernel of Truth", "description": "Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.", "kill_chain_phases": [ @@ -1234,8 +1168,8 @@ "spec_version": "2.1", "id": "attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.339417Z", - "modified": "2024-03-13T22:04:00.339417Z", + "created": "2024-08-02T17:12:32.343925Z", + "modified": "2024-08-02T17:12:32.343925Z", "name": "Chat Apps", "description": "Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.", "kill_chain_phases": [ @@ -1267,8 +1201,8 @@ "spec_version": "2.1", "id": "attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.339879Z", - "modified": "2024-03-13T22:04:00.339879Z", + "created": "2024-08-02T17:12:32.344084Z", + "modified": "2024-08-02T17:12:32.344084Z", "name": "Use Encrypted Chat Apps", "description": "Examples include Signal, WhatsApp, Discord, Wire, etc.", "kill_chain_phases": [ @@ -1300,8 +1234,8 @@ "spec_version": "2.1", "id": "attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.340388Z", - "modified": "2024-03-13T22:04:00.340388Z", + "created": "2024-08-02T17:12:32.344274Z", + "modified": "2024-08-02T17:12:32.344274Z", "name": "Use Unencrypted Chats Apps", "description": "Examples include SMS, etc.", "kill_chain_phases": [ @@ -1333,8 +1267,8 @@ "spec_version": "2.1", "id": "attack-pattern--6b23206e-6a5a-4173-ab1a-17e6cc9a9d2d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.340846Z", - "modified": "2024-03-13T22:04:00.340846Z", + "created": "2024-08-02T17:12:32.344511Z", + "modified": "2024-08-02T17:12:32.344511Z", "name": "Seed Distortions", "description": "Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression.", "kill_chain_phases": [ @@ -1366,8 +1300,8 @@ "spec_version": "2.1", "id": "attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.341356Z", - "modified": "2024-03-13T22:04:00.341356Z", + "created": "2024-08-02T17:12:32.344715Z", + "modified": "2024-08-02T17:12:32.344715Z", "name": "Use Fake Experts", "description": "Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give \"credility\" to misinformation. Take advantage of credential bias", "kill_chain_phases": [ @@ -1399,8 +1333,8 @@ "spec_version": "2.1", "id": "attack-pattern--50f92bc8-f6ad-4267-bd00-f4c572370a72", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.34181Z", - "modified": "2024-03-13T22:04:00.34181Z", + "created": "2024-08-02T17:12:32.344897Z", + "modified": "2024-08-02T17:12:32.344897Z", "name": "Use Search Engine Optimisation", "description": "Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka \"Black-hat SEO\"", "kill_chain_phases": [ @@ -1432,8 +1366,8 @@ "spec_version": "2.1", "id": "attack-pattern--90ca8c39-a644-4007-b3d6-68fabc90b531", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.342476Z", - "modified": "2024-03-13T22:04:00.342476Z", + "created": "2024-08-02T17:12:32.345087Z", + "modified": "2024-08-02T17:12:32.345087Z", "name": "Censor Social Media as a Political Force", "description": "Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports).", "kill_chain_phases": [ @@ -1465,8 +1399,8 @@ "spec_version": "2.1", "id": "attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.342863Z", - "modified": "2024-03-13T22:04:00.342863Z", + "created": "2024-08-02T17:12:32.34527Z", + "modified": "2024-08-02T17:12:32.34527Z", "name": "Harass", "description": "Threatening or harassing believers of opposing narratives refers to the use of intimidation techniques, including cyberbullying and doxing, to discourage opponents from voicing their dissent. An influence operation may threaten or harass believers of the opposing narratives to deter individuals from posting or proliferating conflicting content.", "kill_chain_phases": [ @@ -1498,8 +1432,8 @@ "spec_version": "2.1", "id": "attack-pattern--7d5ba27c-12c7-4a30-8624-e1ea6670f0f8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.343006Z", - "modified": "2024-03-13T22:04:00.343006Z", + "created": "2024-08-02T17:12:32.345448Z", + "modified": "2024-08-02T17:12:32.345448Z", "name": "Boycott/\"Cancel\" Opponents", "description": "Cancel culture refers to the phenomenon in which individuals collectively refrain from supporting an individual, organisation, business, or other entity, usually following a real or falsified controversy. An influence operation may exploit cancel culture by emphasising an adversary\u2019s problematic or disputed behaviour and presenting its own content as an alternative.", "kill_chain_phases": [ @@ -1531,8 +1465,8 @@ "spec_version": "2.1", "id": "attack-pattern--e47ae747-d83d-433d-a69a-f6d0970fed5e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.343143Z", - "modified": "2024-03-13T22:04:00.343143Z", + "created": "2024-08-02T17:12:32.345613Z", + "modified": "2024-08-02T17:12:32.345613Z", "name": "Harass People Based on Identities", "description": "Examples include social identities like gender, sexuality, race, ethnicity, religion, ability, nationality, etc. as well as roles and occupations like journalist or activist.", "kill_chain_phases": [ @@ -1564,8 +1498,8 @@ "spec_version": "2.1", "id": "attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.343278Z", - "modified": "2024-03-13T22:04:00.343278Z", + "created": "2024-08-02T17:12:32.346525Z", + "modified": "2024-08-02T17:12:32.346525Z", "name": "Threaten to Dox", "description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.", "kill_chain_phases": [ @@ -1597,8 +1531,8 @@ "spec_version": "2.1", "id": "attack-pattern--5bc895e8-eb26-43ec-8469-ab665092970d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.343413Z", - "modified": "2024-03-13T22:04:00.343413Z", + "created": "2024-08-02T17:12:32.347214Z", + "modified": "2024-08-02T17:12:32.347214Z", "name": "Dox", "description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.", "kill_chain_phases": [ @@ -1630,10 +1564,10 @@ "spec_version": "2.1", "id": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.343811Z", - "modified": "2024-03-13T22:04:00.343811Z", + "created": "2024-08-02T17:12:32.347894Z", + "modified": "2024-08-02T17:12:32.347894Z", "name": "Flood Information Space", - "description": "Flooding sources of information (e.g. Social Media feeds) with a high volume of inauthentic content.\n\nThis can be done to control/shape online conversations, drown out opposing points of view, or make it harder to find legitimate information.\u00a0\n\nBots and/or patriotic trolls are effective tools to achieve this effect.\n\nThis Technique previously used the name Flooding the Information Space.", + "description": "Flooding sources of information (e.g. Social Media feeds) with a high volume of inauthentic content.

This can be done to control/shape online conversations, drown out opposing points of view, or make it harder to find legitimate information.

Bots and/or patriotic trolls are effective tools to achieve this effect.

This Technique previously used the name Flooding the Information Space.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -1663,8 +1597,8 @@ "spec_version": "2.1", "id": "attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.343965Z", - "modified": "2024-03-13T22:04:00.343965Z", + "created": "2024-08-02T17:12:32.348471Z", + "modified": "2024-08-02T17:12:32.348471Z", "name": "Trolls Amplify and Manipulate", "description": "Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).", "kill_chain_phases": [ @@ -1696,10 +1630,10 @@ "spec_version": "2.1", "id": "attack-pattern--bfce790b-dfd6-46ca-8fab-c2d72f21bba2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.344104Z", - "modified": "2024-03-13T22:04:00.344104Z", + "created": "2024-08-02T17:12:32.349076Z", + "modified": "2024-08-02T17:12:32.349076Z", "name": "Flood Existing Hashtag", - "description": "Hashtags can be used by communities to collate information they post about particular topics (such as their interests, or current events) and users can find communities to join by exploring hashtags they\u2019re interested in.\u00a0\n\nThreat actors can flood an existing hashtag to try to ruin hashtag functionality, posting content unrelated to the hashtag alongside it, making it a less reliable source of relevant information. They may also try to flood existing hashtags with campaign content, with the intent of maximising exposure to users.\n\nThis Technique covers cases where threat actors flood existing hashtags with campaign content.\n\nThis Technique covers behaviours previously documented by T0019.002: Hijack Hashtags, which has since been deprecated. This Technique was previously called Hijack Existing Hashtag.", + "description": "Hashtags can be used by communities to collate information they post about particular topics (such as their interests, or current events) and users can find communities to join by exploring hashtags they\u2019re interested in.

Threat actors can flood an existing hashtag to try to ruin hashtag functionality, posting content unrelated to the hashtag alongside it, making it a less reliable source of relevant information. They may also try to flood existing hashtags with campaign content, with the intent of maximising exposure to users.

This Technique covers cases where threat actors flood existing hashtags with campaign content.

This Technique covers behaviours previously documented by T0019.002: Hijack Hashtags, which has since been deprecated. This Technique was previously called Hijack Existing Hashtag.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -1729,8 +1663,8 @@ "spec_version": "2.1", "id": "attack-pattern--e6ab2793-a059-4354-bb60-045afb019833", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.34424Z", - "modified": "2024-03-13T22:04:00.34424Z", + "created": "2024-08-02T17:12:32.349745Z", + "modified": "2024-08-02T17:12:32.349745Z", "name": "Bots Amplify via Automated Forwarding and Reposting", "description": "Automated forwarding and reposting refer to the proliferation of operation content using automated means, such as artificial intelligence or social media bots. An influence operation may use automated activity to increase content exposure without dedicating the resources, including personnel and time, traditionally required to forward and repost content. Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more \"popular\" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.", "kill_chain_phases": [ @@ -1762,8 +1696,8 @@ "spec_version": "2.1", "id": "attack-pattern--4282febe-c8a6-46da-863c-f19081615d80", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.344376Z", - "modified": "2024-03-13T22:04:00.344376Z", + "created": "2024-08-02T17:12:32.350087Z", + "modified": "2024-08-02T17:12:32.350087Z", "name": "Utilise Spamoflauge", "description": "Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, \"you've w0n our jackp0t!\". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging.", "kill_chain_phases": [ @@ -1795,8 +1729,8 @@ "spec_version": "2.1", "id": "attack-pattern--ce5b400c-6f82-4095-936b-617857800da8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.344523Z", - "modified": "2024-03-13T22:04:00.344523Z", + "created": "2024-08-02T17:12:32.350548Z", + "modified": "2024-08-02T17:12:32.350548Z", "name": "Conduct Swarming", "description": "Swarming refers to the coordinated use of accounts to overwhelm the information space with operation content. Unlike information flooding, swarming centres exclusively around a specific event or actor rather than a general narrative. Swarming relies on \u201chorizontal communication\u201d between information assets rather than a top-down, vertical command-and-control approach.", "kill_chain_phases": [ @@ -1828,8 +1762,8 @@ "spec_version": "2.1", "id": "attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.344667Z", - "modified": "2024-03-13T22:04:00.344667Z", + "created": "2024-08-02T17:12:32.350844Z", + "modified": "2024-08-02T17:12:32.350844Z", "name": "Conduct Keyword Squatting", "description": "Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term.", "kill_chain_phases": [ @@ -1861,8 +1795,8 @@ "spec_version": "2.1", "id": "attack-pattern--cec91e97-76c8-4a1f-8397-a06939a558ef", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.344928Z", - "modified": "2024-03-13T22:04:00.344928Z", + "created": "2024-08-02T17:12:32.35121Z", + "modified": "2024-08-02T17:12:32.35121Z", "name": "Inauthentic Sites Amplify News and Narratives", "description": "Inauthentic sites circulate cross-post stories and amplify narratives. Often these sites have no masthead, bylines or attribution.", "kill_chain_phases": [ @@ -1892,12 +1826,12 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--ad48b850-c73d-470a-ab8f-bdc7bfcb8ae6", + "id": "attack-pattern--3a2f96fa-c3d0-4f54-a041-6807f0ea4955", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.345085Z", - "modified": "2024-03-13T22:04:00.345085Z", + "created": "2024-08-02T17:12:32.351504Z", + "modified": "2024-08-02T17:12:32.351504Z", "name": "Generate Information Pollution", - "description": "Information Pollution occurs when threat actors attempt to ruin a source of information by flooding it with lots of inauthentic or unreliable content, intending to make it harder for legitimate users to find the information they\u2019re looking for.\u00a0\n\nThis subtechnique's objective is to reduce exposure to target information, rather than promoting exposure to campaign content, for which the parent technique T0049 can be used.\u00a0\n\nAnalysts will need to infer what the motive for flooding an information space was when deciding whether to use T0049 or T0049.008 to tag a case when an information space is flooded. If such inference is not possible, default to T0049.\n\nThis Technique previously used the ID T0019.", + "description": "Information Pollution occurs when threat actors attempt to ruin a source of information by flooding it with lots of inauthentic or unreliable content, intending to make it harder for legitimate users to find the information they\u2019re looking for.

This sub-technique\u2019s objective is to reduce exposure to target information, rather than promoting exposure to campaign content, for which the parent Technique T0049 can be used.

Analysts will need to infer what the motive for flooding an information space was when deciding whether to use T0049 or T0049.008 to tag a case when an information space is flooded. If such inference is not possible, default to T0049.

This Technique previously used the ID T0019.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -1927,8 +1861,8 @@ "spec_version": "2.1", "id": "attack-pattern--0102376a-e896-4191-b3fb-e58188301822", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.345227Z", - "modified": "2024-03-13T22:04:00.345227Z", + "created": "2024-08-02T17:12:32.351843Z", + "modified": "2024-08-02T17:12:32.351843Z", "name": "Organise Events", "description": "Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.", "kill_chain_phases": [ @@ -1960,8 +1894,8 @@ "spec_version": "2.1", "id": "attack-pattern--7b32abce-e101-4dc3-98db-30b79c0c8397", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.345385Z", - "modified": "2024-03-13T22:04:00.345385Z", + "created": "2024-08-02T17:12:32.352216Z", + "modified": "2024-08-02T17:12:32.352216Z", "name": "Pay for Physical Action", "description": "Paying for physical action occurs when an influence operation pays individuals to act in the physical realm. An influence operation may pay for physical action to create specific situations and frame them in a way that supports operation narratives, for example, paying a group of people to burn a car to later post an image of the burning car and frame it as an act of protest.", "kill_chain_phases": [ @@ -1993,8 +1927,8 @@ "spec_version": "2.1", "id": "attack-pattern--f601eb03-79d0-4c00-b07d-4b4647c37efd", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.345583Z", - "modified": "2024-03-13T22:04:00.345583Z", + "created": "2024-08-02T17:12:32.352658Z", + "modified": "2024-08-02T17:12:32.352658Z", "name": "Conduct Symbolic Action", "description": "Symbolic action refers to activities specifically intended to advance an operation\u2019s narrative by signalling something to the audience, for example, a military parade supporting a state\u2019s narrative of military superiority. An influence operation may use symbolic action to create falsified evidence supporting operation narratives in the physical information space.", "kill_chain_phases": [ @@ -2026,8 +1960,8 @@ "spec_version": "2.1", "id": "attack-pattern--d1f55d22-f487-48ec-a810-a9f74220c02e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.345806Z", - "modified": "2024-03-13T22:04:00.345806Z", + "created": "2024-08-02T17:12:32.35304Z", + "modified": "2024-08-02T17:12:32.35304Z", "name": "Play the Long Game", "description": "Play the long game refers to two phenomena: 1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold 2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative.", "kill_chain_phases": [ @@ -2059,8 +1993,8 @@ "spec_version": "2.1", "id": "attack-pattern--ad410829-2fb3-490b-b470-f5f859d45942", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.346172Z", - "modified": "2024-03-13T22:04:00.346172Z", + "created": "2024-08-02T17:12:32.3534Z", + "modified": "2024-08-02T17:12:32.3534Z", "name": "Continue to Amplify", "description": "continue narrative or message amplification after the main incident work has finished", "kill_chain_phases": [ @@ -2092,8 +2026,8 @@ "spec_version": "2.1", "id": "attack-pattern--ddc9d571-88a9-4246-bbbf-075bfed721f8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.346436Z", - "modified": "2024-03-13T22:04:00.346436Z", + "created": "2024-08-02T17:12:32.353767Z", + "modified": "2024-08-02T17:12:32.353767Z", "name": "Sell Merchandise", "description": "Sell mechandise refers to getting the message or narrative into physical space in the offline world while making money", "kill_chain_phases": [ @@ -2125,8 +2059,8 @@ "spec_version": "2.1", "id": "attack-pattern--b3bb61ca-5472-42b0-807e-bd8657fc05b2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.346573Z", - "modified": "2024-03-13T22:04:00.346573Z", + "created": "2024-08-02T17:12:32.354177Z", + "modified": "2024-08-02T17:12:32.354177Z", "name": "Prepare Physical Broadcast Capabilities", "description": "Create or coopt broadcast capabilities (e.g. TV, radio etc).", "kill_chain_phases": [ @@ -2158,8 +2092,8 @@ "spec_version": "2.1", "id": "attack-pattern--d696b89b-9686-42ff-b3c4-5a4d5ecaa17a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.346712Z", - "modified": "2024-03-13T22:04:00.346712Z", + "created": "2024-08-02T17:12:32.354685Z", + "modified": "2024-08-02T17:12:32.354685Z", "name": "Degrade Adversary", "description": "Plan to degrade an adversary\u2019s image or ability to act. This could include preparation and use of harmful information about the adversary\u2019s actions or reputation.", "kill_chain_phases": [ @@ -2191,8 +2125,8 @@ "spec_version": "2.1", "id": "attack-pattern--b2a7561a-28ad-426c-a249-f415b5f11cee", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.346847Z", - "modified": "2024-03-13T22:04:00.346847Z", + "created": "2024-08-02T17:12:32.355029Z", + "modified": "2024-08-02T17:12:32.355029Z", "name": "Respond to Breaking News Event or Active Crisis", "description": "Media attention on a story or event is heightened during a breaking news event, where unclear facts and incomplete information increase speculation, rumours, and conspiracy theories, which are all vulnerable to manipulation.", "kill_chain_phases": [ @@ -2224,8 +2158,8 @@ "spec_version": "2.1", "id": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.346983Z", - "modified": "2024-03-13T22:04:00.346983Z", + "created": "2024-08-02T17:12:32.355426Z", + "modified": "2024-08-02T17:12:32.355426Z", "name": "Segment Audiences", "description": "Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics.", "kill_chain_phases": [ @@ -2257,8 +2191,8 @@ "spec_version": "2.1", "id": "attack-pattern--77574742-25a0-4375-a2c8-d5b54e1360aa", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.347169Z", - "modified": "2024-03-13T22:04:00.347169Z", + "created": "2024-08-02T17:12:32.355793Z", + "modified": "2024-08-02T17:12:32.355793Z", "name": "Geographic Segmentation", "description": "An influence operation may target populations in a specific geographic location, such as a region, state, or city. An influence operation may use geographic segmentation to Create Localised Content (see: Establish Legitimacy).", "kill_chain_phases": [ @@ -2290,8 +2224,8 @@ "spec_version": "2.1", "id": "attack-pattern--694bafc2-bd74-40c9-89f2-2ad033f079f4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.347464Z", - "modified": "2024-03-13T22:04:00.347464Z", + "created": "2024-08-02T17:12:32.356167Z", + "modified": "2024-08-02T17:12:32.356167Z", "name": "Demographic Segmentation", "description": "An influence operation may target populations based on demographic segmentation, including age, gender, and income. Demographic segmentation may be useful for influence operations aiming to change state policies that affect a specific population sector. For example, an influence operation attempting to influence Medicare funding in the United States would likely target U.S. voters over 65 years of age.", "kill_chain_phases": [ @@ -2323,8 +2257,8 @@ "spec_version": "2.1", "id": "attack-pattern--1d917530-027d-4f82-b380-404c320dc783", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.347701Z", - "modified": "2024-03-13T22:04:00.347701Z", + "created": "2024-08-02T17:12:32.356564Z", + "modified": "2024-08-02T17:12:32.356564Z", "name": "Economic Segmentation", "description": "An influence operation may target populations based on their income bracket, wealth, or other financial or economic division.", "kill_chain_phases": [ @@ -2356,8 +2290,8 @@ "spec_version": "2.1", "id": "attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.347851Z", - "modified": "2024-03-13T22:04:00.347851Z", + "created": "2024-08-02T17:12:32.356931Z", + "modified": "2024-08-02T17:12:32.356931Z", "name": "Psychographic Segmentation", "description": "An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes.", "kill_chain_phases": [ @@ -2389,8 +2323,8 @@ "spec_version": "2.1", "id": "attack-pattern--a468ff54-27eb-4e6d-b709-a9830017df86", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.348089Z", - "modified": "2024-03-13T22:04:00.348089Z", + "created": "2024-08-02T17:12:32.357307Z", + "modified": "2024-08-02T17:12:32.357307Z", "name": "Political Segmentation", "description": "An influence operation may target populations based on their political affiliations, especially when aiming to manipulate voting or change policy.", "kill_chain_phases": [ @@ -2422,8 +2356,8 @@ "spec_version": "2.1", "id": "attack-pattern--6faf71ca-1e32-4134-8a7c-79b25f7f3615", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.34842Z", - "modified": "2024-03-13T22:04:00.34842Z", + "created": "2024-08-02T17:12:32.357634Z", + "modified": "2024-08-02T17:12:32.357634Z", "name": "Determine Target Audiences", "description": "Determining the target audiences (segments of the population) who will receive campaign narratives and artefacts intended to achieve the strategic ends.", "kill_chain_phases": [ @@ -2455,8 +2389,8 @@ "spec_version": "2.1", "id": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.348703Z", - "modified": "2024-03-13T22:04:00.348703Z", + "created": "2024-08-02T17:12:32.358298Z", + "modified": "2024-08-02T17:12:32.358298Z", "name": "Determine Strategic Ends", "description": "These are the long-term end-states the campaign aims to bring about. They typically involve an advantageous position vis-a-vis competitors in terms of power or influence. The strategic goal may be to improve or simply to hold one\u2019s position. Competition occurs in the public sphere in the domains of war, diplomacy, politics, economics, and ideology, and can play out between armed groups, nation-states, political parties, corporations, interest groups, or individuals. ", "kill_chain_phases": [ @@ -2486,10 +2420,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--f3a240cc-d8bd-4e0e-8076-8ca89c09b638", + "id": "attack-pattern--030976e3-fce8-434e-9ea8-a36ee2c0192e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.348867Z", - "modified": "2024-03-13T22:04:00.348867Z", + "created": "2024-08-02T17:12:32.358684Z", + "modified": "2024-08-02T17:12:32.358684Z", "name": "Geopolitical Advantage", "description": "Favourable position on the international stage in terms of great power politics or regional rivalry. Geopolitics plays out in the realms of foreign policy, national security, diplomacy, and intelligence. It involves nation-state governments, heads of state, foreign ministers, intergovernmental organisations, and regional security alliances.", "kill_chain_phases": [ @@ -2519,10 +2453,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--ec0442ff-f447-4f22-bd34-9167f50b0fe7", + "id": "attack-pattern--6c001f2c-b143-4d9b-91d7-5a663152cdb5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.349018Z", - "modified": "2024-03-13T22:04:00.349018Z", + "created": "2024-08-02T17:12:32.359091Z", + "modified": "2024-08-02T17:12:32.359091Z", "name": "Domestic Political Advantage", "description": "Favourable position vis-\u00e0-vis national or sub-national political opponents such as political parties, interest groups, politicians, candidates. ", "kill_chain_phases": [ @@ -2552,10 +2486,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--4ecb18af-7e16-4eba-b2c3-40d43f737fdf", + "id": "attack-pattern--2b1270a6-d432-453f-88cf-17fa38ec6f40", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.349163Z", - "modified": "2024-03-13T22:04:00.349163Z", + "created": "2024-08-02T17:12:32.359451Z", + "modified": "2024-08-02T17:12:32.359451Z", "name": "Economic Advantage", "description": "Favourable position domestically or internationally in the realms of commerce, trade, finance, industry. Economics involves nation-states, corporations, banks, trade blocs, industry associations, cartels. ", "kill_chain_phases": [ @@ -2585,10 +2519,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--97c51e13-0bcf-45f6-9e8a-6d8e89c8e6f4", + "id": "attack-pattern--d6681707-afcc-4656-91ca-779bc303d944", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.349306Z", - "modified": "2024-03-13T22:04:00.349306Z", + "created": "2024-08-02T17:12:32.359885Z", + "modified": "2024-08-02T17:12:32.359885Z", "name": "Ideological Advantage", "description": "Favourable position domestically or internationally in the market for ideas, beliefs, and world views. Competition plays out among faith systems, political systems, and value systems. It can involve sub-national, national or supra-national movements. ", "kill_chain_phases": [ @@ -2620,8 +2554,8 @@ "spec_version": "2.1", "id": "attack-pattern--5414f74d-0b10-4562-ad9d-e5e1093e255a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.349529Z", - "modified": "2024-03-13T22:04:00.349529Z", + "created": "2024-08-02T17:12:32.360306Z", + "modified": "2024-08-02T17:12:32.360306Z", "name": "Dismiss", "description": "Push back against criticism by dismissing your critics. This might be arguing that the critics use a different standard for you than with other actors or themselves; or arguing that their criticism is biassed.", "kill_chain_phases": [ @@ -2653,8 +2587,8 @@ "spec_version": "2.1", "id": "attack-pattern--9b66eaf5-5b03-46b8-b076-cf1da3593745", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.349855Z", - "modified": "2024-03-13T22:04:00.349855Z", + "created": "2024-08-02T17:12:32.360819Z", + "modified": "2024-08-02T17:12:32.360819Z", "name": "Discredit Credible Sources", "description": "Plan to delegitimize the media landscape and degrade public trust in reporting, by discrediting credible sources. This makes it easier to promote influence operation content.", "kill_chain_phases": [ @@ -2686,8 +2620,8 @@ "spec_version": "2.1", "id": "attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.350132Z", - "modified": "2024-03-13T22:04:00.350132Z", + "created": "2024-08-02T17:12:32.361233Z", + "modified": "2024-08-02T17:12:32.361233Z", "name": "Distort", "description": "Twist the narrative. Take information, or artefacts like images, and change the framing around them.", "kill_chain_phases": [ @@ -2719,8 +2653,8 @@ "spec_version": "2.1", "id": "attack-pattern--9e80abf9-0991-47c3-982c-b33e66640d10", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.350357Z", - "modified": "2024-03-13T22:04:00.350357Z", + "created": "2024-08-02T17:12:32.361644Z", + "modified": "2024-08-02T17:12:32.361644Z", "name": "Distract", "description": "Shift attention to a different narrative or actor, for instance by accusing critics of the same activity that they\u2019ve accused you of (e.g. police brutality).", "kill_chain_phases": [ @@ -2752,8 +2686,8 @@ "spec_version": "2.1", "id": "attack-pattern--8ad58740-d5c1-40bb-9091-f98adfe8d89f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.350647Z", - "modified": "2024-03-13T22:04:00.350647Z", + "created": "2024-08-02T17:12:32.362029Z", + "modified": "2024-08-02T17:12:32.362029Z", "name": "Dismay", "description": "Threaten the critic or narrator of events. For instance, threaten journalists or news outlets reporting on a story.", "kill_chain_phases": [ @@ -2785,8 +2719,8 @@ "spec_version": "2.1", "id": "attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.350927Z", - "modified": "2024-03-13T22:04:00.350927Z", + "created": "2024-08-02T17:12:32.362521Z", + "modified": "2024-08-02T17:12:32.362521Z", "name": "Divide", "description": "Create conflict between subgroups, to widen divisions in a community", "kill_chain_phases": [ @@ -2818,8 +2752,8 @@ "spec_version": "2.1", "id": "attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.351162Z", - "modified": "2024-03-13T22:04:00.351162Z", + "created": "2024-08-02T17:12:32.362876Z", + "modified": "2024-08-02T17:12:32.362876Z", "name": "Map Target Audience Information Environment", "description": "Mapping the target audience information environment analyses the information space itself, including social media analytics, web traffic, and media surveys. Mapping the information environment may help the influence operation determine the most realistic and popular information channels to reach its target audience. Mapping the target audience information environment aids influence operations in determining the most vulnerable areas of the information space to target with messaging.", "kill_chain_phases": [ @@ -2851,8 +2785,8 @@ "spec_version": "2.1", "id": "attack-pattern--9ec25bd4-7dcd-4bbf-9e2f-6170af84e166", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.351403Z", - "modified": "2024-03-13T22:04:00.351403Z", + "created": "2024-08-02T17:12:32.363333Z", + "modified": "2024-08-02T17:12:32.363333Z", "name": "Monitor Social Media Analytics", "description": "An influence operation may use social media analytics to determine which factors will increase the operation content\u2019s exposure to its target audience on social media platforms, including views, interactions, and sentiment relating to topics and content types. The social media platform itself or a third-party tool may collect the metrics.", "kill_chain_phases": [ @@ -2884,8 +2818,8 @@ "spec_version": "2.1", "id": "attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.351675Z", - "modified": "2024-03-13T22:04:00.351675Z", + "created": "2024-08-02T17:12:32.363691Z", + "modified": "2024-08-02T17:12:32.363691Z", "name": "Evaluate Media Surveys", "description": "An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience\u2019s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.", "kill_chain_phases": [ @@ -2917,8 +2851,8 @@ "spec_version": "2.1", "id": "attack-pattern--5a279d23-6ba2-425c-bf72-20c6411ca5a7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.351922Z", - "modified": "2024-03-13T22:04:00.351922Z", + "created": "2024-08-02T17:12:32.364042Z", + "modified": "2024-08-02T17:12:32.364042Z", "name": "Identify Trending Topics/Hashtags", "description": "An influence operation may identify trending hashtags on social media platforms for later use in boosting operation content. A hashtag40 refers to a word or phrase preceded by the hash symbol (#) on social media used to identify messages and posts relating to a specific topic. All public posts that use the same hashtag are aggregated onto a centralised page dedicated to the word or phrase and sorted either chronologically or by popularity.", "kill_chain_phases": [ @@ -2950,8 +2884,8 @@ "spec_version": "2.1", "id": "attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.352229Z", - "modified": "2024-03-13T22:04:00.352229Z", + "created": "2024-08-02T17:12:32.364425Z", + "modified": "2024-08-02T17:12:32.364425Z", "name": "Conduct Web Traffic Analysis", "description": "An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.", "kill_chain_phases": [ @@ -2983,8 +2917,8 @@ "spec_version": "2.1", "id": "attack-pattern--c729368d-246a-47eb-8e4b-ab5b0a3510ec", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.352481Z", - "modified": "2024-03-13T22:04:00.352481Z", + "created": "2024-08-02T17:12:32.364767Z", + "modified": "2024-08-02T17:12:32.364767Z", "name": "Assess Degree/Type of Media Access", "description": "An influence operation may survey a target audience\u2019s Internet availability and degree of media freedom to determine which target audience members will have access to operation content and on which platforms. An operation may face more difficulty targeting an information environment with heavy restrictions and media control than an environment with independent media, freedom of speech and of the press, and individual liberties.", "kill_chain_phases": [ @@ -3016,8 +2950,8 @@ "spec_version": "2.1", "id": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.352692Z", - "modified": "2024-03-13T22:04:00.352692Z", + "created": "2024-08-02T17:12:32.365103Z", + "modified": "2024-08-02T17:12:32.365103Z", "name": "Identify Social and Technical Vulnerabilities", "description": "Identifying social and technical vulnerabilities determines weaknesses within the target audience information environment for later exploitation. Vulnerabilities include decisive political issues, weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment. Identifying social and technical vulnerabilities facilitates the later exploitation of the identified weaknesses to advance operation objectives.", "kill_chain_phases": [ @@ -3049,8 +2983,8 @@ "spec_version": "2.1", "id": "attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.352828Z", - "modified": "2024-03-13T22:04:00.352828Z", + "created": "2024-08-02T17:12:32.365448Z", + "modified": "2024-08-02T17:12:32.365448Z", "name": "Find Echo Chambers", "description": "Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with.", "kill_chain_phases": [ @@ -3082,8 +3016,8 @@ "spec_version": "2.1", "id": "attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.352963Z", - "modified": "2024-03-13T22:04:00.352963Z", + "created": "2024-08-02T17:12:32.36588Z", + "modified": "2024-08-02T17:12:32.36588Z", "name": "Identify Data Voids", "description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.", "kill_chain_phases": [ @@ -3115,8 +3049,8 @@ "spec_version": "2.1", "id": "attack-pattern--8ecbc28c-36e9-4d9a-8578-b9e20552d732", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.353147Z", - "modified": "2024-03-13T22:04:00.353147Z", + "created": "2024-08-02T17:12:32.366252Z", + "modified": "2024-08-02T17:12:32.366252Z", "name": "Identify Existing Prejudices", "description": "An influence operation may exploit existing racial, religious, demographic, or social prejudices to further polarise its target audience from the rest of the public.", "kill_chain_phases": [ @@ -3148,8 +3082,8 @@ "spec_version": "2.1", "id": "attack-pattern--d13ff5af-16fd-4b32-8e14-f2e0980c15fb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.353349Z", - "modified": "2024-03-13T22:04:00.353349Z", + "created": "2024-08-02T17:12:32.366531Z", + "modified": "2024-08-02T17:12:32.366531Z", "name": "Identify Existing Fissures", "description": "An influence operation may identify existing fissures to pit target populations against one another or facilitate a \u201cdivide-and-conquer\" approach to tailor operation narratives along the divides.", "kill_chain_phases": [ @@ -3181,8 +3115,8 @@ "spec_version": "2.1", "id": "attack-pattern--625fe1a6-ee9d-45c8-9912-9e9f6e87dc85", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.353568Z", - "modified": "2024-03-13T22:04:00.353568Z", + "created": "2024-08-02T17:12:32.366827Z", + "modified": "2024-08-02T17:12:32.366827Z", "name": "Identify Existing Conspiracy Narratives/Suspicions", "description": "An influence operation may assess preexisting conspiracy theories or suspicions in a population to identify existing narratives that support operational objectives.", "kill_chain_phases": [ @@ -3214,8 +3148,8 @@ "spec_version": "2.1", "id": "attack-pattern--594993b4-86a3-455b-af59-61f167d7fd93", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.353765Z", - "modified": "2024-03-13T22:04:00.353765Z", + "created": "2024-08-02T17:12:32.367108Z", + "modified": "2024-08-02T17:12:32.367108Z", "name": "Identify Wedge Issues", "description": "A wedge issue is a divisive political issue, usually concerning a social phenomenon, that divides individuals along a defined line. An influence operation may exploit wedge issues by intentionally polarising the public along the wedge issue line and encouraging opposition between factions.", "kill_chain_phases": [ @@ -3247,8 +3181,8 @@ "spec_version": "2.1", "id": "attack-pattern--7d69d231-78a6-4a98-a715-c0edd9adafce", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.353902Z", - "modified": "2024-03-13T22:04:00.353902Z", + "created": "2024-08-02T17:12:32.367396Z", + "modified": "2024-08-02T17:12:32.367396Z", "name": "Identify Target Audience Adversaries", "description": "An influence operation may identify or create a real or imaginary adversary to centre operation narratives against. A real adversary may include certain politicians or political parties while imaginary adversaries may include falsified \u201cdeep state\u201d62 actors that, according to conspiracies, run the state behind public view.", "kill_chain_phases": [ @@ -3280,8 +3214,8 @@ "spec_version": "2.1", "id": "attack-pattern--bb8da71f-108a-4c46-a1ef-d24ef1c8a661", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.354054Z", - "modified": "2024-03-13T22:04:00.354054Z", + "created": "2024-08-02T17:12:32.367712Z", + "modified": "2024-08-02T17:12:32.367712Z", "name": "Identify Media System Vulnerabilities", "description": "An influence operation may exploit existing weaknesses in a target\u2019s media system. These weaknesses may include existing biases among media agencies, vulnerability to false news agencies on social media, or existing distrust of traditional media sources. An existing distrust among the public in the media system\u2019s credibility holds high potential for exploitation by an influence operation when establishing alternative news agencies to spread operation content.", "kill_chain_phases": [ @@ -3313,8 +3247,8 @@ "spec_version": "2.1", "id": "attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.354296Z", - "modified": "2024-03-13T22:04:00.354296Z", + "created": "2024-08-02T17:12:32.368028Z", + "modified": "2024-08-02T17:12:32.368028Z", "name": "Develop New Narratives", "description": "Actors may develop new narratives to further strategic or tactical goals, especially when existing narratives adequately align with the campaign goals. New narratives provide more control in terms of crafting the message to achieve specific goals. However, new narratives may require more effort to disseminate than adapting or adopting existing narratives.", "kill_chain_phases": [ @@ -3346,8 +3280,8 @@ "spec_version": "2.1", "id": "attack-pattern--c254c765-c83d-4ae3-880e-7a253ef02d37", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.354512Z", - "modified": "2024-03-13T22:04:00.354512Z", + "created": "2024-08-02T17:12:32.368347Z", + "modified": "2024-08-02T17:12:32.368347Z", "name": "Integrate Target Audience Vulnerabilities into Narrative", "description": "An influence operation may seek to exploit the preexisting weaknesses, fears, and enemies of the target audience for integration into the operation\u2019s narratives and overall strategy. Integrating existing vulnerabilities into the operational approach conserves resources by exploiting already weak areas of the target information environment instead of forcing the operation to create new vulnerabilities in the environment.", "kill_chain_phases": [ @@ -3379,8 +3313,8 @@ "spec_version": "2.1", "id": "attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.354684Z", - "modified": "2024-03-13T22:04:00.354684Z", + "created": "2024-08-02T17:12:32.368664Z", + "modified": "2024-08-02T17:12:32.368664Z", "name": "Reuse Existing Content", "description": "When an operation recycles content from its own previous operations or plagiarises from external operations. An operation may launder information to conserve resources that would have otherwise been utilised to develop new content.", "kill_chain_phases": [ @@ -3412,8 +3346,8 @@ "spec_version": "2.1", "id": "attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.35482Z", - "modified": "2024-03-13T22:04:00.35482Z", + "created": "2024-08-02T17:12:32.369011Z", + "modified": "2024-08-02T17:12:32.369011Z", "name": "Use Copypasta", "description": "Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta\u2019s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text.", "kill_chain_phases": [ @@ -3445,8 +3379,8 @@ "spec_version": "2.1", "id": "attack-pattern--a3fe7752-dbfa-4918-912f-c492c8593c68", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.354989Z", - "modified": "2024-03-13T22:04:00.354989Z", + "created": "2024-08-02T17:12:32.369332Z", + "modified": "2024-08-02T17:12:32.369332Z", "name": "Plagiarise Content", "description": "An influence operation may take content from other sources without proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources.", "kill_chain_phases": [ @@ -3478,8 +3412,8 @@ "spec_version": "2.1", "id": "attack-pattern--7475b7e6-1095-4ae1-a995-10ab1a6c838a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.355206Z", - "modified": "2024-03-13T22:04:00.355206Z", + "created": "2024-08-02T17:12:32.369661Z", + "modified": "2024-08-02T17:12:32.369661Z", "name": "Deceptively Labelled or Translated", "description": "An influence operation may take authentic content from other sources and add deceptive labels or deceptively translate the content into other langauges.", "kill_chain_phases": [ @@ -3511,8 +3445,8 @@ "spec_version": "2.1", "id": "attack-pattern--e27cf6aa-69bc-434b-ac68-b0164d0b3421", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.355407Z", - "modified": "2024-03-13T22:04:00.355407Z", + "created": "2024-08-02T17:12:32.370006Z", + "modified": "2024-08-02T17:12:32.370006Z", "name": "Appropriate Content", "description": "An influence operation may take content from other sources with proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources. Examples include the appropriation of content from one inauthentic news site to another inauthentic news site or network in ways that align with the originators licencing or terms of service.", "kill_chain_phases": [ @@ -3544,8 +3478,8 @@ "spec_version": "2.1", "id": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.355624Z", - "modified": "2024-03-13T22:04:00.355624Z", + "created": "2024-08-02T17:12:32.370419Z", + "modified": "2024-08-02T17:12:32.370419Z", "name": "Develop Text-Based Content", "description": "Creating and editing false or misleading text-based artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign.", "kill_chain_phases": [ @@ -3577,10 +3511,10 @@ "spec_version": "2.1", "id": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.35582Z", - "modified": "2024-03-13T22:04:00.35582Z", + "created": "2024-08-02T17:12:32.370771Z", + "modified": "2024-08-02T17:12:32.370771Z", "name": "Develop AI-Generated Text", - "description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.", + "description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.

Associated Techniques and Sub-techniques:
T0085.008: Machine Translated Text: Use this sub-technique when AI has been used to generate a translation of a piece of text.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -3610,8 +3544,8 @@ "spec_version": "2.1", "id": "attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.355959Z", - "modified": "2024-03-13T22:04:00.355959Z", + "created": "2024-08-02T17:12:32.371128Z", + "modified": "2024-08-02T17:12:32.371128Z", "name": "Develop Inauthentic News Articles", "description": "An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives.", "kill_chain_phases": [ @@ -3641,10 +3575,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--594af720-6df6-4d82-97c5-cf165d5c81db", + "id": "attack-pattern--9f99239e-f22e-4db4-9681-c20e511b4c35", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.356126Z", - "modified": "2024-03-13T22:04:00.356126Z", + "created": "2024-08-02T17:12:32.371475Z", + "modified": "2024-08-02T17:12:32.371475Z", "name": "Develop Document", "description": "Produce text in the form of a document.", "kill_chain_phases": [ @@ -3674,12 +3608,12 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--e8571474-253f-4a8f-9087-a2a3e5b187d2", + "id": "attack-pattern--df5189cc-29b5-41d1-a20f-bd641f5946be", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.356271Z", - "modified": "2024-03-13T22:04:00.356271Z", + "created": "2024-08-02T17:12:32.371835Z", + "modified": "2024-08-02T17:12:32.371835Z", "name": "Develop Book", - "description": "Produce text content in the form of a book.\u00a0\n\nThis technique covers both e-books and physical books, however, the former is more easily deployed by threat actors given the lower cost to develop.", + "description": "Produce text content in the form of a book.\u00a0

This technique covers both e-books and physical books, however, the former is more easily deployed by threat actors given the lower cost to develop.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -3707,12 +3641,12 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--a54ce69b-fad5-48ec-a238-4bc3afd1d3e1", + "id": "attack-pattern--269dbccd-0cff-4f60-a0bf-253eba9bcc63", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.356433Z", - "modified": "2024-03-13T22:04:00.356433Z", + "created": "2024-08-02T17:12:32.372218Z", + "modified": "2024-08-02T17:12:32.372218Z", "name": "Develop Opinion Article", - "description": "Opinion articles (aka \u201cOp-Eds\u201d or \u201cEditorials\u201d) are articles or regular columns flagged as \u201copinion\u201d posted to news sources, and can be contributed by people outside the organisation.\u00a0\n\nFlagging articles as opinions allow news organisations to distinguish them from the typical expectations of objective news reporting while distancing the presented opinion from the organisation or its employees.\n\nThe use of this technique is not by itself an indication of malicious or inauthentic content; Op-eds are a common format in media. However, threat actors exploit op-eds to, for example, submit opinion articles to local media to promote their narratives.\n\nExamples from the perspective of a news site involve publishing op-eds from perceived prestigious voices to give legitimacy to an inauthentic publication, or supporting causes by hosting op-eds from actors aligned with the organisation\u2019s goals.", + "description": "Opinion articles (aka \u201cOp-Eds\u201d or \u201cEditorials\u201d) are articles or regular columns flagged as \u201copinion\u201d posted to news sources, and can be contributed by people outside the organisation.\u00a0

Flagging articles as opinions allow news organisations to distinguish them from the typical expectations of objective news reporting while distancing the presented opinion from the organisation or its employees.

The use of this technique is not by itself an indication of malicious or inauthentic content; Op-eds are a common format in media. However, threat actors exploit op-eds to, for example, submit opinion articles to local media to promote their narratives.

Examples from the perspective of a news site involve publishing op-eds from perceived prestigious voices to give legitimacy to an inauthentic publication, or supporting causes by hosting op-eds from actors aligned with the organisation\u2019s goals.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -3740,12 +3674,12 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--de28e1be-a5e8-4031-ae6c-cdc570020a1f", + "id": "attack-pattern--0b662d26-ea3d-45d2-87e8-b32296ad9227", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.356663Z", - "modified": "2024-03-13T22:04:00.356663Z", + "created": "2024-08-02T17:12:32.372647Z", + "modified": "2024-08-02T17:12:32.372647Z", "name": "Create Fake Research", - "description": "Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx.\n\nThis Technique previously used the ID T0019.001", + "description": "Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx.

This Technique previously used the ID T0019.001.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -3770,13 +3704,46 @@ ], "x_mitre_version": "2.1" }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--1e817a7b-5f96-48d0-a2f9-7ba53c168397", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.373021Z", + "modified": "2024-08-02T17:12:32.373021Z", + "name": "Machine Translated Text", + "description": "Text which has been translated into another language using machine translation tools, such as AI.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "develop-content" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.008.md", + "external_id": "T0085.008" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.356861Z", - "modified": "2024-03-13T22:04:00.356861Z", + "created": "2024-08-02T17:12:32.3734Z", + "modified": "2024-08-02T17:12:32.3734Z", "name": "Develop Image-Based Content", "description": "Creating and editing false or misleading visual artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include photographing staged real-life situations, repurposing existing digital images, or using image creation and editing technologies.", "kill_chain_phases": [ @@ -3808,8 +3775,8 @@ "spec_version": "2.1", "id": "attack-pattern--a60b4d87-cca8-4e17-a51c-f9c2af96aef4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.357048Z", - "modified": "2024-03-13T22:04:00.357048Z", + "created": "2024-08-02T17:12:32.373732Z", + "modified": "2024-08-02T17:12:32.373732Z", "name": "Develop Memes", "description": "Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.", "kill_chain_phases": [ @@ -3841,10 +3808,10 @@ "spec_version": "2.1", "id": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.357237Z", - "modified": "2024-03-13T22:04:00.357237Z", + "created": "2024-08-02T17:12:32.374151Z", + "modified": "2024-08-02T17:12:32.374151Z", "name": "Develop AI-Generated Images (Deepfakes)", - "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.", + "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.

Associated Techniques and Sub-techniques:
T0145.002: AI-Generated Account Imagery: Analysts should use this sub-technique to document use of AI generated imagery in accounts\u2019 profile pictures or other account imagery.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -3874,8 +3841,8 @@ "spec_version": "2.1", "id": "attack-pattern--e4ad5ad8-f52d-48a0-8fce-33157f885a3e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.35738Z", - "modified": "2024-03-13T22:04:00.35738Z", + "created": "2024-08-02T17:12:32.374513Z", + "modified": "2024-08-02T17:12:32.374513Z", "name": "Deceptively Edit Images (Cheap Fakes)", "description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.", "kill_chain_phases": [ @@ -3907,8 +3874,8 @@ "spec_version": "2.1", "id": "attack-pattern--58b169c1-7e9a-4300-a98f-eb7baee8967f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.357518Z", - "modified": "2024-03-13T22:04:00.357518Z", + "created": "2024-08-02T17:12:32.374865Z", + "modified": "2024-08-02T17:12:32.374865Z", "name": "Aggregate Information into Evidence Collages", "description": "Image files that aggregate positive evidence (Joan Donovan)", "kill_chain_phases": [ @@ -3940,8 +3907,8 @@ "spec_version": "2.1", "id": "attack-pattern--ce4a9eee-7437-43ce-ac86-c1921f5c01a7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.357721Z", - "modified": "2024-03-13T22:04:00.357721Z", + "created": "2024-08-02T17:12:32.375242Z", + "modified": "2024-08-02T17:12:32.375242Z", "name": "Develop Video-Based Content", "description": "Creating and editing false or misleading video artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include staging videos of purportedly real situations, repurposing existing video artefacts, or using AI-generated video creation and editing technologies (including deepfakes).", "kill_chain_phases": [ @@ -3973,8 +3940,8 @@ "spec_version": "2.1", "id": "attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.357915Z", - "modified": "2024-03-13T22:04:00.357915Z", + "created": "2024-08-02T17:12:32.375552Z", + "modified": "2024-08-02T17:12:32.375552Z", "name": "Develop AI-Generated Videos (Deepfakes)", "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.", "kill_chain_phases": [ @@ -4006,8 +3973,8 @@ "spec_version": "2.1", "id": "attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.358087Z", - "modified": "2024-03-13T22:04:00.358087Z", + "created": "2024-08-02T17:12:32.37578Z", + "modified": "2024-08-02T17:12:32.37578Z", "name": "Deceptively Edit Video (Cheap Fakes)", "description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.", "kill_chain_phases": [ @@ -4039,8 +4006,8 @@ "spec_version": "2.1", "id": "attack-pattern--5b6aaad5-7166-4321-ae82-b9300a2ddad7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.358249Z", - "modified": "2024-03-13T22:04:00.358249Z", + "created": "2024-08-02T17:12:32.375987Z", + "modified": "2024-08-02T17:12:32.375987Z", "name": "Develop Audio-Based Content", "description": "Creating and editing false or misleading audio artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include creating completely new audio content, repurposing existing audio artefacts (including cheap fakes), or using AI-generated audio creation and editing technologies (including deepfakes).", "kill_chain_phases": [ @@ -4072,8 +4039,8 @@ "spec_version": "2.1", "id": "attack-pattern--e60f54a3-9972-43b8-8359-ee21d781acae", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.358419Z", - "modified": "2024-03-13T22:04:00.358419Z", + "created": "2024-08-02T17:12:32.376186Z", + "modified": "2024-08-02T17:12:32.376186Z", "name": "Develop AI-Generated Audio (Deepfakes)", "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.", "kill_chain_phases": [ @@ -4105,8 +4072,8 @@ "spec_version": "2.1", "id": "attack-pattern--779fe6e8-44ee-4f36-ab93-9daa867001d4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.35863Z", - "modified": "2024-03-13T22:04:00.35863Z", + "created": "2024-08-02T17:12:32.376384Z", + "modified": "2024-08-02T17:12:32.376384Z", "name": "Deceptively Edit Audio (Cheap Fakes)", "description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.", "kill_chain_phases": [ @@ -4138,8 +4105,8 @@ "spec_version": "2.1", "id": "attack-pattern--8c7832cb-8877-4f54-8e05-7e6df9a3d2b4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.358826Z", - "modified": "2024-03-13T22:04:00.358826Z", + "created": "2024-08-02T17:12:32.376603Z", + "modified": "2024-08-02T17:12:32.376603Z", "name": "Obtain Private Documents", "description": "Procuring documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can include authentic non-public documents, authentic non-public documents have been altered, or inauthentic documents intended to appear as if they are authentic non-public documents. All of these types of documents can be \"leaked\" during later stages in the operation.", "kill_chain_phases": [ @@ -4171,8 +4138,8 @@ "spec_version": "2.1", "id": "attack-pattern--ec8424e6-c7de-4543-b943-f0c4cc9ac63d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.359017Z", - "modified": "2024-03-13T22:04:00.359017Z", + "created": "2024-08-02T17:12:32.376796Z", + "modified": "2024-08-02T17:12:32.376796Z", "name": "Obtain Authentic Documents", "description": "Procure authentic documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can be \"leaked\" during later stages in the operation.", "kill_chain_phases": [ @@ -4204,8 +4171,8 @@ "spec_version": "2.1", "id": "attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.359363Z", - "modified": "2024-03-13T22:04:00.359363Z", + "created": "2024-08-02T17:12:32.37699Z", + "modified": "2024-08-02T17:12:32.37699Z", "name": "Alter Authentic Documents", "description": "Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic and can be \"leaked\" during later stages in the operation.", "kill_chain_phases": [ @@ -4237,8 +4204,8 @@ "spec_version": "2.1", "id": "attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.359596Z", - "modified": "2024-03-13T22:04:00.359596Z", + "created": "2024-08-02T17:12:32.377225Z", + "modified": "2024-08-02T17:12:32.377225Z", "name": "Create Inauthentic Accounts", "description": "Inauthentic accounts include bot accounts, cyborg accounts, sockpuppet accounts, and anonymous accounts.", "kill_chain_phases": [ @@ -4270,8 +4237,8 @@ "spec_version": "2.1", "id": "attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.35974Z", - "modified": "2024-03-13T22:04:00.35974Z", + "created": "2024-08-02T17:12:32.377423Z", + "modified": "2024-08-02T17:12:32.377423Z", "name": "Create Anonymous Accounts", "description": "Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation.", "kill_chain_phases": [ @@ -4303,8 +4270,8 @@ "spec_version": "2.1", "id": "attack-pattern--db93e285-c516-40b0-bb5a-36bbaf5c08b9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.359881Z", - "modified": "2024-03-13T22:04:00.359881Z", + "created": "2024-08-02T17:12:32.377614Z", + "modified": "2024-08-02T17:12:32.377614Z", "name": "Create Cyborg Accounts", "description": "Cyborg accounts refer to partly manned, partly automated social media accounts. Cyborg accounts primarily act as bots, but a human operator periodically takes control of the account to engage with real social media users by responding to comments and posting original content. Influence operations may use cyborg accounts to reduce the amount of direct human input required to maintain a regular account but increase the apparent legitimacy of the cyborg account by occasionally breaking its bot-like behaviour with human interaction.", "kill_chain_phases": [ @@ -4336,8 +4303,8 @@ "spec_version": "2.1", "id": "attack-pattern--b2695cde-5f12-4e6a-b55a-e31220cb4bd7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.360018Z", - "modified": "2024-03-13T22:04:00.360018Z", + "created": "2024-08-02T17:12:32.377807Z", + "modified": "2024-08-02T17:12:32.377807Z", "name": "Create Bot Accounts", "description": "Bots refer to autonomous internet users that interact with systems or other users while imitating traditional human behaviour. Bots use a variety of tools to stay active without direct human operation, including artificial intelligence and big data analytics. For example, an individual may programme a Twitter bot to retweet a tweet every time it contains a certain keyword or hashtag. An influence operation may use bots to increase its exposure and artificially promote its content across the internet without dedicating additional time or human resources. Amplifier bots promote operation content through reposts, shares, and likes to increase the content\u2019s online popularity. Hacker bots are traditionally covert bots running on computer scripts that rarely engage with users and work primarily as agents of larger cyberattacks, such as a Distributed Denial of Service attacks. Spammer bots are programmed to post content on social media or in comment sections, usually as a supplementary tool. Impersonator bots102 pose as real people by mimicking human behaviour, complicating their detection.", "kill_chain_phases": [ @@ -4369,8 +4336,8 @@ "spec_version": "2.1", "id": "attack-pattern--81abb4fa-705e-430f-ba54-34bf7bd467f7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.360159Z", - "modified": "2024-03-13T22:04:00.360159Z", + "created": "2024-08-02T17:12:32.377997Z", + "modified": "2024-08-02T17:12:32.377997Z", "name": "Create Sockpuppet Accounts", "description": "Sockpuppet accounts refer to falsified accounts that either promote the influence operation\u2019s own material or attack critics of the material online. Individuals who control sockpuppet accounts also man at least one other user account.67 Sockpuppet accounts help legitimise operation narratives by providing an appearance of external support for the material and discrediting opponents of the operation.", "kill_chain_phases": [ @@ -4402,8 +4369,8 @@ "spec_version": "2.1", "id": "attack-pattern--9a4a16c5-a671-4469-a854-ef45cb0e38ab", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.36031Z", - "modified": "2024-03-13T22:04:00.36031Z", + "created": "2024-08-02T17:12:32.378342Z", + "modified": "2024-08-02T17:12:32.378342Z", "name": "Recruit Malign Actors", "description": "Operators recruit bad actors paying recruiting, or exerting control over individuals includes trolls, partisans, and contractors.", "kill_chain_phases": [ @@ -4435,8 +4402,8 @@ "spec_version": "2.1", "id": "attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.360488Z", - "modified": "2024-03-13T22:04:00.360488Z", + "created": "2024-08-02T17:12:32.378557Z", + "modified": "2024-08-02T17:12:32.378557Z", "name": "Recruit Contractors", "description": "Operators recruit paid contractor to support the campaign.", "kill_chain_phases": [ @@ -4468,8 +4435,8 @@ "spec_version": "2.1", "id": "attack-pattern--fe5cf0f2-3792-4cab-b546-a9af7a5aa319", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.360652Z", - "modified": "2024-03-13T22:04:00.360652Z", + "created": "2024-08-02T17:12:32.378752Z", + "modified": "2024-08-02T17:12:32.378752Z", "name": "Recruit Partisans", "description": "Operators recruit partisans (ideologically-aligned individuals) to support the campaign.", "kill_chain_phases": [ @@ -4501,8 +4468,8 @@ "spec_version": "2.1", "id": "attack-pattern--ef3dcdcd-bd97-48e0-9d15-3e482a72c979", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.360815Z", - "modified": "2024-03-13T22:04:00.360815Z", + "created": "2024-08-02T17:12:32.378944Z", + "modified": "2024-08-02T17:12:32.378944Z", "name": "Enlist Troll Accounts", "description": "An influence operation may hire trolls, or human operators of fake accounts that aim to provoke others by posting and amplifying content about controversial issues. Trolls can serve to discredit an influence operation\u2019s opposition or bring attention to the operation\u2019s cause through debate. Classic trolls refer to regular people who troll for personal reasons, such as attention-seeking or boredom. Classic trolls may advance operation narratives by coincidence but are not directly affiliated with any larger operation. Conversely, hybrid trolls act on behalf of another institution, such as a state or financial organisation, and post content with a specific ideological goal. Hybrid trolls may be highly advanced and institutionalised or less organised and work for a single individual.", "kill_chain_phases": [ @@ -4534,8 +4501,8 @@ "spec_version": "2.1", "id": "attack-pattern--c4213e65-a7cc-42a5-a3a7-2d8040258625", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.361012Z", - "modified": "2024-03-13T22:04:00.361012Z", + "created": "2024-08-02T17:12:32.379162Z", + "modified": "2024-08-02T17:12:32.379162Z", "name": "Build Network", "description": "Operators build their own network, creating links between accounts -- whether authentic or inauthentic -- in order amplify and promote narratives and artefacts, and encourage further growth of ther network, as well as the ongoing sharing and engagement with operational content.", "kill_chain_phases": [ @@ -4567,8 +4534,8 @@ "spec_version": "2.1", "id": "attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.361186Z", - "modified": "2024-03-13T22:04:00.361186Z", + "created": "2024-08-02T17:12:32.379547Z", + "modified": "2024-08-02T17:12:32.379547Z", "name": "Create Organisations", "description": "Influence operations may establish organisations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.", "kill_chain_phases": [ @@ -4600,8 +4567,8 @@ "spec_version": "2.1", "id": "attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.361358Z", - "modified": "2024-03-13T22:04:00.361358Z", + "created": "2024-08-02T17:12:32.379779Z", + "modified": "2024-08-02T17:12:32.379779Z", "name": "Use Follow Trains", "description": "A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups.", "kill_chain_phases": [ @@ -4633,8 +4600,8 @@ "spec_version": "2.1", "id": "attack-pattern--abb6518d-50fe-4428-9bca-a6e3c6ed4de4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.361594Z", - "modified": "2024-03-13T22:04:00.361594Z", + "created": "2024-08-02T17:12:32.379974Z", + "modified": "2024-08-02T17:12:32.379974Z", "name": "Create Community or Sub-Group", "description": "When there is not an existing community or sub-group that meets a campaign's goals, an influence operation may seek to create a community or sub-group.", "kill_chain_phases": [ @@ -4666,8 +4633,8 @@ "spec_version": "2.1", "id": "attack-pattern--c1182f49-4318-486f-81be-d44b99300343", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.36177Z", - "modified": "2024-03-13T22:04:00.36177Z", + "created": "2024-08-02T17:12:32.380189Z", + "modified": "2024-08-02T17:12:32.380189Z", "name": "Acquire/Recruit Network", "description": "Operators acquire an existing network by paying, recruiting, or exerting control over the leaders of the existing network.", "kill_chain_phases": [ @@ -4699,8 +4666,8 @@ "spec_version": "2.1", "id": "attack-pattern--d522f417-ba0e-4e2d-ae96-df2c1fd607e6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.361966Z", - "modified": "2024-03-13T22:04:00.361966Z", + "created": "2024-08-02T17:12:32.380386Z", + "modified": "2024-08-02T17:12:32.380386Z", "name": "Fund Proxies", "description": "An influence operation may fund proxies, or external entities that work for the operation. An operation may recruit/train users with existing sympathies towards the operation\u2019s narratives and/or goals as proxies. Funding proxies serves various purposes including: - Diversifying operation locations to complicate attribution - Reducing the workload for direct operation assets", "kill_chain_phases": [ @@ -4732,8 +4699,8 @@ "spec_version": "2.1", "id": "attack-pattern--c7017017-4965-4dad-a970-e748b7080a19", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.36214Z", - "modified": "2024-03-13T22:04:00.36214Z", + "created": "2024-08-02T17:12:32.380585Z", + "modified": "2024-08-02T17:12:32.380585Z", "name": "Acquire Botnets", "description": "A botnet is a group of bots that can function in coordination with each other.", "kill_chain_phases": [ @@ -4765,8 +4732,8 @@ "spec_version": "2.1", "id": "attack-pattern--adaaa726-50fe-47e2-b92d-de0d65c9250c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.362286Z", - "modified": "2024-03-13T22:04:00.362286Z", + "created": "2024-08-02T17:12:32.38078Z", + "modified": "2024-08-02T17:12:32.38078Z", "name": "Infiltrate Existing Networks", "description": "Operators deceptively insert social assets into existing networks as group members in order to influence the members of the network and the wider information environment that the network impacts.", "kill_chain_phases": [ @@ -4798,8 +4765,8 @@ "spec_version": "2.1", "id": "attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.362475Z", - "modified": "2024-03-13T22:04:00.362475Z", + "created": "2024-08-02T17:12:32.380974Z", + "modified": "2024-08-02T17:12:32.380974Z", "name": "Identify Susceptible Targets in Networks", "description": "When seeking to infiltrate an existing network, an influence operation may identify individuals and groups that might be susceptible to being co-opted or influenced.", "kill_chain_phases": [ @@ -4831,8 +4798,8 @@ "spec_version": "2.1", "id": "attack-pattern--8f545c7e-f2ba-4541-9004-dbe50fcc0b0f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.362675Z", - "modified": "2024-03-13T22:04:00.362675Z", + "created": "2024-08-02T17:12:32.381311Z", + "modified": "2024-08-02T17:12:32.381311Z", "name": "Utilise Butterfly Attacks", "description": "Butterfly attacks occur when operators pretend to be members of a certain social group, usually a group that struggles for representation. An influence operation may mimic a group to insert controversial statements into the discourse, encourage the spread of operation content, or promote harassment among group members. Unlike astroturfing, butterfly attacks aim to infiltrate and discredit existing grassroots movements, organisations, and media campaigns.", "kill_chain_phases": [ @@ -4864,8 +4831,8 @@ "spec_version": "2.1", "id": "attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.362873Z", - "modified": "2024-03-13T22:04:00.362873Z", + "created": "2024-08-02T17:12:32.381825Z", + "modified": "2024-08-02T17:12:32.381825Z", "name": "Develop Owned Media Assets", "description": "An owned media asset refers to an agency or organisation through which an influence operation may create, develop, and host content and narratives. Owned media assets include websites, blogs, social media pages, forums, and other platforms that facilitate the creation and organisation of content.", "kill_chain_phases": [ @@ -4897,8 +4864,8 @@ "spec_version": "2.1", "id": "attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.363115Z", - "modified": "2024-03-13T22:04:00.363115Z", + "created": "2024-08-02T17:12:32.382258Z", + "modified": "2024-08-02T17:12:32.382258Z", "name": "Leverage Content Farms", "description": "Using the services of large-scale content providers for creating and amplifying campaign artefacts at scale.", "kill_chain_phases": [ @@ -4930,8 +4897,8 @@ "spec_version": "2.1", "id": "attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.363311Z", - "modified": "2024-03-13T22:04:00.363311Z", + "created": "2024-08-02T17:12:32.382597Z", + "modified": "2024-08-02T17:12:32.382597Z", "name": "Create Content Farms", "description": "An influence operation may create an organisation for creating and amplifying campaign artefacts at scale.", "kill_chain_phases": [ @@ -4963,8 +4930,8 @@ "spec_version": "2.1", "id": "attack-pattern--64bcccb9-4d10-4eed-8c49-8816ecfd78a3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.363461Z", - "modified": "2024-03-13T22:04:00.363461Z", + "created": "2024-08-02T17:12:32.382901Z", + "modified": "2024-08-02T17:12:32.382901Z", "name": "Outsource Content Creation to External Organisations", "description": "An influence operation may outsource content creation to external companies to avoid attribution, increase the rate of content creation, or improve content quality, i.e., by employing an organisation that can create content in the target audience\u2019s native language. Employed organisations may include marketing companies for tailored advertisements or external content farms for high volumes of targeted media.", "kill_chain_phases": [ @@ -4996,10 +4963,10 @@ "spec_version": "2.1", "id": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.363599Z", - "modified": "2024-03-13T22:04:00.363599Z", - "name": "Create Personas", - "description": "Creating fake people, often with accounts across multiple platforms. These personas can be as simple as a name, can contain slightly more background like location, profile pictures, backstory, or can be effectively backstopped with indicators like fake identity documents.", + "created": "2024-08-02T17:12:32.383296Z", + "modified": "2024-08-02T17:12:32.383296Z", + "name": "Present Persona", + "description": "This Technique contains different types of personas commonly taken on by threat actors during influence operations.

Analysts should use T0097\u2019s sub-techniques to document the type of persona which an account is presenting. For example, an account which describes itself as being a journalist can be tagged with T0097.102: Journalist Persona.

Personas presented by individuals include:

T0097.100: Individual Persona
T0097.101: Local Persona
T0097.102: Journalist Persona
T0097.103: Activist Persona
T0097.104: Hacktivist Persona
T0097.105: Military Personnel Persona
T0097.106: Recruiter Persona
T0097.107: Researcher Persona
T0097.108: Expert Persona
T0097.109: Romantic Suitor Persona
T0097.110: Party Official Persona
T0097.111: Government Official Persona
T0097.112: Government Employee Persona

This Technique also houses institutional personas commonly taken on by threat actors:

T0097.200: Institutional Persona
T0097.201: Local Institution Persona
T0097.202: News Outlet Persona
T0097.203: Fact Checking Organisation Persona
T0097.204: Think Tank Persona
T0097.205: Business Persona
T0097.206: Government Institution Persona
T0097.207: NGO Persona
T0097.208: Social Cause Persona

By using a persona, a threat actor is adding the perceived legitimacy of the persona to their narratives and activities.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -5027,12 +4994,12 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--8f3f1d6f-beda-4f20-b1a7-2d087ae453f7", + "id": "attack-pattern--39f767f7-bc22-4611-8a39-3584c5bbdd5a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.363736Z", - "modified": "2024-03-13T22:04:00.363736Z", - "name": "Produce Evidence for Persona", - "description": "People may produce evidence which supports the persona they are deploying (T0097) (aka \u201cbackstopping\u201d the persona).\n\nThis Technique covers situations where evidence is developed or produced as part of an influence operation to increase the perceived legitimacy of a persona used during IO, including creating accounts for the same persona on multiple platforms.\n\nThe use of personas (T0097), and providing evidence to improve people\u2019s perception of one\u2019s persona (T0097.001), are not necessarily malicious or inauthentic. However, sometimes people use personas to increase the perceived legitimacy of narratives for malicious purposes.\n\nThis Technique was previously called Backstop Personas.", + "created": "2024-08-02T17:12:32.383638Z", + "modified": "2024-08-02T17:12:32.383638Z", + "name": "Individual Persona", + "description": "This sub-technique can be used to indicate that an entity is presenting itself as an individual. If the person is presenting themselves as having one of the personas listed below then these sub-techniques should be used instead, as they indicate both the type of persona they presented and that the entity presented itself as an individual:

T0097.101: Local Persona
T0097.102: Journalist Persona
T0097.103: Activist Persona
T0097.104: Hacktivist Persona
T0097.105: Military Personnel Persona
T0097.106: Recruiter Persona
T0097.107: Researcher Persona
T0097.108: Expert Persona
T0097.109: Romantic Suitor Persona
T0097.110: Party Official Persona
T0097.111: Government Official Persona
T0097.112: Government Employee Persona", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -5042,8 +5009,701 @@ "external_references": [ { "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.001.md", - "external_id": "T0097.001" + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.100.md", + "external_id": "T0097.100" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--a62e0c69-0c29-4c71-a326-1a7c3e19b74d", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.384037Z", + "modified": "2024-08-02T17:12:32.384037Z", + "name": "Local Persona", + "description": "A person with a local persona presents themselves as living in a particular geography or having local knowledge relevant to a narrative.

While presenting as a local is not an indication of inauthentic behaviour,\u00a0 an influence operation may have its narratives amplified by people presenting as local to a target area. Threat actors can fabricate locals (T0143.002: Fabricated Persona, T0097.101: Local Persona) to add credibility to their narratives, or to misrepresent the real opinions of locals in the area.

People who are legitimate locals (T0143.001: Authentic Persona, T0097.101: Local Persona) can use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a local to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.201: Local Institution Persona: Analysts should use this sub-technique to catalogue cases where an institution is presenting as a local, such as a local news organisation or local business.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.101.md", + "external_id": "T0097.101" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--930ddf1d-7dc9-4fb2-9f5c-be928d2eb909", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.384404Z", + "modified": "2024-08-02T17:12:32.384404Z", + "name": "Journalist Persona", + "description": "A person with a journalist persona presents themselves as a reporter or journalist delivering news, conducting interviews, investigations etc.

While presenting as a journalist is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as journalists. Threat actors can fabricate journalists to give the appearance of legitimacy, justifying the actor\u2019s requests for interviews, etc (T0143.002: Fabricated Persona, T0097.102: Journalist Persona).

People who have legitimately developed a persona as a journalist (T0143.001: Authentic Persona, T0097.102: Journalist Persona) can use it for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a trusted journalist to provide legitimacy to a false narrative or be tricked into doing so without the journalist\u2019s knowledge.

Associated Techniques and Sub-techniques
T0097.202: News Organisation Persona: People with a journalist persona may present as being part of a news organisation.
T0097.101: Local Persona: People with a journalist persona may present themselves as local reporters.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.102.md", + "external_id": "T0097.102" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--001e2693-c7a6-4615-b06a-90ae22d7b353", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.384802Z", + "modified": "2024-08-02T17:12:32.384802Z", + "name": "Activist Persona", + "description": "A person with an activist persona presents themselves as an activist; an individual who campaigns for a political cause, organises related events, etc.

While presenting as an activist is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as activists. Threat actors can fabricate activists to give the appearance of popular support for an evolving grassroots movement (see T0143.002: Fabricated Persona, T0097.103: Activist Persona).

People who are legitimate activists can use this persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as an activist to provide visibility to a false narrative or be tricked into doing so without their knowledge (T0143.001: Authentic Persona, T0097.103: Activist Persona).

Associated Techniques and Sub-techniques
T0097.104: Hacktivist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as someone engaged in activism who uses technical tools and methods, including building technical infrastructure and conducting offensive cyber operations, to achieve their goals.
T0097.207: NGO Persona: People with an activist persona may present as being part of an NGO.
T0097.208: Social Cause Persona: Analysts should use this sub-technique to catalogue cases where an online account is presenting as posting content related to a particular social cause, while not presenting as an individual.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.103.md", + "external_id": "T0097.103" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--976faac5-b7e1-4a1d-b52f-4878109e2dc9", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.385218Z", + "modified": "2024-08-02T17:12:32.385218Z", + "name": "Hacktivist Persona", + "description": "A person with a hacktivist persona presents themselves as an activist who conducts offensive cyber operations or builds technical infrastructure for political purposes, rather than the financial motivations commonly attributed to hackers; hacktivists are hacker activists who use their technical knowledge to take political action.

Hacktivists can build technical infrastructure to support other activists, including secure communication channels and surveillance and censorship circumvention. They can also conduct DDOS attacks and other offensive cyber operations, aiming to take down digital assets or gain access to proprietary information. An influence operation may use hacktivist personas to support their operational narratives and legitimise their operational activities.

Fabricated Hacktivists are sometimes referred to as \u201cFaketivists\u201d.

Associated Techniques and Sub-techniques
T0097.103: Activist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as someone engaged in activism but doesn\u2019t present themselves as using technical tools and methods to achieve their goals.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.104.md", + "external_id": "T0097.104" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--dde28850-4198-4223-81b5-ff9b30b4e04f", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.385665Z", + "modified": "2024-08-02T17:12:32.385665Z", + "name": "Military Personnel Persona", + "description": "A person with a military personnel persona presents themselves as a serving member or veteran of a military organisation operating in an official capacity on behalf of a government.

While presenting as military personnel is not an indication of inauthentic behaviour,\u00a0 an influence operation may have its narratives amplified by people presenting as military personnel. Threat actors can fabricate military personnel (T0143.002: Fabricated Persona, T0097.105: Military Personnel Persona) to pose as experts on military topics, or to discredit geopolitical adversaries by pretending to be one of their military personnel and spreading discontent.

People who have legitimately developed a military persona (T0143.001: Authentic Persona, T0097.105: Military Personnel Persona) can use it for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a member of the military to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.105.md", + "external_id": "T0097.105" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d3e83913-e2d5-4dad-b917-2363100c6ca0", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.386035Z", + "modified": "2024-08-02T17:12:32.386035Z", + "name": "Recruiter Persona", + "description": "A person with a recruiter persona presents themselves as a potential employer or provider of freelance work.

While presenting as a recruiter is not an indication of inauthentic behaviour, threat actors fabricate recruiters (T0143.002: Fabricated Persona, T0097.106: Recruiter Persona) to justify asking for personal information from their targets or to trick targets into working for the threat actors (without revealing who they are).

Associated Techniques and Sub-techniques
T0097.205: Business Persona: People with a recruiter persona may present as being part of a business which they are recruiting for.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.106.md", + "external_id": "T0097.106" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--e4ea9ed6-b158-4cdc-95c2-749383d2a388", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.386542Z", + "modified": "2024-08-02T17:12:32.386542Z", + "name": "Researcher Persona", + "description": "A person with a researcher persona presents themselves as conducting research (e.g. for academic institutions, or think tanks), or having previously conducted research.

While presenting as a researcher is not an indication of inauthentic behaviour,\u00a0 an influence operation may have its narratives amplified by people presenting as researchers. Threat actors can fabricate researchers (T0143.002: Fabricated Persona, T0097.107: Researcher Persona) to add credibility to their narratives.

People who are legitimate researchers (T0143.001: Authentic Persona, T0097.107: Researcher Persona) can use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a Researcher to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.204: Think Tank Persona: People with a researcher persona may present as being part of a think tank.
T0097.108: Expert Persona: People who present as researching a given topic are likely to also present as having expertise in the area.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.107.md", + "external_id": "T0097.107" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d9381123-f2ef-419a-b895-8f2147e26b15", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.386986Z", + "modified": "2024-08-02T17:12:32.386986Z", + "name": "Expert Persona", + "description": "A person with an expert persona presents themselves as having expertise or experience in a field. Commonly the persona\u2019s expertise will be called upon to add credibility to a given narrative.

While presenting as an expert is not an indication of inauthentic behaviour,\u00a0 an influence operation may have its narratives amplified by people presenting as experts. Threat actors can fabricate experts (T0143.002: Fabricated Persona, T0097.107: Researcher Persona) to add credibility to their narratives.

People who are legitimate experts (T0143.001: Authentic Persona, T0097.107: Researcher Persona) can make mistakes, use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as an expert to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.107: Researcher Persona: People who present as experts may also present as conducting or having conducted research into their specialist subject.
T0097.204: Think Tank Persona: People with an expert persona may present as being part of a think tank.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.108.md", + "external_id": "T0097.108" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--6270bd3c-efcf-4778-8512-065abffe9a88", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.387376Z", + "modified": "2024-08-02T17:12:32.387376Z", + "name": "Romantic Suitor Persona", + "description": "A person with a romantic suitor persona presents themselves as seeking a romantic or physical connection with another person.

While presenting as seeking a romantic or physical connection is not an indication of inauthentic behaviour, threat actors can use dating apps, social media channels or dating websites to fabricate romantic suitors to lure targets they can blackmail, extract information from, deceive or trick into giving them money (T0143.002: Fabricated Persona, T0097.109: Romantic Suitor Persona).

Honeypotting in espionage and Big Butchering in scamming are commonly associated with romantic suitor personas.

Associated Techniques and Sub-techniques
T0104.002: Dating App: Analysts can use this sub-technique for tagging cases where an account has been identified as using a dating platform.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.109.md", + "external_id": "T0097.109" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--fa4e9051-46d7-45b4-a65b-9376b003ad2a", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.387783Z", + "modified": "2024-08-02T17:12:32.387783Z", + "name": "Party Official Persona", + "description": "A person who presents as an official member of a political party, such as leaders of political parties, candidates standing to represent constituents, and campaign staff.

Presenting as an official of a political party is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in political parties to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.110: Party Official Persona). They may also impersonate existing officials of political parties (T0143.003: Impersonated Persona, T0097.110: Party Official Persona).

Legitimate members of political parties could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.110: Party Official Persona). For example, an electoral candidate could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting as a member of a government.\u00a0

Some party officials will also be government officials. For example, in the United Kingdom the head of government is commonly also the head of their political party.

Some party officials won\u2019t be government officials. For example, members of a party standing in an election, or party officials who work outside of government (e.g. campaign staff).", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.110.md", + "external_id": "T0097.110" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--e41b04e4-b8c2-4f66-93d7-c148f3378008", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.38815Z", + "modified": "2024-08-02T17:12:32.38815Z", + "name": "Government Official Persona", + "description": "A person who presents as an active or previous government official has the government official persona. These are officials serving in government, such as heads of government departments, leaders of countries, and members of government selected to represent constituents.

Presenting as a government official is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in government to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.111: Government Official Persona). They may also impersonate existing members of government (T0143.003: Impersonated Persona, T0097.111: Government Official Persona).

Legitimate government officials could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.111: Government Official Persona). For example, a government official could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.110: Party Official Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting as a member of a political party.\u00a0

Not all government officials are political party officials (such as outside experts brought into government) and not all political party officials are government officials (such as people standing for office who are not yet working in government).

T0097.206: Government Institution Persona: People presenting as members of a government may also represent a government institution which they are associated with.

T0097.112: Government Employee Persona: Analysts should use this sub-technique to document people presenting as professionals hired to serve in government institutions and departments, not officials selected to represent constituents, or assigned official roles in government (such as heads of departments).", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.111.md", + "external_id": "T0097.111" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--66e1a3b9-d837-4eaa-9cdf-900663a8708d", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.388554Z", + "modified": "2024-08-02T17:12:32.388554Z", + "name": "Government Employee Persona", + "description": "A person who presents as an active or previous civil servant has the government employee persona. These are professionals hired to serve in government institutions and departments, not officials selected to represent constituents, or assigned official roles in government (such as heads of departments).

Presenting as a government employee is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in government to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.112: Government Employee Persona). They may also impersonate existing government employees (T0143.003: Impersonated Persona, T0097.112: Government Employee Persona).

Legitimate government employees could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.112: Government Employee Persona). For example, a government employee could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Analysts should use this technique to document people who present as an active or previous government official, such as heads of government departments, leaders of countries, and members of government selected to represent constituents.
T0097.206: Government Institution Persona: People presenting as members of a government may also present a government institution which they are associated with.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.112.md", + "external_id": "T0097.112" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--63ed1a5a-835e-4a51-9b95-0f0525a95186", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.388973Z", + "modified": "2024-08-02T17:12:32.388973Z", + "name": "Institutional Persona", + "description": "This Technique can be used to indicate that an entity is presenting itself as an institution. If the organisation is presenting itself as having one of the personas listed below then these Techniques should be used instead, as they indicate both that the entity presented itself as an institution, and the type of persona they presented:

T0097.201: Local Institution Persona
T0097.202: News Outlet Persona
T0097.203: Fact Checking Organisation Persona
T0097.204: Think Tank Persona
T0097.205: Business Persona
T0097.206: Government Institution Persona
T0097.207: NGO Persona
T0097.208: Social Cause Persona", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.200.md", + "external_id": "T0097.200" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--a5ef7a55-8c38-4210-ad39-ccb22c9dd70c", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.390107Z", + "modified": "2024-08-02T17:12:32.390107Z", + "name": "Local Institution Persona", + "description": "Institutions which present themselves as operating in a particular geography, or as having local knowledge relevant to a narrative, are presenting a local institution persona.

While presenting as a local institution is not an indication of inauthentic behaviour, threat actors may present themselves as such (T0143.002: Fabricated Persona, T0097.201: Local Institution Persona) to add credibility to their narratives, or misrepresent the real opinions of locals in the area.

Legitimate local institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.201: Local Institution Persona). For example, a local institution could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.101: Local Persona: Institutions presenting as local may also present locals working within the organisation.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.201.md", + "external_id": "T0097.201" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--72268aef-baf4-4606-a3ba-837950a54f52", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.390521Z", + "modified": "2024-08-02T17:12:32.390521Z", + "name": "News Outlet Persona", + "description": "An institution with a news outlet persona presents itself as an organisation which delivers new information to its target audience.

While presenting as a news outlet is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by news organisations. Threat actors can fabricate news organisations (T0143.002: Fabricated Persona, T0097.202: News Outlet Persona), or they can impersonate existing news outlets (T0143.003: Impersonated Persona, T0097.202: News Outlet Persona).

Legitimate news organisations could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.202: News Outlet Persona).

Associated Techniques and Sub-techniques
T0097.102: Journalist Persona: Institutions presenting as news outlets may also present journalists working within the organisation.
T0097.201: Local Institution Persona: Institutions presenting as news outlets may present as being a local news outlet.
T0097.203: Fact Checking Organisation Persona: Institutions presenting as news outlets may also deliver a fact checking service (e.g. The UK\u2019s BBC News has the fact checking service BBC Verify). When an actor presents as the fact checking arm of a news outlet, they are presenting both a News Outlet Persona and a Fact Checking Organisation Persona.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.202.md", + "external_id": "T0097.202" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--97ba7c89-f5d0-49a4-a661-f8317b44cf20", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.390969Z", + "modified": "2024-08-02T17:12:32.390969Z", + "name": "Fact Checking Organisation Persona", + "description": "An institution with a fact checking organisation persona presents itself as an organisation which produces reports which assess the validity of others\u2019 reporting / statements.

While presenting as a fact checking organisation is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by fact checking organisations. Threat actors can fabricate fact checking organisations (T0143.002: Fabricated Persona, T0097.202: News Outlet Persona), or they can impersonate existing fact checking outlets (T0143.003: Impersonated Persona, T0097.202: News Outlet Persona).

Legitimate fact checking organisations could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.202: News Outlet Persona).

Associated Techniques and Sub-techniques
T0097.102: Journalist Persona: Institutions presenting as fact checking organisations may also present journalists working within the organisation.
T0097.202: News Outlet Persona: Fact checking organisations may present as operating as part of a larger news outlet (e.g. The UK\u2019s BBC News has the fact checking service BBC Verify). When an actor presents as the fact checking arm of a news outlet, they are presenting both a News Outlet Persona and a Fact Checking Organisation Persona.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.203.md", + "external_id": "T0097.203" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--15ca8e62-e179-4dd8-9f5e-427771e915a3", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.391349Z", + "modified": "2024-08-02T17:12:32.391349Z", + "name": "Think Tank Persona", + "description": "An institution with a think tank persona presents itself as a think tank; an organisation that aims to conduct original research and propose new policies or solutions, especially for social and scientific problems.

While presenting as a think tank is not an indication of inauthentic behaviour, think tank personas are commonly used by threat actors as a front for their operational activity (T0143.002: Fabricated Persona, T0097.204: Think Tank Persona). They may be created to give legitimacy to narratives and allow them to suggest politically beneficial solutions to societal issues.

Legitimate think tanks could have a political bias that they may not be transparent about, they could use their persona for malicious purposes, or they could be exploited by threat actors (T0143.001: Authentic Persona, T0097.204: Think Tank Persona). For example, a think tank could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.107: Researcher Persona: Institutions presenting as think tanks may also present researchers working within the organisation.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.204.md", + "external_id": "T0097.204" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--faa5450d-6d1f-4700-93bd-fd2d59a79e60", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.391786Z", + "modified": "2024-08-02T17:12:32.391786Z", + "name": "Business Persona", + "description": "An institution with a business persona presents itself as a for-profit organisation which provides goods or services for a price.

While presenting as a business is not an indication of inauthentic behaviour, business personas may be used by threat actors as a front for their operational activity (T0143.002: Fabricated Persona, T0097.205: Business Persona).

Threat actors may also impersonate existing businesses (T0143.003: Impersonated Persona, T0097.205: Business Persona) to exploit their brand or cause reputational damage.

Legitimate businesses could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.205: Business Persona). For example, a business could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.205.md", + "external_id": "T0097.205" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--7e812f7d-f8a5-4636-b354-3d93561eda49", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.392145Z", + "modified": "2024-08-02T17:12:32.392145Z", + "name": "Government Institution Persona", + "description": "Institutions which present themselves as governments, or government ministries, are presenting a government institution persona.

While presenting as a government institution is not an indication of inauthentic behaviour, threat actors may impersonate existing government institutions as part of their operation (T0143.003: Impersonated Persona, T0097.206: Government Institution Persona), to add legitimacy to their narratives, or discredit the government.

Legitimate government institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.206: Government Institution Persona). For example, a government institution could be used by elected officials to spread inauthentic narratives.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Institutions presenting as governments may also present officials working within the organisation.
T0097.112: Government Employee Persona: Institutions presenting as governments may also present employees working within the organisation.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.206.md", + "external_id": "T0097.206" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--f99e6f94-8c7d-42d7-8343-8d959643f721", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.392573Z", + "modified": "2024-08-02T17:12:32.392573Z", + "name": "NGO Persona", + "description": "Institutions which present themselves as an NGO (Non-Governmental Organisation), an organisation which provides services or advocates for public policy (while not being directly affiliated with any government), are presenting an NGO persona.

While presenting as an NGO is not an indication of inauthentic behaviour, NGO personas are commonly used by threat actors (such as intelligence services) as a front for their operational activity (T0143.002: Fabricated Persona, T0097.207: NGO Persona). They are created to give legitimacy to the influence operation and potentially infiltrate grassroots movements

Legitimate NGOs could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.207: NGO Persona). For example, an NGO could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques:
T0097.103: Activist Persona: Institutions presenting as activist groups may also present activists working within the organisation.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.207.md", + "external_id": "T0097.207" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--422b6ba9-3ad0-4e6f-9f00-b044e5d657a1", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.392983Z", + "modified": "2024-08-02T17:12:32.392983Z", + "name": "Social Cause Persona", + "description": "Online accounts which present themselves as focusing on a social cause are presenting the Social Cause Persona. Examples include accounts which post about current affairs, such as discrimination faced by minorities.

While presenting as an account invested in a social cause is not an indication of inauthentic behaviour, such personas have been used by threat actors to exploit peoples\u2019 legitimate emotional investment regarding social causes that matter to them (T0143.002: Fabricated Persona, T0097.208: Social Cause Persona).

Legitimate accounts focused on a social cause could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.208: Social Cause Persona). For example, the account holders could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques:
T0097.103: Activist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as an activist related to a social cause. Accounts with social cause personas do not present themselves as individuals, but may have activists controlling the accounts.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.208.md", + "external_id": "T0097.208" } ], "object_marking_refs": [ @@ -5062,8 +5722,8 @@ "spec_version": "2.1", "id": "attack-pattern--6db47704-ba87-402d-933a-de90f5aa8965", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.363873Z", - "modified": "2024-03-13T22:04:00.363873Z", + "created": "2024-08-02T17:12:32.3934Z", + "modified": "2024-08-02T17:12:32.3934Z", "name": "Establish Inauthentic News Sites", "description": "Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details.", "kill_chain_phases": [ @@ -5095,8 +5755,8 @@ "spec_version": "2.1", "id": "attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.364072Z", - "modified": "2024-03-13T22:04:00.364072Z", + "created": "2024-08-02T17:12:32.393803Z", + "modified": "2024-08-02T17:12:32.393803Z", "name": "Create Inauthentic News Sites", "description": "Create Inauthentic News Sites", "kill_chain_phases": [ @@ -5128,8 +5788,8 @@ "spec_version": "2.1", "id": "attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.364263Z", - "modified": "2024-03-13T22:04:00.364263Z", + "created": "2024-08-02T17:12:32.394405Z", + "modified": "2024-08-02T17:12:32.394405Z", "name": "Leverage Existing Inauthentic News Sites", "description": "Leverage Existing Inauthentic News Sites", "kill_chain_phases": [ @@ -5156,211 +5816,13 @@ ], "x_mitre_version": "2.1" }, - { - "type": "attack-pattern", - "spec_version": "2.1", - "id": "attack-pattern--3ae4fb28-4864-468d-8085-cb8035cbb272", - "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.364458Z", - "modified": "2024-03-13T22:04:00.364458Z", - "name": "Impersonate Existing Entity", - "description": "An influence operation may prepare assets impersonating existing entities (both organisations and people) to further conceal its network identity and add a layer of legitimacy to its operation content. Existing entities may include authentic news outlets, public figures, organisations, or state entities.\u00a0\n\nUsers will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites.\u00a0\n\nAn influence operation may use a wide variety of cyber techniques to impersonate a legitimate entity\u2019s website or social media account.\u00a0\n\nThis Technique was previously called Prepare Assets Impersonating Legitimate Entities.", - "kill_chain_phases": [ - { - "kill_chain_name": "mitre-attack", - "phase_name": "establish-legitimacy" - } - ], - "external_references": [ - { - "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.md", - "external_id": "T0099" - } - ], - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ], - "x_mitre_is_subtechnique": false, - "x_mitre_platforms": [ - "Windows", - "Linux", - "Mac" - ], - "x_mitre_version": "2.1" - }, - { - "type": "attack-pattern", - "spec_version": "2.1", - "id": "attack-pattern--9b3efc53-3a9e-45e7-8a26-dd2c4a305fd2", - "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.36465Z", - "modified": "2024-03-13T22:04:00.36465Z", - "name": "Spoof/Parody Account/Site", - "description": "An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organisations, or state entities.", - "kill_chain_phases": [ - { - "kill_chain_name": "mitre-attack", - "phase_name": "establish-legitimacy" - } - ], - "external_references": [ - { - "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.002.md", - "external_id": "T0099.002" - } - ], - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ], - "x_mitre_is_subtechnique": true, - "x_mitre_platforms": [ - "Windows", - "Linux", - "Mac" - ], - "x_mitre_version": "2.1" - }, - { - "type": "attack-pattern", - "spec_version": "2.1", - "id": "attack-pattern--4e7d967e-4b48-49a6-b54a-4555a98a2473", - "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.364847Z", - "modified": "2024-03-13T22:04:00.364847Z", - "name": "Impersonate Existing Organisation", - "description": "A situation where a threat actor styles their online assets or content to mimic an existing organisation.\n\nThis can be done to take advantage of peoples\u2019 trust in the organisation to increase narrative believability, to smear the organisation, or to make the organisation less trustworthy.", - "kill_chain_phases": [ - { - "kill_chain_name": "mitre-attack", - "phase_name": "establish-legitimacy" - } - ], - "external_references": [ - { - "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.003.md", - "external_id": "T0099.003" - } - ], - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ], - "x_mitre_is_subtechnique": true, - "x_mitre_platforms": [ - "Windows", - "Linux", - "Mac" - ], - "x_mitre_version": "2.1" - }, - { - "type": "attack-pattern", - "spec_version": "2.1", - "id": "attack-pattern--17fe025d-9876-4c14-8ac9-ea0de1ef26c7", - "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.365069Z", - "modified": "2024-03-13T22:04:00.365069Z", - "name": "Impersonate Existing Media Outlet", - "description": "A situation where a threat actor styles their online assets or content to mimic an existing media outlet.\n\nThis can be done to take advantage of peoples\u2019 trust in the outlet to increase narrative believability, to smear the outlet, or to make the outlet less trustworthy.", - "kill_chain_phases": [ - { - "kill_chain_name": "mitre-attack", - "phase_name": "establish-legitimacy" - } - ], - "external_references": [ - { - "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.004.md", - "external_id": "T0099.004" - } - ], - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ], - "x_mitre_is_subtechnique": true, - "x_mitre_platforms": [ - "Windows", - "Linux", - "Mac" - ], - "x_mitre_version": "2.1" - }, - { - "type": "attack-pattern", - "spec_version": "2.1", - "id": "attack-pattern--8da4166c-99f6-4dd9-ab94-c61450d2be63", - "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.365273Z", - "modified": "2024-03-13T22:04:00.365273Z", - "name": "Impersonate Existing Official", - "description": "A situation where a threat actor styles their online assets or content to impersonate an official (including government officials, organisation officials, etc).", - "kill_chain_phases": [ - { - "kill_chain_name": "mitre-attack", - "phase_name": "establish-legitimacy" - } - ], - "external_references": [ - { - "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.005.md", - "external_id": "T0099.005" - } - ], - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ], - "x_mitre_is_subtechnique": true, - "x_mitre_platforms": [ - "Windows", - "Linux", - "Mac" - ], - "x_mitre_version": "2.1" - }, - { - "type": "attack-pattern", - "spec_version": "2.1", - "id": "attack-pattern--6147c1f4-4cb8-4edd-a875-aaf8e9d39fbd", - "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.365526Z", - "modified": "2024-03-13T22:04:00.365526Z", - "name": "Impersonate Existing Influencer", - "description": "A situation where a threat actor styles their online assets or content to impersonate an influencer or celebrity, typically to exploit users\u2019 existing faith in the impersonated target.", - "kill_chain_phases": [ - { - "kill_chain_name": "mitre-attack", - "phase_name": "establish-legitimacy" - } - ], - "external_references": [ - { - "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.006.md", - "external_id": "T0099.006" - } - ], - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ], - "x_mitre_is_subtechnique": true, - "x_mitre_platforms": [ - "Windows", - "Linux", - "Mac" - ], - "x_mitre_version": "2.1" - }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--283333f5-e161-4195-9070-5a7c22505adf", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.365751Z", - "modified": "2024-03-13T22:04:00.365751Z", + "created": "2024-08-02T17:12:32.394819Z", + "modified": "2024-08-02T17:12:32.394819Z", "name": "Co-Opt Trusted Sources", "description": "An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: - National or local new outlets - Research or academic publications - Online blogs or websites", "kill_chain_phases": [ @@ -5392,8 +5854,8 @@ "spec_version": "2.1", "id": "attack-pattern--a50d7269-9365-46f0-ba81-27964e422faa", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.365944Z", - "modified": "2024-03-13T22:04:00.365944Z", + "created": "2024-08-02T17:12:32.395176Z", + "modified": "2024-08-02T17:12:32.395176Z", "name": "Co-Opt Trusted Individuals", "description": "Co-Opt Trusted Individuals", "kill_chain_phases": [ @@ -5425,8 +5887,8 @@ "spec_version": "2.1", "id": "attack-pattern--b43dbee2-e1e2-40e5-bea1-45630d55d30b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.366135Z", - "modified": "2024-03-13T22:04:00.366135Z", + "created": "2024-08-02T17:12:32.395629Z", + "modified": "2024-08-02T17:12:32.395629Z", "name": "Co-Opt Grassroots Groups", "description": "Co-Opt Grassroots Groups", "kill_chain_phases": [ @@ -5458,8 +5920,8 @@ "spec_version": "2.1", "id": "attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.366273Z", - "modified": "2024-03-13T22:04:00.366273Z", + "created": "2024-08-02T17:12:32.396005Z", + "modified": "2024-08-02T17:12:32.396005Z", "name": "Co-Opt Influencers", "description": "Co-opt Influencers", "kill_chain_phases": [ @@ -5491,8 +5953,8 @@ "spec_version": "2.1", "id": "attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.366438Z", - "modified": "2024-03-13T22:04:00.366438Z", + "created": "2024-08-02T17:12:32.396562Z", + "modified": "2024-08-02T17:12:32.396562Z", "name": "Create Localised Content", "description": "Localised content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localised content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localised content may help an operation increase legitimacy, avoid detection, and complicate external attribution.", "kill_chain_phases": [ @@ -5524,8 +5986,8 @@ "spec_version": "2.1", "id": "attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.366633Z", - "modified": "2024-03-13T22:04:00.366633Z", + "created": "2024-08-02T17:12:32.397193Z", + "modified": "2024-08-02T17:12:32.397193Z", "name": "Leverage Echo Chambers/Filter Bubbles", "description": "An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with \u201cothers with which they are already in agreement.\u201d A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members.", "kill_chain_phases": [ @@ -5557,8 +6019,8 @@ "spec_version": "2.1", "id": "attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.366825Z", - "modified": "2024-03-13T22:04:00.366825Z", + "created": "2024-08-02T17:12:32.398558Z", + "modified": "2024-08-02T17:12:32.398558Z", "name": "Use Existing Echo Chambers/Filter Bubbles", "description": "Use existing Echo Chambers/Filter Bubbles", "kill_chain_phases": [ @@ -5590,8 +6052,8 @@ "spec_version": "2.1", "id": "attack-pattern--bb25b4aa-9223-40ea-a28a-0dd675e91e46", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.367014Z", - "modified": "2024-03-13T22:04:00.367014Z", + "created": "2024-08-02T17:12:32.399125Z", + "modified": "2024-08-02T17:12:32.399125Z", "name": "Create Echo Chambers/Filter Bubbles", "description": "Create Echo Chambers/Filter Bubbles", "kill_chain_phases": [ @@ -5623,8 +6085,8 @@ "spec_version": "2.1", "id": "attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.367203Z", - "modified": "2024-03-13T22:04:00.367203Z", + "created": "2024-08-02T17:12:32.399364Z", + "modified": "2024-08-02T17:12:32.399364Z", "name": "Exploit Data Voids", "description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.", "kill_chain_phases": [ @@ -5656,8 +6118,8 @@ "spec_version": "2.1", "id": "attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.367392Z", - "modified": "2024-03-13T22:04:00.367392Z", + "created": "2024-08-02T17:12:32.399545Z", + "modified": "2024-08-02T17:12:32.399545Z", "name": "Livestream", "description": "A livestream refers to an online broadcast capability that allows for real-time communication to closed or open networks.", "kill_chain_phases": [ @@ -5689,8 +6151,8 @@ "spec_version": "2.1", "id": "attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.367606Z", - "modified": "2024-03-13T22:04:00.367606Z", + "created": "2024-08-02T17:12:32.39972Z", + "modified": "2024-08-02T17:12:32.39972Z", "name": "Video Livestream", "description": "A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks.", "kill_chain_phases": [ @@ -5722,8 +6184,8 @@ "spec_version": "2.1", "id": "attack-pattern--6d75e3ac-e923-4815-8e9b-3e6af9e1baa0", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.367798Z", - "modified": "2024-03-13T22:04:00.367798Z", + "created": "2024-08-02T17:12:32.399894Z", + "modified": "2024-08-02T17:12:32.399894Z", "name": "Audio Livestream", "description": "An audio livestream refers to an online audio broadcast capability that allows for real-time communication to closed or open networks.", "kill_chain_phases": [ @@ -5755,8 +6217,8 @@ "spec_version": "2.1", "id": "attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.367988Z", - "modified": "2024-03-13T22:04:00.367988Z", + "created": "2024-08-02T17:12:32.400087Z", + "modified": "2024-08-02T17:12:32.400087Z", "name": "Social Networks", "description": "Social media are interactive digital channels that facilitate the creation and sharing of information, ideas, interests, and other forms of expression through virtual communities and networks.", "kill_chain_phases": [ @@ -5788,8 +6250,8 @@ "spec_version": "2.1", "id": "attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.368177Z", - "modified": "2024-03-13T22:04:00.368177Z", + "created": "2024-08-02T17:12:32.400306Z", + "modified": "2024-08-02T17:12:32.400306Z", "name": "Mainstream Social Networks", "description": "Examples include Facebook, Twitter, LinkedIn, etc.", "kill_chain_phases": [ @@ -5821,10 +6283,10 @@ "spec_version": "2.1", "id": "attack-pattern--7f338181-2e4b-435b-a190-7044f3867aa3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.368366Z", - "modified": "2024-03-13T22:04:00.368366Z", + "created": "2024-08-02T17:12:32.400595Z", + "modified": "2024-08-02T17:12:32.400595Z", "name": "Dating App", - "description": "\u201cDating App\u201d refers to any platform (or platform feature) in which the ostensive purpose is for users to develop a physical/romantic relationship with other users.\n\nThreat Actors can exploit users\u2019 quest for love to trick them into doing things like revealing sensitive information or giving them money.\n\nExamples include Tinder, Bumble, Grindr, Facebook Dating, Tantan, Badoo, Plenty of Fish, hinge, LOVOO, OkCupid, happn, and Mamba.", + "description": "\u201cDating App\u201d refers to any platform (or platform feature) in which the ostensive purpose is for users to develop a physical/romantic relationship with other users.

Threat Actors can exploit users\u2019 quest for love to trick them into doing things like revealing sensitive information or giving them money.

Examples include Tinder, Bumble, Grindr, Facebook Dating, Tantan, Badoo, Plenty of Fish, hinge, LOVOO, OkCupid, happn, and Mamba.

Associated Techniques and Sub-techniques
T0097.109: Romantic Suitor Persona: Analysts can use this sub-technique for tagging cases where an account presents itself as seeking a romantic or physical connection with another person.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -5854,8 +6316,8 @@ "spec_version": "2.1", "id": "attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.368578Z", - "modified": "2024-03-13T22:04:00.368578Z", + "created": "2024-08-02T17:12:32.400959Z", + "modified": "2024-08-02T17:12:32.400959Z", "name": "Private/Closed Social Networks", "description": "Social networks that are not open to people outside of family, friends, neighbours, or co-workers. Non-work-related examples include Couple, FamilyWall, 23snaps, and Nextdoor. Some of the larger social network platforms enable closed communities: examples are Instagram Close Friends and Twitter (X) Circle. Work-related examples of private social networks include LinkedIn, Facebook Workplace, and enterprise communication platforms such as Slack or Microsoft Teams.", "kill_chain_phases": [ @@ -5887,8 +6349,8 @@ "spec_version": "2.1", "id": "attack-pattern--a24e779c-0f44-493b-862d-00693bf34ca4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.368767Z", - "modified": "2024-03-13T22:04:00.368767Z", + "created": "2024-08-02T17:12:32.40143Z", + "modified": "2024-08-02T17:12:32.40143Z", "name": "Interest-Based Networks", "description": "Examples include smaller and niche networks including Gettr, Truth Social, Parler, etc.", "kill_chain_phases": [ @@ -5920,8 +6382,8 @@ "spec_version": "2.1", "id": "attack-pattern--62036130-6083-43e3-b1e0-8ab0822bedda", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.368977Z", - "modified": "2024-03-13T22:04:00.368977Z", + "created": "2024-08-02T17:12:32.401797Z", + "modified": "2024-08-02T17:12:32.401797Z", "name": "Use Hashtags", "description": "Use a dedicated, existing hashtag for the campaign/incident.", "kill_chain_phases": [ @@ -5953,8 +6415,8 @@ "spec_version": "2.1", "id": "attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.369192Z", - "modified": "2024-03-13T22:04:00.369192Z", + "created": "2024-08-02T17:12:32.402241Z", + "modified": "2024-08-02T17:12:32.402241Z", "name": "Create Dedicated Hashtag", "description": "Create a campaign/incident specific hashtag.", "kill_chain_phases": [ @@ -5986,8 +6448,8 @@ "spec_version": "2.1", "id": "attack-pattern--6e525f48-d8d6-4484-8838-208eb00bd2a8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.369386Z", - "modified": "2024-03-13T22:04:00.369386Z", + "created": "2024-08-02T17:12:32.402812Z", + "modified": "2024-08-02T17:12:32.402812Z", "name": "Media Sharing Networks", "description": "Media sharing networks refer to services whose primary function is the hosting and sharing of specific forms of media. Examples include Instagram, Snapchat, TikTok, Youtube, SoundCloud.", "kill_chain_phases": [ @@ -6019,8 +6481,8 @@ "spec_version": "2.1", "id": "attack-pattern--78ff99d8-dce8-4f4e-9dc2-3f37f154a39d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.369576Z", - "modified": "2024-03-13T22:04:00.369576Z", + "created": "2024-08-02T17:12:32.40304Z", + "modified": "2024-08-02T17:12:32.40304Z", "name": "Photo Sharing", "description": "Examples include Instagram, Snapchat, Flickr, etc", "kill_chain_phases": [ @@ -6052,8 +6514,8 @@ "spec_version": "2.1", "id": "attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.369769Z", - "modified": "2024-03-13T22:04:00.369769Z", + "created": "2024-08-02T17:12:32.403282Z", + "modified": "2024-08-02T17:12:32.403282Z", "name": "Video Sharing", "description": "Examples include Youtube, TikTok, ShareChat, Rumble, etc", "kill_chain_phases": [ @@ -6085,8 +6547,8 @@ "spec_version": "2.1", "id": "attack-pattern--c26749da-f15d-48d7-ac1f-e2a2a49b9930", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.370017Z", - "modified": "2024-03-13T22:04:00.370017Z", + "created": "2024-08-02T17:12:32.403485Z", + "modified": "2024-08-02T17:12:32.403485Z", "name": "Audio Sharing", "description": "Examples include podcasting apps, Soundcloud, etc.", "kill_chain_phases": [ @@ -6118,8 +6580,8 @@ "spec_version": "2.1", "id": "attack-pattern--9b6b3dea-54ac-4e00-bd92-380555205afe", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.370233Z", - "modified": "2024-03-13T22:04:00.370233Z", + "created": "2024-08-02T17:12:32.403681Z", + "modified": "2024-08-02T17:12:32.403681Z", "name": "Discussion Forums", "description": "Platforms for finding, discussing, and sharing information and opinions. Examples include Reddit, Quora, Digg, message boards, interest-based discussion forums, etc.", "kill_chain_phases": [ @@ -6151,8 +6613,8 @@ "spec_version": "2.1", "id": "attack-pattern--8432d382-0ce8-4507-97ea-95be10de3488", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.370426Z", - "modified": "2024-03-13T22:04:00.370426Z", + "created": "2024-08-02T17:12:32.403875Z", + "modified": "2024-08-02T17:12:32.403875Z", "name": "Anonymous Message Boards", "description": "Examples include the Chans", "kill_chain_phases": [ @@ -6184,8 +6646,8 @@ "spec_version": "2.1", "id": "attack-pattern--b69275ef-ba3d-409f-a857-40d4d1870dca", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.37062Z", - "modified": "2024-03-13T22:04:00.37062Z", + "created": "2024-08-02T17:12:32.404069Z", + "modified": "2024-08-02T17:12:32.404069Z", "name": "Bookmarking and Content Curation", "description": "Platforms for searching, sharing, and curating content and media. Examples include Pinterest, Flipboard, etc.", "kill_chain_phases": [ @@ -6217,8 +6679,8 @@ "spec_version": "2.1", "id": "attack-pattern--d4e35ba1-f83d-41b4-a862-caabb634cc3e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.370813Z", - "modified": "2024-03-13T22:04:00.370813Z", + "created": "2024-08-02T17:12:32.404285Z", + "modified": "2024-08-02T17:12:32.404285Z", "name": "Blogging and Publishing Networks", "description": "Examples include WordPress, Blogger, Weebly, Tumblr, Medium, etc.", "kill_chain_phases": [ @@ -6250,8 +6712,8 @@ "spec_version": "2.1", "id": "attack-pattern--da4ae172-c8c8-4eb1-bc03-c5198624c8a2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.371029Z", - "modified": "2024-03-13T22:04:00.371029Z", + "created": "2024-08-02T17:12:32.404483Z", + "modified": "2024-08-02T17:12:32.404483Z", "name": "Consumer Review Networks", "description": "Platforms for finding, reviewing, and sharing information about brands, products, services, restaurants, travel destinations, etc. Examples include Yelp, TripAdvisor, etc.", "kill_chain_phases": [ @@ -6283,8 +6745,8 @@ "spec_version": "2.1", "id": "attack-pattern--d4813d4a-2afe-4c0e-8ddb-b21973bb283a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.371221Z", - "modified": "2024-03-13T22:04:00.371221Z", + "created": "2024-08-02T17:12:32.404679Z", + "modified": "2024-08-02T17:12:32.404679Z", "name": "Formal Diplomatic Channels", "description": "Leveraging formal, traditional, diplomatic channels to communicate with foreign governments (written documents, meetings, summits, diplomatic visits, etc). This type of diplomacy is conducted by diplomats of one nation with diplomats and other officials of another nation or international organisation.", "kill_chain_phases": [ @@ -6316,8 +6778,8 @@ "spec_version": "2.1", "id": "attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.371448Z", - "modified": "2024-03-13T22:04:00.371448Z", + "created": "2024-08-02T17:12:32.404876Z", + "modified": "2024-08-02T17:12:32.404876Z", "name": "Traditional Media", "description": "Examples include TV, Newspaper, Radio, etc.", "kill_chain_phases": [ @@ -6349,8 +6811,8 @@ "spec_version": "2.1", "id": "attack-pattern--db9eafc0-261b-48d0-97a2-1c92dcb4026a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.371638Z", - "modified": "2024-03-13T22:04:00.371638Z", + "created": "2024-08-02T17:12:32.405072Z", + "modified": "2024-08-02T17:12:32.405072Z", "name": "TV", "description": "TV", "kill_chain_phases": [ @@ -6382,8 +6844,8 @@ "spec_version": "2.1", "id": "attack-pattern--eb66afed-6c29-4947-a422-c380c5caeda5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.371827Z", - "modified": "2024-03-13T22:04:00.371827Z", + "created": "2024-08-02T17:12:32.405316Z", + "modified": "2024-08-02T17:12:32.405316Z", "name": "Newspaper", "description": "Newspaper", "kill_chain_phases": [ @@ -6415,8 +6877,8 @@ "spec_version": "2.1", "id": "attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.372061Z", - "modified": "2024-03-13T22:04:00.372061Z", + "created": "2024-08-02T17:12:32.405517Z", + "modified": "2024-08-02T17:12:32.405517Z", "name": "Radio", "description": "Radio", "kill_chain_phases": [ @@ -6448,8 +6910,8 @@ "spec_version": "2.1", "id": "attack-pattern--c54dd9c4-5b7b-47a9-bb40-e63967b2ec33", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.37226Z", - "modified": "2024-03-13T22:04:00.37226Z", + "created": "2024-08-02T17:12:32.405713Z", + "modified": "2024-08-02T17:12:32.405713Z", "name": "Email", "description": "Delivering content and narratives via email. This can include using list management or high-value individually targeted messaging.", "kill_chain_phases": [ @@ -6481,8 +6943,8 @@ "spec_version": "2.1", "id": "attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.37247Z", - "modified": "2024-03-13T22:04:00.37247Z", + "created": "2024-08-02T17:12:32.405913Z", + "modified": "2024-08-02T17:12:32.405913Z", "name": "Employ Commercial Analytic Firms", "description": "Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.", "kill_chain_phases": [ @@ -6514,8 +6976,8 @@ "spec_version": "2.1", "id": "attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.372645Z", - "modified": "2024-03-13T22:04:00.372645Z", + "created": "2024-08-02T17:12:32.406119Z", + "modified": "2024-08-02T17:12:32.406119Z", "name": "Deliver Ads", "description": "Delivering content via any form of paid media or advertising.", "kill_chain_phases": [ @@ -6547,8 +7009,8 @@ "spec_version": "2.1", "id": "attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.372788Z", - "modified": "2024-03-13T22:04:00.372788Z", + "created": "2024-08-02T17:12:32.406496Z", + "modified": "2024-08-02T17:12:32.406496Z", "name": "Social Media", "description": "Social Media", "kill_chain_phases": [ @@ -6580,8 +7042,8 @@ "spec_version": "2.1", "id": "attack-pattern--8f83d6b8-01f4-406c-a3da-48a040e46139", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.372966Z", - "modified": "2024-03-13T22:04:00.372966Z", + "created": "2024-08-02T17:12:32.406729Z", + "modified": "2024-08-02T17:12:32.406729Z", "name": "Traditional Media", "description": "Examples include TV, Radio, Newspaper, billboards", "kill_chain_phases": [ @@ -6613,8 +7075,8 @@ "spec_version": "2.1", "id": "attack-pattern--1997947a-7e08-4ea9-802c-85391d561266", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.373158Z", - "modified": "2024-03-13T22:04:00.373158Z", + "created": "2024-08-02T17:12:32.406924Z", + "modified": "2024-08-02T17:12:32.406924Z", "name": "Post Content", "description": "Delivering content by posting via owned media (assets that the operator controls).", "kill_chain_phases": [ @@ -6646,8 +7108,8 @@ "spec_version": "2.1", "id": "attack-pattern--9a5261b8-5051-47ed-a4f6-bdbb7b6edcb4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.37335Z", - "modified": "2024-03-13T22:04:00.37335Z", + "created": "2024-08-02T17:12:32.40712Z", + "modified": "2024-08-02T17:12:32.40712Z", "name": "Share Memes", "description": "Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.", "kill_chain_phases": [ @@ -6679,8 +7141,8 @@ "spec_version": "2.1", "id": "attack-pattern--fb6f8352-c368-49a3-b7d4-f1ee5a3fb370", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.373636Z", - "modified": "2024-03-13T22:04:00.373636Z", + "created": "2024-08-02T17:12:32.407338Z", + "modified": "2024-08-02T17:12:32.407338Z", "name": "Post Violative Content to Provoke Takedown and Backlash", "description": "Post Violative Content to Provoke Takedown and Backlash.", "kill_chain_phases": [ @@ -6712,8 +7174,8 @@ "spec_version": "2.1", "id": "attack-pattern--5daa2f8a-2460-4cdd-ae55-b70f439a9f51", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.373909Z", - "modified": "2024-03-13T22:04:00.373909Z", + "created": "2024-08-02T17:12:32.407532Z", + "modified": "2024-08-02T17:12:32.407532Z", "name": "One-Way Direct Posting", "description": "Direct posting refers to a method of posting content via a one-way messaging service, where the recipient cannot directly respond to the poster\u2019s messaging. An influence operation may post directly to promote operation narratives to the target audience without allowing opportunities for fact-checking or disagreement, creating a false sense of support for the narrative.", "kill_chain_phases": [ @@ -6745,8 +7207,8 @@ "spec_version": "2.1", "id": "attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.374136Z", - "modified": "2024-03-13T22:04:00.374136Z", + "created": "2024-08-02T17:12:32.407759Z", + "modified": "2024-08-02T17:12:32.407759Z", "name": "Comment or Reply on Content", "description": "Delivering content by replying or commenting via owned media (assets that the operator controls).", "kill_chain_phases": [ @@ -6778,8 +7240,8 @@ "spec_version": "2.1", "id": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.3743Z", - "modified": "2024-03-13T22:04:00.3743Z", + "created": "2024-08-02T17:12:32.408023Z", + "modified": "2024-08-02T17:12:32.408023Z", "name": "Post Inauthentic Social Media Comment", "description": "Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.", "kill_chain_phases": [ @@ -6811,8 +7273,8 @@ "spec_version": "2.1", "id": "attack-pattern--72df7e55-dc60-4a7e-9928-ed41ac0e1581", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.374569Z", - "modified": "2024-03-13T22:04:00.374569Z", + "created": "2024-08-02T17:12:32.408236Z", + "modified": "2024-08-02T17:12:32.408236Z", "name": "Attract Traditional Media", "description": "Deliver content by attracting the attention of traditional media (earned media).", "kill_chain_phases": [ @@ -6844,8 +7306,8 @@ "spec_version": "2.1", "id": "attack-pattern--836e9eef-b446-4f68-805f-0f10116d6e7f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.374771Z", - "modified": "2024-03-13T22:04:00.374771Z", + "created": "2024-08-02T17:12:32.408436Z", + "modified": "2024-08-02T17:12:32.408436Z", "name": "Amplify Existing Narrative", "description": "An influence operation may amplify existing narratives that align with its narratives to support operation objectives.", "kill_chain_phases": [ @@ -6877,8 +7339,8 @@ "spec_version": "2.1", "id": "attack-pattern--872f0dc3-202e-4e9a-a4fc-0457252aecae", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.374914Z", - "modified": "2024-03-13T22:04:00.374914Z", + "created": "2024-08-02T17:12:32.408629Z", + "modified": "2024-08-02T17:12:32.408629Z", "name": "Cross-Posting", "description": "Cross-posting refers to posting the same message to multiple internet discussions, social media platforms or accounts, or news groups at one time. An influence operation may post content online in multiple communities and platforms to increase the chances of content exposure to the target audience.", "kill_chain_phases": [ @@ -6910,8 +7372,8 @@ "spec_version": "2.1", "id": "attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.375056Z", - "modified": "2024-03-13T22:04:00.375056Z", + "created": "2024-08-02T17:12:32.408822Z", + "modified": "2024-08-02T17:12:32.408822Z", "name": "Post across Groups", "description": "An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences.", "kill_chain_phases": [ @@ -6943,8 +7405,8 @@ "spec_version": "2.1", "id": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.375196Z", - "modified": "2024-03-13T22:04:00.375196Z", + "created": "2024-08-02T17:12:32.409015Z", + "modified": "2024-08-02T17:12:32.409015Z", "name": "Post across Platform", "description": "An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.", "kill_chain_phases": [ @@ -6976,8 +7438,8 @@ "spec_version": "2.1", "id": "attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.375339Z", - "modified": "2024-03-13T22:04:00.375339Z", + "created": "2024-08-02T17:12:32.409219Z", + "modified": "2024-08-02T17:12:32.409219Z", "name": "Post across Disciplines", "description": "Post Across Disciplines", "kill_chain_phases": [ @@ -7009,8 +7471,8 @@ "spec_version": "2.1", "id": "attack-pattern--5e7541d8-2b43-4443-89d9-7362ca78944c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.375523Z", - "modified": "2024-03-13T22:04:00.375523Z", + "created": "2024-08-02T17:12:32.409423Z", + "modified": "2024-08-02T17:12:32.409423Z", "name": "Incentivize Sharing", "description": "Incentivizing content sharing refers to actions that encourage users to share content themselves, reducing the need for the operation itself to post and promote its own content.", "kill_chain_phases": [ @@ -7042,8 +7504,8 @@ "spec_version": "2.1", "id": "attack-pattern--5bbea132-9da6-42f7-93e9-71f0a9cf311d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.375691Z", - "modified": "2024-03-13T22:04:00.375691Z", + "created": "2024-08-02T17:12:32.409621Z", + "modified": "2024-08-02T17:12:32.409621Z", "name": "Use Affiliate Marketing Programmes", "description": "Use Affiliate Marketing Programmes", "kill_chain_phases": [ @@ -7075,8 +7537,8 @@ "spec_version": "2.1", "id": "attack-pattern--ddc4a9e6-a371-4f16-91b6-c71139a154ce", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.375855Z", - "modified": "2024-03-13T22:04:00.375855Z", + "created": "2024-08-02T17:12:32.409853Z", + "modified": "2024-08-02T17:12:32.409853Z", "name": "Use Contests and Prizes", "description": "Use Contests and Prizes", "kill_chain_phases": [ @@ -7108,8 +7570,8 @@ "spec_version": "2.1", "id": "attack-pattern--7e3a06ee-c109-4901-8720-69c46fe04a76", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.376028Z", - "modified": "2024-03-13T22:04:00.376028Z", + "created": "2024-08-02T17:12:32.410054Z", + "modified": "2024-08-02T17:12:32.410054Z", "name": "Manipulate Platform Algorithm", "description": "Manipulating a platform algorithm refers to conducting activity on a platform in a way that intentionally targets its underlying algorithm. After analysing a platform\u2019s algorithm (see: Select Platforms), an influence operation may use a platform in a way that increases its content exposure, avoids content removal, or otherwise benefits the operation\u2019s strategy. For example, an influence operation may use bots to amplify its posts so that the platform\u2019s algorithm recognises engagement with operation content and further promotes the content on user timelines.", "kill_chain_phases": [ @@ -7141,8 +7603,8 @@ "spec_version": "2.1", "id": "attack-pattern--89b88c22-0686-4d28-9c2b-e0c6ac31a4ab", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.376185Z", - "modified": "2024-03-13T22:04:00.376185Z", + "created": "2024-08-02T17:12:32.410247Z", + "modified": "2024-08-02T17:12:32.410247Z", "name": "Bypass Content Blocking", "description": "Bypassing content blocking refers to actions taken to circumvent network security measures that prevent users from accessing certain servers, resources, or other online spheres. An influence operation may bypass content blocking to proliferate its content on restricted areas of the internet. Common strategies for bypassing content blocking include: - Altering IP addresses to avoid IP filtering - Using a Virtual Private Network (VPN) to avoid IP filtering - Using a Content Delivery Network (CDN) to avoid IP filtering - Enabling encryption to bypass packet inspection blocking - Manipulating text to avoid filtering by keywords - Posting content on multiple platforms to avoid platform-specific removals - Using local facilities or modified DNS servers to avoid DNS filtering", "kill_chain_phases": [ @@ -7174,8 +7636,8 @@ "spec_version": "2.1", "id": "attack-pattern--690761b6-8afd-4dd5-954e-174de362d1b0", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.376326Z", - "modified": "2024-03-13T22:04:00.376326Z", + "created": "2024-08-02T17:12:32.41053Z", + "modified": "2024-08-02T17:12:32.41053Z", "name": "Direct Users to Alternative Platforms", "description": "Direct users to alternative platforms refers to encouraging users to move from the platform on which they initially viewed operation content and engage with content on alternate information channels, including separate social media channels and inauthentic websites. An operation may drive users to alternative platforms to diversify its information channels and ensure the target audience knows where to access operation content if the initial platform suspends, flags, or otherwise removes original operation assets and content.", "kill_chain_phases": [ @@ -7207,8 +7669,8 @@ "spec_version": "2.1", "id": "attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.376498Z", - "modified": "2024-03-13T22:04:00.376498Z", + "created": "2024-08-02T17:12:32.410743Z", + "modified": "2024-08-02T17:12:32.410743Z", "name": "Control Information Environment through Offensive Cyberspace Operations", "description": "Controlling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of content in the information space to either prioritise operation messaging or block opposition messaging.", "kill_chain_phases": [ @@ -7240,8 +7702,8 @@ "spec_version": "2.1", "id": "attack-pattern--d65af8b6-91ce-490e-8978-014ff995a2ac", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.376644Z", - "modified": "2024-03-13T22:04:00.376644Z", + "created": "2024-08-02T17:12:32.410935Z", + "modified": "2024-08-02T17:12:32.410935Z", "name": "Delete Opposing Content", "description": "Deleting opposing content refers to the removal of content that conflicts with operational narratives from selected platforms. An influence operation may delete opposing content to censor contradictory information from the target audience, allowing operation narratives to take priority in the information space.", "kill_chain_phases": [ @@ -7273,8 +7735,8 @@ "spec_version": "2.1", "id": "attack-pattern--9b667c6e-5bc3-4c1e-b114-6f679a662b5d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.376786Z", - "modified": "2024-03-13T22:04:00.376786Z", + "created": "2024-08-02T17:12:32.411168Z", + "modified": "2024-08-02T17:12:32.411168Z", "name": "Block Content", "description": "Content blocking refers to actions taken to restrict internet access or render certain areas of the internet inaccessible. An influence operation may restrict content based on both network and content attributes.", "kill_chain_phases": [ @@ -7306,8 +7768,8 @@ "spec_version": "2.1", "id": "attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.376964Z", - "modified": "2024-03-13T22:04:00.376964Z", + "created": "2024-08-02T17:12:32.411369Z", + "modified": "2024-08-02T17:12:32.411369Z", "name": "Destroy Information Generation Capabilities", "description": "Destroying information generation capabilities refers to actions taken to limit, degrade, or otherwise incapacitate an actor\u2019s ability to generate conflicting information. An influence operation may destroy an actor\u2019s information generation capabilities by physically dismantling the information infrastructure, disconnecting resources needed for information generation, or redirecting information generation personnel. An operation may destroy an adversary\u2019s information generation capabilities to limit conflicting content exposure to the target audience and crowd the information space with its own narratives.", "kill_chain_phases": [ @@ -7339,8 +7801,8 @@ "spec_version": "2.1", "id": "attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.377159Z", - "modified": "2024-03-13T22:04:00.377159Z", + "created": "2024-08-02T17:12:32.411564Z", + "modified": "2024-08-02T17:12:32.411564Z", "name": "Conduct Server Redirect", "description": "A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side or client-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.", "kill_chain_phases": [ @@ -7372,8 +7834,8 @@ "spec_version": "2.1", "id": "attack-pattern--e22e3d7d-40fc-4a5e-8d6c-d528b9f78e8e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.377343Z", - "modified": "2024-03-13T22:04:00.377343Z", + "created": "2024-08-02T17:12:32.411758Z", + "modified": "2024-08-02T17:12:32.411758Z", "name": "Suppress Opposition", "description": "Operators can suppress the opposition by exploiting platform content moderation tools and processes like reporting non-violative content to platforms for takedown and goading opposition actors into taking actions that result in platform action or target audience disapproval.", "kill_chain_phases": [ @@ -7405,8 +7867,8 @@ "spec_version": "2.1", "id": "attack-pattern--c31542d3-d9c4-4fe4-ac5d-47632225a425", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.377512Z", - "modified": "2024-03-13T22:04:00.377512Z", + "created": "2024-08-02T17:12:32.41195Z", + "modified": "2024-08-02T17:12:32.41195Z", "name": "Report Non-Violative Opposing Content", "description": "Reporting opposing content refers to notifying and providing an instance of a violation of a platform\u2019s guidelines and policies for conduct on the platform. In addition to simply reporting the content, an operation may leverage copyright regulations to trick social media and web platforms into removing opposing content by manipulating the content to appear in violation of copyright laws. Reporting opposing content facilitates the suppression of contradictory information and allows operation narratives to take priority in the information space.", "kill_chain_phases": [ @@ -7438,8 +7900,8 @@ "spec_version": "2.1", "id": "attack-pattern--651a5188-f38a-42be-a253-d1b90cbd28e1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.377682Z", - "modified": "2024-03-13T22:04:00.377682Z", + "created": "2024-08-02T17:12:32.412165Z", + "modified": "2024-08-02T17:12:32.412165Z", "name": "Goad People into Harmful Action (Stop Hitting Yourself)", "description": "Goad people into actions that violate terms of service or will lead to having their content or accounts taken down.", "kill_chain_phases": [ @@ -7471,8 +7933,8 @@ "spec_version": "2.1", "id": "attack-pattern--d615efdc-7296-4254-90f5-99d2986d97fa", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.37787Z", - "modified": "2024-03-13T22:04:00.37787Z", + "created": "2024-08-02T17:12:32.412541Z", + "modified": "2024-08-02T17:12:32.412541Z", "name": "Exploit Platform TOS/Content Moderation", "description": "Exploit Platform TOS/Content Moderation", "kill_chain_phases": [ @@ -7504,8 +7966,8 @@ "spec_version": "2.1", "id": "attack-pattern--fd04fba0-0e20-40f9-868d-e8effcf6dab6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.378108Z", - "modified": "2024-03-13T22:04:00.378108Z", + "created": "2024-08-02T17:12:32.412744Z", + "modified": "2024-08-02T17:12:32.412744Z", "name": "Platform Filtering", "description": "Platform filtering refers to the decontextualization of information as claims cross platforms (from Joan Donovan https://www.hks.harvard.edu/publications/disinformation-design-use-evidence-collages-and-platform-filtering-media-manipulation)", "kill_chain_phases": [ @@ -7537,8 +7999,8 @@ "spec_version": "2.1", "id": "attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.378303Z", - "modified": "2024-03-13T22:04:00.378303Z", + "created": "2024-08-02T17:12:32.412914Z", + "modified": "2024-08-02T17:12:32.412914Z", "name": "Encourage Attendance at Events", "description": "Operation encourages attendance at existing real world event.", "kill_chain_phases": [ @@ -7570,8 +8032,8 @@ "spec_version": "2.1", "id": "attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.378491Z", - "modified": "2024-03-13T22:04:00.378491Z", + "created": "2024-08-02T17:12:32.413057Z", + "modified": "2024-08-02T17:12:32.413057Z", "name": "Call to Action to Attend", "description": "Call to action to attend an event", "kill_chain_phases": [ @@ -7603,8 +8065,8 @@ "spec_version": "2.1", "id": "attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.378681Z", - "modified": "2024-03-13T22:04:00.378681Z", + "created": "2024-08-02T17:12:32.413199Z", + "modified": "2024-08-02T17:12:32.413199Z", "name": "Facilitate Logistics or Support for Attendance", "description": "Facilitate logistics or support for travel, food, housing, etc.", "kill_chain_phases": [ @@ -7636,8 +8098,8 @@ "spec_version": "2.1", "id": "attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.37887Z", - "modified": "2024-03-13T22:04:00.37887Z", + "created": "2024-08-02T17:12:32.413349Z", + "modified": "2024-08-02T17:12:32.413349Z", "name": "Physical Violence", "description": "Physical violence refers to the use of force to injure, abuse, damage, or destroy. An influence operation may conduct or encourage physical violence to discourage opponents from promoting conflicting content or draw attention to operation narratives using shock value.", "kill_chain_phases": [ @@ -7669,8 +8131,8 @@ "spec_version": "2.1", "id": "attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.379089Z", - "modified": "2024-03-13T22:04:00.379089Z", + "created": "2024-08-02T17:12:32.413648Z", + "modified": "2024-08-02T17:12:32.413648Z", "name": "Conduct Physical Violence", "description": "An influence operation may directly Conduct Physical Violence to achieve campaign goals.", "kill_chain_phases": [ @@ -7702,8 +8164,8 @@ "spec_version": "2.1", "id": "attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.379286Z", - "modified": "2024-03-13T22:04:00.379286Z", + "created": "2024-08-02T17:12:32.413845Z", + "modified": "2024-08-02T17:12:32.413845Z", "name": "Encourage Physical Violence", "description": "An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.", "kill_chain_phases": [ @@ -7735,8 +8197,8 @@ "spec_version": "2.1", "id": "attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.379494Z", - "modified": "2024-03-13T22:04:00.379494Z", + "created": "2024-08-02T17:12:32.413994Z", + "modified": "2024-08-02T17:12:32.413994Z", "name": "Conceal Information Assets", "description": "Conceal the identity or provenance of campaign information assets such as accounts, channels, pages etc. to avoid takedown and attribution.", "kill_chain_phases": [ @@ -7768,8 +8230,8 @@ "spec_version": "2.1", "id": "attack-pattern--78cf4cd6-a8a0-408f-a5e8-d6f1491aace8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.379708Z", - "modified": "2024-03-13T22:04:00.379708Z", + "created": "2024-08-02T17:12:32.41414Z", + "modified": "2024-08-02T17:12:32.41414Z", "name": "Use Pseudonyms", "description": "An operation may use pseudonyms, or fake names, to mask the identity of operational accounts, channels, pages etc., publish anonymous content, or otherwise use falsified personas to conceal the identity of the operation. An operation may coordinate pseudonyms across multiple platforms, for example, by writing an article under a pseudonym and then posting a link to the article on social media on an account, channel, or page with the same falsified name.", "kill_chain_phases": [ @@ -7801,8 +8263,8 @@ "spec_version": "2.1", "id": "attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.379896Z", - "modified": "2024-03-13T22:04:00.379896Z", + "created": "2024-08-02T17:12:32.414283Z", + "modified": "2024-08-02T17:12:32.414283Z", "name": "Conceal Network Identity", "description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.", "kill_chain_phases": [ @@ -7834,8 +8296,8 @@ "spec_version": "2.1", "id": "attack-pattern--9affd892-2479-4843-99d1-1e1a9f7f1020", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.380083Z", - "modified": "2024-03-13T22:04:00.380083Z", + "created": "2024-08-02T17:12:32.414425Z", + "modified": "2024-08-02T17:12:32.414425Z", "name": "Distance Reputable Individuals from Operation", "description": "Distancing reputable individuals from the operation occurs when enlisted individuals, such as celebrities or subject matter experts, actively disengage themselves from operation activities and messaging. Individuals may distance themselves from the operation by deleting old posts or statements, unfollowing operation information assets, or otherwise detaching themselves from the operation\u2019s timeline. An influence operation may want reputable individuals to distance themselves from the operation to reduce operation exposure, particularly if the operation aims to remove all evidence.", "kill_chain_phases": [ @@ -7867,8 +8329,8 @@ "spec_version": "2.1", "id": "attack-pattern--6b495bb5-d2ab-4da7-9530-a1aadd488803", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.380269Z", - "modified": "2024-03-13T22:04:00.380269Z", + "created": "2024-08-02T17:12:32.414755Z", + "modified": "2024-08-02T17:12:32.414755Z", "name": "Launder Information Assets", "description": "Laundering occurs when an influence operation acquires control of previously legitimate information assets such as accounts, channels, pages etc. from third parties through sale or exchange and often in contravention of terms of use. Influence operations use laundered assets to reach target audience members from within an existing information community and to complicate attribution.", "kill_chain_phases": [ @@ -7900,8 +8362,8 @@ "spec_version": "2.1", "id": "attack-pattern--5bca3084-f5b0-48a8-934c-7f2c03bfd2c3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.380478Z", - "modified": "2024-03-13T22:04:00.380478Z", + "created": "2024-08-02T17:12:32.414942Z", + "modified": "2024-08-02T17:12:32.414942Z", "name": "Change Names of Information Assets", "description": "Changing names or brand names of information assets such as accounts, channels, pages etc. An operation may change the names or brand names of its assets throughout an operation to avoid detection or alter the names of newly acquired or repurposed assets to fit operational narratives.", "kill_chain_phases": [ @@ -7933,8 +8395,8 @@ "spec_version": "2.1", "id": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.380679Z", - "modified": "2024-03-13T22:04:00.380679Z", + "created": "2024-08-02T17:12:32.415084Z", + "modified": "2024-08-02T17:12:32.415084Z", "name": "Conceal Operational Activity", "description": "Conceal the campaign's operational activity to avoid takedown and attribution.", "kill_chain_phases": [ @@ -7966,8 +8428,8 @@ "spec_version": "2.1", "id": "attack-pattern--eb67513e-b6e8-42e1-a95b-197f64c21588", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.380871Z", - "modified": "2024-03-13T22:04:00.380871Z", + "created": "2024-08-02T17:12:32.415225Z", + "modified": "2024-08-02T17:12:32.415225Z", "name": "Conceal Network Identity", "description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.", "kill_chain_phases": [ @@ -7999,8 +8461,8 @@ "spec_version": "2.1", "id": "attack-pattern--eb037d2a-82a7-4bcb-bffd-e7791de21d1c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.381063Z", - "modified": "2024-03-13T22:04:00.381063Z", + "created": "2024-08-02T17:12:32.415366Z", + "modified": "2024-08-02T17:12:32.415366Z", "name": "Generate Content Unrelated to Narrative", "description": "An influence operation may mix its own operation content with legitimate news or external unrelated content to disguise operational objectives, narratives, or existence. For example, an operation may generate \"lifestyle\" or \"cuisine\" content alongside regular operation content.", "kill_chain_phases": [ @@ -8032,8 +8494,8 @@ "spec_version": "2.1", "id": "attack-pattern--3437993c-c521-4145-a2d8-b860399876b0", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.381257Z", - "modified": "2024-03-13T22:04:00.381257Z", + "created": "2024-08-02T17:12:32.415535Z", + "modified": "2024-08-02T17:12:32.415535Z", "name": "Break Association with Content", "description": "Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation.", "kill_chain_phases": [ @@ -8065,8 +8527,8 @@ "spec_version": "2.1", "id": "attack-pattern--a09fbbeb-58ef-4e7a-8183-5eaa668200c9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.381447Z", - "modified": "2024-03-13T22:04:00.381447Z", + "created": "2024-08-02T17:12:32.415759Z", + "modified": "2024-08-02T17:12:32.415759Z", "name": "Delete URLs", "description": "URL deletion occurs when an influence operation completely removes its website registration, rendering the URL inaccessible. An influence operation may delete its URLs to complicate attribution or remove online documentation that the operation ever occurred.", "kill_chain_phases": [ @@ -8098,8 +8560,8 @@ "spec_version": "2.1", "id": "attack-pattern--e7b62982-106f-4234-9545-9466c687d1b5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.381714Z", - "modified": "2024-03-13T22:04:00.381714Z", + "created": "2024-08-02T17:12:32.415971Z", + "modified": "2024-08-02T17:12:32.415971Z", "name": "Coordinate on Encrypted/Closed Networks", "description": "Coordinate on encrypted/ closed networks", "kill_chain_phases": [ @@ -8131,8 +8593,8 @@ "spec_version": "2.1", "id": "attack-pattern--da5fb984-37a6-4152-a078-e2af40c0844f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.381916Z", - "modified": "2024-03-13T22:04:00.381916Z", + "created": "2024-08-02T17:12:32.416284Z", + "modified": "2024-08-02T17:12:32.416284Z", "name": "Deny Involvement", "description": "Without \"smoking gun\" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in \"Demand insurmountable proof\", specifically the asymmetric disadvantage for truth-tellers in a \"firehose of misinformation\" environment.", "kill_chain_phases": [ @@ -8164,8 +8626,8 @@ "spec_version": "2.1", "id": "attack-pattern--deb9a225-0803-4a1f-b37b-3a10c3e7ca79", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.382113Z", - "modified": "2024-03-13T22:04:00.382113Z", + "created": "2024-08-02T17:12:32.416479Z", + "modified": "2024-08-02T17:12:32.416479Z", "name": "Delete Accounts/Account Activity", "description": "Deleting accounts and account activity occurs when an influence operation removes its online social media assets, including social media accounts, posts, likes, comments, and other online artefacts. An influence operation may delete its accounts and account activity to complicate attribution or remove online documentation that the operation ever occurred.", "kill_chain_phases": [ @@ -8197,8 +8659,8 @@ "spec_version": "2.1", "id": "attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.382307Z", - "modified": "2024-03-13T22:04:00.382307Z", + "created": "2024-08-02T17:12:32.416684Z", + "modified": "2024-08-02T17:12:32.416684Z", "name": "Redirect URLs", "description": "An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection.", "kill_chain_phases": [ @@ -8230,8 +8692,8 @@ "spec_version": "2.1", "id": "attack-pattern--ea762d7a-8852-4d91-b44f-4754aa079313", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.382535Z", - "modified": "2024-03-13T22:04:00.382535Z", + "created": "2024-08-02T17:12:32.41687Z", + "modified": "2024-08-02T17:12:32.41687Z", "name": "Remove Post Origins", "description": "Removing post origins refers to the elimination of evidence that indicates the initial source of operation content, often to complicate attribution. An influence operation may remove post origins by deleting watermarks, renaming files, or removing embedded links in its content.", "kill_chain_phases": [ @@ -8263,8 +8725,8 @@ "spec_version": "2.1", "id": "attack-pattern--dd415f9d-ce3a-44c6-9237-f8ceeb52a6a3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.382748Z", - "modified": "2024-03-13T22:04:00.382748Z", + "created": "2024-08-02T17:12:32.417055Z", + "modified": "2024-08-02T17:12:32.417055Z", "name": "Misattribute Activity", "description": "Misattributed activity refers to incorrectly attributed operation activity. For example, a state sponsored influence operation may conduct operation activity in a way that mimics another state so that external entities misattribute activity to the incorrect state. An operation may misattribute their activities to complicate attribution, avoid detection, or frame an adversary for negative behaviour.", "kill_chain_phases": [ @@ -8296,8 +8758,8 @@ "spec_version": "2.1", "id": "attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.382928Z", - "modified": "2024-03-13T22:04:00.382928Z", + "created": "2024-08-02T17:12:32.417236Z", + "modified": "2024-08-02T17:12:32.417236Z", "name": "Conceal Infrastructure", "description": "Conceal the campaign's infrastructure to avoid takedown and attribution.", "kill_chain_phases": [ @@ -8329,8 +8791,8 @@ "spec_version": "2.1", "id": "attack-pattern--a09594d3-c930-451a-8eb6-7e2d748618bb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.383099Z", - "modified": "2024-03-13T22:04:00.383099Z", + "created": "2024-08-02T17:12:32.417423Z", + "modified": "2024-08-02T17:12:32.417423Z", "name": "Conceal Sponsorship", "description": "Concealing sponsorship aims to mislead or obscure the identity of the hidden sponsor behind an operation rather than entity publicly running the operation. Operations that conceal sponsorship may maintain visible falsified groups, news outlets, non-profits, or other organisations, but seek to mislead or obscure the identity sponsoring, funding, or otherwise supporting these entities. Influence operations may use a variety of techniques to mask the location of their social media accounts to complicate attribution and conceal evidence of foreign interference. Operation accounts may set their location to a false place, often the location of the operation\u2019s target audience, and post in the region\u2019s language", "kill_chain_phases": [ @@ -8362,8 +8824,8 @@ "spec_version": "2.1", "id": "attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.383245Z", - "modified": "2024-03-13T22:04:00.383245Z", + "created": "2024-08-02T17:12:32.417607Z", + "modified": "2024-08-02T17:12:32.417607Z", "name": "Utilise Bulletproof Hosting", "description": "Hosting refers to services through which storage and computing resources are provided to an individual or organisation for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilise bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend.", "kill_chain_phases": [ @@ -8395,8 +8857,8 @@ "spec_version": "2.1", "id": "attack-pattern--b6644001-8597-4f9f-a2a4-8005c54e8a39", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.383386Z", - "modified": "2024-03-13T22:04:00.383386Z", + "created": "2024-08-02T17:12:32.417826Z", + "modified": "2024-08-02T17:12:32.417826Z", "name": "Use Shell Organisations", "description": "Use Shell Organisations to conceal sponsorship.", "kill_chain_phases": [ @@ -8428,8 +8890,8 @@ "spec_version": "2.1", "id": "attack-pattern--c80ef7af-3f51-4be5-b42a-19d29ab40a53", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.383526Z", - "modified": "2024-03-13T22:04:00.383526Z", + "created": "2024-08-02T17:12:32.418021Z", + "modified": "2024-08-02T17:12:32.418021Z", "name": "Use Cryptocurrency", "description": "Use Cryptocurrency to conceal sponsorship. Examples include Bitcoin, Monero, and Etherium.", "kill_chain_phases": [ @@ -8461,8 +8923,8 @@ "spec_version": "2.1", "id": "attack-pattern--8b991b67-9df8-42e7-b11a-5ed1bc41c5a5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.383668Z", - "modified": "2024-03-13T22:04:00.383668Z", + "created": "2024-08-02T17:12:32.418215Z", + "modified": "2024-08-02T17:12:32.418215Z", "name": "Obfuscate Payment", "description": "Obfuscate Payment", "kill_chain_phases": [ @@ -8494,8 +8956,8 @@ "spec_version": "2.1", "id": "attack-pattern--c73c3210-6414-46c8-9885-a3b3e405da56", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.383814Z", - "modified": "2024-03-13T22:04:00.383814Z", + "created": "2024-08-02T17:12:32.418409Z", + "modified": "2024-08-02T17:12:32.418409Z", "name": "Exploit TOS/Content Moderation", "description": "Exploiting weaknesses in platforms' terms of service and content moderation policies to avoid takedowns and platform actions.", "kill_chain_phases": [ @@ -8527,8 +8989,8 @@ "spec_version": "2.1", "id": "attack-pattern--ce1e088c-d061-490c-a13a-3cbe4216a86e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.384023Z", - "modified": "2024-03-13T22:04:00.384023Z", + "created": "2024-08-02T17:12:32.418604Z", + "modified": "2024-08-02T17:12:32.418604Z", "name": "Legacy Web Content", "description": "Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.", "kill_chain_phases": [ @@ -8560,8 +9022,8 @@ "spec_version": "2.1", "id": "attack-pattern--67afaa3d-ffd7-4ad5-bcb0-e77962c084cf", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.384226Z", - "modified": "2024-03-13T22:04:00.384226Z", + "created": "2024-08-02T17:12:32.418954Z", + "modified": "2024-08-02T17:12:32.418954Z", "name": "Post Borderline Content", "description": "Post Borderline Content", "kill_chain_phases": [ @@ -8593,8 +9055,8 @@ "spec_version": "2.1", "id": "attack-pattern--c171dd41-42d0-45c2-806e-3cb518ba0357", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.384429Z", - "modified": "2024-03-13T22:04:00.384429Z", + "created": "2024-08-02T17:12:32.419159Z", + "modified": "2024-08-02T17:12:32.419159Z", "name": "Measure Performance", "description": "A metric used to determine the accomplishment of actions. \u201cAre the actions being executed as planned?\u201d", "kill_chain_phases": [ @@ -8626,8 +9088,8 @@ "spec_version": "2.1", "id": "attack-pattern--83b4e2db-265f-4f88-9b35-26df05c561e9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.384621Z", - "modified": "2024-03-13T22:04:00.384621Z", + "created": "2024-08-02T17:12:32.419355Z", + "modified": "2024-08-02T17:12:32.419355Z", "name": "People Focused", "description": "Measure the performance individuals in achieving campaign goals", "kill_chain_phases": [ @@ -8659,8 +9121,8 @@ "spec_version": "2.1", "id": "attack-pattern--5dc224b1-c69e-496d-91f7-e8ce4fd3f166", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.384766Z", - "modified": "2024-03-13T22:04:00.384766Z", + "created": "2024-08-02T17:12:32.419551Z", + "modified": "2024-08-02T17:12:32.419551Z", "name": "Content Focused", "description": "Measure the performance of campaign content", "kill_chain_phases": [ @@ -8692,8 +9154,8 @@ "spec_version": "2.1", "id": "attack-pattern--c25ad637-cfa5-40c0-a23c-f741d8f4319e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.384925Z", - "modified": "2024-03-13T22:04:00.384925Z", + "created": "2024-08-02T17:12:32.419768Z", + "modified": "2024-08-02T17:12:32.419768Z", "name": "View Focused", "description": "View Focused", "kill_chain_phases": [ @@ -8725,8 +9187,8 @@ "spec_version": "2.1", "id": "attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.385121Z", - "modified": "2024-03-13T22:04:00.385121Z", + "created": "2024-08-02T17:12:32.419973Z", + "modified": "2024-08-02T17:12:32.419973Z", "name": "Measure Effectiveness", "description": "A metric used to measure a current system state. \u201cAre we on track to achieve the intended new system state within the planned timescale?\u201d", "kill_chain_phases": [ @@ -8758,8 +9220,8 @@ "spec_version": "2.1", "id": "attack-pattern--a925711a-dbfb-41b1-bd81-70d41dbaa69c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.385261Z", - "modified": "2024-03-13T22:04:00.385261Z", + "created": "2024-08-02T17:12:32.42017Z", + "modified": "2024-08-02T17:12:32.42017Z", "name": "Behaviour Changes", "description": "Monitor and evaluate behaviour changes from misinformation incidents.", "kill_chain_phases": [ @@ -8791,8 +9253,8 @@ "spec_version": "2.1", "id": "attack-pattern--d2536dd3-53a5-4fc1-b508-1697cf0dafde", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.385402Z", - "modified": "2024-03-13T22:04:00.385402Z", + "created": "2024-08-02T17:12:32.420363Z", + "modified": "2024-08-02T17:12:32.420363Z", "name": "Content", "description": "Measure current system state with respect to the effectiveness of campaign content.", "kill_chain_phases": [ @@ -8824,8 +9286,8 @@ "spec_version": "2.1", "id": "attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.385542Z", - "modified": "2024-03-13T22:04:00.385542Z", + "created": "2024-08-02T17:12:32.420557Z", + "modified": "2024-08-02T17:12:32.420557Z", "name": "Awareness", "description": "Measure current system state with respect to the effectiveness of influencing awareness.", "kill_chain_phases": [ @@ -8857,8 +9319,8 @@ "spec_version": "2.1", "id": "attack-pattern--7fdc6b19-0d37-43a9-8144-f0c180a13ed0", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.38568Z", - "modified": "2024-03-13T22:04:00.38568Z", + "created": "2024-08-02T17:12:32.420751Z", + "modified": "2024-08-02T17:12:32.420751Z", "name": "Knowledge", "description": "Measure current system state with respect to the effectiveness of influencing knowledge.", "kill_chain_phases": [ @@ -8890,8 +9352,8 @@ "spec_version": "2.1", "id": "attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.385865Z", - "modified": "2024-03-13T22:04:00.385865Z", + "created": "2024-08-02T17:12:32.420979Z", + "modified": "2024-08-02T17:12:32.420979Z", "name": "Action/Attitude", "description": "Measure current system state with respect to the effectiveness of influencing action/attitude.", "kill_chain_phases": [ @@ -8923,8 +9385,8 @@ "spec_version": "2.1", "id": "attack-pattern--6aa772c8-f51f-428e-a7e5-2d69dd8d4add", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.386097Z", - "modified": "2024-03-13T22:04:00.386097Z", + "created": "2024-08-02T17:12:32.421176Z", + "modified": "2024-08-02T17:12:32.421176Z", "name": "Measure Effectiveness Indicators (or KPIs)", "description": "Ensuring that Key Performance Indicators are identified and tracked, so that the performance and effectiveness of campaigns, and elements of campaigns, can be measured, during and after their execution.", "kill_chain_phases": [ @@ -8956,8 +9418,8 @@ "spec_version": "2.1", "id": "attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.386294Z", - "modified": "2024-03-13T22:04:00.386294Z", + "created": "2024-08-02T17:12:32.421381Z", + "modified": "2024-08-02T17:12:32.421381Z", "name": "Message Reach", "description": "Monitor and evaluate message reach in misinformation incidents.", "kill_chain_phases": [ @@ -8989,8 +9451,8 @@ "spec_version": "2.1", "id": "attack-pattern--cb324e3c-1041-4a26-9fa8-da45547b7dcc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.38651Z", - "modified": "2024-03-13T22:04:00.38651Z", + "created": "2024-08-02T17:12:32.421597Z", + "modified": "2024-08-02T17:12:32.421597Z", "name": "Social Media Engagement", "description": "Monitor and evaluate social media engagement in misinformation incidents.", "kill_chain_phases": [ @@ -9020,10 +9482,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--7a1b2851-c2c4-4b42-bbbf-0c3542789287", + "id": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.386735Z", - "modified": "2024-03-13T22:04:00.386735Z", + "created": "2024-08-02T17:12:32.421799Z", + "modified": "2024-08-02T17:12:32.421799Z", "name": "Undermine", "description": "Weaken, debilitate, or subvert a target or their actions. An influence operation may be designed to disparage an opponent; sabotage an opponent\u2019s systems or processes; compromise an opponent\u2019s relationships or support system; impair an opponent\u2019s capability; or thwart an opponent\u2019s initiative. ", "kill_chain_phases": [ @@ -9053,10 +9515,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--335de36d-e372-431b-b4cb-c57d3874afb8", + "id": "attack-pattern--16583ab1-7dae-470c-8bd1-b7ffa1f9b13f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.38694Z", - "modified": "2024-03-13T22:04:00.38694Z", + "created": "2024-08-02T17:12:32.422003Z", + "modified": "2024-08-02T17:12:32.422003Z", "name": "Smear", "description": "Denigrate, disparage, or discredit an opponent. This is a common tactical objective in political campaigns with a larger strategic goal. It differs from efforts to harm a target through defamation. If there is no ulterior motive and the sole aim is to cause harm to the target, then choose sub-technique \u201cDefame\u201d of technique \u201cCause Harm\u201d instead.", "kill_chain_phases": [ @@ -9086,10 +9548,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--dfc90683-d6ef-42b7-979d-ca6fce04da64", + "id": "attack-pattern--0765e40a-7204-4913-b24d-6793cf4f6590", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.387141Z", - "modified": "2024-03-13T22:04:00.387141Z", + "created": "2024-08-02T17:12:32.422204Z", + "modified": "2024-08-02T17:12:32.422204Z", "name": "Thwart", "description": "Prevent the successful outcome of a policy, operation, or initiative. Actors conduct influence operations to stymie or foil proposals, plans, or courses of action which are not in their interest. ", "kill_chain_phases": [ @@ -9119,10 +9581,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--8ef7bb45-cf04-4a91-82ae-23f8d3cd1672", + "id": "attack-pattern--fdc7e2f8-dfb1-4353-a59f-f88d3b15eee7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.387336Z", - "modified": "2024-03-13T22:04:00.387336Z", + "created": "2024-08-02T17:12:32.422406Z", + "modified": "2024-08-02T17:12:32.422406Z", "name": "Subvert", "description": "Sabotage, destroy, or damage a system, process, or relationship. The classic example is the Soviet strategy of \u201cactive measures\u201d involving deniable covert activities such as political influence, the use of front organisations, the orchestration of domestic unrest, and the spread of disinformation. ", "kill_chain_phases": [ @@ -9152,10 +9614,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--956cdc6e-520d-4437-8d71-069a4b1d364d", + "id": "attack-pattern--4f7361ac-3b52-443f-8b4c-4032bb290a80", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.387538Z", - "modified": "2024-03-13T22:04:00.387538Z", + "created": "2024-08-02T17:12:32.422724Z", + "modified": "2024-08-02T17:12:32.422724Z", "name": "Polarise", "description": "To cause a target audience to divide into two completely opposing groups. This is a special case of subversion. To divide and conquer is an age-old approach to subverting and overcoming an enemy.", "kill_chain_phases": [ @@ -9185,10 +9647,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--d248f5e4-033f-4b71-a297-e164981e0d34", + "id": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.387749Z", - "modified": "2024-03-13T22:04:00.387749Z", + "created": "2024-08-02T17:12:32.422933Z", + "modified": "2024-08-02T17:12:32.422933Z", "name": "Cultivate Support", "description": "Grow or maintain the base of support for the actor, ally, or action. This includes hard core recruitment, managing alliances, and generating or maintaining sympathy among a wider audience, including reputation management and public relations. Sub-techniques assume support for actor (self) unless otherwise specified. ", "kill_chain_phases": [ @@ -9218,10 +9680,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--3d5684c2-4772-4af0-b8d9-e4a1362c9b0f", + "id": "attack-pattern--69f4e3bb-a587-468a-8a0c-31f9acd931b6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.387949Z", - "modified": "2024-03-13T22:04:00.387949Z", + "created": "2024-08-02T17:12:32.423136Z", + "modified": "2024-08-02T17:12:32.423136Z", "name": "Defend Reputaton", "description": "Preserve a positive perception in the public\u2019s mind following an accusation or adverse event. When accused of a wrongful act, an actor may engage in denial, counter accusations, whataboutism, or conspiracy theories to distract public attention and attempt to maintain a positive image. ", "kill_chain_phases": [ @@ -9251,10 +9713,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--cbd63bce-91c8-460d-b5da-59f52bb42307", + "id": "attack-pattern--648ac47f-a288-454a-a784-3f2111c0b76b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.388136Z", - "modified": "2024-03-13T22:04:00.388136Z", + "created": "2024-08-02T17:12:32.423338Z", + "modified": "2024-08-02T17:12:32.423338Z", "name": "Justify Action", "description": "To convince others to exonerate you of a perceived wrongdoing. When an actor finds it untenable to deny doing something, they may attempt to exonerate themselves with disinformation which claims the action was reasonable. This is a special case of \u201cDefend Reputation\u201d. ", "kill_chain_phases": [ @@ -9284,10 +9746,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--b5d40b47-6792-40b8-954c-0080dc6e36bc", + "id": "attack-pattern--0dc4a07b-94cb-4743-b812-3fc3c8288551", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.388316Z", - "modified": "2024-03-13T22:04:00.388316Z", + "created": "2024-08-02T17:12:32.423683Z", + "modified": "2024-08-02T17:12:32.423683Z", "name": "Energise Supporters", "description": "Raise the morale of those who support the organisation or group. Invigorate constituents with zeal for the mission or activity. Terrorist groups, political movements, and cults may indoctrinate their supporters with ideologies that are based on warped versions of religion or cause harm to others. ", "kill_chain_phases": [ @@ -9317,10 +9779,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--bdea2ea4-9db1-4925-a7bd-da87cff30020", + "id": "attack-pattern--150be76a-9bdc-4f1d-837c-6a845d1eda1c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.388531Z", - "modified": "2024-03-13T22:04:00.388531Z", + "created": "2024-08-02T17:12:32.424095Z", + "modified": "2024-08-02T17:12:32.424095Z", "name": "Boost Reputation", "description": "Elevate the estimation of the actor in the public\u2019s mind. Improve their image or standing. Public relations professionals use persuasive overt communications to achieve this goal; manipulators use covert disinformation. ", "kill_chain_phases": [ @@ -9350,10 +9812,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--d8da91e5-19d2-4a54-b20b-bbcfb52f4cef", + "id": "attack-pattern--ee594da3-8999-481e-90b3-e8c2e965ae28", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.388734Z", - "modified": "2024-03-13T22:04:00.388734Z", + "created": "2024-08-02T17:12:32.42446Z", + "modified": "2024-08-02T17:12:32.42446Z", "name": "Cultvate Support for Initiative", "description": "Elevate or fortify the public backing for a policy, operation, or idea. Domestic and foreign actors can use artificial means to fabricate or amplify public support for a proposal or action. ", "kill_chain_phases": [ @@ -9383,10 +9845,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--e20185ab-a567-4eda-84a1-60dd5936990b", + "id": "attack-pattern--62eb26b8-d555-46a5-831d-c6b55909a9c4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.388931Z", - "modified": "2024-03-13T22:04:00.388931Z", + "created": "2024-08-02T17:12:32.424819Z", + "modified": "2024-08-02T17:12:32.424819Z", "name": "Cultivate Support for Ally", "description": "Elevate or fortify the public backing for a partner. Governments may interfere in other countries\u2019 elections by covertly favouring a party or candidate aligned with their interests. They may also mount an influence operation to bolster the reputation of an ally under attack. ", "kill_chain_phases": [ @@ -9416,10 +9878,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--8d95a8e4-fe8a-4344-adc2-f0713c84cdde", + "id": "attack-pattern--fc986d09-410d-45ac-b4b4-161ff339147f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.389127Z", - "modified": "2024-03-13T22:04:00.389127Z", + "created": "2024-08-02T17:12:32.425208Z", + "modified": "2024-08-02T17:12:32.425208Z", "name": "Recruit Members", "description": "Motivate followers to join or subscribe as members of the team. Organisations may mount recruitment drives that use propaganda to entice sympathisers to sign up. ", "kill_chain_phases": [ @@ -9449,10 +9911,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--1af96790-1496-4975-9c17-61482c120f75", + "id": "attack-pattern--4e33bf6a-c042-4673-b72a-c4121e0aae0d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.38933Z", - "modified": "2024-03-13T22:04:00.38933Z", + "created": "2024-08-02T17:12:32.425583Z", + "modified": "2024-08-02T17:12:32.425583Z", "name": "Increase Prestige", "description": "Improve personal standing within a community. Gain fame, approbation, or notoriety. Conspiracy theorists, those with special access, and ideologues can gain prominence in a community by propagating disinformation, leaking confidential documents, or spreading hate. ", "kill_chain_phases": [ @@ -9482,10 +9944,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--f82582bf-2475-43bb-b793-ad51cb30d221", + "id": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.389561Z", - "modified": "2024-03-13T22:04:00.389561Z", + "created": "2024-08-02T17:12:32.425893Z", + "modified": "2024-08-02T17:12:32.425893Z", "name": "Make Money", "description": "Profit from disinformation, conspiracy theories, or online harm. In some cases, the sole objective is financial gain, in other cases the objective is both financial and political. Making money may also be a way to sustain a political campaign. ", "kill_chain_phases": [ @@ -9515,10 +9977,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--5c5ba2be-95ed-4b80-81ac-c56579482300", + "id": "attack-pattern--faacbfa9-600a-4cfb-8afe-844a186d72b3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.389769Z", - "modified": "2024-03-13T22:04:00.389769Z", + "created": "2024-08-02T17:12:32.426286Z", + "modified": "2024-08-02T17:12:32.426286Z", "name": "Generate Ad Revenue", "description": "Earn income from digital advertisements published alongside inauthentic content. Conspiratorial, false, or provocative content drives internet traffic. Content owners earn money from impressions of, or clicks on, or conversions of ads published on their websites, social media profiles, or streaming services, or ads published when their content appears in search engine results. Fraudsters simulate impressions, clicks, and conversions, or they spin up inauthentic sites or social media profiles just to generate ad revenue. Conspiracy theorists and political operators generate ad revenue as a byproduct of their operation or as a means of sustaining their campaign. ", "kill_chain_phases": [ @@ -9548,10 +10010,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--c33f44c6-69c7-4dca-a022-bce150e00351", + "id": "attack-pattern--62a0eef8-a23a-4fbf-bb17-17ea636213cc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.389969Z", - "modified": "2024-03-13T22:04:00.389969Z", + "created": "2024-08-02T17:12:32.426585Z", + "modified": "2024-08-02T17:12:32.426585Z", "name": "Scam", "description": "Defraud a target or trick a target into doing something that benefits the attacker. A typical scam is where a fraudster convinces a target to pay for something without the intention of ever delivering anything in return. Alternatively, the fraudster may promise benefits which never materialise, such as a fake cure. Criminals often exploit a fear or crisis or generate a sense of urgency. They may use deepfakes to impersonate authority figures or individuals in distress. ", "kill_chain_phases": [ @@ -9581,10 +10043,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--ab662bce-7c59-40db-8ec1-f1860b31c8d2", + "id": "attack-pattern--7bcb15ef-d371-4b1e-8768-30784e9d7b87", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.390582Z", - "modified": "2024-03-13T22:04:00.390582Z", + "created": "2024-08-02T17:12:32.426878Z", + "modified": "2024-08-02T17:12:32.426878Z", "name": "Raise Funds", "description": "Solicit donations for a cause. Popular conspiracy theorists can attract financial contributions from their followers. Fighting back against the establishment is a popular crowdfunding narrative. ", "kill_chain_phases": [ @@ -9614,10 +10076,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--b3489363-a0d6-44fa-a739-220721337318", + "id": "attack-pattern--8958b87c-85fd-478f-ae01-8952c787d9b7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.390746Z", - "modified": "2024-03-13T22:04:00.390746Z", + "created": "2024-08-02T17:12:32.427325Z", + "modified": "2024-08-02T17:12:32.427325Z", "name": "Sell Items under False Pretences", "description": "Offer products for sale under false pretences. Campaigns may hijack or create causes built on disinformation to sell promotional merchandise. Or charlatans may amplify victims\u2019 unfounded fears to sell them items of questionable utility such as supplements or survival gear. ", "kill_chain_phases": [ @@ -9647,10 +10109,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--46dd1614-b2f4-40c1-bcdb-0ca33ce4357f", + "id": "attack-pattern--9e081185-12f4-41f0-8379-95b688e1d80f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.390897Z", - "modified": "2024-03-13T22:04:00.390897Z", + "created": "2024-08-02T17:12:32.427609Z", + "modified": "2024-08-02T17:12:32.427609Z", "name": "Extort", "description": "Coerce money or favours from a target by threatening to expose or corrupt information. Ransomware criminals typically demand money. Intelligence agencies demand national secrets. Sexual predators demand favours. The leverage may be critical, sensitive, or embarrassing information. ", "kill_chain_phases": [ @@ -9680,10 +10142,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--70de8fc1-509c-4922-995b-1512fba1e338", + "id": "attack-pattern--3628a6fd-b102-48a0-862b-9b66e80ee556", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.391044Z", - "modified": "2024-03-13T22:04:00.391044Z", + "created": "2024-08-02T17:12:32.427838Z", + "modified": "2024-08-02T17:12:32.427838Z", "name": "Manipulate Stocks", "description": "Artificially inflate or deflate the price of stocks or other financial instruments and then trade on these to make profit. The most common securities fraud schemes are called \u201cpump and dump\u201d and \u201cpoop and scoop\u201d. ", "kill_chain_phases": [ @@ -9713,10 +10175,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--6c3345b8-026e-4aa6-8b2c-15cfb2258df6", + "id": "attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.391189Z", - "modified": "2024-03-13T22:04:00.391189Z", + "created": "2024-08-02T17:12:32.428073Z", + "modified": "2024-08-02T17:12:32.428073Z", "name": "Motivate to Act", "description": "Persuade, impel, or provoke the target to behave in a specific manner favourable to the attacker. Some common behaviours are joining, subscribing, voting, buying, demonstrating, fighting, retreating, resigning, boycotting.", "kill_chain_phases": [ @@ -9746,10 +10208,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--12fbb7ad-ceea-4f59-a626-a30a47a4cc56", + "id": "attack-pattern--01ad5f44-da00-491f-84e8-3ba8da154c45", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.391394Z", - "modified": "2024-03-13T22:04:00.391394Z", + "created": "2024-08-02T17:12:32.428281Z", + "modified": "2024-08-02T17:12:32.428281Z", "name": "Encourage", "description": "Inspire, animate, or exhort a target to act. An actor can use propaganda, disinformation, or conspiracy theories to stimulate a target to act in its interest. ", "kill_chain_phases": [ @@ -9779,10 +10241,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--637d504e-4f85-4979-b48c-b9512419329e", + "id": "attack-pattern--29a3ec78-469a-43b8-b0ae-9f34c58316f2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.391761Z", - "modified": "2024-03-13T22:04:00.391761Z", + "created": "2024-08-02T17:12:32.428473Z", + "modified": "2024-08-02T17:12:32.428473Z", "name": "Provoke", "description": "Instigate, incite, or arouse a target to act. Social media manipulators exploit moral outrage to propel targets to spread hate, take to the streets to protest, or engage in acts of violence. ", "kill_chain_phases": [ @@ -9812,10 +10274,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--ac2e2374-ff39-4167-af9e-71ba5d96e828", + "id": "attack-pattern--3af9d1c0-9a09-4dba-8975-a204e6951ac4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.391929Z", - "modified": "2024-03-13T22:04:00.391929Z", + "created": "2024-08-02T17:12:32.428678Z", + "modified": "2024-08-02T17:12:32.428678Z", "name": "Compel", "description": "Force target to take an action or to stop taking an action it has already started. Actors can use the threat of reputational damage alongside military or economic threats to compel a target.", "kill_chain_phases": [ @@ -9845,10 +10307,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--554fc43f-426e-40ba-a82f-148774abaee2", + "id": "attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.392079Z", - "modified": "2024-03-13T22:04:00.392079Z", + "created": "2024-08-02T17:12:32.42888Z", + "modified": "2024-08-02T17:12:32.42888Z", "name": "Dissuade from Acting", "description": "Discourage, deter, or inhibit the target from actions which would be unfavourable to the attacker. The actor may want the target to refrain from voting, buying, fighting, or supplying. ", "kill_chain_phases": [ @@ -9878,10 +10340,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--431e1e82-c9ef-44e6-b1ec-354aca1890fa", + "id": "attack-pattern--d60dd224-14bd-4b6e-9960-a789a8370fdf", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.392254Z", - "modified": "2024-03-13T22:04:00.392254Z", + "created": "2024-08-02T17:12:32.429055Z", + "modified": "2024-08-02T17:12:32.429055Z", "name": "Discourage", "description": "To make a target disinclined or reluctant to act. Manipulators use disinformation to cause targets to question the utility, legality, or morality of taking an action. ", "kill_chain_phases": [ @@ -9911,10 +10373,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--8376b756-0340-4870-ba1d-38b43ce811a4", + "id": "attack-pattern--5af23f8e-38df-48c6-b832-6f4589cd2590", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.392403Z", - "modified": "2024-03-13T22:04:00.392403Z", + "created": "2024-08-02T17:12:32.429223Z", + "modified": "2024-08-02T17:12:32.429223Z", "name": "Silence", "description": "Intimidate or incentivise target into remaining silent or prevent target from speaking out. A threat actor may cow a target into silence as a special case of deterrence. Or they may buy the target\u2019s silence. Or they may repress or restrict the target\u2019s speech. ", "kill_chain_phases": [ @@ -9944,10 +10406,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--b4a3940c-fa6d-4086-9a6d-ccab45cd5072", + "id": "attack-pattern--8ac60812-17d7-4e9f-911e-64467233a9b3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.392574Z", - "modified": "2024-03-13T22:04:00.392574Z", + "created": "2024-08-02T17:12:32.429391Z", + "modified": "2024-08-02T17:12:32.429391Z", "name": "Deter", "description": "Prevent target from taking an action for fear of the consequences. Deterrence occurs in the mind of the target, who fears they will be worse off if they take an action than if they don\u2019t. When making threats, aggressors may bluff, feign irrationality, or engage in brinksmanship.", "kill_chain_phases": [ @@ -9977,10 +10439,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--3eeb3c60-b41a-412c-ada9-ad6e82022dec", + "id": "attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.392728Z", - "modified": "2024-03-13T22:04:00.392728Z", + "created": "2024-08-02T17:12:32.429558Z", + "modified": "2024-08-02T17:12:32.429558Z", "name": "Cause Harm", "description": "Persecute, malign, or inflict pain upon a target. The objective of a campaign may be to cause fear or emotional distress in a target. In some cases, harm is instrumental to achieving a primary objective, as in coercion, repression, or intimidation. In other cases, harm may be inflicted for the satisfaction of the perpetrator, as in revenge or sadistic cruelty. ", "kill_chain_phases": [ @@ -10010,10 +10472,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--6275c34f-44ea-4799-bb61-3c0a25450812", + "id": "attack-pattern--741c08dd-2dd3-4c6f-8d08-32481f4cb61f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.392887Z", - "modified": "2024-03-13T22:04:00.392887Z", + "created": "2024-08-02T17:12:32.429741Z", + "modified": "2024-08-02T17:12:32.429741Z", "name": "Defame", "description": "Attempt to damage the target\u2019s personal reputation by impugning their character. This can range from subtle attempts to misrepresent or insinuate, to obvious attempts to denigrate or disparage, to blatant attempts to malign or vilify. Slander applies to oral expression. Libel applies to written or pictorial material. Defamation is often carried out by online trolls. The sole aim here is to cause harm to the target. If the threat actor uses defamation as a means of undermining the target, then choose sub-technique \u201cSmear\u201d of technique \u201cUndermine\u201d instead. ", "kill_chain_phases": [ @@ -10043,10 +10505,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--e4f85bfa-8e18-407f-b111-17f18ed209d0", + "id": "attack-pattern--b502f8ae-e296-4dd7-83ea-8d737f8d3fb1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.393053Z", - "modified": "2024-03-13T22:04:00.393053Z", + "created": "2024-08-02T17:12:32.429946Z", + "modified": "2024-08-02T17:12:32.429946Z", "name": "Intimidate", "description": "Coerce, bully, or frighten the target. An influence operation may use intimidation to compel the target to act against their will. Or the goal may be to frighten or even terrify the target into silence or submission. In some cases, the goal is simply to make the victim suffer. ", "kill_chain_phases": [ @@ -10076,10 +10538,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--92b7f596-d223-440a-b62b-149dbcc73b9f", + "id": "attack-pattern--c5274385-9abf-45cb-9ef6-faf86145d5ef", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.393221Z", - "modified": "2024-03-13T22:04:00.393221Z", + "created": "2024-08-02T17:12:32.43014Z", + "modified": "2024-08-02T17:12:32.43014Z", "name": "Spread Hate", "description": "Publish and/or propagate demeaning, derisive, or humiliating content targeting an individual or group of individuals with the intent to cause emotional, psychological, or physical distress. Hate speech can cause harm directly or incite others to harm the target. It often aims to stigmatise the target by singling out immutable characteristics such as colour, race, religion, national or ethnic origin, gender, gender identity, sexual orientation, age, disease, or mental or physical disability. Thus, promoting hatred online may involve racism, antisemitism, Islamophobia, xenophobia, sexism, misogyny, homophobia, transphobia, ageism, ableism, or any combination thereof. Motivations for hate speech range from group preservation to ideological superiority to the unbridled infliction of suffering. ", "kill_chain_phases": [ @@ -10109,10 +10571,10 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--44e57875-edb9-4bce-927d-17aac9bf9a48", + "id": "attack-pattern--729483ae-39cf-416e-8d38-da06f1fc5991", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.393395Z", - "modified": "2024-03-13T22:04:00.393395Z", + "created": "2024-08-02T17:12:32.430495Z", + "modified": "2024-08-02T17:12:32.430495Z", "name": "Acquire Compromised Asset", "description": "Threat Actors may take over existing assets not owned by them through nefarious means, such as using technical exploits, hacking, purchasing compromised accounts from the dark web, or social engineering.", "kill_chain_phases": [ @@ -10142,12 +10604,12 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--ebfe12db-6e8f-4826-8f8e-b9e865f1d29d", + "id": "attack-pattern--d556b582-dd00-44d7-8c2f-74fb48c755fa", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.393606Z", - "modified": "2024-03-13T22:04:00.393606Z", + "created": "2024-08-02T17:12:32.430653Z", + "modified": "2024-08-02T17:12:32.430653Z", "name": "Acquire Compromised Account", - "description": "Threat Actors can take over existing users\u2019 accounts to distribute campaign content.\u00a0\n\nThe actor may maintain the asset\u2019s previous identity to capitalise on the perceived legitimacy its previous owner had cultivated.\n\nThe actor may completely rebrand the account to exploit its existing reach, or relying on the account\u2019s history to avoid more stringent automated content moderation rules applied to new accounts.\n\nSee also [Mitre ATT&CK\u2019s T1586 Compromise Accounts](https://attack.mitre.org/techniques/T1586/) for more technical information on how threat actors may achieve this objective.\n\nThis Technique was previously called Compromise Legitimate Accounts, and used the ID T0011.", + "description": "Threat Actors can take over existing users\u2019 accounts to distribute campaign content.

The actor may maintain the asset\u2019s previous identity to capitalise on the perceived legitimacy its previous owner had cultivated.

The actor may completely rebrand the account to exploit its existing reach, or relying on the account\u2019s history to avoid more stringent automated content moderation rules applied to new accounts.

See also [Mitre ATT&CK\u2019s T1586 Compromise Accounts](https://attack.mitre.org/techniques/T1586/) for more technical information on how threat actors may achieve this objective.

This Technique was previously called Compromise Legitimate Accounts, and used the ID T0011.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -10175,12 +10637,12 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--fcbde78a-826a-4d53-8071-6e8034901c05", + "id": "attack-pattern--fde45c5f-c612-4969-b104-d96a60e6d888", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.393755Z", - "modified": "2024-03-13T22:04:00.393755Z", + "created": "2024-08-02T17:12:32.430799Z", + "modified": "2024-08-02T17:12:32.430799Z", "name": "Acquire Compromised Website", - "description": "Threat Actors may take over existing websites to publish or amplify inauthentic narratives. This includes the defacement of websites, and cases where websites\u2019 personas are maintained to add credence to threat actors\u2019 narratives.\n\nSee also [Mitre ATT&CK\u2019s T1584 Compromise Infrastructure](https://attack.mitre.org/techniques/T1584/) for more technical information on how threat actors may achieve this objective.", + "description": "Threat Actors may take over existing websites to publish or amplify inauthentic narratives. This includes the defacement of websites, and cases where websites\u2019 personas are maintained to add credence to threat actors\u2019 narratives.

See also [Mitre ATT&CK\u2019s T1584 Compromise Infrastructure](https://attack.mitre.org/techniques/T1584/) for more technical information on how threat actors may achieve this objective.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -10208,12 +10670,12 @@ { "type": "attack-pattern", "spec_version": "2.1", - "id": "attack-pattern--616faeda-13e2-4693-9d14-106f323ae45d", + "id": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.3939Z", - "modified": "2024-03-13T22:04:00.3939Z", - "name": "Fabricate Grassroots Movement", - "description": "This technique, sometimes known as \"astroturfing\", occurs when an influence operation disguises itself as a grassroots movement or organisation that supports operation narratives.\u00a0\n\nAstroturfing aims to increase the appearance of popular support for an evolving grassroots movement in contrast to \"Utilise Butterfly Attacks\", which aims to discredit an existing grassroots movement.\u00a0\n\nThis Technique was previously called Astroturfing, and used the ID T0099.001", + "created": "2024-08-02T17:12:32.430948Z", + "modified": "2024-08-02T17:12:32.430948Z", + "name": "Persona Legitimacy", + "description": "This Technique contains sub-techniques which analysts can use to assert whether an account is presenting an authentic, fabricated, or parody persona:

T0143.001: Authentic Persona
T0143.002: Fabricated Persona
T0143.003: Impersonated Persona
T0143.004: Parody Persona", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", @@ -10223,8 +10685,8 @@ "external_references": [ { "source_name": "mitre-attack", - "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0142.md", - "external_id": "T0142" + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.md", + "external_id": "T0143" } ], "object_marking_refs": [ @@ -10239,25 +10701,506 @@ "x_mitre_version": "2.1" }, { - "type": "relationship", + "type": "attack-pattern", "spec_version": "2.1", - "id": "relationship--58a25b31-077e-4bcd-8dd9-9a9baede020e", - "created": "2024-03-13T22:04:00.394211Z", - "modified": "2024-03-13T22:04:00.394211Z", - "relationship_type": "subtechnique-of", - "description": "", - "source_ref": "attack-pattern--ec740173-f964-47cc-b849-06a1b134ee4f", - "target_ref": "attack-pattern--7981d39a-01be-46f6-b9f9-507d0c03e919", + "id": "attack-pattern--6ae4a4d2-4ac8-4764-ac9f-7261c5c882e0", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431094Z", + "modified": "2024-08-02T17:12:32.431094Z", + "name": "Authentic Persona", + "description": "An individual or institution presenting a persona that legitimately matches who or what they are is presenting an authentic persona.

For example, an account which presents as being managed by a member of a country\u2019s military, and is legitimately managed by that person, would be presenting an authentic persona (T0143.001: Authentic Persona, T0097.105: Military Personnel).

Sometimes people can authentically present themselves as who they are while still participating in malicious/inauthentic activity; a legitimate journalist (T0143.001: Authentic Persona, T0097.102: Journalist Persona) may accept bribes to promote products, or they could be tricked by threat actors into sharing an operation\u2019s narrative.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.001.md", + "external_id": "T0143.001" + } + ], "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ] + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--f328541f-2537-4db7-8a05-1c76ed26d3eb", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431241Z", + "modified": "2024-08-02T17:12:32.431241Z", + "name": "Fabricated Persona", + "description": "An individual or institution pretending to have a persona without any legitimate claim to that persona is presenting a fabricated persona, such as a person who presents themselves as a member of a country\u2019s military without having worked in any capacity with the military (T0143.002: Fabricated Persona, T0097.105: Military Personnel).

Sometimes real people can present entirely fabricated personas; they can use real names and photos on social media while also pretending to have credentials or traits they don\u2019t have in real life.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.002.md", + "external_id": "T0143.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--b2c62262-d3cc-49a9-830c-9d6f0bb95082", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431468Z", + "modified": "2024-08-02T17:12:32.431468Z", + "name": "Impersonated Persona", + "description": "Threat actors may impersonate existing individuals or institutions to conceal their network identity, add legitimacy to content, or harm the impersonated target\u2019s reputation. This Technique covers situations where an actor presents themselves as another existing individual or institution.

This Technique was previously called Prepare Assets Impersonating Legitimate Entities and used the ID T0099.

Associated Techniques and Sub-techniques
T0097: Presented Persona: Analysts can use the sub-techniques of T0097: Presented Persona to categorise the type of impersonation. For example, a document developed by a threat actor which falsely presented as a letter from a government department could be documented using T0085.004: Develop Document, T0143.003: Impersonated Persona, and T0097.206: Government Institution Persona.
T0145.001: Copy Account Imagery: Actors may take existing accounts\u2019 profile pictures as part of their impersonation efforts.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.003.md", + "external_id": "T0143.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d592cbac-8fcd-4569-8a7a-4e5c6a0b08e7", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431712Z", + "modified": "2024-08-02T17:12:32.431712Z", + "name": "Parody Persona", + "description": "Parody is a form of artistic expression that imitates the style or characteristics of a particular work, genre, or individual in a humorous or satirical way, often to comment on or critique the original work or subject matter. People may present as parodies to create humour or make a point by exaggerating or altering elements of the original, while still maintaining recognizable elements.

The use of parody is not an indication of inauthentic or malicious behaviour; parody allows people to present ideas or criticisms in a comedic or exaggerated manner, softening the impact of sensitive or contentious topics. Because parody is often protected as a form of free speech or artistic expression, it provides a legal and social framework for discussing controversial issues.

However, parody personas may be perceived as authentic personas, leading to people mistakenly believing that a parody account\u2019s statements represent the real opinions of a parodied target. Threat actors may also use the guise of parody to spread campaign content. Parody personas may disclaim that they are operating as a parody, however this is not always the case, and is not always given prominence.

Associated Techniques and Sub-techniques T0097: Presented Persona: Analysts can use the sub-techniques of T0097: Presented Persona to categorise the type of parody.\u00a0For example, an account presenting as a parody of a business could be documented using T0097.205: Business Persona and T0143.003: Parody Persona.
T0145.001: Copy Account Imagery: Actors may take existing accounts\u2019 profile pictures as part of their parody efforts.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.004.md", + "external_id": "T0143.004" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--0c2c22ae-5115-4b91-9e0f-08259e6aad99", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431925Z", + "modified": "2024-08-02T17:12:32.431925Z", + "name": "Persona Legitimacy Evidence", + "description": "This Technique contains behaviours which might indicate whether a persona is legitimate, a fabrication, or a parody.

For example, the same persona being consistently presented across platforms is consistent with how authentic users behave on social media. However, threat actors have also displayed this behaviour as a way to increase the perceived legitimacy of their fabricated personas (aka \u201cbackstopping\u201d).", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0144.md", + "external_id": "T0144" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--410e8ae7-e11d-44ff-8f10-3ec29798a9e0", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.432127Z", + "modified": "2024-08-02T17:12:32.432127Z", + "name": "Present Persona across Platforms", + "description": "This sub-technique covers situations where analysts have identified the same persona being presented across multiple platforms.

Having multiple accounts presenting the same persona is not an indicator of inauthentic behaviour; many people create accounts and present as themselves on multiple platforms. However, threat actors are known to present the same persona across multiple platforms, benefiting from an increase in perceived legitimacy.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0144.001.md", + "external_id": "T0144.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--3b7dd3e2-ff22-4b4b-813e-c31c2fb68029", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.43236Z", + "modified": "2024-08-02T17:12:32.43236Z", + "name": "Persona Template", + "description": "Threat actors have been observed following a template when filling their accounts\u2019 online profiles. This may be done to enable account holders to quickly present themselves as a real person with a targeted persona.

For example, an actor may be instructed to create many fabricated local accounts for use in an operation using a template of \u201c[flag emojis], [location], [personal quote], [political party] supporter\u201d in their account\u2019s description.

Associated Techniques and Sub-techniques
T0143.002: Fabricated Persona: The use of a templated account biography in a collection of accounts may be an indicator that the personas have been fabricated.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0144.002.md", + "external_id": "T0144.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.432566Z", + "modified": "2024-08-02T17:12:32.432566Z", + "name": "Establish Account Imagery", + "description": "Introduce visual elements to an account where a platform allows this functionality (e.g. a profile picture, a cover photo, etc).\u00a0

Threat Actors who don\u2019t want to use pictures of themselves in their social media accounts may use alternate imagery to make their account appear more legitimate.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.md", + "external_id": "T0145" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--c060ec87-d4d7-4de0-9f1d-9a9a42c05446", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.432726Z", + "modified": "2024-08-02T17:12:32.432726Z", + "name": "Copy Account Imagery", + "description": "Account imagery copied from an existing account.

Analysts may use reverse image search tools to try to identify previous uses of account imagery (e.g. a profile picture) by other accounts.

Threat Actors have been known to copy existing accounts\u2019 imagery to impersonate said accounts, or to provide imagery for unrelated accounts which aren\u2019t intended to impersonate the original assets\u2019 owner.

Associated Techniques and Sub-techniques
T0143.003: Impersonated Persona: Actors may copy existing accounts\u2019 imagery in an attempt to impersonate them.
T0143.004: Parody Persona: Actors may copy existing accounts\u2019 imagery as part of a parody of that account.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.001.md", + "external_id": "T0145.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--8314b253-72a3-46c0-8ee5-6fa02aa9a8fa", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.432872Z", + "modified": "2024-08-02T17:12:32.432872Z", + "name": "AI-Generated Account Imagery", + "description": "AI Generated images used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived legitimacy. By using an AI-generated picture for this purpose, they are able to present themselves as a real person without compromising their own identity, or risking detection by taking a real person\u2019s existing profile picture.

Associated Techniques and Sub-techniques
T0086.002: Develop AI-Generated Images (Deepfakes): Analysts should use this sub-technique to document use of AI generated imagery used to support narratives.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.002.md", + "external_id": "T0145.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--5ba86be4-c8ba-458c-abea-2ad706d7ddd9", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.433022Z", + "modified": "2024-08-02T17:12:32.433022Z", + "name": "Animal Account Imagery", + "description": "Animal used in account imagery.

An influence operation might flesh out its account by uploading a profile picture, increasing its perceived authenticity.

People sometimes legitimately use images of animals as their profile pictures (e.g. of their pets), and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.003.md", + "external_id": "T0145.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--15cba133-fa27-4632-9996-22b74751749a", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.433235Z", + "modified": "2024-08-02T17:12:32.433235Z", + "name": "Scenery Account Imagery", + "description": "Scenery or nature used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

People sometimes legitimately use images of scenery as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.004.md", + "external_id": "T0145.004" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--df9f74e6-1a56-4515-910e-d58a386bbf1f", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.433467Z", + "modified": "2024-08-02T17:12:32.433467Z", + "name": "Illustrated Character Account Imagery", + "description": "A cartoon/illustrated/anime character used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

People sometimes legitimately use images of illustrated characters as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.005.md", + "external_id": "T0145.005" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--0e605049-ac7a-46a9-bbac-ef0a69e160cb", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.433674Z", + "modified": "2024-08-02T17:12:32.433674Z", + "name": "Attractive Person Account Imagery", + "description": "Attractive person used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

Pictures of physically attractive people can benefit threat actors by increasing attention given to their posts.

People sometimes legitimately use images of attractive people as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.

Associated Techniques and Sub-techniques
T0097.109: Romantic Suitor Persona: Accounts presenting as a romantic suitor may use an attractive person in their account imagery.
T0104.002: Dating App: Analysts can use this sub-technique for tagging cases where an account has been identified as using a dating platform.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.006.md", + "external_id": "T0145.006" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + }, + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--cf4ee6a4-f503-425c-a069-3245de145582", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.43387Z", + "modified": "2024-08-02T17:12:32.43387Z", + "name": "Stock Image Account Imagery", + "description": "Stock images used in account imagery.

Stock image websites produce photos of people in various situations. Threat Actors can purchase or appropriate these images for use in their account imagery, increasing perceived legitimacy while avoiding the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).\u00a0

Stock images tend to include physically attractive people, and this can benefit threat actors by increasing attention given to their posts.

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.007.md", + "external_id": "T0145.007" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" }, { "type": "relationship", "spec_version": "2.1", - "id": "relationship--c8ab60c6-0a41-4f1c-a3d9-fca52fe88b87", - "created": "2024-03-13T22:04:00.394357Z", - "modified": "2024-03-13T22:04:00.394357Z", + "id": "relationship--d497f5e2-c815-4103-80ef-66e973ce080a", + "created": "2024-08-02T17:12:32.434382Z", + "modified": "2024-08-02T17:12:32.434382Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45", @@ -10269,9 +11212,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7891e002-c63d-4556-a1e9-57865a71d0a2", - "created": "2024-03-13T22:04:00.39454Z", - "modified": "2024-03-13T22:04:00.39454Z", + "id": "relationship--6b9a11bb-a632-4459-ab38-7f72563b7c2a", + "created": "2024-08-02T17:12:32.434701Z", + "modified": "2024-08-02T17:12:32.434701Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--e0b7c795-eae2-4494-a3c9-52bc68c6df06", @@ -10283,9 +11226,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--9605b8e6-ba96-428c-9c54-fec50d4b937b", - "created": "2024-03-13T22:04:00.394674Z", - "modified": "2024-03-13T22:04:00.394674Z", + "id": "relationship--01daebfb-3b40-4a94-9d9f-b937747dc480", + "created": "2024-08-02T17:12:32.434806Z", + "modified": "2024-08-02T17:12:32.434806Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--72207f73-5b54-4cd4-b453-746a61eb3e28", @@ -10297,9 +11240,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--ea3cc0fb-3dd9-441c-b818-cc900b49438a", - "created": "2024-03-13T22:04:00.394798Z", - "modified": "2024-03-13T22:04:00.394798Z", + "id": "relationship--1ea19ad6-4924-441c-97b2-9386ae1e66e7", + "created": "2024-08-02T17:12:32.434902Z", + "modified": "2024-08-02T17:12:32.434902Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--b4ed63e5-e8db-4057-989b-3ff5ad8c000c", @@ -10311,9 +11254,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--b77672a0-2b20-4056-99bb-a4c7bc98e98f", - "created": "2024-03-13T22:04:00.394915Z", - "modified": "2024-03-13T22:04:00.394915Z", + "id": "relationship--e27f9a78-1896-4b10-a4d7-988caa571061", + "created": "2024-08-02T17:12:32.435003Z", + "modified": "2024-08-02T17:12:32.435003Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--eb63894c-aad1-47f0-98ee-0fa5e07ed3f3", @@ -10325,9 +11268,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--320d1c61-913e-4b54-afbc-51cc83f71537", - "created": "2024-03-13T22:04:00.395048Z", - "modified": "2024-03-13T22:04:00.395048Z", + "id": "relationship--db118e6a-1c08-4dbf-ab67-ed0a3c9c205e", + "created": "2024-08-02T17:12:32.435125Z", + "modified": "2024-08-02T17:12:32.435125Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733", @@ -10339,9 +11282,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--29694e22-0a3b-4325-82e1-4f9e464ef4d3", - "created": "2024-03-13T22:04:00.395174Z", - "modified": "2024-03-13T22:04:00.395174Z", + "id": "relationship--6498a6ab-a2c2-408c-8cd9-8ff9fe935a48", + "created": "2024-08-02T17:12:32.435224Z", + "modified": "2024-08-02T17:12:32.435224Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--84e0fdf7-3bba-4e66-a575-6a32a7f8eca6", @@ -10353,9 +11296,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--68c3b358-b76f-4b33-a66b-5b799252d016", - "created": "2024-03-13T22:04:00.395279Z", - "modified": "2024-03-13T22:04:00.395279Z", + "id": "relationship--e39c7019-ac09-4202-ad2d-8ca0ed3c3eec", + "created": "2024-08-02T17:12:32.435314Z", + "modified": "2024-08-02T17:12:32.435314Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16", @@ -10367,9 +11310,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--de8e3bcc-6c14-4e52-9638-03cceda4590c", - "created": "2024-03-13T22:04:00.395398Z", - "modified": "2024-03-13T22:04:00.395398Z", + "id": "relationship--489c49a3-53da-4808-989b-950f8f78e447", + "created": "2024-08-02T17:12:32.435402Z", + "modified": "2024-08-02T17:12:32.435402Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9", @@ -10381,9 +11324,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--cb990976-6c73-4450-8952-ac9c09d47ef3", - "created": "2024-03-13T22:04:00.39552Z", - "modified": "2024-03-13T22:04:00.39552Z", + "id": "relationship--0cd0a45c-6751-48b3-ab61-e0a94f4fafd9", + "created": "2024-08-02T17:12:32.435493Z", + "modified": "2024-08-02T17:12:32.435493Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--7d5ba27c-12c7-4a30-8624-e1ea6670f0f8", @@ -10395,9 +11338,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--e95bb346-52eb-4222-a179-43576c13883e", - "created": "2024-03-13T22:04:00.39564Z", - "modified": "2024-03-13T22:04:00.39564Z", + "id": "relationship--b63a1013-1ddd-4a02-83b1-e0ccc9969613", + "created": "2024-08-02T17:12:32.435581Z", + "modified": "2024-08-02T17:12:32.435581Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--e47ae747-d83d-433d-a69a-f6d0970fed5e", @@ -10409,9 +11352,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--90791aea-b615-45f3-bce5-c6641cd58cc2", - "created": "2024-03-13T22:04:00.39576Z", - "modified": "2024-03-13T22:04:00.39576Z", + "id": "relationship--16bd1f97-9919-4208-a94e-0d459d47baef", + "created": "2024-08-02T17:12:32.43567Z", + "modified": "2024-08-02T17:12:32.43567Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb", @@ -10423,9 +11366,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--a6bcba12-2d38-44b4-a36c-22d41a6bdbb5", - "created": "2024-03-13T22:04:00.395879Z", - "modified": "2024-03-13T22:04:00.395879Z", + "id": "relationship--b85c988c-7c1f-42ea-aae3-af30a0bd413e", + "created": "2024-08-02T17:12:32.435758Z", + "modified": "2024-08-02T17:12:32.435758Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--5bc895e8-eb26-43ec-8469-ab665092970d", @@ -10437,9 +11380,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--45e8a0a3-74dd-4c0f-a177-8bd6dc8ef852", - "created": "2024-03-13T22:04:00.396018Z", - "modified": "2024-03-13T22:04:00.396018Z", + "id": "relationship--5eeb73b2-67a1-4088-91ee-a84e29a7a773", + "created": "2024-08-02T17:12:32.435846Z", + "modified": "2024-08-02T17:12:32.435846Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635", @@ -10451,9 +11394,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--0239e4d9-bdb6-48ea-9cf3-008ed5c19fba", - "created": "2024-03-13T22:04:00.396138Z", - "modified": "2024-03-13T22:04:00.396138Z", + "id": "relationship--41e95a18-7fa8-436e-b74c-194ca81ac126", + "created": "2024-08-02T17:12:32.435934Z", + "modified": "2024-08-02T17:12:32.435934Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--bfce790b-dfd6-46ca-8fab-c2d72f21bba2", @@ -10465,9 +11408,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7440a473-b715-4a19-ab6b-07d57393eeea", - "created": "2024-03-13T22:04:00.396258Z", - "modified": "2024-03-13T22:04:00.396258Z", + "id": "relationship--726afd71-b106-4593-b582-82964b359a88", + "created": "2024-08-02T17:12:32.436057Z", + "modified": "2024-08-02T17:12:32.436057Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--e6ab2793-a059-4354-bb60-045afb019833", @@ -10479,9 +11422,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--123dc92d-6031-42ff-a857-90534755eb42", - "created": "2024-03-13T22:04:00.396379Z", - "modified": "2024-03-13T22:04:00.396379Z", + "id": "relationship--3c489170-87fc-4f62-92cc-6b885cb8d3b8", + "created": "2024-08-02T17:12:32.436202Z", + "modified": "2024-08-02T17:12:32.436202Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--4282febe-c8a6-46da-863c-f19081615d80", @@ -10493,9 +11436,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--d71a0536-5973-4563-8ff6-8e338452ead9", - "created": "2024-03-13T22:04:00.396498Z", - "modified": "2024-03-13T22:04:00.396498Z", + "id": "relationship--40c2086c-389d-4197-b712-54223ddc9a0a", + "created": "2024-08-02T17:12:32.436333Z", + "modified": "2024-08-02T17:12:32.436333Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--ce5b400c-6f82-4095-936b-617857800da8", @@ -10507,9 +11450,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7d1bcafc-fb9f-4701-a1cb-a8711532d613", - "created": "2024-03-13T22:04:00.396617Z", - "modified": "2024-03-13T22:04:00.396617Z", + "id": "relationship--54c1cbd7-5e99-4911-be1b-ec708f309367", + "created": "2024-08-02T17:12:32.436461Z", + "modified": "2024-08-02T17:12:32.436461Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69", @@ -10521,9 +11464,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--045f2fda-ea5b-4a69-806e-8970a6437d2c", - "created": "2024-03-13T22:04:00.396734Z", - "modified": "2024-03-13T22:04:00.396734Z", + "id": "relationship--771a6483-9bf3-48c8-b72c-dfa85a0a3350", + "created": "2024-08-02T17:12:32.436592Z", + "modified": "2024-08-02T17:12:32.436592Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--cec91e97-76c8-4a1f-8397-a06939a558ef", @@ -10535,12 +11478,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--5a2fc90e-6ed5-4019-919f-adbcd8731f29", - "created": "2024-03-13T22:04:00.396853Z", - "modified": "2024-03-13T22:04:00.396853Z", + "id": "relationship--6b46663a-a2da-4e4b-b3f7-cf5386126af4", + "created": "2024-08-02T17:12:32.43672Z", + "modified": "2024-08-02T17:12:32.43672Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--ad48b850-c73d-470a-ab8f-bdc7bfcb8ae6", + "source_ref": "attack-pattern--3a2f96fa-c3d0-4f54-a041-6807f0ea4955", "target_ref": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -10549,9 +11492,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--cbdc6b33-2eea-4bfe-a0ef-e34eb6dc7fdf", - "created": "2024-03-13T22:04:00.396997Z", - "modified": "2024-03-13T22:04:00.396997Z", + "id": "relationship--c89bea7d-e089-4546-8145-c698b6e98f99", + "created": "2024-08-02T17:12:32.436845Z", + "modified": "2024-08-02T17:12:32.436845Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--7b32abce-e101-4dc3-98db-30b79c0c8397", @@ -10563,9 +11506,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--dcedefb6-cbe8-4469-a22c-3faa6343bff0", - "created": "2024-03-13T22:04:00.397122Z", - "modified": "2024-03-13T22:04:00.397122Z", + "id": "relationship--ec7d1da9-fff6-4c53-a14b-9909bf9431a2", + "created": "2024-08-02T17:12:32.436969Z", + "modified": "2024-08-02T17:12:32.436969Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--f601eb03-79d0-4c00-b07d-4b4647c37efd", @@ -10577,9 +11520,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7c24ff52-827d-4a20-8f8d-97463a02e32b", - "created": "2024-03-13T22:04:00.397239Z", - "modified": "2024-03-13T22:04:00.397239Z", + "id": "relationship--b110b1a9-38f2-4d14-a0a0-42882595aac1", + "created": "2024-08-02T17:12:32.437121Z", + "modified": "2024-08-02T17:12:32.437121Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--77574742-25a0-4375-a2c8-d5b54e1360aa", @@ -10591,9 +11534,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--0b63777c-ca7a-4e5f-840a-78c67f3e155b", - "created": "2024-03-13T22:04:00.397355Z", - "modified": "2024-03-13T22:04:00.397355Z", + "id": "relationship--7f3e3711-680c-4bcd-91c8-0c2867ec084d", + "created": "2024-08-02T17:12:32.437244Z", + "modified": "2024-08-02T17:12:32.437244Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--694bafc2-bd74-40c9-89f2-2ad033f079f4", @@ -10605,9 +11548,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--d32c8077-9ef1-40d4-9534-e3db0eee2480", - "created": "2024-03-13T22:04:00.397471Z", - "modified": "2024-03-13T22:04:00.397471Z", + "id": "relationship--00e32dc0-885f-4d8c-a668-6866f00cb494", + "created": "2024-08-02T17:12:32.437365Z", + "modified": "2024-08-02T17:12:32.437365Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--1d917530-027d-4f82-b380-404c320dc783", @@ -10619,9 +11562,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--5e144eb8-14d8-491b-81dc-aca42039c94d", - "created": "2024-03-13T22:04:00.39759Z", - "modified": "2024-03-13T22:04:00.39759Z", + "id": "relationship--e760da0c-640a-4962-abed-0c416b1e011f", + "created": "2024-08-02T17:12:32.437486Z", + "modified": "2024-08-02T17:12:32.437486Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14", @@ -10633,9 +11576,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--ebc75ecf-ab02-4346-b7ab-79df0cb6fec1", - "created": "2024-03-13T22:04:00.397712Z", - "modified": "2024-03-13T22:04:00.397712Z", + "id": "relationship--231df415-9e93-4fc9-9fc8-757b1d554717", + "created": "2024-08-02T17:12:32.437615Z", + "modified": "2024-08-02T17:12:32.437615Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--a468ff54-27eb-4e6d-b709-a9830017df86", @@ -10647,12 +11590,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--acc1755d-4f5b-45df-84b4-ccd077a1b6e6", - "created": "2024-03-13T22:04:00.397833Z", - "modified": "2024-03-13T22:04:00.397833Z", + "id": "relationship--aee829bb-cb42-44aa-9f8e-e392ee5d480f", + "created": "2024-08-02T17:12:32.437775Z", + "modified": "2024-08-02T17:12:32.437775Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--f3a240cc-d8bd-4e0e-8076-8ca89c09b638", + "source_ref": "attack-pattern--030976e3-fce8-434e-9ea8-a36ee2c0192e", "target_ref": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -10661,12 +11604,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--5d4ecf3f-5424-460c-85e5-fcae4876446c", - "created": "2024-03-13T22:04:00.397984Z", - "modified": "2024-03-13T22:04:00.397984Z", + "id": "relationship--b649a088-85c3-4412-8346-0d5aaad3d5f5", + "created": "2024-08-02T17:12:32.437898Z", + "modified": "2024-08-02T17:12:32.437898Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--ec0442ff-f447-4f22-bd34-9167f50b0fe7", + "source_ref": "attack-pattern--6c001f2c-b143-4d9b-91d7-5a663152cdb5", "target_ref": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -10675,12 +11618,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--2c9fdca5-8ac7-4f10-9362-e945d7a4b2a3", - "created": "2024-03-13T22:04:00.398111Z", - "modified": "2024-03-13T22:04:00.398111Z", + "id": "relationship--f5418e2d-ccfc-4239-9990-ec2cc81c821e", + "created": "2024-08-02T17:12:32.437999Z", + "modified": "2024-08-02T17:12:32.437999Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--4ecb18af-7e16-4eba-b2c3-40d43f737fdf", + "source_ref": "attack-pattern--2b1270a6-d432-453f-88cf-17fa38ec6f40", "target_ref": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -10689,12 +11632,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--f1f589a6-1109-4621-b65e-d6b1b8000420", - "created": "2024-03-13T22:04:00.398231Z", - "modified": "2024-03-13T22:04:00.398231Z", + "id": "relationship--b8a0ed52-ed5b-4f2e-b65d-3ddaed3207be", + "created": "2024-08-02T17:12:32.438227Z", + "modified": "2024-08-02T17:12:32.438227Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--97c51e13-0bcf-45f6-9e8a-6d8e89c8e6f4", + "source_ref": "attack-pattern--d6681707-afcc-4656-91ca-779bc303d944", "target_ref": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -10703,9 +11646,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--808fd738-da9a-4c36-bd52-a82ac594bb5d", - "created": "2024-03-13T22:04:00.39835Z", - "modified": "2024-03-13T22:04:00.39835Z", + "id": "relationship--19f1005a-d61b-411b-bc1e-94ec1835a336", + "created": "2024-08-02T17:12:32.43833Z", + "modified": "2024-08-02T17:12:32.43833Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--9b66eaf5-5b03-46b8-b076-cf1da3593745", @@ -10717,9 +11660,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--69b43d9b-4a8c-427c-adb0-cd026f1fbd12", - "created": "2024-03-13T22:04:00.398485Z", - "modified": "2024-03-13T22:04:00.398485Z", + "id": "relationship--b57a9910-f094-422d-9a22-7d73f00fb93e", + "created": "2024-08-02T17:12:32.438519Z", + "modified": "2024-08-02T17:12:32.438519Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--9ec25bd4-7dcd-4bbf-9e2f-6170af84e166", @@ -10731,9 +11674,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7561514e-3dad-4de7-8d8c-d18c1764ea6e", - "created": "2024-03-13T22:04:00.398625Z", - "modified": "2024-03-13T22:04:00.398625Z", + "id": "relationship--8655812c-900b-44ac-a9a0-d427cd473b34", + "created": "2024-08-02T17:12:32.43875Z", + "modified": "2024-08-02T17:12:32.43875Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1", @@ -10745,9 +11688,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--db73cb1c-c7a9-472b-8dd6-70aee12a5b2a", - "created": "2024-03-13T22:04:00.398749Z", - "modified": "2024-03-13T22:04:00.398749Z", + "id": "relationship--960a15c3-efaa-4105-9041-1cff93d20dbf", + "created": "2024-08-02T17:12:32.438921Z", + "modified": "2024-08-02T17:12:32.438921Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--5a279d23-6ba2-425c-bf72-20c6411ca5a7", @@ -10759,9 +11702,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--45b9d472-2360-4ec9-8752-63c720e4a8cc", - "created": "2024-03-13T22:04:00.398867Z", - "modified": "2024-03-13T22:04:00.398867Z", + "id": "relationship--cafb835c-2756-46f2-8883-196135def28f", + "created": "2024-08-02T17:12:32.439016Z", + "modified": "2024-08-02T17:12:32.439016Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34", @@ -10773,9 +11716,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--620bdd67-9eb5-489d-8897-dcccd7d1a7af", - "created": "2024-03-13T22:04:00.398985Z", - "modified": "2024-03-13T22:04:00.398985Z", + "id": "relationship--7f0d136e-aeeb-4a62-adcc-a64b9033b155", + "created": "2024-08-02T17:12:32.439105Z", + "modified": "2024-08-02T17:12:32.439105Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--c729368d-246a-47eb-8e4b-ab5b0a3510ec", @@ -10787,9 +11730,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--ce7e56bd-7b32-42ae-be25-c4feb687f085", - "created": "2024-03-13T22:04:00.399103Z", - "modified": "2024-03-13T22:04:00.399103Z", + "id": "relationship--77329110-1e86-4d38-a361-15594db7fa7a", + "created": "2024-08-02T17:12:32.439194Z", + "modified": "2024-08-02T17:12:32.439194Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157", @@ -10801,9 +11744,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--62633bfd-2629-4a99-841d-02a16da5c9bd", - "created": "2024-03-13T22:04:00.399222Z", - "modified": "2024-03-13T22:04:00.399222Z", + "id": "relationship--70d5245c-4930-4bfe-b58a-e73776bdd926", + "created": "2024-08-02T17:12:32.439281Z", + "modified": "2024-08-02T17:12:32.439281Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648", @@ -10815,9 +11758,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--72a35683-c0c0-466c-81a0-4bd655f9d5cf", - "created": "2024-03-13T22:04:00.399343Z", - "modified": "2024-03-13T22:04:00.399343Z", + "id": "relationship--eb82cf07-b346-4cb6-9b84-cc8418edbe11", + "created": "2024-08-02T17:12:32.439369Z", + "modified": "2024-08-02T17:12:32.439369Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--8ecbc28c-36e9-4d9a-8578-b9e20552d732", @@ -10829,9 +11772,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--610a90ee-ae8b-47c7-936d-21888d8c49ff", - "created": "2024-03-13T22:04:00.399478Z", - "modified": "2024-03-13T22:04:00.399478Z", + "id": "relationship--6bd2ab8c-5f5e-44f1-9b26-8d698a33de04", + "created": "2024-08-02T17:12:32.43946Z", + "modified": "2024-08-02T17:12:32.43946Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--d13ff5af-16fd-4b32-8e14-f2e0980c15fb", @@ -10843,9 +11786,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--914fe0b0-9d15-481a-9c38-1ee1bc0f290b", - "created": "2024-03-13T22:04:00.399603Z", - "modified": "2024-03-13T22:04:00.399603Z", + "id": "relationship--7b1f0b13-f4d8-4114-a647-fb023aabcd9e", + "created": "2024-08-02T17:12:32.439565Z", + "modified": "2024-08-02T17:12:32.439565Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--625fe1a6-ee9d-45c8-9912-9e9f6e87dc85", @@ -10857,9 +11800,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--32d63ef1-6f92-47fd-bb00-2f6b610dbbc4", - "created": "2024-03-13T22:04:00.399723Z", - "modified": "2024-03-13T22:04:00.399723Z", + "id": "relationship--1bcb57b6-0e8d-4e7a-b455-3cee4a9e366a", + "created": "2024-08-02T17:12:32.439687Z", + "modified": "2024-08-02T17:12:32.439687Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--594993b4-86a3-455b-af59-61f167d7fd93", @@ -10871,9 +11814,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--273c117d-13f7-4818-9ce9-86ae480d45cb", - "created": "2024-03-13T22:04:00.399842Z", - "modified": "2024-03-13T22:04:00.399842Z", + "id": "relationship--884209d0-0fe1-49bb-83bf-85efd7590c50", + "created": "2024-08-02T17:12:32.439788Z", + "modified": "2024-08-02T17:12:32.439788Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--7d69d231-78a6-4a98-a715-c0edd9adafce", @@ -10885,9 +11828,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--df14bf56-b3ae-4a26-a791-5cafd37f8abb", - "created": "2024-03-13T22:04:00.399963Z", - "modified": "2024-03-13T22:04:00.399963Z", + "id": "relationship--5a176546-96f2-4ecf-bc9d-ea243cf76794", + "created": "2024-08-02T17:12:32.439912Z", + "modified": "2024-08-02T17:12:32.439912Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--bb8da71f-108a-4c46-a1ef-d24ef1c8a661", @@ -10899,9 +11842,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--4d3be459-5e69-4942-b3ca-988b8cd34cea", - "created": "2024-03-13T22:04:00.400085Z", - "modified": "2024-03-13T22:04:00.400085Z", + "id": "relationship--e516deeb-46ba-423e-8cc4-9aaf73fcde99", + "created": "2024-08-02T17:12:32.440038Z", + "modified": "2024-08-02T17:12:32.440038Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35", @@ -10913,9 +11856,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--c1028c96-4b70-4066-842a-f8238255ef72", - "created": "2024-03-13T22:04:00.400205Z", - "modified": "2024-03-13T22:04:00.400205Z", + "id": "relationship--5ae50051-9941-497b-8b5b-f02658ee7751", + "created": "2024-08-02T17:12:32.440162Z", + "modified": "2024-08-02T17:12:32.440162Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--a3fe7752-dbfa-4918-912f-c492c8593c68", @@ -10927,9 +11870,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--2bd0f0d6-ef28-4c3d-b345-c1aa5ceaba40", - "created": "2024-03-13T22:04:00.400324Z", - "modified": "2024-03-13T22:04:00.400324Z", + "id": "relationship--c86b532f-a32a-4801-90c4-36421c9ce24a", + "created": "2024-08-02T17:12:32.440286Z", + "modified": "2024-08-02T17:12:32.440286Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--7475b7e6-1095-4ae1-a995-10ab1a6c838a", @@ -10941,9 +11884,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--6e0736be-b54d-45b6-981a-de663f4efb92", - "created": "2024-03-13T22:04:00.400444Z", - "modified": "2024-03-13T22:04:00.400444Z", + "id": "relationship--22858b0c-ab6e-448d-a9cf-d4eebc9d203b", + "created": "2024-08-02T17:12:32.44041Z", + "modified": "2024-08-02T17:12:32.44041Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--e27cf6aa-69bc-434b-ac68-b0164d0b3421", @@ -10955,9 +11898,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--a263c8b0-447d-4fea-bff8-8504c23b11f4", - "created": "2024-03-13T22:04:00.400583Z", - "modified": "2024-03-13T22:04:00.400583Z", + "id": "relationship--57f8fb9d-bf8c-4de6-b4f2-d8d1f6c78378", + "created": "2024-08-02T17:12:32.440532Z", + "modified": "2024-08-02T17:12:32.440532Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03", @@ -10969,9 +11912,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--5192d531-ab3e-4705-8a39-1355924488fe", - "created": "2024-03-13T22:04:00.400703Z", - "modified": "2024-03-13T22:04:00.400703Z", + "id": "relationship--95a3e1ab-3a40-4a0a-9e31-49eecf1aac78", + "created": "2024-08-02T17:12:32.440652Z", + "modified": "2024-08-02T17:12:32.440652Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8", @@ -10983,12 +11926,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--946bb11d-89a4-46a1-9f27-9d97d56d2c8b", - "created": "2024-03-13T22:04:00.400822Z", - "modified": "2024-03-13T22:04:00.400822Z", + "id": "relationship--67d540af-a1e0-40c2-a51b-6af5dbaca337", + "created": "2024-08-02T17:12:32.440862Z", + "modified": "2024-08-02T17:12:32.440862Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--594af720-6df6-4d82-97c5-cf165d5c81db", + "source_ref": "attack-pattern--9f99239e-f22e-4db4-9681-c20e511b4c35", "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -10997,12 +11940,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--f00efa83-4ac3-4895-afd4-4029929db747", - "created": "2024-03-13T22:04:00.400941Z", - "modified": "2024-03-13T22:04:00.400941Z", + "id": "relationship--000f3d69-4afe-49b5-a106-5213a9d63bb7", + "created": "2024-08-02T17:12:32.441053Z", + "modified": "2024-08-02T17:12:32.441053Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--e8571474-253f-4a8f-9087-a2a3e5b187d2", + "source_ref": "attack-pattern--df5189cc-29b5-41d1-a20f-bd641f5946be", "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -11011,12 +11954,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--688583a1-303c-406a-880c-17ebc6791eb9", - "created": "2024-03-13T22:04:00.401059Z", - "modified": "2024-03-13T22:04:00.401059Z", + "id": "relationship--c1c9cca1-06eb-4fd3-9314-15a4d5d545b6", + "created": "2024-08-02T17:12:32.441222Z", + "modified": "2024-08-02T17:12:32.441222Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--a54ce69b-fad5-48ec-a238-4bc3afd1d3e1", + "source_ref": "attack-pattern--269dbccd-0cff-4f60-a0bf-253eba9bcc63", "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -11025,12 +11968,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--4b34a367-0e13-48f1-b78f-7c6cd3c4641f", - "created": "2024-03-13T22:04:00.401178Z", - "modified": "2024-03-13T22:04:00.401178Z", + "id": "relationship--ce3d1864-d8a2-411b-93fa-7586cce39703", + "created": "2024-08-02T17:12:32.441344Z", + "modified": "2024-08-02T17:12:32.441344Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--de28e1be-a5e8-4031-ae6c-cdc570020a1f", + "source_ref": "attack-pattern--0b662d26-ea3d-45d2-87e8-b32296ad9227", "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -11039,9 +11982,23 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--b8ee6edc-2dd4-47db-a0fa-cd394811bee1", - "created": "2024-03-13T22:04:00.401297Z", - "modified": "2024-03-13T22:04:00.401297Z", + "id": "relationship--dc7a3d89-04b4-4d68-9217-ca07321f3cf3", + "created": "2024-08-02T17:12:32.441461Z", + "modified": "2024-08-02T17:12:32.441461Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--1e817a7b-5f96-48d0-a2f9-7ba53c168397", + "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd6621a0-c381-4050-a460-b6e59a2616b5", + "created": "2024-08-02T17:12:32.441586Z", + "modified": "2024-08-02T17:12:32.441586Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--a60b4d87-cca8-4e17-a51c-f9c2af96aef4", @@ -11053,9 +12010,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--b14950ee-3955-4762-91a3-7d6c06b17b62", - "created": "2024-03-13T22:04:00.401416Z", - "modified": "2024-03-13T22:04:00.401416Z", + "id": "relationship--bd1412e1-704b-4803-91f0-5811f3410501", + "created": "2024-08-02T17:12:32.441761Z", + "modified": "2024-08-02T17:12:32.441761Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3", @@ -11067,9 +12024,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--fddd7840-284d-4be3-876a-5a90e48048ee", - "created": "2024-03-13T22:04:00.401564Z", - "modified": "2024-03-13T22:04:00.401564Z", + "id": "relationship--7d00a61b-5c71-4554-9ca6-7b0f3e48dd79", + "created": "2024-08-02T17:12:32.441892Z", + "modified": "2024-08-02T17:12:32.441892Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--e4ad5ad8-f52d-48a0-8fce-33157f885a3e", @@ -11081,9 +12038,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--221f2fe6-3f8f-482a-ae90-e973d58b365c", - "created": "2024-03-13T22:04:00.401686Z", - "modified": "2024-03-13T22:04:00.401686Z", + "id": "relationship--cd3c63ae-f158-4721-92bb-a0f31ddb7d99", + "created": "2024-08-02T17:12:32.442017Z", + "modified": "2024-08-02T17:12:32.442017Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--58b169c1-7e9a-4300-a98f-eb7baee8967f", @@ -11095,9 +12052,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--c0d54dcb-67f1-44a0-bca8-6520901bf0fe", - "created": "2024-03-13T22:04:00.401806Z", - "modified": "2024-03-13T22:04:00.401806Z", + "id": "relationship--8b1fa5aa-9694-4306-8000-5476f9422fdb", + "created": "2024-08-02T17:12:32.44214Z", + "modified": "2024-08-02T17:12:32.44214Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5", @@ -11109,9 +12066,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7584e269-ec45-4b97-baeb-9a7cf8e317c9", - "created": "2024-03-13T22:04:00.401926Z", - "modified": "2024-03-13T22:04:00.401926Z", + "id": "relationship--2d022115-b5d8-4210-8445-c7795cecd15b", + "created": "2024-08-02T17:12:32.442261Z", + "modified": "2024-08-02T17:12:32.442261Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc", @@ -11123,9 +12080,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--767ff8fc-1487-458e-bb6c-4f88445764ef", - "created": "2024-03-13T22:04:00.402079Z", - "modified": "2024-03-13T22:04:00.402079Z", + "id": "relationship--1ee6fbfa-b319-4bd7-9c35-daccb745cfe1", + "created": "2024-08-02T17:12:32.442711Z", + "modified": "2024-08-02T17:12:32.442711Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--e60f54a3-9972-43b8-8359-ee21d781acae", @@ -11137,9 +12094,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--cb80717c-ee55-4e2a-b5f5-1509a8bae1b5", - "created": "2024-03-13T22:04:00.402277Z", - "modified": "2024-03-13T22:04:00.402277Z", + "id": "relationship--8e5361d9-e5f5-4c33-ad3b-c2f328243530", + "created": "2024-08-02T17:12:32.442907Z", + "modified": "2024-08-02T17:12:32.442907Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--779fe6e8-44ee-4f36-ab93-9daa867001d4", @@ -11151,9 +12108,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--d11602e1-6c02-445c-9825-2a3d969821bd", - "created": "2024-03-13T22:04:00.402401Z", - "modified": "2024-03-13T22:04:00.402401Z", + "id": "relationship--5479dcea-be91-4714-8446-46a5ab4a0da9", + "created": "2024-08-02T17:12:32.443274Z", + "modified": "2024-08-02T17:12:32.443274Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--ec8424e6-c7de-4543-b943-f0c4cc9ac63d", @@ -11165,9 +12122,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--847f633d-620e-4218-97fe-241f61a14831", - "created": "2024-03-13T22:04:00.402521Z", - "modified": "2024-03-13T22:04:00.402521Z", + "id": "relationship--51964223-9b30-45fe-935e-56993ca644b5", + "created": "2024-08-02T17:12:32.443461Z", + "modified": "2024-08-02T17:12:32.443461Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea", @@ -11179,9 +12136,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7faf49e9-55c9-45f6-995f-808a12185bd2", - "created": "2024-03-13T22:04:00.402642Z", - "modified": "2024-03-13T22:04:00.402642Z", + "id": "relationship--514b9655-3393-4d9a-ba7f-661845a7a3e2", + "created": "2024-08-02T17:12:32.443738Z", + "modified": "2024-08-02T17:12:32.443738Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1", @@ -11193,9 +12150,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--42dc78c2-c045-41ae-b910-81e52727e696", - "created": "2024-03-13T22:04:00.40276Z", - "modified": "2024-03-13T22:04:00.40276Z", + "id": "relationship--bff67d5f-8327-40b0-b9f7-ffeb62282955", + "created": "2024-08-02T17:12:32.443953Z", + "modified": "2024-08-02T17:12:32.443953Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--db93e285-c516-40b0-bb5a-36bbaf5c08b9", @@ -11207,9 +12164,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--c92a7284-5225-4f60-9796-57077f1040c1", - "created": "2024-03-13T22:04:00.402855Z", - "modified": "2024-03-13T22:04:00.402855Z", + "id": "relationship--823e237c-e8c4-450f-9cbf-df9bdd0acb92", + "created": "2024-08-02T17:12:32.444301Z", + "modified": "2024-08-02T17:12:32.444301Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--b2695cde-5f12-4e6a-b55a-e31220cb4bd7", @@ -11221,9 +12178,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--8285c356-b0a0-43cc-be1d-301c16d34a12", - "created": "2024-03-13T22:04:00.402941Z", - "modified": "2024-03-13T22:04:00.402941Z", + "id": "relationship--8fc9a902-7851-4ba0-88b8-7702912660f0", + "created": "2024-08-02T17:12:32.44447Z", + "modified": "2024-08-02T17:12:32.44447Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--81abb4fa-705e-430f-ba54-34bf7bd467f7", @@ -11235,9 +12192,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--0521e979-03f0-4bed-b74b-14a086cdd60f", - "created": "2024-03-13T22:04:00.403042Z", - "modified": "2024-03-13T22:04:00.403042Z", + "id": "relationship--7d7ef4ca-2567-48ff-ba3a-43cae1860a5e", + "created": "2024-08-02T17:12:32.444677Z", + "modified": "2024-08-02T17:12:32.444677Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99", @@ -11249,9 +12206,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--265ba647-b94e-4099-8b9f-de75ffa6018a", - "created": "2024-03-13T22:04:00.403132Z", - "modified": "2024-03-13T22:04:00.403132Z", + "id": "relationship--78552f8c-0fca-4561-a189-f9d643315fec", + "created": "2024-08-02T17:12:32.444844Z", + "modified": "2024-08-02T17:12:32.444844Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--fe5cf0f2-3792-4cab-b546-a9af7a5aa319", @@ -11263,9 +12220,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--3ce3e8ce-0f72-448f-a7de-e45e8cade97b", - "created": "2024-03-13T22:04:00.403254Z", - "modified": "2024-03-13T22:04:00.403254Z", + "id": "relationship--a51bafef-e93f-46ce-b9ab-7175f4147e51", + "created": "2024-08-02T17:12:32.445087Z", + "modified": "2024-08-02T17:12:32.445087Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--ef3dcdcd-bd97-48e0-9d15-3e482a72c979", @@ -11277,9 +12234,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--64810766-cf52-49b0-b068-f44789dbce61", - "created": "2024-03-13T22:04:00.403373Z", - "modified": "2024-03-13T22:04:00.403373Z", + "id": "relationship--b9b299a0-c628-4a4d-8efc-80c0d08e18df", + "created": "2024-08-02T17:12:32.445287Z", + "modified": "2024-08-02T17:12:32.445287Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d", @@ -11291,9 +12248,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--05bce465-21d7-42e0-9115-e68797d00386", - "created": "2024-03-13T22:04:00.403495Z", - "modified": "2024-03-13T22:04:00.403495Z", + "id": "relationship--a77fdd52-addf-40c0-bcba-32a8d5c35123", + "created": "2024-08-02T17:12:32.445516Z", + "modified": "2024-08-02T17:12:32.445516Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9", @@ -11305,9 +12262,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--57e47bf5-4e67-4949-8cfa-3bc29231170c", - "created": "2024-03-13T22:04:00.403616Z", - "modified": "2024-03-13T22:04:00.403616Z", + "id": "relationship--cc0fe0d0-f80a-4bb6-b6da-07ce5a75f25d", + "created": "2024-08-02T17:12:32.445702Z", + "modified": "2024-08-02T17:12:32.445702Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--abb6518d-50fe-4428-9bca-a6e3c6ed4de4", @@ -11319,9 +12276,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--2df391c3-66d1-455e-a8ae-46b5f35bcead", - "created": "2024-03-13T22:04:00.403735Z", - "modified": "2024-03-13T22:04:00.403735Z", + "id": "relationship--8d7269a0-a864-4c37-8276-29397febfe34", + "created": "2024-08-02T17:12:32.445902Z", + "modified": "2024-08-02T17:12:32.445902Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--d522f417-ba0e-4e2d-ae96-df2c1fd607e6", @@ -11333,9 +12290,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7ba2bb89-f601-4e2d-9c39-895843a41d2b", - "created": "2024-03-13T22:04:00.403853Z", - "modified": "2024-03-13T22:04:00.403853Z", + "id": "relationship--c0666d0c-46d6-465a-a083-ff6617e48f5b", + "created": "2024-08-02T17:12:32.446282Z", + "modified": "2024-08-02T17:12:32.446282Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--c7017017-4965-4dad-a970-e748b7080a19", @@ -11347,9 +12304,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--41510779-513f-4a91-87d1-f8afe45e4b22", - "created": "2024-03-13T22:04:00.40399Z", - "modified": "2024-03-13T22:04:00.40399Z", + "id": "relationship--cb870a35-17b3-4b0a-9887-cc4c6b5630a8", + "created": "2024-08-02T17:12:32.446467Z", + "modified": "2024-08-02T17:12:32.446467Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc", @@ -11361,9 +12318,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--e45e77ef-316c-40d3-a563-abef80dfaecc", - "created": "2024-03-13T22:04:00.404171Z", - "modified": "2024-03-13T22:04:00.404171Z", + "id": "relationship--ac091cb4-0da7-4b12-b875-f488edd6de42", + "created": "2024-08-02T17:12:32.446637Z", + "modified": "2024-08-02T17:12:32.446637Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--8f545c7e-f2ba-4541-9004-dbe50fcc0b0f", @@ -11375,9 +12332,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--60ef4606-b5ec-40ae-a863-382de000838b", - "created": "2024-03-13T22:04:00.404301Z", - "modified": "2024-03-13T22:04:00.404301Z", + "id": "relationship--d034e341-e394-414a-86ad-2650e26d71b5", + "created": "2024-08-02T17:12:32.446869Z", + "modified": "2024-08-02T17:12:32.446869Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85", @@ -11389,9 +12346,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--d265cda4-3bfe-4fe7-b864-cb5d938022fb", - "created": "2024-03-13T22:04:00.404418Z", - "modified": "2024-03-13T22:04:00.404418Z", + "id": "relationship--e2f0bfc5-31af-4db5-8634-49b399001df3", + "created": "2024-08-02T17:12:32.447088Z", + "modified": "2024-08-02T17:12:32.447088Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--64bcccb9-4d10-4eed-8c49-8816ecfd78a3", @@ -11403,12 +12360,12 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--15ef89f7-c2d8-4441-8746-5052e0e291f8", - "created": "2024-03-13T22:04:00.404507Z", - "modified": "2024-03-13T22:04:00.404507Z", + "id": "relationship--10d37af7-07f7-452b-b401-123c2a2abedc", + "created": "2024-08-02T17:12:32.447271Z", + "modified": "2024-08-02T17:12:32.447271Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--8f3f1d6f-beda-4f20-b1a7-2d087ae453f7", + "source_ref": "attack-pattern--39f767f7-bc22-4611-8a39-3584c5bbdd5a", "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" @@ -11417,9 +12374,303 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--309b2bf2-73fe-45d7-bd75-c7f1bdc85df8", - "created": "2024-03-13T22:04:00.404594Z", - "modified": "2024-03-13T22:04:00.404594Z", + "id": "relationship--ac8acbb9-b6dd-4c5c-a4a1-df3d39c3dd7a", + "created": "2024-08-02T17:12:32.447521Z", + "modified": "2024-08-02T17:12:32.447521Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a62e0c69-0c29-4c71-a326-1a7c3e19b74d", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91885846-54dc-4165-8db9-1075a1f8813c", + "created": "2024-08-02T17:12:32.447705Z", + "modified": "2024-08-02T17:12:32.447705Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--930ddf1d-7dc9-4fb2-9f5c-be928d2eb909", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c9cb5c30-9fbc-496f-b1a7-97d96d771d25", + "created": "2024-08-02T17:12:32.44789Z", + "modified": "2024-08-02T17:12:32.44789Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--001e2693-c7a6-4615-b06a-90ae22d7b353", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5ea0820e-aa71-42f7-8b18-7c6aa56e32be", + "created": "2024-08-02T17:12:32.448161Z", + "modified": "2024-08-02T17:12:32.448161Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--976faac5-b7e1-4a1d-b52f-4878109e2dc9", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3ba0ee9-0af5-4246-a9f1-e4fb89563970", + "created": "2024-08-02T17:12:32.448345Z", + "modified": "2024-08-02T17:12:32.448345Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--dde28850-4198-4223-81b5-ff9b30b4e04f", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--11cbd45e-c9e7-4338-b95b-657edd1afedf", + "created": "2024-08-02T17:12:32.448548Z", + "modified": "2024-08-02T17:12:32.448548Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d3e83913-e2d5-4dad-b917-2363100c6ca0", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--68c1601b-19f0-479f-a455-4c1835c7b207", + "created": "2024-08-02T17:12:32.448775Z", + "modified": "2024-08-02T17:12:32.448775Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e4ea9ed6-b158-4cdc-95c2-749383d2a388", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80212476-013a-4bd5-be66-d2773a78d0db", + "created": "2024-08-02T17:12:32.448947Z", + "modified": "2024-08-02T17:12:32.448947Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d9381123-f2ef-419a-b895-8f2147e26b15", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f3da117f-ba2b-49e0-a404-dfb3df33ce9e", + "created": "2024-08-02T17:12:32.449188Z", + "modified": "2024-08-02T17:12:32.449188Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--6270bd3c-efcf-4778-8512-065abffe9a88", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6418791d-7823-4b45-ae87-4c2991b9993e", + "created": "2024-08-02T17:12:32.449333Z", + "modified": "2024-08-02T17:12:32.449333Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--fa4e9051-46d7-45b4-a65b-9376b003ad2a", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8fb75375-1525-44ae-a06d-c011583c76d1", + "created": "2024-08-02T17:12:32.44944Z", + "modified": "2024-08-02T17:12:32.44944Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e41b04e4-b8c2-4f66-93d7-c148f3378008", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--366c2e49-0ddb-4dc8-92fc-8eae364df624", + "created": "2024-08-02T17:12:32.449588Z", + "modified": "2024-08-02T17:12:32.449588Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--66e1a3b9-d837-4eaa-9cdf-900663a8708d", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6724659f-25b2-4eba-85fc-7bdf9629cbe4", + "created": "2024-08-02T17:12:32.449773Z", + "modified": "2024-08-02T17:12:32.449773Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--63ed1a5a-835e-4a51-9b95-0f0525a95186", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--583e9ab6-d417-41dd-874e-9f7ba16d990d", + "created": "2024-08-02T17:12:32.449979Z", + "modified": "2024-08-02T17:12:32.449979Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a5ef7a55-8c38-4210-ad39-ccb22c9dd70c", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--72abdeaa-c07b-409e-95d0-59de32dbb194", + "created": "2024-08-02T17:12:32.450166Z", + "modified": "2024-08-02T17:12:32.450166Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--72268aef-baf4-4606-a3ba-837950a54f52", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--089a31c6-accd-409b-b4c3-0eb30911d163", + "created": "2024-08-02T17:12:32.450348Z", + "modified": "2024-08-02T17:12:32.450348Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--97ba7c89-f5d0-49a4-a661-f8317b44cf20", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d40ca135-7884-4d87-8ff1-68fe96bc8fe6", + "created": "2024-08-02T17:12:32.450685Z", + "modified": "2024-08-02T17:12:32.450685Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--15ca8e62-e179-4dd8-9f5e-427771e915a3", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85ed9ef9-dcf9-4f82-9243-c83d6ae5050b", + "created": "2024-08-02T17:12:32.450836Z", + "modified": "2024-08-02T17:12:32.450836Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--faa5450d-6d1f-4700-93bd-fd2d59a79e60", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1926a20f-29a4-4440-9f6f-7e08c9b9b57d", + "created": "2024-08-02T17:12:32.450944Z", + "modified": "2024-08-02T17:12:32.450944Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7e812f7d-f8a5-4636-b354-3d93561eda49", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f60ad1a-a99c-4fb5-b01a-81338c4b25af", + "created": "2024-08-02T17:12:32.451169Z", + "modified": "2024-08-02T17:12:32.451169Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--f99e6f94-8c7d-42d7-8343-8d959643f721", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4180b276-b34f-4965-b31d-56a3e7f77a94", + "created": "2024-08-02T17:12:32.451376Z", + "modified": "2024-08-02T17:12:32.451376Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--422b6ba9-3ad0-4e6f-9f00-b044e5d657a1", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4d311002-0910-4439-85a0-fe9d68b8f340", + "created": "2024-08-02T17:12:32.451602Z", + "modified": "2024-08-02T17:12:32.451602Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea", @@ -11431,9 +12682,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--3d314ee8-b2ca-4903-abef-48cd7c3083ac", - "created": "2024-03-13T22:04:00.404683Z", - "modified": "2024-03-13T22:04:00.404683Z", + "id": "relationship--c32ce954-9aae-48a5-abee-e0b8acec8fd2", + "created": "2024-08-02T17:12:32.451856Z", + "modified": "2024-08-02T17:12:32.451856Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321", @@ -11445,79 +12696,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--5677fde1-9e5e-4e0c-af11-2198043aba88", - "created": "2024-03-13T22:04:00.404771Z", - "modified": "2024-03-13T22:04:00.404771Z", - "relationship_type": "subtechnique-of", - "description": "", - "source_ref": "attack-pattern--9b3efc53-3a9e-45e7-8a26-dd2c4a305fd2", - "target_ref": "attack-pattern--3ae4fb28-4864-468d-8085-cb8035cbb272", - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ] - }, - { - "type": "relationship", - "spec_version": "2.1", - "id": "relationship--9a33280d-1cac-4735-a74f-3d8887e4d7a5", - "created": "2024-03-13T22:04:00.404857Z", - "modified": "2024-03-13T22:04:00.404857Z", - "relationship_type": "subtechnique-of", - "description": "", - "source_ref": "attack-pattern--4e7d967e-4b48-49a6-b54a-4555a98a2473", - "target_ref": "attack-pattern--3ae4fb28-4864-468d-8085-cb8035cbb272", - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ] - }, - { - "type": "relationship", - "spec_version": "2.1", - "id": "relationship--3a81b9ef-e3c3-40a8-b2b4-53586df421dd", - "created": "2024-03-13T22:04:00.404963Z", - "modified": "2024-03-13T22:04:00.404963Z", - "relationship_type": "subtechnique-of", - "description": "", - "source_ref": "attack-pattern--17fe025d-9876-4c14-8ac9-ea0de1ef26c7", - "target_ref": "attack-pattern--3ae4fb28-4864-468d-8085-cb8035cbb272", - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ] - }, - { - "type": "relationship", - "spec_version": "2.1", - "id": "relationship--142b5bb0-dde4-4539-87ab-9f3ba7acf9ff", - "created": "2024-03-13T22:04:00.405106Z", - "modified": "2024-03-13T22:04:00.405106Z", - "relationship_type": "subtechnique-of", - "description": "", - "source_ref": "attack-pattern--8da4166c-99f6-4dd9-ab94-c61450d2be63", - "target_ref": "attack-pattern--3ae4fb28-4864-468d-8085-cb8035cbb272", - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ] - }, - { - "type": "relationship", - "spec_version": "2.1", - "id": "relationship--492b0591-4fef-469c-bd15-0f4dcf251efe", - "created": "2024-03-13T22:04:00.405226Z", - "modified": "2024-03-13T22:04:00.405226Z", - "relationship_type": "subtechnique-of", - "description": "", - "source_ref": "attack-pattern--6147c1f4-4cb8-4edd-a875-aaf8e9d39fbd", - "target_ref": "attack-pattern--3ae4fb28-4864-468d-8085-cb8035cbb272", - "object_marking_refs": [ - "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" - ] - }, - { - "type": "relationship", - "spec_version": "2.1", - "id": "relationship--e23794a4-ab22-4b5b-a4f3-011631e9f558", - "created": "2024-03-13T22:04:00.405346Z", - "modified": "2024-03-13T22:04:00.405346Z", + "id": "relationship--31b07b2b-114a-4b48-b01e-cb434788ca3d", + "created": "2024-08-02T17:12:32.452117Z", + "modified": "2024-08-02T17:12:32.452117Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--a50d7269-9365-46f0-ba81-27964e422faa", @@ -11529,9 +12710,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--02adc689-8417-4500-b0ac-7fe8865beb1e", - "created": "2024-03-13T22:04:00.405468Z", - "modified": "2024-03-13T22:04:00.405468Z", + "id": "relationship--81089a7f-ff64-48c5-b767-40c6bb4b6546", + "created": "2024-08-02T17:12:32.452404Z", + "modified": "2024-08-02T17:12:32.452404Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--b43dbee2-e1e2-40e5-bea1-45630d55d30b", @@ -11543,9 +12724,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--ccd93902-2d8c-4f4f-aacf-8331ddc42f47", - "created": "2024-03-13T22:04:00.405776Z", - "modified": "2024-03-13T22:04:00.405776Z", + "id": "relationship--460f1b43-0951-44fb-8735-e6e68d3c14ac", + "created": "2024-08-02T17:12:32.452605Z", + "modified": "2024-08-02T17:12:32.452605Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2", @@ -11557,9 +12738,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--77c2ff95-6a5d-41b4-b4de-c42aa35b3b72", - "created": "2024-03-13T22:04:00.405924Z", - "modified": "2024-03-13T22:04:00.405924Z", + "id": "relationship--e01612ea-0cb3-40ce-8216-01a60f02d64f", + "created": "2024-08-02T17:12:32.452817Z", + "modified": "2024-08-02T17:12:32.452817Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72", @@ -11571,9 +12752,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--27be5b09-3a2f-4b35-962e-0d7047495086", - "created": "2024-03-13T22:04:00.406051Z", - "modified": "2024-03-13T22:04:00.406051Z", + "id": "relationship--3fe97582-50f0-46d0-82e9-2599faef18f9", + "created": "2024-08-02T17:12:32.452951Z", + "modified": "2024-08-02T17:12:32.452951Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--bb25b4aa-9223-40ea-a28a-0dd675e91e46", @@ -11585,9 +12766,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--993a7455-eab0-41e7-9de0-dee2aee79709", - "created": "2024-03-13T22:04:00.406171Z", - "modified": "2024-03-13T22:04:00.406171Z", + "id": "relationship--c2f7cc4a-df2a-4fec-b02a-8fdcec401e35", + "created": "2024-08-02T17:12:32.453174Z", + "modified": "2024-08-02T17:12:32.453174Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c", @@ -11599,9 +12780,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--79e7f910-f819-4f25-b2b0-4d386d285f8b", - "created": "2024-03-13T22:04:00.40626Z", - "modified": "2024-03-13T22:04:00.40626Z", + "id": "relationship--025bccc9-30f8-4125-b84e-648df58b3b13", + "created": "2024-08-02T17:12:32.453417Z", + "modified": "2024-08-02T17:12:32.453417Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99", @@ -11613,9 +12794,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--40974bcb-90f4-4f5b-9de1-11884cee4070", - "created": "2024-03-13T22:04:00.406348Z", - "modified": "2024-03-13T22:04:00.406348Z", + "id": "relationship--d3501734-2bd1-4f32-be44-f515e3c9d4a0", + "created": "2024-08-02T17:12:32.453664Z", + "modified": "2024-08-02T17:12:32.453664Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--6d75e3ac-e923-4815-8e9b-3e6af9e1baa0", @@ -11627,9 +12808,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7f930e1a-3ee2-40d5-b559-6148fcda4255", - "created": "2024-03-13T22:04:00.406436Z", - "modified": "2024-03-13T22:04:00.406436Z", + "id": "relationship--f33e7ae8-015a-4989-a252-b6854c715d2e", + "created": "2024-08-02T17:12:32.453868Z", + "modified": "2024-08-02T17:12:32.453868Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271", @@ -11641,9 +12822,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--fbf0aca3-ef66-43ad-b03b-990bb65a6167", - "created": "2024-03-13T22:04:00.406523Z", - "modified": "2024-03-13T22:04:00.406523Z", + "id": "relationship--4717c1e4-c6f6-426b-8d4b-38cb5f03b47c", + "created": "2024-08-02T17:12:32.45405Z", + "modified": "2024-08-02T17:12:32.45405Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--7f338181-2e4b-435b-a190-7044f3867aa3", @@ -11655,9 +12836,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--84342ee8-b232-429a-b2b4-e9605f1f069d", - "created": "2024-03-13T22:04:00.40661Z", - "modified": "2024-03-13T22:04:00.40661Z", + "id": "relationship--372e3ddd-2c5f-42b1-9440-516e4f6ef017", + "created": "2024-08-02T17:12:32.454346Z", + "modified": "2024-08-02T17:12:32.454346Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403", @@ -11669,9 +12850,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--59023943-ea00-479c-8d46-e386d52fe6e8", - "created": "2024-03-13T22:04:00.406696Z", - "modified": "2024-03-13T22:04:00.406696Z", + "id": "relationship--9552c157-4d4a-483b-b81c-7a7837445ceb", + "created": "2024-08-02T17:12:32.454519Z", + "modified": "2024-08-02T17:12:32.454519Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--a24e779c-0f44-493b-862d-00693bf34ca4", @@ -11683,9 +12864,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--83113c5e-1b9a-4a1f-9027-67081c7a6491", - "created": "2024-03-13T22:04:00.406781Z", - "modified": "2024-03-13T22:04:00.406781Z", + "id": "relationship--bdc6b769-1e8b-4c6d-aa34-f91fac8a0c9c", + "created": "2024-08-02T17:12:32.454653Z", + "modified": "2024-08-02T17:12:32.454653Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--62036130-6083-43e3-b1e0-8ab0822bedda", @@ -11697,9 +12878,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--e784c38b-1477-453d-b405-eaf9f201469e", - "created": "2024-03-13T22:04:00.406868Z", - "modified": "2024-03-13T22:04:00.406868Z", + "id": "relationship--a0a2647d-69ee-4a43-8c90-588668c44d4c", + "created": "2024-08-02T17:12:32.454863Z", + "modified": "2024-08-02T17:12:32.454863Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12", @@ -11711,9 +12892,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--2863caab-7152-45b0-be43-ae6ec0c034b9", - "created": "2024-03-13T22:04:00.406955Z", - "modified": "2024-03-13T22:04:00.406955Z", + "id": "relationship--1086eb5d-f95a-460e-99f0-add25b544883", + "created": "2024-08-02T17:12:32.455029Z", + "modified": "2024-08-02T17:12:32.455029Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--78ff99d8-dce8-4f4e-9dc2-3f37f154a39d", @@ -11725,9 +12906,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--4e423b83-76cd-4863-a925-f185a278987d", - "created": "2024-03-13T22:04:00.407048Z", - "modified": "2024-03-13T22:04:00.407048Z", + "id": "relationship--34431358-ede6-4604-9d1f-324127534cea", + "created": "2024-08-02T17:12:32.455178Z", + "modified": "2024-08-02T17:12:32.455178Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8", @@ -11739,9 +12920,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--05a99c36-e0a4-432b-b331-2c525c48c2b2", - "created": "2024-03-13T22:04:00.407161Z", - "modified": "2024-03-13T22:04:00.407161Z", + "id": "relationship--d63fa14a-19c8-4c63-ac69-3198d8eb31c3", + "created": "2024-08-02T17:12:32.455293Z", + "modified": "2024-08-02T17:12:32.455293Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--c26749da-f15d-48d7-ac1f-e2a2a49b9930", @@ -11753,9 +12934,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--e18dc4f0-8905-4261-976e-46bbc4eefbb1", - "created": "2024-03-13T22:04:00.407259Z", - "modified": "2024-03-13T22:04:00.407259Z", + "id": "relationship--9ef09fc6-903b-4b14-ab94-ad2dd6d3859b", + "created": "2024-08-02T17:12:32.455394Z", + "modified": "2024-08-02T17:12:32.455394Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--8432d382-0ce8-4507-97ea-95be10de3488", @@ -11767,9 +12948,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--5d50b073-0698-4419-881f-ef4d03966346", - "created": "2024-03-13T22:04:00.407357Z", - "modified": "2024-03-13T22:04:00.407357Z", + "id": "relationship--91305c8c-f82d-4809-9820-0348eeccd3c5", + "created": "2024-08-02T17:12:32.455546Z", + "modified": "2024-08-02T17:12:32.455546Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--db9eafc0-261b-48d0-97a2-1c92dcb4026a", @@ -11781,9 +12962,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7426e230-8ec3-43d5-883c-2182473b5ca3", - "created": "2024-03-13T22:04:00.407454Z", - "modified": "2024-03-13T22:04:00.407454Z", + "id": "relationship--4f1c76d7-af06-4408-aa06-f50dfd5c0ea6", + "created": "2024-08-02T17:12:32.455657Z", + "modified": "2024-08-02T17:12:32.455657Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--eb66afed-6c29-4947-a422-c380c5caeda5", @@ -11795,9 +12976,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--54084ae3-48bc-4087-ba53-a7a40824cc84", - "created": "2024-03-13T22:04:00.40755Z", - "modified": "2024-03-13T22:04:00.40755Z", + "id": "relationship--bdc05aaf-02e4-49b0-b230-fe2d536997bb", + "created": "2024-08-02T17:12:32.455765Z", + "modified": "2024-08-02T17:12:32.455765Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5", @@ -11809,9 +12990,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--bbad9148-abe6-494e-af53-c90f7e0de807", - "created": "2024-03-13T22:04:00.407646Z", - "modified": "2024-03-13T22:04:00.407646Z", + "id": "relationship--975fd38a-3395-464d-a9b7-7c8c3ea17dab", + "created": "2024-08-02T17:12:32.455936Z", + "modified": "2024-08-02T17:12:32.455936Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca", @@ -11823,9 +13004,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--6fc15b19-a6d2-4065-beed-a6eb9cfe6861", - "created": "2024-03-13T22:04:00.407741Z", - "modified": "2024-03-13T22:04:00.407741Z", + "id": "relationship--8fadc280-2bf2-48f1-9ae0-2c873d5cf085", + "created": "2024-08-02T17:12:32.456046Z", + "modified": "2024-08-02T17:12:32.456046Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--8f83d6b8-01f4-406c-a3da-48a040e46139", @@ -11837,9 +13018,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--5cc19b11-b2fb-4cb6-a2fb-0f07c0d29bec", - "created": "2024-03-13T22:04:00.407836Z", - "modified": "2024-03-13T22:04:00.407836Z", + "id": "relationship--1a1a95f4-12ec-4fb3-9847-04154050c820", + "created": "2024-08-02T17:12:32.456153Z", + "modified": "2024-08-02T17:12:32.456153Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--9a5261b8-5051-47ed-a4f6-bdbb7b6edcb4", @@ -11851,9 +13032,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--43e3c9b6-8088-4976-a93b-f534821eb8cb", - "created": "2024-03-13T22:04:00.407922Z", - "modified": "2024-03-13T22:04:00.407922Z", + "id": "relationship--a0bc46c3-b1f7-4de0-8d41-ad6c626ae84d", + "created": "2024-08-02T17:12:32.456254Z", + "modified": "2024-08-02T17:12:32.456254Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--fb6f8352-c368-49a3-b7d4-f1ee5a3fb370", @@ -11865,9 +13046,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--4d8dda39-68d4-4dea-8914-2a647caa943a", - "created": "2024-03-13T22:04:00.408007Z", - "modified": "2024-03-13T22:04:00.408007Z", + "id": "relationship--91941499-9520-4168-bbc7-c39c6084c06b", + "created": "2024-08-02T17:12:32.456354Z", + "modified": "2024-08-02T17:12:32.456354Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--5daa2f8a-2460-4cdd-ae55-b70f439a9f51", @@ -11879,9 +13060,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--670f68f6-4d05-408a-87f7-96b578fc6410", - "created": "2024-03-13T22:04:00.40811Z", - "modified": "2024-03-13T22:04:00.40811Z", + "id": "relationship--ab6e26e2-eb6f-4f30-a37e-715d8d39a26e", + "created": "2024-08-02T17:12:32.456677Z", + "modified": "2024-08-02T17:12:32.456677Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1", @@ -11893,9 +13074,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--b7ac806f-cd78-4207-bbbb-87dcb5f635b8", - "created": "2024-03-13T22:04:00.408222Z", - "modified": "2024-03-13T22:04:00.408222Z", + "id": "relationship--81d0f43c-a1eb-4af0-a8a0-66cd1c6f1d3f", + "created": "2024-08-02T17:12:32.457526Z", + "modified": "2024-08-02T17:12:32.457526Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944", @@ -11907,9 +13088,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--8e48dc96-5be3-4ce1-9fee-fa50734c36a2", - "created": "2024-03-13T22:04:00.408327Z", - "modified": "2024-03-13T22:04:00.408327Z", + "id": "relationship--60337241-9131-42f0-a515-dc6bd082a52a", + "created": "2024-08-02T17:12:32.45812Z", + "modified": "2024-08-02T17:12:32.45812Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe", @@ -11921,9 +13102,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--8aeb1b00-af60-4d91-9401-72dd881ea3b6", - "created": "2024-03-13T22:04:00.408436Z", - "modified": "2024-03-13T22:04:00.408436Z", + "id": "relationship--a3b0c1b3-71fd-4b8c-b275-80bdaea6ad92", + "created": "2024-08-02T17:12:32.458996Z", + "modified": "2024-08-02T17:12:32.458996Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9", @@ -11935,9 +13116,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--426542ba-bc2e-4cd7-bf1b-ab9d248d9084", - "created": "2024-03-13T22:04:00.408545Z", - "modified": "2024-03-13T22:04:00.408545Z", + "id": "relationship--c4a912f8-840d-4232-a584-d2e577bf66d6", + "created": "2024-08-02T17:12:32.459171Z", + "modified": "2024-08-02T17:12:32.459171Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--5bbea132-9da6-42f7-93e9-71f0a9cf311d", @@ -11949,9 +13130,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--57c77249-1ae1-475e-aef2-394dce51247e", - "created": "2024-03-13T22:04:00.408664Z", - "modified": "2024-03-13T22:04:00.408664Z", + "id": "relationship--29bd0f63-fc52-4e9a-a40f-b1e2dd529372", + "created": "2024-08-02T17:12:32.459327Z", + "modified": "2024-08-02T17:12:32.459327Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--ddc4a9e6-a371-4f16-91b6-c71139a154ce", @@ -11963,9 +13144,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--a1534efb-9739-4d22-a982-dffe2775720b", - "created": "2024-03-13T22:04:00.408779Z", - "modified": "2024-03-13T22:04:00.408779Z", + "id": "relationship--42839b24-556c-4f42-a29c-2a52f5938b5e", + "created": "2024-08-02T17:12:32.459557Z", + "modified": "2024-08-02T17:12:32.459557Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--89b88c22-0686-4d28-9c2b-e0c6ac31a4ab", @@ -11977,9 +13158,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--4f2fef97-afa1-4ba1-ae3c-aa9998013a0a", - "created": "2024-03-13T22:04:00.408878Z", - "modified": "2024-03-13T22:04:00.408878Z", + "id": "relationship--156fb6c1-bbeb-4d79-8e53-b1a0504b826b", + "created": "2024-08-02T17:12:32.45979Z", + "modified": "2024-08-02T17:12:32.45979Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--d65af8b6-91ce-490e-8978-014ff995a2ac", @@ -11991,9 +13172,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--01c976e1-b473-4a35-a8b0-5870ee47484b", - "created": "2024-03-13T22:04:00.408978Z", - "modified": "2024-03-13T22:04:00.408978Z", + "id": "relationship--503103ed-f83c-4b98-a260-270085e23f89", + "created": "2024-08-02T17:12:32.459926Z", + "modified": "2024-08-02T17:12:32.459926Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--9b667c6e-5bc3-4c1e-b114-6f679a662b5d", @@ -12005,9 +13186,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--1d61ef73-5f94-43fa-8197-0982fa503d51", - "created": "2024-03-13T22:04:00.409081Z", - "modified": "2024-03-13T22:04:00.409081Z", + "id": "relationship--3829da40-4cbf-49eb-8917-8b43bcb536c9", + "created": "2024-08-02T17:12:32.460029Z", + "modified": "2024-08-02T17:12:32.460029Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5", @@ -12019,9 +13200,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--99bd78c9-9983-4d03-8f9e-ca7ed53a15dd", - "created": "2024-03-13T22:04:00.409215Z", - "modified": "2024-03-13T22:04:00.409215Z", + "id": "relationship--26ec708c-aa87-4b21-b26b-717a07144c82", + "created": "2024-08-02T17:12:32.46013Z", + "modified": "2024-08-02T17:12:32.46013Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291", @@ -12033,9 +13214,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--872c162b-0e2e-4b38-9d63-5aea5c740dae", - "created": "2024-03-13T22:04:00.409319Z", - "modified": "2024-03-13T22:04:00.409319Z", + "id": "relationship--feaac006-8456-4170-a49d-8c614a0d97e2", + "created": "2024-08-02T17:12:32.460231Z", + "modified": "2024-08-02T17:12:32.460231Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--c31542d3-d9c4-4fe4-ac5d-47632225a425", @@ -12047,9 +13228,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--67d7aa1e-e795-4a6d-9128-6223545b1395", - "created": "2024-03-13T22:04:00.409435Z", - "modified": "2024-03-13T22:04:00.409435Z", + "id": "relationship--2231f705-2c4c-4593-9401-e05c124df454", + "created": "2024-08-02T17:12:32.460362Z", + "modified": "2024-08-02T17:12:32.460362Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--651a5188-f38a-42be-a253-d1b90cbd28e1", @@ -12061,9 +13242,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--a27aabd5-383c-4428-bd8e-eb0f947a285f", - "created": "2024-03-13T22:04:00.40955Z", - "modified": "2024-03-13T22:04:00.40955Z", + "id": "relationship--d6140e04-b5d2-4627-a59c-13bdda3f4d19", + "created": "2024-08-02T17:12:32.460484Z", + "modified": "2024-08-02T17:12:32.460484Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--d615efdc-7296-4254-90f5-99d2986d97fa", @@ -12075,9 +13256,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--06b8b6a0-0c75-4dd1-9afb-5dc66386f69f", - "created": "2024-03-13T22:04:00.409777Z", - "modified": "2024-03-13T22:04:00.409777Z", + "id": "relationship--89905450-65c8-4239-a28f-0f09c01fa399", + "created": "2024-08-02T17:12:32.460588Z", + "modified": "2024-08-02T17:12:32.460588Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4", @@ -12089,9 +13270,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--4d80a029-b42b-4f91-97be-d666c000b5af", - "created": "2024-03-13T22:04:00.409899Z", - "modified": "2024-03-13T22:04:00.409899Z", + "id": "relationship--9d12512b-e964-4da6-bbd3-e431e77763dd", + "created": "2024-08-02T17:12:32.460689Z", + "modified": "2024-08-02T17:12:32.460689Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1", @@ -12103,9 +13284,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--5452600f-5fcd-472b-a875-b34c325f500e", - "created": "2024-03-13T22:04:00.410014Z", - "modified": "2024-03-13T22:04:00.410014Z", + "id": "relationship--8078fe4a-f9d6-45df-984f-aa5f305e0cee", + "created": "2024-08-02T17:12:32.460968Z", + "modified": "2024-08-02T17:12:32.460968Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82", @@ -12117,9 +13298,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--e1745a0c-1961-4e95-9ced-51591d144652", - "created": "2024-03-13T22:04:00.410128Z", - "modified": "2024-03-13T22:04:00.410128Z", + "id": "relationship--c0c59cf4-03ae-4298-9f1d-611fca8ad206", + "created": "2024-08-02T17:12:32.461157Z", + "modified": "2024-08-02T17:12:32.461157Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e", @@ -12131,9 +13312,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--a68e9e4e-9de0-4c87-a71d-313d0a6d46f3", - "created": "2024-03-13T22:04:00.410244Z", - "modified": "2024-03-13T22:04:00.410244Z", + "id": "relationship--542dfa94-5bb2-43b0-af29-d5f0e8c3954d", + "created": "2024-08-02T17:12:32.461324Z", + "modified": "2024-08-02T17:12:32.461324Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--78cf4cd6-a8a0-408f-a5e8-d6f1491aace8", @@ -12145,9 +13326,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--b5ae590c-7924-4532-bd86-ccc0f72fdfae", - "created": "2024-03-13T22:04:00.410361Z", - "modified": "2024-03-13T22:04:00.410361Z", + "id": "relationship--1d6dee53-1e87-4859-9a89-fa4f373e9587", + "created": "2024-08-02T17:12:32.46151Z", + "modified": "2024-08-02T17:12:32.46151Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae", @@ -12159,9 +13340,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--f55ce4c7-b429-4e9b-85c6-0ac1c3a94498", - "created": "2024-03-13T22:04:00.410481Z", - "modified": "2024-03-13T22:04:00.410481Z", + "id": "relationship--a8d3ceb0-3bd4-4fda-9c3c-bf25a9a9bd8e", + "created": "2024-08-02T17:12:32.461673Z", + "modified": "2024-08-02T17:12:32.461673Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--9affd892-2479-4843-99d1-1e1a9f7f1020", @@ -12173,9 +13354,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--ab3f9551-b7e3-4ed6-9902-a39b4ea05638", - "created": "2024-03-13T22:04:00.410627Z", - "modified": "2024-03-13T22:04:00.410627Z", + "id": "relationship--f7be5566-14e3-4e0e-b790-9570529a9be8", + "created": "2024-08-02T17:12:32.461883Z", + "modified": "2024-08-02T17:12:32.461883Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--6b495bb5-d2ab-4da7-9530-a1aadd488803", @@ -12187,9 +13368,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--9dbca9ae-e79e-4ccd-af1c-7d561922358f", - "created": "2024-03-13T22:04:00.410786Z", - "modified": "2024-03-13T22:04:00.410786Z", + "id": "relationship--a4b58981-0a68-43da-823f-362da1cb7702", + "created": "2024-08-02T17:12:32.46208Z", + "modified": "2024-08-02T17:12:32.46208Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--5bca3084-f5b0-48a8-934c-7f2c03bfd2c3", @@ -12201,9 +13382,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--120e8086-7272-4023-b80f-ec38de71cbd5", - "created": "2024-03-13T22:04:00.410908Z", - "modified": "2024-03-13T22:04:00.410908Z", + "id": "relationship--fbaf156b-fb40-420f-bd04-756e420fd8ac", + "created": "2024-08-02T17:12:32.462254Z", + "modified": "2024-08-02T17:12:32.462254Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--eb67513e-b6e8-42e1-a95b-197f64c21588", @@ -12215,9 +13396,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--14216021-a3bd-42ee-9258-5b23c27d0157", - "created": "2024-03-13T22:04:00.411027Z", - "modified": "2024-03-13T22:04:00.411027Z", + "id": "relationship--9b577c6e-65c2-429c-9720-e5a2d8d4ce26", + "created": "2024-08-02T17:12:32.46244Z", + "modified": "2024-08-02T17:12:32.46244Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--eb037d2a-82a7-4bcb-bffd-e7791de21d1c", @@ -12229,9 +13410,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--470d4362-b5fb-46f2-839e-419fe4af71a6", - "created": "2024-03-13T22:04:00.411145Z", - "modified": "2024-03-13T22:04:00.411145Z", + "id": "relationship--4d03e4b6-29ab-42ca-b342-e17eda61d6e2", + "created": "2024-08-02T17:12:32.462647Z", + "modified": "2024-08-02T17:12:32.462647Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--3437993c-c521-4145-a2d8-b860399876b0", @@ -12243,9 +13424,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--462a77ea-c626-4c0a-bec5-eb267f7a40f8", - "created": "2024-03-13T22:04:00.411262Z", - "modified": "2024-03-13T22:04:00.411262Z", + "id": "relationship--df5f654e-8031-4653-bb99-50ad0da6d0ed", + "created": "2024-08-02T17:12:32.462974Z", + "modified": "2024-08-02T17:12:32.462974Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--a09fbbeb-58ef-4e7a-8183-5eaa668200c9", @@ -12257,9 +13438,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--07287dfc-a00d-48a3-9c5f-246c07950e39", - "created": "2024-03-13T22:04:00.41138Z", - "modified": "2024-03-13T22:04:00.41138Z", + "id": "relationship--050c8b29-f94f-40f3-975b-8cf1e214fddf", + "created": "2024-08-02T17:12:32.463185Z", + "modified": "2024-08-02T17:12:32.463185Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--e7b62982-106f-4234-9545-9466c687d1b5", @@ -12271,9 +13452,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--7552cf3f-bfef-40e3-8c45-7baa261ed738", - "created": "2024-03-13T22:04:00.411499Z", - "modified": "2024-03-13T22:04:00.411499Z", + "id": "relationship--1dcde9ab-7411-4303-891c-9e733976b93c", + "created": "2024-08-02T17:12:32.463427Z", + "modified": "2024-08-02T17:12:32.463427Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--da5fb984-37a6-4152-a078-e2af40c0844f", @@ -12285,9 +13466,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--4e93b069-3fa3-4fcf-a9c3-0a5bc97279e4", - "created": "2024-03-13T22:04:00.411638Z", - "modified": "2024-03-13T22:04:00.411638Z", + "id": "relationship--0adc9df9-b5e2-4c59-886d-b7f53f5e83b5", + "created": "2024-08-02T17:12:32.463639Z", + "modified": "2024-08-02T17:12:32.463639Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--deb9a225-0803-4a1f-b37b-3a10c3e7ca79", @@ -12299,9 +13480,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--0e598ff5-c150-4976-a2b6-f16ab8439ce8", - "created": "2024-03-13T22:04:00.41176Z", - "modified": "2024-03-13T22:04:00.41176Z", + "id": "relationship--3a0f56b1-7ab6-4e1d-82b1-8d0deeb9bb07", + "created": "2024-08-02T17:12:32.463896Z", + "modified": "2024-08-02T17:12:32.463896Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6", @@ -12313,9 +13494,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--901107f9-b50c-45f8-b5e1-34835fed93b9", - "created": "2024-03-13T22:04:00.41188Z", - "modified": "2024-03-13T22:04:00.41188Z", + "id": "relationship--c23de0ab-d8f1-48e0-96ea-f07b5c6f142e", + "created": "2024-08-02T17:12:32.464104Z", + "modified": "2024-08-02T17:12:32.464104Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--ea762d7a-8852-4d91-b44f-4754aa079313", @@ -12327,9 +13508,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--b67b6a2d-5db8-4d88-8030-f9ab981e680d", - "created": "2024-03-13T22:04:00.411998Z", - "modified": "2024-03-13T22:04:00.411998Z", + "id": "relationship--43d3f1aa-dce6-41c5-901f-340c33150299", + "created": "2024-08-02T17:12:32.464398Z", + "modified": "2024-08-02T17:12:32.464398Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--dd415f9d-ce3a-44c6-9237-f8ceeb52a6a3", @@ -12341,9 +13522,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--eba5b557-bf18-4868-b380-ee597cdedd69", - "created": "2024-03-13T22:04:00.412141Z", - "modified": "2024-03-13T22:04:00.412141Z", + "id": "relationship--b4b98b05-c3da-4ce9-8dd7-afaec2c029af", + "created": "2024-08-02T17:12:32.464588Z", + "modified": "2024-08-02T17:12:32.464588Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--a09594d3-c930-451a-8eb6-7e2d748618bb", @@ -12355,9 +13536,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--a8f9825e-8c33-4358-9074-d5ee74ae03c7", - "created": "2024-03-13T22:04:00.412289Z", - "modified": "2024-03-13T22:04:00.412289Z", + "id": "relationship--0cc310ba-a0b6-4fa4-adec-b859ba96092f", + "created": "2024-08-02T17:12:32.464817Z", + "modified": "2024-08-02T17:12:32.464817Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb", @@ -12369,9 +13550,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--12aa1a83-9bef-434d-b9ab-a0efae46378f", - "created": "2024-03-13T22:04:00.412408Z", - "modified": "2024-03-13T22:04:00.412408Z", + "id": "relationship--05840c3e-34ef-49be-a231-d39ad1faae96", + "created": "2024-08-02T17:12:32.465037Z", + "modified": "2024-08-02T17:12:32.465037Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--b6644001-8597-4f9f-a2a4-8005c54e8a39", @@ -12383,9 +13564,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--e238000c-868f-4fc4-8898-d64a52b13718", - "created": "2024-03-13T22:04:00.412511Z", - "modified": "2024-03-13T22:04:00.412511Z", + "id": "relationship--3808e749-4ede-4084-805f-241913923417", + "created": "2024-08-02T17:12:32.465277Z", + "modified": "2024-08-02T17:12:32.465277Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--c80ef7af-3f51-4be5-b42a-19d29ab40a53", @@ -12397,9 +13578,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--0fb72f2b-757b-4ba1-9d61-5264a49c980d", - "created": "2024-03-13T22:04:00.412596Z", - "modified": "2024-03-13T22:04:00.412596Z", + "id": "relationship--beb02da6-2198-445a-a643-e267055791fe", + "created": "2024-08-02T17:12:32.46551Z", + "modified": "2024-08-02T17:12:32.46551Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--8b991b67-9df8-42e7-b11a-5ed1bc41c5a5", @@ -12411,9 +13592,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--2c68419e-afa7-4496-b3da-4e1eb2e5bf55", - "created": "2024-03-13T22:04:00.412684Z", - "modified": "2024-03-13T22:04:00.412684Z", + "id": "relationship--f7a558ee-85bf-4a1a-a5c0-634e8e35199d", + "created": "2024-08-02T17:12:32.465777Z", + "modified": "2024-08-02T17:12:32.465777Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--ce1e088c-d061-490c-a13a-3cbe4216a86e", @@ -12425,9 +13606,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--1c94c386-507c-4865-acc9-e70753f31931", - "created": "2024-03-13T22:04:00.41277Z", - "modified": "2024-03-13T22:04:00.41277Z", + "id": "relationship--a6dd71ba-47f1-4bcb-8335-b3f8cd3393c8", + "created": "2024-08-02T17:12:32.466003Z", + "modified": "2024-08-02T17:12:32.466003Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--67afaa3d-ffd7-4ad5-bcb0-e77962c084cf", @@ -12439,9 +13620,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--2070f80a-d4ed-4053-a496-3672e0a64b43", - "created": "2024-03-13T22:04:00.412857Z", - "modified": "2024-03-13T22:04:00.412857Z", + "id": "relationship--4ed2403c-2e03-43b8-9455-2b5a2afc0db8", + "created": "2024-08-02T17:12:32.466224Z", + "modified": "2024-08-02T17:12:32.466224Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--83b4e2db-265f-4f88-9b35-26df05c561e9", @@ -12453,9 +13634,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--305a2121-bd33-44a7-8547-d10f3785266f", - "created": "2024-03-13T22:04:00.412972Z", - "modified": "2024-03-13T22:04:00.412972Z", + "id": "relationship--79fe1a67-0d97-4b57-9e15-2e25c9d4d0ea", + "created": "2024-08-02T17:12:32.466613Z", + "modified": "2024-08-02T17:12:32.466613Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--5dc224b1-c69e-496d-91f7-e8ce4fd3f166", @@ -12467,9 +13648,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--9dce39d6-3dee-4795-a2b9-7c693ef2e77b", - "created": "2024-03-13T22:04:00.413091Z", - "modified": "2024-03-13T22:04:00.413091Z", + "id": "relationship--4df27b00-6e56-4499-a6c5-1c40b4a14c93", + "created": "2024-08-02T17:12:32.466831Z", + "modified": "2024-08-02T17:12:32.466831Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--c25ad637-cfa5-40c0-a23c-f741d8f4319e", @@ -12481,9 +13662,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--67e4ea90-3b1b-48b7-8c5c-b067832e7f87", - "created": "2024-03-13T22:04:00.413265Z", - "modified": "2024-03-13T22:04:00.413265Z", + "id": "relationship--a64a0665-7765-44f2-9815-77f14b7e0cdc", + "created": "2024-08-02T17:12:32.467064Z", + "modified": "2024-08-02T17:12:32.467064Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--a925711a-dbfb-41b1-bd81-70d41dbaa69c", @@ -12495,9 +13676,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--00eb3329-da31-41b2-88c5-df3722f99036", - "created": "2024-03-13T22:04:00.413386Z", - "modified": "2024-03-13T22:04:00.413386Z", + "id": "relationship--befa7f53-a750-4e9a-ad3b-ba25187ce72b", + "created": "2024-08-02T17:12:32.46732Z", + "modified": "2024-08-02T17:12:32.46732Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--d2536dd3-53a5-4fc1-b508-1697cf0dafde", @@ -12509,9 +13690,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--d1ef8701-9ffd-4566-a8da-7cf066dbe15c", - "created": "2024-03-13T22:04:00.413506Z", - "modified": "2024-03-13T22:04:00.413506Z", + "id": "relationship--be6f1a22-0e88-4330-b7ce-3942a5443ec5", + "created": "2024-08-02T17:12:32.467546Z", + "modified": "2024-08-02T17:12:32.467546Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f", @@ -12523,9 +13704,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--c966f509-60f5-49c2-8936-2dfcaf405cea", - "created": "2024-03-13T22:04:00.413629Z", - "modified": "2024-03-13T22:04:00.413629Z", + "id": "relationship--3db92cd4-5bcf-4e90-a76a-267239073948", + "created": "2024-08-02T17:12:32.467786Z", + "modified": "2024-08-02T17:12:32.467786Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--7fdc6b19-0d37-43a9-8144-f0c180a13ed0", @@ -12537,9 +13718,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--da457161-4530-4f88-8a36-53d4d14c4f1d", - "created": "2024-03-13T22:04:00.413719Z", - "modified": "2024-03-13T22:04:00.413719Z", + "id": "relationship--3ff580e2-f3ef-496d-b112-b46d3dcd6fca", + "created": "2024-08-02T17:12:32.468055Z", + "modified": "2024-08-02T17:12:32.468055Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c", @@ -12551,9 +13732,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--5933f1d9-c436-4fd2-b171-79c9a03609e9", - "created": "2024-03-13T22:04:00.413806Z", - "modified": "2024-03-13T22:04:00.413806Z", + "id": "relationship--8c611778-43a3-43bf-b43b-02aa547d31e2", + "created": "2024-08-02T17:12:32.468287Z", + "modified": "2024-08-02T17:12:32.468287Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8", @@ -12565,9 +13746,9 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--d4f1bc42-1c83-4b6a-b191-09dd7fd9c8db", - "created": "2024-03-13T22:04:00.413892Z", - "modified": "2024-03-13T22:04:00.413892Z", + "id": "relationship--3058a530-8d79-4261-a4f7-df1df8efad3b", + "created": "2024-08-02T17:12:32.468507Z", + "modified": "2024-08-02T17:12:32.468507Z", "relationship_type": "subtechnique-of", "description": "", "source_ref": "attack-pattern--cb324e3c-1041-4a26-9fa8-da45547b7dcc", @@ -12579,13 +13760,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--d87e73c7-e25c-48f3-b712-99a9a3661d75", - "created": "2024-03-13T22:04:00.413986Z", - "modified": "2024-03-13T22:04:00.413986Z", + "id": "relationship--6ee18aa7-5408-46a0-a780-c584b58f6528", + "created": "2024-08-02T17:12:32.468798Z", + "modified": "2024-08-02T17:12:32.468798Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--335de36d-e372-431b-b4cb-c57d3874afb8", - "target_ref": "attack-pattern--7a1b2851-c2c4-4b42-bbbf-0c3542789287", + "source_ref": "attack-pattern--16583ab1-7dae-470c-8bd1-b7ffa1f9b13f", + "target_ref": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12593,13 +13774,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--69395d8d-bf21-48cd-ae44-4e35a1ce0660", - "created": "2024-03-13T22:04:00.41412Z", - "modified": "2024-03-13T22:04:00.41412Z", + "id": "relationship--af6e3e4b-ee96-4223-8224-4708dbc6227a", + "created": "2024-08-02T17:12:32.469027Z", + "modified": "2024-08-02T17:12:32.469027Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--dfc90683-d6ef-42b7-979d-ca6fce04da64", - "target_ref": "attack-pattern--7a1b2851-c2c4-4b42-bbbf-0c3542789287", + "source_ref": "attack-pattern--0765e40a-7204-4913-b24d-6793cf4f6590", + "target_ref": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12607,13 +13788,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--c1b8c978-ec50-4c0c-b991-4b3b35b0cb85", - "created": "2024-03-13T22:04:00.414248Z", - "modified": "2024-03-13T22:04:00.414248Z", + "id": "relationship--170161bb-06ee-43f2-9b93-7c10bd31c1ad", + "created": "2024-08-02T17:12:32.469243Z", + "modified": "2024-08-02T17:12:32.469243Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--8ef7bb45-cf04-4a91-82ae-23f8d3cd1672", - "target_ref": "attack-pattern--7a1b2851-c2c4-4b42-bbbf-0c3542789287", + "source_ref": "attack-pattern--fdc7e2f8-dfb1-4353-a59f-f88d3b15eee7", + "target_ref": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12621,13 +13802,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--bd29c9df-7247-4f76-851a-c974b6435b88", - "created": "2024-03-13T22:04:00.414365Z", - "modified": "2024-03-13T22:04:00.414365Z", + "id": "relationship--be90c4af-cdb8-4f97-9093-f3f665095ae3", + "created": "2024-08-02T17:12:32.4695Z", + "modified": "2024-08-02T17:12:32.4695Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--956cdc6e-520d-4437-8d71-069a4b1d364d", - "target_ref": "attack-pattern--7a1b2851-c2c4-4b42-bbbf-0c3542789287", + "source_ref": "attack-pattern--4f7361ac-3b52-443f-8b4c-4032bb290a80", + "target_ref": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12635,13 +13816,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--a4053807-c5db-4308-94b9-ed5fd3a11db0", - "created": "2024-03-13T22:04:00.414483Z", - "modified": "2024-03-13T22:04:00.414483Z", + "id": "relationship--4959f9bd-1a2c-41d4-b43e-b4669166cd7e", + "created": "2024-08-02T17:12:32.469728Z", + "modified": "2024-08-02T17:12:32.469728Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--3d5684c2-4772-4af0-b8d9-e4a1362c9b0f", - "target_ref": "attack-pattern--d248f5e4-033f-4b71-a297-e164981e0d34", + "source_ref": "attack-pattern--69f4e3bb-a587-468a-8a0c-31f9acd931b6", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12649,13 +13830,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--6fc432d1-ee0a-48b0-bfef-08f76938512a", - "created": "2024-03-13T22:04:00.414602Z", - "modified": "2024-03-13T22:04:00.414602Z", + "id": "relationship--dbe73614-d8a9-49b6-aa3a-e62dc98a7c66", + "created": "2024-08-02T17:12:32.469989Z", + "modified": "2024-08-02T17:12:32.469989Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--cbd63bce-91c8-460d-b5da-59f52bb42307", - "target_ref": "attack-pattern--d248f5e4-033f-4b71-a297-e164981e0d34", + "source_ref": "attack-pattern--648ac47f-a288-454a-a784-3f2111c0b76b", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12663,13 +13844,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--0e422c09-3515-4eae-9878-a0f074e1c278", - "created": "2024-03-13T22:04:00.414712Z", - "modified": "2024-03-13T22:04:00.414712Z", + "id": "relationship--1aa80662-3728-4774-9961-077c2c5bbdbf", + "created": "2024-08-02T17:12:32.470256Z", + "modified": "2024-08-02T17:12:32.470256Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--b5d40b47-6792-40b8-954c-0080dc6e36bc", - "target_ref": "attack-pattern--d248f5e4-033f-4b71-a297-e164981e0d34", + "source_ref": "attack-pattern--0dc4a07b-94cb-4743-b812-3fc3c8288551", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12677,13 +13858,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--554fac31-0233-4cb1-9978-79c55c78f553", - "created": "2024-03-13T22:04:00.414816Z", - "modified": "2024-03-13T22:04:00.414816Z", + "id": "relationship--7e59ea89-0604-4d20-98f9-df99c5f20e3e", + "created": "2024-08-02T17:12:32.470476Z", + "modified": "2024-08-02T17:12:32.470476Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--bdea2ea4-9db1-4925-a7bd-da87cff30020", - "target_ref": "attack-pattern--d248f5e4-033f-4b71-a297-e164981e0d34", + "source_ref": "attack-pattern--150be76a-9bdc-4f1d-837c-6a845d1eda1c", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12691,13 +13872,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--29b002dd-cfe6-4162-a453-ca5c94a317ca", - "created": "2024-03-13T22:04:00.414918Z", - "modified": "2024-03-13T22:04:00.414918Z", + "id": "relationship--1e683113-77cd-42f3-b19b-8eb033d82da2", + "created": "2024-08-02T17:12:32.470746Z", + "modified": "2024-08-02T17:12:32.470746Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--d8da91e5-19d2-4a54-b20b-bbcfb52f4cef", - "target_ref": "attack-pattern--d248f5e4-033f-4b71-a297-e164981e0d34", + "source_ref": "attack-pattern--ee594da3-8999-481e-90b3-e8c2e965ae28", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12705,13 +13886,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--833b4688-9977-4d99-81e0-c705eac7bc4a", - "created": "2024-03-13T22:04:00.415023Z", - "modified": "2024-03-13T22:04:00.415023Z", + "id": "relationship--25921009-96dd-4dfd-99aa-2a5b5c564b75", + "created": "2024-08-02T17:12:32.471106Z", + "modified": "2024-08-02T17:12:32.471106Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--e20185ab-a567-4eda-84a1-60dd5936990b", - "target_ref": "attack-pattern--d248f5e4-033f-4b71-a297-e164981e0d34", + "source_ref": "attack-pattern--62eb26b8-d555-46a5-831d-c6b55909a9c4", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12719,13 +13900,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--082ca4a2-a88e-475b-bac9-4db7e75c5705", - "created": "2024-03-13T22:04:00.415149Z", - "modified": "2024-03-13T22:04:00.415149Z", + "id": "relationship--ae8bca9c-8952-4705-9eee-ed67b1333357", + "created": "2024-08-02T17:12:32.471338Z", + "modified": "2024-08-02T17:12:32.471338Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--8d95a8e4-fe8a-4344-adc2-f0713c84cdde", - "target_ref": "attack-pattern--d248f5e4-033f-4b71-a297-e164981e0d34", + "source_ref": "attack-pattern--fc986d09-410d-45ac-b4b4-161ff339147f", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12733,13 +13914,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--59c2380f-2506-4e51-a923-7f45686c617a", - "created": "2024-03-13T22:04:00.41527Z", - "modified": "2024-03-13T22:04:00.41527Z", + "id": "relationship--9b905f35-fcb5-4088-b729-e6fd1ee6669b", + "created": "2024-08-02T17:12:32.471589Z", + "modified": "2024-08-02T17:12:32.471589Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--1af96790-1496-4975-9c17-61482c120f75", - "target_ref": "attack-pattern--d248f5e4-033f-4b71-a297-e164981e0d34", + "source_ref": "attack-pattern--4e33bf6a-c042-4673-b72a-c4121e0aae0d", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12747,13 +13928,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--d80bffa8-270e-4a4d-864c-caf5d8b907c3", - "created": "2024-03-13T22:04:00.415388Z", - "modified": "2024-03-13T22:04:00.415388Z", + "id": "relationship--e74eab3c-20f9-4b47-9c9f-1331bda6f2a4", + "created": "2024-08-02T17:12:32.471866Z", + "modified": "2024-08-02T17:12:32.471866Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--5c5ba2be-95ed-4b80-81ac-c56579482300", - "target_ref": "attack-pattern--f82582bf-2475-43bb-b793-ad51cb30d221", + "source_ref": "attack-pattern--faacbfa9-600a-4cfb-8afe-844a186d72b3", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12761,13 +13942,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--cd66fd98-3a58-4081-bbe0-aa89b7e5cf51", - "created": "2024-03-13T22:04:00.415507Z", - "modified": "2024-03-13T22:04:00.415507Z", + "id": "relationship--f77974d2-428a-4291-a6c9-efc73648f52d", + "created": "2024-08-02T17:12:32.472093Z", + "modified": "2024-08-02T17:12:32.472093Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--c33f44c6-69c7-4dca-a022-bce150e00351", - "target_ref": "attack-pattern--f82582bf-2475-43bb-b793-ad51cb30d221", + "source_ref": "attack-pattern--62a0eef8-a23a-4fbf-bb17-17ea636213cc", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12775,13 +13956,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--b0ecf7d2-980a-4903-bed0-fc22afe9e691", - "created": "2024-03-13T22:04:00.415641Z", - "modified": "2024-03-13T22:04:00.415641Z", + "id": "relationship--e9a69513-1e41-4e21-aa68-2ee7d26f737e", + "created": "2024-08-02T17:12:32.472379Z", + "modified": "2024-08-02T17:12:32.472379Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--ab662bce-7c59-40db-8ec1-f1860b31c8d2", - "target_ref": "attack-pattern--f82582bf-2475-43bb-b793-ad51cb30d221", + "source_ref": "attack-pattern--7bcb15ef-d371-4b1e-8768-30784e9d7b87", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12789,13 +13970,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--6c5b9811-becf-4a5d-8ac4-cc2faa4b2813", - "created": "2024-03-13T22:04:00.415773Z", - "modified": "2024-03-13T22:04:00.415773Z", + "id": "relationship--1fe75ff3-bf65-434b-b7ef-9a9a158bc159", + "created": "2024-08-02T17:12:32.472628Z", + "modified": "2024-08-02T17:12:32.472628Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--b3489363-a0d6-44fa-a739-220721337318", - "target_ref": "attack-pattern--f82582bf-2475-43bb-b793-ad51cb30d221", + "source_ref": "attack-pattern--8958b87c-85fd-478f-ae01-8952c787d9b7", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12803,13 +13984,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--4f2ded22-5ec3-4c09-bf34-7ac7bafaffaf", - "created": "2024-03-13T22:04:00.415887Z", - "modified": "2024-03-13T22:04:00.415887Z", + "id": "relationship--25acdc48-2496-4c9f-96c9-e5e4f2a67a4f", + "created": "2024-08-02T17:12:32.472854Z", + "modified": "2024-08-02T17:12:32.472854Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--46dd1614-b2f4-40c1-bcdb-0ca33ce4357f", - "target_ref": "attack-pattern--f82582bf-2475-43bb-b793-ad51cb30d221", + "source_ref": "attack-pattern--9e081185-12f4-41f0-8379-95b688e1d80f", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12817,13 +13998,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--ad73fffc-9d4f-4cb0-8f87-6b41650f5707", - "created": "2024-03-13T22:04:00.416Z", - "modified": "2024-03-13T22:04:00.416Z", + "id": "relationship--82147dcc-240d-4a64-9532-02da39174668", + "created": "2024-08-02T17:12:32.473126Z", + "modified": "2024-08-02T17:12:32.473126Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--70de8fc1-509c-4922-995b-1512fba1e338", - "target_ref": "attack-pattern--f82582bf-2475-43bb-b793-ad51cb30d221", + "source_ref": "attack-pattern--3628a6fd-b102-48a0-862b-9b66e80ee556", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12831,13 +14012,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--e872cf2c-8209-4263-96ec-db31f377401f", - "created": "2024-03-13T22:04:00.416111Z", - "modified": "2024-03-13T22:04:00.416111Z", + "id": "relationship--ab7fb70c-bfe0-40e4-9133-7552e0f80dd1", + "created": "2024-08-02T17:12:32.473463Z", + "modified": "2024-08-02T17:12:32.473463Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--12fbb7ad-ceea-4f59-a626-a30a47a4cc56", - "target_ref": "attack-pattern--6c3345b8-026e-4aa6-8b2c-15cfb2258df6", + "source_ref": "attack-pattern--01ad5f44-da00-491f-84e8-3ba8da154c45", + "target_ref": "attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12845,13 +14026,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--50c9affc-7a74-4ee1-a222-325af9134650", - "created": "2024-03-13T22:04:00.416223Z", - "modified": "2024-03-13T22:04:00.416223Z", + "id": "relationship--5acbd3da-5562-479f-be24-aec1313cbbdf", + "created": "2024-08-02T17:12:32.47371Z", + "modified": "2024-08-02T17:12:32.47371Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--637d504e-4f85-4979-b48c-b9512419329e", - "target_ref": "attack-pattern--6c3345b8-026e-4aa6-8b2c-15cfb2258df6", + "source_ref": "attack-pattern--29a3ec78-469a-43b8-b0ae-9f34c58316f2", + "target_ref": "attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12859,13 +14040,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--fdc44df5-bd5e-441a-85d9-11cff2be5264", - "created": "2024-03-13T22:04:00.416335Z", - "modified": "2024-03-13T22:04:00.416335Z", + "id": "relationship--fd13e839-7850-4ee2-adb9-4aad43d3f2cb", + "created": "2024-08-02T17:12:32.473977Z", + "modified": "2024-08-02T17:12:32.473977Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--ac2e2374-ff39-4167-af9e-71ba5d96e828", - "target_ref": "attack-pattern--6c3345b8-026e-4aa6-8b2c-15cfb2258df6", + "source_ref": "attack-pattern--3af9d1c0-9a09-4dba-8975-a204e6951ac4", + "target_ref": "attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12873,13 +14054,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--c6b7ed29-3901-4471-b7de-98cbf3f38580", - "created": "2024-03-13T22:04:00.416455Z", - "modified": "2024-03-13T22:04:00.416455Z", + "id": "relationship--90dcd645-f7c0-445f-ae64-1673800a8d3a", + "created": "2024-08-02T17:12:32.474175Z", + "modified": "2024-08-02T17:12:32.474175Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--431e1e82-c9ef-44e6-b1ec-354aca1890fa", - "target_ref": "attack-pattern--554fc43f-426e-40ba-a82f-148774abaee2", + "source_ref": "attack-pattern--d60dd224-14bd-4b6e-9960-a789a8370fdf", + "target_ref": "attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12887,13 +14068,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--9e67cc0f-2786-403b-a7db-49e9131d3545", - "created": "2024-03-13T22:04:00.416573Z", - "modified": "2024-03-13T22:04:00.416573Z", + "id": "relationship--6414fc2a-27cd-4e7b-9bea-9a8a38ad8e1c", + "created": "2024-08-02T17:12:32.474341Z", + "modified": "2024-08-02T17:12:32.474341Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--8376b756-0340-4870-ba1d-38b43ce811a4", - "target_ref": "attack-pattern--554fc43f-426e-40ba-a82f-148774abaee2", + "source_ref": "attack-pattern--5af23f8e-38df-48c6-b832-6f4589cd2590", + "target_ref": "attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12901,13 +14082,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--ff26d3d1-65b4-451c-8624-762893290925", - "created": "2024-03-13T22:04:00.417115Z", - "modified": "2024-03-13T22:04:00.417115Z", + "id": "relationship--26c6fa26-40a0-44e9-9ef4-58b04967882d", + "created": "2024-08-02T17:12:32.474548Z", + "modified": "2024-08-02T17:12:32.474548Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--b4a3940c-fa6d-4086-9a6d-ccab45cd5072", - "target_ref": "attack-pattern--554fc43f-426e-40ba-a82f-148774abaee2", + "source_ref": "attack-pattern--8ac60812-17d7-4e9f-911e-64467233a9b3", + "target_ref": "attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12915,13 +14096,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--83eb2b50-5674-4d95-8c71-2f7d70f37421", - "created": "2024-03-13T22:04:00.417239Z", - "modified": "2024-03-13T22:04:00.417239Z", + "id": "relationship--edc0fb98-5036-45af-8f14-3fecd0dc0a3c", + "created": "2024-08-02T17:12:32.474796Z", + "modified": "2024-08-02T17:12:32.474796Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--6275c34f-44ea-4799-bb61-3c0a25450812", - "target_ref": "attack-pattern--3eeb3c60-b41a-412c-ada9-ad6e82022dec", + "source_ref": "attack-pattern--741c08dd-2dd3-4c6f-8d08-32481f4cb61f", + "target_ref": "attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12929,13 +14110,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--1c42b9cd-b6c8-4212-81ee-d56bbe7573e1", - "created": "2024-03-13T22:04:00.417357Z", - "modified": "2024-03-13T22:04:00.417357Z", + "id": "relationship--0842bbd9-8779-4830-8211-d56a7df758bc", + "created": "2024-08-02T17:12:32.474903Z", + "modified": "2024-08-02T17:12:32.474903Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--e4f85bfa-8e18-407f-b111-17f18ed209d0", - "target_ref": "attack-pattern--3eeb3c60-b41a-412c-ada9-ad6e82022dec", + "source_ref": "attack-pattern--b502f8ae-e296-4dd7-83ea-8d737f8d3fb1", + "target_ref": "attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12943,13 +14124,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--c14c0156-2a62-40d9-8b41-d7855c8495b0", - "created": "2024-03-13T22:04:00.417478Z", - "modified": "2024-03-13T22:04:00.417478Z", + "id": "relationship--b8c2dc42-11c5-4f1b-944d-3a677029663f", + "created": "2024-08-02T17:12:32.475007Z", + "modified": "2024-08-02T17:12:32.475007Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--92b7f596-d223-440a-b62b-149dbcc73b9f", - "target_ref": "attack-pattern--3eeb3c60-b41a-412c-ada9-ad6e82022dec", + "source_ref": "attack-pattern--c5274385-9abf-45cb-9ef6-faf86145d5ef", + "target_ref": "attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12957,13 +14138,13 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--e8660451-59aa-438c-9d72-0d4577ced07c", - "created": "2024-03-13T22:04:00.417599Z", - "modified": "2024-03-13T22:04:00.417599Z", + "id": "relationship--2bd9135a-f7c7-436e-a05a-ca5ff39d897c", + "created": "2024-08-02T17:12:32.475147Z", + "modified": "2024-08-02T17:12:32.475147Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--ebfe12db-6e8f-4826-8f8e-b9e865f1d29d", - "target_ref": "attack-pattern--44e57875-edb9-4bce-927d-17aac9bf9a48", + "source_ref": "attack-pattern--d556b582-dd00-44d7-8c2f-74fb48c755fa", + "target_ref": "attack-pattern--729483ae-39cf-416e-8d38-da06f1fc5991", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12971,13 +14152,195 @@ { "type": "relationship", "spec_version": "2.1", - "id": "relationship--b0799e56-55d4-4757-a196-223c6821db2d", - "created": "2024-03-13T22:04:00.417761Z", - "modified": "2024-03-13T22:04:00.417761Z", + "id": "relationship--7f138fe5-7c8b-4c83-b595-4eac6b1db993", + "created": "2024-08-02T17:12:32.475339Z", + "modified": "2024-08-02T17:12:32.475339Z", "relationship_type": "subtechnique-of", "description": "", - "source_ref": "attack-pattern--fcbde78a-826a-4d53-8071-6e8034901c05", - "target_ref": "attack-pattern--44e57875-edb9-4bce-927d-17aac9bf9a48", + "source_ref": "attack-pattern--fde45c5f-c612-4969-b104-d96a60e6d888", + "target_ref": "attack-pattern--729483ae-39cf-416e-8d38-da06f1fc5991", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f87e26a8-754d-4476-b92d-e0572b1b8e64", + "created": "2024-08-02T17:12:32.47553Z", + "modified": "2024-08-02T17:12:32.47553Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--6ae4a4d2-4ac8-4764-ac9f-7261c5c882e0", + "target_ref": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--51717459-dc66-4c95-916f-b562336b1e3d", + "created": "2024-08-02T17:12:32.47575Z", + "modified": "2024-08-02T17:12:32.47575Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--f328541f-2537-4db7-8a05-1c76ed26d3eb", + "target_ref": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e3dfbd7-a4c5-4430-9e78-ce24c4b66ada", + "created": "2024-08-02T17:12:32.475994Z", + "modified": "2024-08-02T17:12:32.475994Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--b2c62262-d3cc-49a9-830c-9d6f0bb95082", + "target_ref": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07b41de1-19a9-445e-8d5c-21126231bd97", + "created": "2024-08-02T17:12:32.476199Z", + "modified": "2024-08-02T17:12:32.476199Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d592cbac-8fcd-4569-8a7a-4e5c6a0b08e7", + "target_ref": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--063f9539-81fc-47b6-a0a4-577c0989ee16", + "created": "2024-08-02T17:12:32.476433Z", + "modified": "2024-08-02T17:12:32.476433Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--410e8ae7-e11d-44ff-8f10-3ec29798a9e0", + "target_ref": "attack-pattern--0c2c22ae-5115-4b91-9e0f-08259e6aad99", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d708051-2b92-4655-a8da-1741b308a91b", + "created": "2024-08-02T17:12:32.476712Z", + "modified": "2024-08-02T17:12:32.476712Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3b7dd3e2-ff22-4b4b-813e-c31c2fb68029", + "target_ref": "attack-pattern--0c2c22ae-5115-4b91-9e0f-08259e6aad99", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6827b732-0761-4c26-8abb-276ac10b38b4", + "created": "2024-08-02T17:12:32.476928Z", + "modified": "2024-08-02T17:12:32.476928Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c060ec87-d4d7-4de0-9f1d-9a9a42c05446", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69279f8c-7c9f-4b63-a225-4989299f3e73", + "created": "2024-08-02T17:12:32.477134Z", + "modified": "2024-08-02T17:12:32.477134Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--8314b253-72a3-46c0-8ee5-6fa02aa9a8fa", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5034924-c0be-49de-b0fa-e2e2e28f486e", + "created": "2024-08-02T17:12:32.477321Z", + "modified": "2024-08-02T17:12:32.477321Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5ba86be4-c8ba-458c-abea-2ad706d7ddd9", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c02c461b-222e-40af-bebe-781dc07e523d", + "created": "2024-08-02T17:12:32.477589Z", + "modified": "2024-08-02T17:12:32.477589Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--15cba133-fa27-4632-9996-22b74751749a", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d75e290c-a056-4383-92b1-119cc344dafe", + "created": "2024-08-02T17:12:32.477813Z", + "modified": "2024-08-02T17:12:32.477813Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--df9f74e6-1a56-4515-910e-d58a386bbf1f", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43c952d0-443f-4e6a-9f2a-547d69a05494", + "created": "2024-08-02T17:12:32.478031Z", + "modified": "2024-08-02T17:12:32.478031Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--0e605049-ac7a-46a9-bbac-ef0a69e160cb", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + }, + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8abd7e6d-926c-48a9-8d4e-9f526bd9ab47", + "created": "2024-08-02T17:12:32.478239Z", + "modified": "2024-08-02T17:12:32.478239Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--cf4ee6a4-f503-425c-a069-3245de145582", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", "object_marking_refs": [ "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" ] @@ -12986,8 +14349,8 @@ "type": "identity", "spec_version": "2.1", "id": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.326796Z", - "modified": "2024-03-13T22:04:00.326796Z", + "created": "2024-08-02T17:12:32.312276Z", + "modified": "2024-08-02T17:12:32.312276Z", "name": "DISARM Foundation", "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", "identity_class": "organization" @@ -12997,7 +14360,7 @@ "spec_version": "2.1", "id": "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2024-03-13T22:04:00.327073Z", + "created": "2024-08-02T17:12:32.313302Z", "definition_type": "statement", "name": "DISARM Foundation", "definition": { @@ -13008,8 +14371,8 @@ "type": "x-mitre-matrix", "spec_version": "2.1", "id": "x-mitre-matrix--0e0c1597-4b7d-43f1-b768-1c4a253c44df", - "created": "2024-03-13T22:04:00.418929Z", - "modified": "2024-03-13T22:04:00.418929Z", + "created": "2024-08-02T17:12:32.484418Z", + "modified": "2024-08-02T17:12:32.484418Z", "name": "DISARM Framework", "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", "tactic_refs": [ @@ -13018,13 +14381,13 @@ "x-mitre-tactic--1e005da9-56cc-4802-af90-b267d17a1ad1", "x-mitre-tactic--fd1e7dd3-63d0-4040-808e-3e61b9ddca86", "x-mitre-tactic--82039146-59a3-4353-b328-a422da34db6b", - "x-mitre-tactic--8fc5e05d-c61d-41bc-a009-c9235ec420fb", + "x-mitre-tactic--c6c75568-5369-4f9e-89c1-43307702a19c", "x-mitre-tactic--8f32bafc-edb2-4d3c-9b7e-e42a9147123b", "x-mitre-tactic--acaf8903-418f-425a-93dc-8e1bfb626876", "x-mitre-tactic--3c73d309-b066-44f9-ad81-866a64e438c9", "x-mitre-tactic--8a96b3ce-332e-4685-8ec6-5140eef192a4", "x-mitre-tactic--4a9c3d11-801b-4ee9-a5bc-b5bc042a92f9", - "x-mitre-tactic--51a3f349-b77f-4e84-9fa8-765f8aa8b695", + "x-mitre-tactic--03e4259c-83fc-40d6-9e20-1269a7adaac8", "x-mitre-tactic--f0505ac9-8979-49e4-a87c-d1109536a7db", "x-mitre-tactic--3fa1ad18-ca09-40ed-be45-f210b9c07e0b", "x-mitre-tactic--dffcf337-d4d9-449b-aa9c-6a97a891c5a9", diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--001e2693-c7a6-4615-b06a-90ae22d7b353.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--001e2693-c7a6-4615-b06a-90ae22d7b353.json new file mode 100644 index 0000000..3bd9187 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--001e2693-c7a6-4615-b06a-90ae22d7b353.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--d487272a-75b6-4e0e-b394-044bc153b0c5", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--001e2693-c7a6-4615-b06a-90ae22d7b353", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.384802Z", + "modified": "2024-08-02T17:12:32.384802Z", + "name": "Activist Persona", + "description": "A person with an activist persona presents themselves as an activist; an individual who campaigns for a political cause, organises related events, etc.

While presenting as an activist is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as activists. Threat actors can fabricate activists to give the appearance of popular support for an evolving grassroots movement (see T0143.002: Fabricated Persona, T0097.103: Activist Persona).

People who are legitimate activists can use this persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as an activist to provide visibility to a false narrative or be tricked into doing so without their knowledge (T0143.001: Authentic Persona, T0097.103: Activist Persona).

Associated Techniques and Sub-techniques
T0097.104: Hacktivist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as someone engaged in activism who uses technical tools and methods, including building technical infrastructure and conducting offensive cyber operations, to achieve their goals.
T0097.207: NGO Persona: People with an activist persona may present as being part of an NGO.
T0097.208: Social Cause Persona: Analysts should use this sub-technique to catalogue cases where an online account is presenting as posting content related to a particular social cause, while not presenting as an individual.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.103.md", + "external_id": "T0097.103" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99.json index 803f658..7cc0601 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--96866e90-4a43-44b5-ad9c-948c09670963", + "id": "bundle--217d8c4d-82ef-4208-a42a-81b437d84c93", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.256885Z", - "modified": "2023-09-28T21:25:13.256885Z", + "created": "2024-08-02T17:12:32.39972Z", + "modified": "2024-08-02T17:12:32.39972Z", "name": "Video Livestream", "description": "A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0102376a-e896-4191-b3fb-e58188301822.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0102376a-e896-4191-b3fb-e58188301822.json index 6e1ada4..5ef26b1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0102376a-e896-4191-b3fb-e58188301822.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0102376a-e896-4191-b3fb-e58188301822.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--7e0b8688-d125-484c-a4f9-13137341b898", + "id": "bundle--9e5d8720-341f-4d99-8e5d-fa7f245ef873", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0102376a-e896-4191-b3fb-e58188301822", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.212125Z", - "modified": "2023-09-28T21:25:13.212125Z", + "created": "2024-08-02T17:12:32.351843Z", + "modified": "2024-08-02T17:12:32.351843Z", "name": "Organise Events", "description": "Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--01ad5f44-da00-491f-84e8-3ba8da154c45.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--01ad5f44-da00-491f-84e8-3ba8da154c45.json new file mode 100644 index 0000000..bc431b0 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--01ad5f44-da00-491f-84e8-3ba8da154c45.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--982ee90c-dcf4-4f73-9bff-b2bb847117c0", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--01ad5f44-da00-491f-84e8-3ba8da154c45", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.428281Z", + "modified": "2024-08-02T17:12:32.428281Z", + "name": "Encourage", + "description": "Inspire, animate, or exhort a target to act. An actor can use propaganda, disinformation, or conspiracy theories to stimulate a target to act in its interest. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.001.md", + "external_id": "T0138.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d.json index 71220d6..14b02a3 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--6bdc0034-a9ad-43e7-91b0-c54757577c9e", + "id": "bundle--40da46c0-9a28-494e-b8a8-e22b09910e17", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.266843Z", - "modified": "2023-09-28T21:25:13.266843Z", + "created": "2024-08-02T17:12:32.406119Z", + "modified": "2024-08-02T17:12:32.406119Z", "name": "Deliver Ads", "description": "Delivering content via any form of paid media or advertising.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--030976e3-fce8-434e-9ea8-a36ee2c0192e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--030976e3-fce8-434e-9ea8-a36ee2c0192e.json new file mode 100644 index 0000000..2d486b4 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--030976e3-fce8-434e-9ea8-a36ee2c0192e.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--c30461e5-7fe1-4ce9-be7e-ed82782aac8c", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--030976e3-fce8-434e-9ea8-a36ee2c0192e", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.358684Z", + "modified": "2024-08-02T17:12:32.358684Z", + "name": "Geopolitical Advantage", + "description": "Favourable position on the international stage in terms of great power politics or regional rivalry. Geopolitics plays out in the realms of foreign policy, national security, diplomacy, and intelligence. It involves nation-state governments, heads of state, foreign ministers, intergovernmental organisations, and regional security alliances.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-strategy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.001.md", + "external_id": "T0074.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe.json index 42ba0af..d25da5c 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--482fef6d-55ff-4da9-a49e-ceb149aae6ea", + "id": "bundle--35be0875-c21a-44f2-be60-c3c4ee5cb39f", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.273066Z", - "modified": "2023-09-28T21:25:13.273066Z", + "created": "2024-08-02T17:12:32.409015Z", + "modified": "2024-08-02T17:12:32.409015Z", "name": "Post across Platform", "description": "An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733.json index 64837c0..cc319ab 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9325ea08-ba9a-444a-ab34-842dcc82d190", + "id": "bundle--63e73074-11b1-45ee-ab42-127e90ba2d27", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.201279Z", - "modified": "2023-09-28T21:25:13.201279Z", + "created": "2024-08-02T17:12:32.34226Z", + "modified": "2024-08-02T17:12:32.34226Z", "name": "Reframe Context", "description": "Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5.json index 5a6d3c3..a0fe904 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--2942a238-1b75-45e3-9022-ad5e15b3dd6c", + "id": "bundle--3c0daaa1-a910-4eed-9f58-91a47656c595", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.214551Z", - "modified": "2023-09-28T21:25:13.214551Z", + "created": "2024-08-02T17:12:32.355426Z", + "modified": "2024-08-02T17:12:32.355426Z", "name": "Segment Audiences", "description": "Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403.json index aca903b..545c1fb 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d4a83f50-42d8-434f-95a7-f36433f65d3a", + "id": "bundle--d62aacf5-75f8-439a-8dad-4cfe8232954b", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.257984Z", - "modified": "2023-09-28T21:25:13.257984Z", + "created": "2024-08-02T17:12:32.400959Z", + "modified": "2024-08-02T17:12:32.400959Z", "name": "Private/Closed Social Networks", "description": "Social networks that are not open to people outside of family, friends, neighbours, or co-workers. Non-work-related examples include Couple, FamilyWall, 23snaps, and Nextdoor. Some of the larger social network platforms enable closed communities: examples are Instagram Close Friends and Twitter (X) Circle. Work-related examples of private social networks include LinkedIn, Facebook Workplace, and enterprise communication platforms such as Slack or Microsoft Teams.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0765e40a-7204-4913-b24d-6793cf4f6590.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0765e40a-7204-4913-b24d-6793cf4f6590.json new file mode 100644 index 0000000..c514453 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0765e40a-7204-4913-b24d-6793cf4f6590.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--dc9ec3b1-9063-4e4b-a131-6f287ecbb2c1", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--0765e40a-7204-4913-b24d-6793cf4f6590", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.422204Z", + "modified": "2024-08-02T17:12:32.422204Z", + "name": "Thwart", + "description": "Prevent the successful outcome of a policy, operation, or initiative. Actors conduct influence operations to stymie or foil proposals, plans, or courses of action which are not in their interest. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.002.md", + "external_id": "T0135.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214.json new file mode 100644 index 0000000..08bd538 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--ac45e6e1-68eb-4095-818b-f681b904a64e", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.422933Z", + "modified": "2024-08-02T17:12:32.422933Z", + "name": "Cultivate Support", + "description": "Grow or maintain the base of support for the actor, ally, or action. This includes hard core recruitment, managing alliances, and generating or maintaining sympathy among a wider audience, including reputation management and public relations. Sub-techniques assume support for actor (self) unless otherwise specified. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.md", + "external_id": "T0136" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051.json index 3d4d789..345fe6b 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d6e00044-58a7-4ddb-bf88-30f8653b5f09", + "id": "bundle--f3eee90c-eaba-4fe4-bc69-1e48f329772e", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.279115Z", - "modified": "2023-09-28T21:25:13.279115Z", + "created": "2024-08-02T17:12:32.415084Z", + "modified": "2024-08-02T17:12:32.415084Z", "name": "Conceal Operational Activity", "description": "Conceal the campaign's operational activity to avoid takedown and attribution.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69.json index ccc96e9..a365e77 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c1247e3b-818a-4a71-b381-cbedbde5efe1", + "id": "bundle--9ff46e68-6a01-4053-92e6-0abd694f8d69", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.211835Z", - "modified": "2023-09-28T21:25:13.211835Z", + "created": "2024-08-02T17:12:32.350844Z", + "modified": "2024-08-02T17:12:32.350844Z", "name": "Conduct Keyword Squatting", "description": "Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7.json index 3450342..b492e58 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--869a9a71-029c-4338-8243-0d7ee648acaa", + "id": "bundle--3940f8c5-8b74-480b-97a9-9246f9a439d4", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.247708Z", - "modified": "2023-09-28T21:25:13.247708Z", + "created": "2024-08-02T17:12:32.382258Z", + "modified": "2024-08-02T17:12:32.382258Z", "name": "Leverage Content Farms", "description": "Using the services of large-scale content providers for creating and amplifying campaign artefacts at scale.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b.json index 581c415..12ca3b8 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--806c52c7-049a-4309-9cc4-54e8ef929b0c", + "id": "bundle--2af4cfde-2a63-497e-bdb2-a5abdb6e7bbb", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.27669Z", - "modified": "2023-09-28T21:25:13.27669Z", + "created": "2024-08-02T17:12:32.412914Z", + "modified": "2024-08-02T17:12:32.412914Z", "name": "Encourage Attendance at Events", "description": "Operation encourages attendance at existing real world event.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0b662d26-ea3d-45d2-87e8-b32296ad9227.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0b662d26-ea3d-45d2-87e8-b32296ad9227.json new file mode 100644 index 0000000..012b076 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0b662d26-ea3d-45d2-87e8-b32296ad9227.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--cc1110ee-d357-45f6-8867-72ff03c2935c", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--0b662d26-ea3d-45d2-87e8-b32296ad9227", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.372647Z", + "modified": "2024-08-02T17:12:32.372647Z", + "name": "Create Fake Research", + "description": "Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx.

This Technique previously used the ID T0019.001.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "develop-content" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.007.md", + "external_id": "T0085.007" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0c2c22ae-5115-4b91-9e0f-08259e6aad99.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0c2c22ae-5115-4b91-9e0f-08259e6aad99.json new file mode 100644 index 0000000..29ba172 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0c2c22ae-5115-4b91-9e0f-08259e6aad99.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--a1ab6ca7-8c0e-4e6e-ada2-d5acbfb8f0ae", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--0c2c22ae-5115-4b91-9e0f-08259e6aad99", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431925Z", + "modified": "2024-08-02T17:12:32.431925Z", + "name": "Persona Legitimacy Evidence", + "description": "This Technique contains behaviours which might indicate whether a persona is legitimate, a fabrication, or a parody.

For example, the same persona being consistently presented across platforms is consistent with how authentic users behave on social media. However, threat actors have also displayed this behaviour as a way to increase the perceived legitimacy of their fabricated personas (aka \u201cbackstopping\u201d).", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0144.md", + "external_id": "T0144" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc.json index 4c76704..6748b63 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc.json @@ -1,16 +1,16 @@ { "type": "bundle", - "id": "bundle--6ac57769-ec69-4864-9538-3087bbba30c8", + "id": "bundle--af67a6d7-fd4e-496d-aaad-7c9eb0bb0f2a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.21044Z", - "modified": "2023-09-28T21:25:13.21044Z", - "name": "Flooding the Information Space", - "description": "Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.", + "created": "2024-08-02T17:12:32.347894Z", + "modified": "2024-08-02T17:12:32.347894Z", + "name": "Flood Information Space", + "description": "Flooding sources of information (e.g. Social Media feeds) with a high volume of inauthentic content.

This can be done to control/shape online conversations, drown out opposing points of view, or make it harder to find legitimate information.

Bots and/or patriotic trolls are effective tools to achieve this effect.

This Technique previously used the name Flooding the Information Space.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944.json index b20de2e..211458a 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--df5f361a-9a5c-46e4-a3b9-3c67065697c5", + "id": "bundle--6bc8d3c5-c0a8-49e4-9941-75104d2435a9", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.272851Z", - "modified": "2023-09-28T21:25:13.272851Z", + "created": "2024-08-02T17:12:32.408822Z", + "modified": "2024-08-02T17:12:32.408822Z", "name": "Post across Groups", "description": "An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39.json index 0b29a7a..8063625 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--3a92da8a-6f8d-4cee-a3f1-c71f43c3cd5a", + "id": "bundle--49eee4c9-4f69-4fb3-8c3b-8e45da598a06", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.206512Z", - "modified": "2023-09-28T21:25:13.206512Z", + "created": "2024-08-02T17:12:32.344715Z", + "modified": "2024-08-02T17:12:32.344715Z", "name": "Use Fake Experts", "description": "Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give \"credility\" to misinformation. Take advantage of credential bias", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0dc4a07b-94cb-4743-b812-3fc3c8288551.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0dc4a07b-94cb-4743-b812-3fc3c8288551.json new file mode 100644 index 0000000..74d6b97 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0dc4a07b-94cb-4743-b812-3fc3c8288551.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--40e59355-99e8-4eee-9115-9fd7707383c3", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--0dc4a07b-94cb-4743-b812-3fc3c8288551", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.423683Z", + "modified": "2024-08-02T17:12:32.423683Z", + "name": "Energise Supporters", + "description": "Raise the morale of those who support the organisation or group. Invigorate constituents with zeal for the mission or activity. Terrorist groups, political movements, and cults may indoctrinate their supporters with ideologies that are based on warped versions of religion or cause harm to others. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.003.md", + "external_id": "T0136.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0e605049-ac7a-46a9-bbac-ef0a69e160cb.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0e605049-ac7a-46a9-bbac-ef0a69e160cb.json new file mode 100644 index 0000000..ea4f46e --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0e605049-ac7a-46a9-bbac-ef0a69e160cb.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--a1972020-cf23-4c88-b0ca-18dcee13130d", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--0e605049-ac7a-46a9-bbac-ef0a69e160cb", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.433674Z", + "modified": "2024-08-02T17:12:32.433674Z", + "name": "Attractive Person Account Imagery", + "description": "Attractive person used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

Pictures of physically attractive people can benefit threat actors by increasing attention given to their posts.

People sometimes legitimately use images of attractive people as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.

Associated Techniques and Sub-techniques
T0097.109: Romantic Suitor Persona: Accounts presenting as a romantic suitor may use an attractive person in their account imagery.
T0104.002: Dating App: Analysts can use this sub-technique for tagging cases where an account has been identified as using a dating platform.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.006.md", + "external_id": "T0145.006" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9.json index 9ae3fc7..648e417 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d03b0d2a-e3bd-4077-8b6a-e0a3b8c23a76", + "id": "bundle--fb40e740-8007-4e6e-977a-7dcd7c3e05e6", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.256347Z", - "modified": "2023-09-28T21:25:13.256347Z", + "created": "2024-08-02T17:12:32.399545Z", + "modified": "2024-08-02T17:12:32.399545Z", "name": "Livestream", "description": "A livestream refers to an online broadcast capability that allows for real-time communication to closed or open networks.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5.json index 0557929..e80e9a5 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--92bb24f3-0189-4c1b-8650-52ee3c63e2fa", + "id": "bundle--deb25743-ee30-42c8-a86d-7368e5fa0cd8", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.254922Z", - "modified": "2023-09-28T21:25:13.254922Z", + "created": "2024-08-02T17:12:32.396562Z", + "modified": "2024-08-02T17:12:32.396562Z", "name": "Create Localised Content", "description": "Localised content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localised content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localised content may help an operation increase legitimacy, avoid detection, and complicate external attribution.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb.json index c0bfa74..24d0cc1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--815c8801-b5bf-4ce1-9cc8-8502206826eb", + "id": "bundle--52fca5ca-b49e-4b9e-ad30-21b67ebf5ef4", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.2094Z", - "modified": "2023-09-28T21:25:13.2094Z", + "created": "2024-08-02T17:12:32.346525Z", + "modified": "2024-08-02T17:12:32.346525Z", "name": "Threaten to Dox", "description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e.json index a5b6d2c..b9463c4 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--16d67122-d992-4258-9654-4e144f7db6a3", + "id": "bundle--c3d7ea01-fc3c-4177-b13c-e4e52587459e", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.227448Z", - "modified": "2023-09-28T21:25:13.227448Z", + "created": "2024-08-02T17:12:32.368028Z", + "modified": "2024-08-02T17:12:32.368028Z", "name": "Develop New Narratives", "description": "Actors may develop new narratives to further strategic or tactical goals, especially when existing narratives adequately align with the campaign goals. New narratives provide more control in terms of crafting the message to achieve specific goals. However, new narratives may require more effort to disseminate than adapting or adopting existing narratives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9.json index cd44028..56cc8d5 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--ce822db7-2c37-44b2-bb15-40bfcf69c926", + "id": "bundle--551cc2bb-8ed4-4f30-82c8-bda74bdc7899", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.274372Z", - "modified": "2023-09-28T21:25:13.274372Z", + "created": "2024-08-02T17:12:32.410743Z", + "modified": "2024-08-02T17:12:32.410743Z", "name": "Control Information Environment through Offensive Cyberspace Operations", "description": "Controlling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of content in the information space to either prioritise operation messaging or block opposition messaging.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--150be76a-9bdc-4f1d-837c-6a845d1eda1c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--150be76a-9bdc-4f1d-837c-6a845d1eda1c.json new file mode 100644 index 0000000..3a96210 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--150be76a-9bdc-4f1d-837c-6a845d1eda1c.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--35f139fc-d892-4d6a-ac87-389b3c1623c1", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--150be76a-9bdc-4f1d-837c-6a845d1eda1c", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.424095Z", + "modified": "2024-08-02T17:12:32.424095Z", + "name": "Boost Reputation", + "description": "Elevate the estimation of the actor in the public\u2019s mind. Improve their image or standing. Public relations professionals use persuasive overt communications to achieve this goal; manipulators use covert disinformation. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.004.md", + "external_id": "T0136.004" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--15ca8e62-e179-4dd8-9f5e-427771e915a3.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--15ca8e62-e179-4dd8-9f5e-427771e915a3.json new file mode 100644 index 0000000..91ceff4 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--15ca8e62-e179-4dd8-9f5e-427771e915a3.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--e7fb76aa-a303-4635-a5db-c2e8299a03a7", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--15ca8e62-e179-4dd8-9f5e-427771e915a3", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.391349Z", + "modified": "2024-08-02T17:12:32.391349Z", + "name": "Think Tank Persona", + "description": "An institution with a think tank persona presents itself as a think tank; an organisation that aims to conduct original research and propose new policies or solutions, especially for social and scientific problems.

While presenting as a think tank is not an indication of inauthentic behaviour, think tank personas are commonly used by threat actors as a front for their operational activity (T0143.002: Fabricated Persona, T0097.204: Think Tank Persona). They may be created to give legitimacy to narratives and allow them to suggest politically beneficial solutions to societal issues.

Legitimate think tanks could have a political bias that they may not be transparent about, they could use their persona for malicious purposes, or they could be exploited by threat actors (T0143.001: Authentic Persona, T0097.204: Think Tank Persona). For example, a think tank could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.107: Researcher Persona: Institutions presenting as think tanks may also present researchers working within the organisation.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.204.md", + "external_id": "T0097.204" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--15cba133-fa27-4632-9996-22b74751749a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--15cba133-fa27-4632-9996-22b74751749a.json new file mode 100644 index 0000000..7db094e --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--15cba133-fa27-4632-9996-22b74751749a.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--e1b8ccd4-988a-497c-a9c6-80f3cef8b999", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--15cba133-fa27-4632-9996-22b74751749a", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.433235Z", + "modified": "2024-08-02T17:12:32.433235Z", + "name": "Scenery Account Imagery", + "description": "Scenery or nature used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

People sometimes legitimately use images of scenery as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.004.md", + "external_id": "T0145.004" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--16583ab1-7dae-470c-8bd1-b7ffa1f9b13f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--16583ab1-7dae-470c-8bd1-b7ffa1f9b13f.json new file mode 100644 index 0000000..bf60127 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--16583ab1-7dae-470c-8bd1-b7ffa1f9b13f.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--f58cb3cc-e84e-4578-a985-afb82423e470", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--16583ab1-7dae-470c-8bd1-b7ffa1f9b13f", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.422003Z", + "modified": "2024-08-02T17:12:32.422003Z", + "name": "Smear", + "description": "Denigrate, disparage, or discredit an opponent. This is a common tactical objective in political campaigns with a larger strategic goal. It differs from efforts to harm a target through defamation. If there is no ulterior motive and the sole aim is to cause harm to the target, then choose sub-technique \u201cDefame\u201d of technique \u201cCause Harm\u201d instead.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.001.md", + "external_id": "T0135.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03.json index 15cb568..a469ecf 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03.json @@ -1,16 +1,16 @@ { "type": "bundle", - "id": "bundle--f217bf9f-cbe8-40f1-b842-2c589fa35221", + "id": "bundle--3ed4b837-7930-4492-baff-965cdc582ef7", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.230922Z", - "modified": "2023-09-28T21:25:13.230922Z", + "created": "2024-08-02T17:12:32.370771Z", + "modified": "2024-08-02T17:12:32.370771Z", "name": "Develop AI-Generated Text", - "description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.", + "description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.

Associated Techniques and Sub-techniques:
T0085.008: Machine Translated Text: Use this sub-technique when AI has been used to generate a translation of a piece of text.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1997947a-7e08-4ea9-802c-85391d561266.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1997947a-7e08-4ea9-802c-85391d561266.json index 56a961f..a5f0211 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1997947a-7e08-4ea9-802c-85391d561266.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1997947a-7e08-4ea9-802c-85391d561266.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--80ec494f-bad1-4f84-85b0-cf9cfde169f7", + "id": "bundle--1f5ef84b-c3a1-4714-97b6-2a1ad201a911", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1997947a-7e08-4ea9-802c-85391d561266", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.268338Z", - "modified": "2023-09-28T21:25:13.268338Z", + "created": "2024-08-02T17:12:32.406924Z", + "modified": "2024-08-02T17:12:32.406924Z", "name": "Post Content", "description": "Delivering content by posting via owned media (assets that the operator controls).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146.json index 145cd90..490d9e1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1fe5fb34-dbda-44e4-acac-d0e5f45ebf40", + "id": "bundle--ee098dbb-4ee9-46d3-a5a6-9cfe4b0307fd", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.22009Z", - "modified": "2023-09-28T21:25:13.22009Z", + "created": "2024-08-02T17:12:32.361233Z", + "modified": "2024-08-02T17:12:32.361233Z", "name": "Distort", "description": "Twist the narrative. Take information, or artefacts like images, and change the framing around them.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c.json index 8362d10..e4ab1e9 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--305e5346-1792-4b24-baa9-68ccbcf07386", + "id": "bundle--80a6cb32-48e5-4423-a547-751e93db2b94", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.289879Z", - "modified": "2023-09-28T21:25:13.289879Z", + "created": "2024-08-02T17:12:32.420979Z", + "modified": "2024-08-02T17:12:32.420979Z", "name": "Action/Attitude", "description": "Measure current system state with respect to the effectiveness of influencing action/attitude.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635.json index 5533c31..0bb2428 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--6110421d-886d-4664-87e0-fe3072ad1829", + "id": "bundle--b3389001-36a8-411e-b389-837bb7db12da", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.210665Z", - "modified": "2023-09-28T21:25:13.210665Z", + "created": "2024-08-02T17:12:32.348471Z", + "modified": "2024-08-02T17:12:32.348471Z", "name": "Trolls Amplify and Manipulate", "description": "Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132.json index 8dab523..9591fcd 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--3fcf4a8d-335e-4e1f-9906-9bde08ced2fe", + "id": "bundle--ba497caf-d32f-40c0-9237-78680cb25ae9", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.221608Z", - "modified": "2023-09-28T21:25:13.221608Z", + "created": "2024-08-02T17:12:32.362521Z", + "modified": "2024-08-02T17:12:32.362521Z", "name": "Divide", "description": "Create conflict between subgroups, to widen divisions in a community", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8.json index 0a0453b..0409f15 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--885db17d-b390-4455-9431-59a8034e8fc2", + "id": "bundle--b2012feb-cb7f-4b42-a231-92ef6cf84b42", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.260018Z", - "modified": "2023-09-28T21:25:13.260018Z", + "created": "2024-08-02T17:12:32.403282Z", + "modified": "2024-08-02T17:12:32.403282Z", "name": "Video Sharing", "description": "Examples include Youtube, TikTok, ShareChat, Rumble, etc", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d917530-027d-4f82-b380-404c320dc783.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d917530-027d-4f82-b380-404c320dc783.json index 903f12f..50eee33 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d917530-027d-4f82-b380-404c320dc783.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d917530-027d-4f82-b380-404c320dc783.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f8a98b0c-d415-42ed-bd09-d92bbede864d", + "id": "bundle--f663935c-16a2-4811-b67e-3944b29e5c65", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1d917530-027d-4f82-b380-404c320dc783", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.216032Z", - "modified": "2023-09-28T21:25:13.216032Z", + "created": "2024-08-02T17:12:32.356564Z", + "modified": "2024-08-02T17:12:32.356564Z", "name": "Economic Segmentation", "description": "An influence operation may target populations based on their income bracket, wealth, or other financial or economic division.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1e817a7b-5f96-48d0-a2f9-7ba53c168397.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1e817a7b-5f96-48d0-a2f9-7ba53c168397.json new file mode 100644 index 0000000..14d05b5 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1e817a7b-5f96-48d0-a2f9-7ba53c168397.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--15ebf512-b461-488d-b4a4-4e572a86c2ef", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--1e817a7b-5f96-48d0-a2f9-7ba53c168397", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.373021Z", + "modified": "2024-08-02T17:12:32.373021Z", + "name": "Machine Translated Text", + "description": "Text which has been translated into another language using machine translation tools, such as AI.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "develop-content" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.008.md", + "external_id": "T0085.008" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4.json index 5ce1a3d..b9260f9 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b902ec75-3655-428a-b579-e421b5f22f6e", + "id": "bundle--734a0d99-4aa6-4d47-90cf-46582be43356", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.276828Z", - "modified": "2023-09-28T21:25:13.276828Z", + "created": "2024-08-02T17:12:32.413057Z", + "modified": "2024-08-02T17:12:32.413057Z", "name": "Call to Action to Attend", "description": "Call to action to attend an event", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae.json index 0cc2bef..29c82ed 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--4f658070-6407-496d-9da4-52ffdff60192", + "id": "bundle--d9571e7a-2b61-4400-8834-5d08863d0d1e", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.27818Z", - "modified": "2023-09-28T21:25:13.27818Z", + "created": "2024-08-02T17:12:32.414283Z", + "modified": "2024-08-02T17:12:32.414283Z", "name": "Conceal Network Identity", "description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794.json index 6522085..1e807ac 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--47a925ff-1268-4aa7-b09f-adb1dd5ac364", + "id": "bundle--72d4cdda-ecd9-4ff5-806c-658e265db5c6", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.195168Z", - "modified": "2023-09-28T21:25:13.195168Z", + "created": "2024-08-02T17:12:32.335027Z", + "modified": "2024-08-02T17:12:32.335027Z", "name": "Prepare Fundraising Campaigns", "description": "Fundraising campaigns refer to an influence operation\u2019s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9.json index cf2b381..cee1a49 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--bd956c8e-2b1e-4b2d-9d3b-7a72a2bf0b9f", + "id": "bundle--040db928-c41c-4eb7-9788-3024186c191c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.204367Z", - "modified": "2023-09-28T21:25:13.204367Z", + "created": "2024-08-02T17:12:32.343925Z", + "modified": "2024-08-02T17:12:32.343925Z", "name": "Chat Apps", "description": "Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4.json index 1ffee57..b816345 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--6932f059-0b1f-4ac7-9479-aa083f500e32", + "id": "bundle--7eeb1560-5bf0-4f48-951e-f7ff3b36a3d7", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.266341Z", - "modified": "2023-09-28T21:25:13.266341Z", + "created": "2024-08-02T17:12:32.405913Z", + "modified": "2024-08-02T17:12:32.405913Z", "name": "Employ Commercial Analytic Firms", "description": "Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "conduct-pump-priming" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--269dbccd-0cff-4f60-a0bf-253eba9bcc63.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--269dbccd-0cff-4f60-a0bf-253eba9bcc63.json new file mode 100644 index 0000000..b09c0d9 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--269dbccd-0cff-4f60-a0bf-253eba9bcc63.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--12c93ca9-c732-4672-94b0-438ed79dbee1", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--269dbccd-0cff-4f60-a0bf-253eba9bcc63", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.372218Z", + "modified": "2024-08-02T17:12:32.372218Z", + "name": "Develop Opinion Article", + "description": "Opinion articles (aka \u201cOp-Eds\u201d or \u201cEditorials\u201d) are articles or regular columns flagged as \u201copinion\u201d posted to news sources, and can be contributed by people outside the organisation.\u00a0

Flagging articles as opinions allow news organisations to distinguish them from the typical expectations of objective news reporting while distancing the presented opinion from the organisation or its employees.

The use of this technique is not by itself an indication of malicious or inauthentic content; Op-eds are a common format in media. However, threat actors exploit op-eds to, for example, submit opinion articles to local media to promote their narratives.

Examples from the perspective of a news site involve publishing op-eds from perceived prestigious voices to give legitimacy to an inauthentic publication, or supporting causes by hosting op-eds from actors aligned with the organisation\u2019s goals.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "develop-content" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.006.md", + "external_id": "T0085.006" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5.json index 9dbfa9c..edd8ff4 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b8903b69-42ef-4c7f-8d29-e0664ebf3893", + "id": "bundle--37701d8b-9802-463a-94bd-88beef82ff4e", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.265297Z", - "modified": "2023-09-28T21:25:13.265297Z", + "created": "2024-08-02T17:12:32.405517Z", + "modified": "2024-08-02T17:12:32.405517Z", "name": "Radio", "description": "Radio", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--283333f5-e161-4195-9070-5a7c22505adf.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--283333f5-e161-4195-9070-5a7c22505adf.json index 1d979bd..1ebd5ed 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--283333f5-e161-4195-9070-5a7c22505adf.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--283333f5-e161-4195-9070-5a7c22505adf.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--793cc6ec-dc65-4bf2-a3a5-425e83da0a68", + "id": "bundle--ef89e3d2-02a9-46a0-b179-3fda040b6499", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--283333f5-e161-4195-9070-5a7c22505adf", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.252865Z", - "modified": "2023-09-28T21:25:13.252865Z", + "created": "2024-08-02T17:12:32.394819Z", + "modified": "2024-08-02T17:12:32.394819Z", "name": "Co-Opt Trusted Sources", "description": "An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: - National or local new outlets - Research or academic publications - Online blogs or websites", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1.json index 9c0e1d8..5922ef9 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--6217b633-fcd8-470f-bf91-16f51d9b02db", + "id": "bundle--003c54f5-0c77-4697-8e79-502d89eba65c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.24035Z", - "modified": "2023-09-28T21:25:13.24035Z", + "created": "2024-08-02T17:12:32.377423Z", + "modified": "2024-08-02T17:12:32.377423Z", "name": "Create Anonymous Accounts", "description": "Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--29a3ec78-469a-43b8-b0ae-9f34c58316f2.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--29a3ec78-469a-43b8-b0ae-9f34c58316f2.json new file mode 100644 index 0000000..6878d9c --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--29a3ec78-469a-43b8-b0ae-9f34c58316f2.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--8d8572f9-b8fc-4a9a-b423-5e048f99c31e", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--29a3ec78-469a-43b8-b0ae-9f34c58316f2", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.428473Z", + "modified": "2024-08-02T17:12:32.428473Z", + "name": "Provoke", + "description": "Instigate, incite, or arouse a target to act. Social media manipulators exploit moral outrage to propel targets to spread hate, take to the streets to protest, or engage in acts of violence. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.002.md", + "external_id": "T0138.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9.json index 1f23167..6eddaf7 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d2c4d87c-409f-4f32-9a31-9e337e970741", + "id": "bundle--9e5e873e-0bbc-4f26-a402-3e23c6485c76", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.273283Z", - "modified": "2023-09-28T21:25:13.273283Z", + "created": "2024-08-02T17:12:32.409219Z", + "modified": "2024-08-02T17:12:32.409219Z", "name": "Post across Disciplines", "description": "Post Across Disciplines", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2b1270a6-d432-453f-88cf-17fa38ec6f40.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2b1270a6-d432-453f-88cf-17fa38ec6f40.json new file mode 100644 index 0000000..dbd24a2 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2b1270a6-d432-453f-88cf-17fa38ec6f40.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--8f7ffd2f-5739-49ff-8fb7-29e2dc02f3ff", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--2b1270a6-d432-453f-88cf-17fa38ec6f40", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.359451Z", + "modified": "2024-08-02T17:12:32.359451Z", + "name": "Economic Advantage", + "description": "Favourable position domestically or internationally in the realms of commerce, trade, finance, industry. Economics involves nation-states, corporations, banks, trade blocs, industry associations, cartels. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-strategy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.003.md", + "external_id": "T0074.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e.json index 34c4d89..e483639 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--707137b3-6225-472e-a07c-4a92d0a22b6c", + "id": "bundle--42842123-6a10-4b1b-84ff-4e826a17a3e2", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.277436Z", - "modified": "2023-09-28T21:25:13.277436Z", + "created": "2024-08-02T17:12:32.413845Z", + "modified": "2024-08-02T17:12:32.413845Z", "name": "Encourage Physical Violence", "description": "An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1.json index 71af7ee..7156337 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--44f9daac-a4fc-4e7e-9682-03efa042ab82", + "id": "bundle--a7887cf0-e79d-4f64-9943-ded469cee484", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.222968Z", - "modified": "2023-09-28T21:25:13.222968Z", + "created": "2024-08-02T17:12:32.363691Z", + "modified": "2024-08-02T17:12:32.363691Z", "name": "Evaluate Media Surveys", "description": "An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience\u2019s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9.json index 1ae133e..d772c26 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c7ea2d2f-edf4-491f-9d18-8a26b73d30ff", + "id": "bundle--33704128-7b3a-40df-b6d7-2a3e3a67f3d4", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.205471Z", - "modified": "2023-09-28T21:25:13.205471Z", + "created": "2024-08-02T17:12:32.344274Z", + "modified": "2024-08-02T17:12:32.344274Z", "name": "Use Unencrypted Chats Apps", "description": "Examples include SMS, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321.json index f62111e..b9e5667 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--386d5b67-da78-41e2-a782-36e8d364c8bd", + "id": "bundle--2212b83b-6b9c-4dd4-bc40-17d1798d55e1", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.250986Z", - "modified": "2023-09-28T21:25:13.250986Z", + "created": "2024-08-02T17:12:32.394405Z", + "modified": "2024-08-02T17:12:32.394405Z", "name": "Leverage Existing Inauthentic News Sites", "description": "Leverage Existing Inauthentic News Sites", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e.json index f1a92a2..ddfee00 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--597df03d-5951-42b5-a04b-a2aab5bc9ecf", + "id": "bundle--496df3e6-88a6-4c59-88ae-66a25293731e", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.263697Z", - "modified": "2023-09-28T21:25:13.263697Z", + "created": "2024-08-02T17:12:32.404876Z", + "modified": "2024-08-02T17:12:32.404876Z", "name": "Traditional Media", "description": "Examples include TV, Newspaper, Radio, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc.json index f46bf67..c914823 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--411884ce-8862-403a-ac58-1ebf7cb5fb49", + "id": "bundle--2964be6a-3bd9-42cd-84b3-e509dcbd1673", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.270307Z", - "modified": "2023-09-28T21:25:13.270307Z", + "created": "2024-08-02T17:12:32.407759Z", + "modified": "2024-08-02T17:12:32.407759Z", "name": "Comment or Reply on Content", "description": "Delivering content by replying or commenting via owned media (assets that the operator controls).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7.json index 6f2b703..c0303c4 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9f1138e3-d221-4fb8-9853-210f71b9fd2e", + "id": "bundle--42a8c8de-5c27-4fd0-b5e4-16cc5208614a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.203339Z", - "modified": "2023-09-28T21:25:13.203339Z", + "created": "2024-08-02T17:12:32.343565Z", + "modified": "2024-08-02T17:12:32.343565Z", "name": "Demand Insurmountable Proof", "description": "Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the \"firehose of misinformation\". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of \"questions\" while the truth teller is burdened with higher and higher standards of proof.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6.json index 23f895c..16cd600 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c25a4ed5-ff5c-4184-af40-63185fd027f0", + "id": "bundle--76eee4c5-b6e3-4149-a33e-b3a542c5bcaf", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.282451Z", - "modified": "2023-09-28T21:25:13.282451Z", + "created": "2024-08-02T17:12:32.416684Z", + "modified": "2024-08-02T17:12:32.416684Z", "name": "Redirect URLs", "description": "An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8.json index a73651d..509c9ec 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--4d5be5ab-9066-40d6-af57-347d231e4fb6", + "id": "bundle--37168ac0-549c-403a-9d31-41fe19a3ea17", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.231884Z", - "modified": "2023-09-28T21:25:13.231884Z", + "created": "2024-08-02T17:12:32.371128Z", + "modified": "2024-08-02T17:12:32.371128Z", "name": "Develop Inauthentic News Articles", "description": "An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb.json index 27501b1..31494b2 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--dedb20af-a3ed-4eb4-8daf-16cd2e08c1e6", + "id": "bundle--782f4bc8-b4e3-47c5-a57e-07b1c7ff3d1b", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.285122Z", - "modified": "2023-09-28T21:25:13.285122Z", + "created": "2024-08-02T17:12:32.417607Z", + "modified": "2024-08-02T17:12:32.417607Z", "name": "Utilise Bulletproof Hosting", "description": "Hosting refers to services through which storage and computing resources are provided to an individual or organisation for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilise bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3437993c-c521-4145-a2d8-b860399876b0.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3437993c-c521-4145-a2d8-b860399876b0.json index 0d73677..cf2fe52 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3437993c-c521-4145-a2d8-b860399876b0.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3437993c-c521-4145-a2d8-b860399876b0.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--eeaf0531-be7c-45b6-afc0-dbed1617f77c", + "id": "bundle--42dd1428-e91b-4115-b7f2-1708f01f77e1", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3437993c-c521-4145-a2d8-b860399876b0", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.2801Z", - "modified": "2023-09-28T21:25:13.2801Z", + "created": "2024-08-02T17:12:32.415535Z", + "modified": "2024-08-02T17:12:32.415535Z", "name": "Break Association with Content", "description": "Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d.json index cd0658f..5ac5240 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a6d496d1-d241-4852-b5d4-327c5ffd64e2", + "id": "bundle--9a378790-917c-4006-851f-8de2ffa81c4c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.195892Z", - "modified": "2023-09-28T21:25:13.195892Z", + "created": "2024-08-02T17:12:32.336169Z", + "modified": "2024-08-02T17:12:32.336169Z", "name": "Create Clickbait", "description": "Create attention grabbing headlines (outrage, doubt, humour) required to drive traffic & engagement. This is a key asset.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca.json index fb17305..79c83b1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--bcd1ecab-1563-4d85-8e3b-80064349facd", + "id": "bundle--35b0650e-99bb-404c-a54c-bb48d9d22b2c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.267305Z", - "modified": "2023-09-28T21:25:13.267305Z", + "created": "2024-08-02T17:12:32.406496Z", + "modified": "2024-08-02T17:12:32.406496Z", "name": "Social Media", "description": "Social Media", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12.json index f757749..0d00631 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1d1a0b5f-1be3-4c52-8c8c-6f7466953698", + "id": "bundle--22d772ff-e5f6-4ace-b4eb-116b885c22e7", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.258959Z", - "modified": "2023-09-28T21:25:13.258959Z", + "created": "2024-08-02T17:12:32.402241Z", + "modified": "2024-08-02T17:12:32.402241Z", "name": "Create Dedicated Hashtag", "description": "Create a campaign/incident specific hashtag.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291.json index b4c2ae1..8486ccc 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--3713c941-49b8-4f24-8083-6c506a11ce72", + "id": "bundle--bdc125c5-3611-4532-b229-2944ab0c001a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.275328Z", - "modified": "2023-09-28T21:25:13.275328Z", + "created": "2024-08-02T17:12:32.411564Z", + "modified": "2024-08-02T17:12:32.411564Z", "name": "Conduct Server Redirect", "description": "A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side or client-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3628a6fd-b102-48a0-862b-9b66e80ee556.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3628a6fd-b102-48a0-862b-9b66e80ee556.json new file mode 100644 index 0000000..426ca1c --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3628a6fd-b102-48a0-862b-9b66e80ee556.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--a4bfe7b9-645e-4af2-a1db-a3871e60e58f", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--3628a6fd-b102-48a0-862b-9b66e80ee556", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.427838Z", + "modified": "2024-08-02T17:12:32.427838Z", + "name": "Manipulate Stocks", + "description": "Artificially inflate or deflate the price of stocks or other financial instruments and then trade on these to make profit. The most common securities fraud schemes are called \u201cpump and dump\u201d and \u201cpoop and scoop\u201d. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.006.md", + "external_id": "T0137.006" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16.json index ae96523..13ebdfb 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--6a0de0a1-88d4-4005-8a2c-e41f4063bb91", + "id": "bundle--d21e749a-399c-40b4-9c7b-209f278ef8c2", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.204899Z", - "modified": "2023-09-28T21:25:13.204899Z", + "created": "2024-08-02T17:12:32.344084Z", + "modified": "2024-08-02T17:12:32.344084Z", "name": "Use Encrypted Chat Apps", "description": "Examples include Signal, WhatsApp, Discord, Wire, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9.json index 0d2b9bb..6a3a1c1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--f9bab428-c384-4942-b2de-195baf6ac01b", + "id": "bundle--59297cc3-eb4a-44e7-ad66-2cd6992a7cad", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.243236Z", - "modified": "2023-09-28T21:25:13.243236Z", + "created": "2024-08-02T17:12:32.379779Z", + "modified": "2024-08-02T17:12:32.379779Z", "name": "Use Follow Trains", "description": "A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea.json index 102e8e9..7a83acf 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea.json @@ -1,16 +1,16 @@ { "type": "bundle", - "id": "bundle--597354a2-caf2-4a4f-937b-3ba4210154dd", + "id": "bundle--68a42eb4-50cb-4b46-8c13-b9cc08efa754", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.239371Z", - "modified": "2023-09-28T21:25:13.239371Z", + "created": "2024-08-02T17:12:32.37699Z", + "modified": "2024-08-02T17:12:32.37699Z", "name": "Alter Authentic Documents", - "description": "Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic can be \"leaked\" during later stages in the operation.", + "description": "Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic and can be \"leaked\" during later stages in the operation.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85.json index d2ff672..281144d 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--9763ce34-ff06-439f-9e5a-6189eb3500d7", + "id": "bundle--8d0c90be-850b-4d32-8460-c499ca709224", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.248135Z", - "modified": "2023-09-28T21:25:13.248135Z", + "created": "2024-08-02T17:12:32.382597Z", + "modified": "2024-08-02T17:12:32.382597Z", "name": "Create Content Farms", "description": "An influence operation may create an organisation for creating and amplifying campaign artefacts at scale.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1.json index ac3aca8..24bf5db 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--7930ed30-e163-4178-b29d-60e7e54310ff", + "id": "bundle--308050af-565a-4fa0-82d9-b0587771b5e9", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.276967Z", - "modified": "2023-09-28T21:25:13.276967Z", + "created": "2024-08-02T17:12:32.413199Z", + "modified": "2024-08-02T17:12:32.413199Z", "name": "Facilitate Logistics or Support for Attendance", "description": "Facilitate logistics or support for travel, food, housing, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72.json index 118b0f2..875eaf9 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--7b84f97c-4639-43b1-a7b5-a15b77650011", + "id": "bundle--db232d51-2359-4ae5-a4e3-3e0c741ded1a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.255837Z", - "modified": "2023-09-28T21:25:13.255837Z", + "created": "2024-08-02T17:12:32.398558Z", + "modified": "2024-08-02T17:12:32.398558Z", "name": "Use Existing Echo Chambers/Filter Bubbles", "description": "Use existing Echo Chambers/Filter Bubbles", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--39f767f7-bc22-4611-8a39-3584c5bbdd5a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--39f767f7-bc22-4611-8a39-3584c5bbdd5a.json new file mode 100644 index 0000000..ea72adf --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--39f767f7-bc22-4611-8a39-3584c5bbdd5a.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--85f7691c-68e0-422e-a862-ea047aacc5c5", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--39f767f7-bc22-4611-8a39-3584c5bbdd5a", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.383638Z", + "modified": "2024-08-02T17:12:32.383638Z", + "name": "Individual Persona", + "description": "This sub-technique can be used to indicate that an entity is presenting itself as an individual. If the person is presenting themselves as having one of the personas listed below then these sub-techniques should be used instead, as they indicate both the type of persona they presented and that the entity presented itself as an individual:

T0097.101: Local Persona
T0097.102: Journalist Persona
T0097.103: Activist Persona
T0097.104: Hacktivist Persona
T0097.105: Military Personnel Persona
T0097.106: Recruiter Persona
T0097.107: Researcher Persona
T0097.108: Expert Persona
T0097.109: Romantic Suitor Persona
T0097.110: Party Official Persona
T0097.111: Government Official Persona
T0097.112: Government Employee Persona", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.100.md", + "external_id": "T0097.100" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3a2f96fa-c3d0-4f54-a041-6807f0ea4955.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3a2f96fa-c3d0-4f54-a041-6807f0ea4955.json new file mode 100644 index 0000000..18b2d3a --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3a2f96fa-c3d0-4f54-a041-6807f0ea4955.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--085b8da4-ab11-404b-bd59-9f25ad7b5334", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--3a2f96fa-c3d0-4f54-a041-6807f0ea4955", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.351504Z", + "modified": "2024-08-02T17:12:32.351504Z", + "name": "Generate Information Pollution", + "description": "Information Pollution occurs when threat actors attempt to ruin a source of information by flooding it with lots of inauthentic or unreliable content, intending to make it harder for legitimate users to find the information they\u2019re looking for.

This sub-technique\u2019s objective is to reduce exposure to target information, rather than promoting exposure to campaign content, for which the parent Technique T0049 can be used.

Analysts will need to infer what the motive for flooding an information space was when deciding whether to use T0049 or T0049.008 to tag a case when an information space is flooded. If such inference is not possible, default to T0049.

This Technique previously used the ID T0019.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "maximise-exposure" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.008.md", + "external_id": "T0049.008" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3af9d1c0-9a09-4dba-8975-a204e6951ac4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3af9d1c0-9a09-4dba-8975-a204e6951ac4.json new file mode 100644 index 0000000..6bf8150 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3af9d1c0-9a09-4dba-8975-a204e6951ac4.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--da43971f-8360-411f-8b0a-2e235b06ad4a", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--3af9d1c0-9a09-4dba-8975-a204e6951ac4", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.428678Z", + "modified": "2024-08-02T17:12:32.428678Z", + "name": "Compel", + "description": "Force target to take an action or to stop taking an action it has already started. Actors can use the threat of reputational damage alongside military or economic threats to compel a target.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.003.md", + "external_id": "T0138.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3b7dd3e2-ff22-4b4b-813e-c31c2fb68029.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3b7dd3e2-ff22-4b4b-813e-c31c2fb68029.json new file mode 100644 index 0000000..e479a01 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3b7dd3e2-ff22-4b4b-813e-c31c2fb68029.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--093e8baf-f3bd-452b-b564-758c25c12bcc", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--3b7dd3e2-ff22-4b4b-813e-c31c2fb68029", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.43236Z", + "modified": "2024-08-02T17:12:32.43236Z", + "name": "Persona Template", + "description": "Threat actors have been observed following a template when filling their accounts\u2019 online profiles. This may be done to enable account holders to quickly present themselves as a real person with a targeted persona.

For example, an actor may be instructed to create many fabricated local accounts for use in an operation using a template of \u201c[flag emojis], [location], [personal quote], [political party] supporter\u201d in their account\u2019s description.

Associated Techniques and Sub-techniques
T0143.002: Fabricated Persona: The use of a templated account biography in a collection of accounts may be an indicator that the personas have been fabricated.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0144.002.md", + "external_id": "T0144.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45.json index ee2380e..f028ec7 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--524c667d-ba42-44dc-99ff-f0341f294492", + "id": "bundle--42db14eb-21c4-4415-85ff-6ea4a0b6988b", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.195475Z", - "modified": "2023-09-28T21:25:13.195475Z", + "created": "2024-08-02T17:12:32.335422Z", + "modified": "2024-08-02T17:12:32.335422Z", "name": "Raise Funds from Malign Actors", "description": "Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f.json new file mode 100644 index 0000000..d6ad49b --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--c4a67919-d59e-40b9-a754-5db16962d44f", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.42888Z", + "modified": "2024-08-02T17:12:32.42888Z", + "name": "Dissuade from Acting", + "description": "Discourage, deter, or inhibit the target from actions which would be unfavourable to the attacker. The actor may want the target to refrain from voting, buying, fighting, or supplying. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.md", + "external_id": "T0139" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14.json index afa2c3d..340029e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e270b35a-fd95-4c34-879c-ef98af69a7a2", + "id": "bundle--4bc6311d-569a-4924-aec6-c9ececa708f4", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.216489Z", - "modified": "2023-09-28T21:25:13.216489Z", + "created": "2024-08-02T17:12:32.356931Z", + "modified": "2024-08-02T17:12:32.356931Z", "name": "Psychographic Segmentation", "description": "An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271.json index 6174655..d826f6f 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--8df61d22-73e4-42fe-81f8-88f17e1f440a", + "id": "bundle--d78866cf-2eef-4cd3-8dff-bb863f6c5282", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.257668Z", - "modified": "2023-09-28T21:25:13.257668Z", + "created": "2024-08-02T17:12:32.400306Z", + "modified": "2024-08-02T17:12:32.400306Z", "name": "Mainstream Social Networks", "description": "Examples include Facebook, Twitter, LinkedIn, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c.json index a1c3b39..dd1cd67 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b83086c0-b76a-45b4-b775-b336e4f5b623", + "id": "bundle--b6b0bec9-0362-4844-b4e7-9dcc47d85ee8", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.256193Z", - "modified": "2023-09-28T21:25:13.256193Z", + "created": "2024-08-02T17:12:32.399364Z", + "modified": "2024-08-02T17:12:32.399364Z", "name": "Exploit Data Voids", "description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b.json index 9276957..a505cc5 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d36d25dd-ffcd-4218-853b-23d09e3325d4", + "id": "bundle--14414258-fd23-4684-9630-c08c108445f6", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.223959Z", - "modified": "2023-09-28T21:25:13.223959Z", + "created": "2024-08-02T17:12:32.365103Z", + "modified": "2024-08-02T17:12:32.365103Z", "name": "Identify Social and Technical Vulnerabilities", "description": "Identifying social and technical vulnerabilities determines weaknesses within the target audience information environment for later exploitation. Vulnerabilities include decisive political issues, weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment. Identifying social and technical vulnerabilities facilitates the later exploitation of the identified weaknesses to advance operation objectives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--410e8ae7-e11d-44ff-8f10-3ec29798a9e0.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--410e8ae7-e11d-44ff-8f10-3ec29798a9e0.json new file mode 100644 index 0000000..3f87267 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--410e8ae7-e11d-44ff-8f10-3ec29798a9e0.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--c3aa656a-00c7-4d75-9624-876a51f62d99", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--410e8ae7-e11d-44ff-8f10-3ec29798a9e0", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.432127Z", + "modified": "2024-08-02T17:12:32.432127Z", + "name": "Present Persona across Platforms", + "description": "This sub-technique covers situations where analysts have identified the same persona being presented across multiple platforms.

Having multiple accounts presenting the same persona is not an indicator of inauthentic behaviour; many people create accounts and present as themselves on multiple platforms. However, threat actors are known to present the same persona across multiple platforms, benefiting from an increase in perceived legitimacy.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0144.001.md", + "external_id": "T0144.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--422b6ba9-3ad0-4e6f-9f00-b044e5d657a1.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--422b6ba9-3ad0-4e6f-9f00-b044e5d657a1.json new file mode 100644 index 0000000..ffcd01b --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--422b6ba9-3ad0-4e6f-9f00-b044e5d657a1.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--7352d4f2-953e-48fc-b1f2-5b3d17dba7bf", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--422b6ba9-3ad0-4e6f-9f00-b044e5d657a1", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.392983Z", + "modified": "2024-08-02T17:12:32.392983Z", + "name": "Social Cause Persona", + "description": "Online accounts which present themselves as focusing on a social cause are presenting the Social Cause Persona. Examples include accounts which post about current affairs, such as discrimination faced by minorities.

While presenting as an account invested in a social cause is not an indication of inauthentic behaviour, such personas have been used by threat actors to exploit peoples\u2019 legitimate emotional investment regarding social causes that matter to them (T0143.002: Fabricated Persona, T0097.208: Social Cause Persona).

Legitimate accounts focused on a social cause could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.208: Social Cause Persona). For example, the account holders could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques:
T0097.103: Activist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as an activist related to a social cause. Accounts with social cause personas do not present themselves as individuals, but may have activists controlling the accounts.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.208.md", + "external_id": "T0097.208" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4282febe-c8a6-46da-863c-f19081615d80.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4282febe-c8a6-46da-863c-f19081615d80.json index 49d639e..ace8c58 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4282febe-c8a6-46da-863c-f19081615d80.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4282febe-c8a6-46da-863c-f19081615d80.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--790268d5-f369-403b-a46d-5ad509c30df0", + "id": "bundle--94d03a1c-720e-4f9a-a17d-56c3863d7e6d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4282febe-c8a6-46da-863c-f19081615d80", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.21143Z", - "modified": "2023-09-28T21:25:13.21143Z", + "created": "2024-08-02T17:12:32.350087Z", + "modified": "2024-08-02T17:12:32.350087Z", "name": "Utilise Spamoflauge", "description": "Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, \"you've w0n our jackp0t!\". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac.json new file mode 100644 index 0000000..308d2b6 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--3f28a037-4fe4-4166-b592-1b9a7f4107c7", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.429558Z", + "modified": "2024-08-02T17:12:32.429558Z", + "name": "Cause Harm", + "description": "Persecute, malign, or inflict pain upon a target. The objective of a campaign may be to cause fear or emotional distress in a target. In some cases, harm is instrumental to achieving a primary objective, as in coercion, repression, or intimidation. In other cases, harm may be inflicted for the satisfaction of the perpetrator, as in revenge or sadistic cruelty. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.md", + "external_id": "T0140" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039.json index ac30419..e73afea 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--38165465-d447-4aad-8084-f23ebfbfb2da", + "id": "bundle--f8685817-1428-4ab4-9c6f-1816985d82d7", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.247214Z", - "modified": "2023-09-28T21:25:13.247214Z", + "created": "2024-08-02T17:12:32.381825Z", + "modified": "2024-08-02T17:12:32.381825Z", "name": "Develop Owned Media Assets", "description": "An owned media asset refers to an agency or organisation through which an influence operation may create, develop, and host content and narratives. Owned media assets include websites, blogs, social media pages, forums, and other platforms that facilitate the creation and organisation of content.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34.json index 9729007..195cb6e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--8d9d6aaf-d143-4278-b601-05613e12dfcb", + "id": "bundle--ca9241d9-8bc9-4609-9f9c-7772037cfb9f", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.223372Z", - "modified": "2023-09-28T21:25:13.223372Z", + "created": "2024-08-02T17:12:32.364425Z", + "modified": "2024-08-02T17:12:32.364425Z", "name": "Conduct Web Traffic Analysis", "description": "An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157.json index 9cb0b69..db88b6e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--fdec7679-d363-46e2-b4f0-eb885fcec3d2", + "id": "bundle--738b5d9f-1406-4dc5-8c4e-cb5139826f7c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.224398Z", - "modified": "2023-09-28T21:25:13.224398Z", + "created": "2024-08-02T17:12:32.365448Z", + "modified": "2024-08-02T17:12:32.365448Z", "name": "Find Echo Chambers", "description": "Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9.json index 8a6192f..d09d921 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--254ab946-c35a-4f26-9e74-9ad45e2ff842", + "id": "bundle--1c441fbd-06b6-4111-ba16-87d8c1e0ac65", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.200791Z", - "modified": "2023-09-28T21:25:13.200791Z", + "created": "2024-08-02T17:12:32.342026Z", + "modified": "2024-08-02T17:12:32.342026Z", "name": "Distort Facts", "description": "Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d.json index 704c291..cc4d2dc 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--af941b53-2a08-4b7e-8300-dd82dc395059", + "id": "bundle--7c940633-a4aa-449b-be9d-5b90cf125997", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.243054Z", - "modified": "2023-09-28T21:25:13.243054Z", + "created": "2024-08-02T17:12:32.379547Z", + "modified": "2024-08-02T17:12:32.379547Z", "name": "Create Organisations", "description": "Influence operations may establish organisations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc.json index 451b30b..7f61821 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a66a21ef-a173-4cde-ba42-d60759c41c57", + "id": "bundle--f6237991-625a-4716-8183-16180d053d73", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.255442Z", - "modified": "2023-09-28T21:25:13.255442Z", + "created": "2024-08-02T17:12:32.397193Z", + "modified": "2024-08-02T17:12:32.397193Z", "name": "Leverage Echo Chambers/Filter Bubbles", "description": "An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with \u201cothers with which they are already in agreement.\u201d A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8.json index b6bef0f..401b5d4 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--24d6d0eb-2e4c-41d5-bcd0-d96a3588d467", + "id": "bundle--35d106c2-5fae-42cf-a024-34d124bc5bf0", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.290171Z", - "modified": "2023-09-28T21:25:13.290171Z", + "created": "2024-08-02T17:12:32.421381Z", + "modified": "2024-08-02T17:12:32.421381Z", "name": "Message Reach", "description": "Monitor and evaluate message reach in misinformation incidents.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc.json index 24c9aed..9725df1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--43f7eb05-0876-4b49-a574-4dd94a243847", + "id": "bundle--1924b4ec-2ce7-4d51-809d-baeb832b2758", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.246267Z", - "modified": "2023-09-28T21:25:13.246267Z", + "created": "2024-08-02T17:12:32.380974Z", + "modified": "2024-08-02T17:12:32.380974Z", "name": "Identify Susceptible Targets in Networks", "description": "When seeking to infiltrate an existing network, an influence operation may identify individuals and groups that might be susceptible to being co-opted or influenced.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35.json index 0ba85b9..a5dc97a 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c8b9df5e-59ba-4442-8f92-91cde7dbcba9", + "id": "bundle--553c753b-15bd-4e7d-9e8b-62616d7148ff", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.228328Z", - "modified": "2023-09-28T21:25:13.228328Z", + "created": "2024-08-02T17:12:32.369011Z", + "modified": "2024-08-02T17:12:32.369011Z", "name": "Use Copypasta", "description": "Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta\u2019s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4e33bf6a-c042-4673-b72a-c4121e0aae0d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4e33bf6a-c042-4673-b72a-c4121e0aae0d.json new file mode 100644 index 0000000..1a8caf3 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4e33bf6a-c042-4673-b72a-c4121e0aae0d.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--1fb78b66-adfe-4b09-8b8d-2d6e1401a54f", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--4e33bf6a-c042-4673-b72a-c4121e0aae0d", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.425583Z", + "modified": "2024-08-02T17:12:32.425583Z", + "name": "Increase Prestige", + "description": "Improve personal standing within a community. Gain fame, approbation, or notoriety. Conspiracy theorists, those with special access, and ideologues can gain prominence in a community by propagating disinformation, leaking confidential documents, or spreading hate. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.008.md", + "external_id": "T0136.008" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4f7361ac-3b52-443f-8b4c-4032bb290a80.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4f7361ac-3b52-443f-8b4c-4032bb290a80.json new file mode 100644 index 0000000..8f2eff6 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--4f7361ac-3b52-443f-8b4c-4032bb290a80.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--a1bd3411-fcb5-423e-a288-8a8351072186", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--4f7361ac-3b52-443f-8b4c-4032bb290a80", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.422724Z", + "modified": "2024-08-02T17:12:32.422724Z", + "name": "Polarise", + "description": "To cause a target audience to divide into two completely opposing groups. This is a special case of subversion. To divide and conquer is an age-old approach to subverting and overcoming an enemy.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.004.md", + "external_id": "T0135.004" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--50f92bc8-f6ad-4267-bd00-f4c572370a72.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--50f92bc8-f6ad-4267-bd00-f4c572370a72.json index 9c176bf..7059932 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--50f92bc8-f6ad-4267-bd00-f4c572370a72.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--50f92bc8-f6ad-4267-bd00-f4c572370a72.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b85c35ca-6b6b-4157-a1d0-3d17eb612378", + "id": "bundle--af83a6a2-c444-4483-98f5-5927461d0804", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--50f92bc8-f6ad-4267-bd00-f4c572370a72", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.206965Z", - "modified": "2023-09-28T21:25:13.206965Z", + "created": "2024-08-02T17:12:32.344897Z", + "modified": "2024-08-02T17:12:32.344897Z", "name": "Use Search Engine Optimisation", "description": "Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka \"Black-hat SEO\"", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1.json index 0533056..79720a8 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--76846529-cada-411b-bd11-af4b98c3f1f4", + "id": "bundle--443a036d-c12e-4cad-bd05-42ddc7627882", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.270783Z", - "modified": "2023-09-28T21:25:13.270783Z", + "created": "2024-08-02T17:12:32.408023Z", + "modified": "2024-08-02T17:12:32.408023Z", "name": "Post Inauthentic Social Media Comment", "description": "Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5414f74d-0b10-4562-ad9d-e5e1093e255a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5414f74d-0b10-4562-ad9d-e5e1093e255a.json index 2519921..111dad4 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5414f74d-0b10-4562-ad9d-e5e1093e255a.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5414f74d-0b10-4562-ad9d-e5e1093e255a.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--bbd7a8b3-9663-4632-8a4d-b8bdd7f2f8e8", + "id": "bundle--1fe89da0-e37c-4504-848a-d7dc6ddc6f47", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5414f74d-0b10-4562-ad9d-e5e1093e255a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.219041Z", - "modified": "2023-09-28T21:25:13.219041Z", + "created": "2024-08-02T17:12:32.360306Z", + "modified": "2024-08-02T17:12:32.360306Z", "name": "Dismiss", "description": "Push back against criticism by dismissing your critics. This might be arguing that the critics use a different standard for you than with other actors or themselves; or arguing that their criticism is biassed.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5.json index 51a5257..87d39b2 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c1b1845f-f5b0-4d07-abe1-d98f26c7c32f", + "id": "bundle--d650442f-22ab-42d3-bea3-c13f4165fc2a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.27495Z", - "modified": "2023-09-28T21:25:13.27495Z", + "created": "2024-08-02T17:12:32.411369Z", + "modified": "2024-08-02T17:12:32.411369Z", "name": "Destroy Information Generation Capabilities", "description": "Destroying information generation capabilities refers to actions taken to limit, degrade, or otherwise incapacitate an actor\u2019s ability to generate conflicting information. An influence operation may destroy an actor\u2019s information generation capabilities by physically dismantling the information infrastructure, disconnecting resources needed for information generation, or redirecting information generation personnel. An operation may destroy an adversary\u2019s information generation capabilities to limit conflicting content exposure to the target audience and crowd the information space with its own narratives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f.json index f036a37..39d1855 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9383febc-dd7c-454b-a110-1ccfd70d3b91", + "id": "bundle--c83cb969-86df-4bc6-80c5-a850cd7f899d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.289474Z", - "modified": "2023-09-28T21:25:13.289474Z", + "created": "2024-08-02T17:12:32.420557Z", + "modified": "2024-08-02T17:12:32.420557Z", "name": "Awareness", "description": "Measure current system state with respect to the effectiveness of influencing awareness.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648.json index b888910..13ea8ef 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a4edde62-06aa-4210-a2ed-4ab9cd239c55", + "id": "bundle--01fe8aad-c800-4ddc-966c-cd9729c938a7", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.224906Z", - "modified": "2023-09-28T21:25:13.224906Z", + "created": "2024-08-02T17:12:32.36588Z", + "modified": "2024-08-02T17:12:32.36588Z", "name": "Identify Data Voids", "description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63.json index 056057e..7192a59 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--edd394c2-0676-4441-b36d-8883b9eb6ccf", + "id": "bundle--f417b352-242c-49c9-b667-9186c9f18444", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.277105Z", - "modified": "2023-09-28T21:25:13.277105Z", + "created": "2024-08-02T17:12:32.413349Z", + "modified": "2024-08-02T17:12:32.413349Z", "name": "Physical Violence", "description": "Physical violence refers to the use of force to injure, abuse, damage, or destroy. An influence operation may conduct or encourage physical violence to discourage opponents from promoting conflicting content or draw attention to operation narratives using shock value.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82.json index b25629b..62a05ea 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--354801d3-22ba-4123-ab59-e8facb7b8800", + "id": "bundle--ef61da7d-7f1e-41a7-a034-4e9ed9c137b4", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.277243Z", - "modified": "2023-09-28T21:25:13.277243Z", + "created": "2024-08-02T17:12:32.413648Z", + "modified": "2024-08-02T17:12:32.413648Z", "name": "Conduct Physical Violence", "description": "An influence operation may directly Conduct Physical Violence to achieve campaign goals.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc.json index 0ed9a2c..6be081c 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e04715f0-b252-4db3-977c-9e34cb387ab3", + "id": "bundle--8f5582d0-279a-4c82-9fa5-0d6b6bd170a2", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.235858Z", - "modified": "2023-09-28T21:25:13.235858Z", + "created": "2024-08-02T17:12:32.37578Z", + "modified": "2024-08-02T17:12:32.37578Z", "name": "Deceptively Edit Video (Cheap Fakes)", "description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99.json index 5b50aa6..9228460 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--a3187df7-ce39-4a67-83cc-72bb0e1896b1", + "id": "bundle--e6a64ec2-eb52-4b7e-80e6-672961344919", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.242366Z", - "modified": "2023-09-28T21:25:13.242366Z", + "created": "2024-08-02T17:12:32.378557Z", + "modified": "2024-08-02T17:12:32.378557Z", "name": "Recruit Contractors", "description": "Operators recruit paid contractor to support the campaign.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--58b169c1-7e9a-4300-a98f-eb7baee8967f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--58b169c1-7e9a-4300-a98f-eb7baee8967f.json index a4efb04..4aa9624 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--58b169c1-7e9a-4300-a98f-eb7baee8967f.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--58b169c1-7e9a-4300-a98f-eb7baee8967f.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--29c900a0-3d71-4a1c-9708-126f036c3635", + "id": "bundle--8672b5dd-5b08-4c32-9681-df167578faaf", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--58b169c1-7e9a-4300-a98f-eb7baee8967f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.23435Z", - "modified": "2023-09-28T21:25:13.23435Z", + "created": "2024-08-02T17:12:32.374865Z", + "modified": "2024-08-02T17:12:32.374865Z", "name": "Aggregate Information into Evidence Collages", "description": "Image files that aggregate positive evidence (Joan Donovan)", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--594993b4-86a3-455b-af59-61f167d7fd93.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--594993b4-86a3-455b-af59-61f167d7fd93.json index 084122c..390a8de 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--594993b4-86a3-455b-af59-61f167d7fd93.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--594993b4-86a3-455b-af59-61f167d7fd93.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--fc23689c-583c-4a27-8169-a3e25ef68e3c", + "id": "bundle--f2ed5491-1539-4e78-aa21-2e341b0e8db7", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--594993b4-86a3-455b-af59-61f167d7fd93", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.226785Z", - "modified": "2023-09-28T21:25:13.226785Z", + "created": "2024-08-02T17:12:32.367108Z", + "modified": "2024-08-02T17:12:32.367108Z", "name": "Identify Wedge Issues", "description": "A wedge issue is a divisive political issue, usually concerning a social phenomenon, that divides individuals along a defined line. An influence operation may exploit wedge issues by intentionally polarising the public along the wedge issue line and encouraging opposition between factions.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5a279d23-6ba2-425c-bf72-20c6411ca5a7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5a279d23-6ba2-425c-bf72-20c6411ca5a7.json index 4ddd9a5..b51f1fe 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5a279d23-6ba2-425c-bf72-20c6411ca5a7.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5a279d23-6ba2-425c-bf72-20c6411ca5a7.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--60871686-5e84-4b0f-9984-8a4b1c278af3", + "id": "bundle--3f4e0f21-97a5-4747-815b-e9028eebf371", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5a279d23-6ba2-425c-bf72-20c6411ca5a7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.223169Z", - "modified": "2023-09-28T21:25:13.223169Z", + "created": "2024-08-02T17:12:32.364042Z", + "modified": "2024-08-02T17:12:32.364042Z", "name": "Identify Trending Topics/Hashtags", "description": "An influence operation may identify trending hashtags on social media platforms for later use in boosting operation content. A hashtag40 refers to a word or phrase preceded by the hash symbol (#) on social media used to identify messages and posts relating to a specific topic. All public posts that use the same hashtag are aggregated onto a centralised page dedicated to the word or phrase and sorted either chronologically or by popularity.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5af23f8e-38df-48c6-b832-6f4589cd2590.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5af23f8e-38df-48c6-b832-6f4589cd2590.json new file mode 100644 index 0000000..3fec734 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5af23f8e-38df-48c6-b832-6f4589cd2590.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--d6284560-52a5-415a-82c3-434f53248d74", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--5af23f8e-38df-48c6-b832-6f4589cd2590", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.429223Z", + "modified": "2024-08-02T17:12:32.429223Z", + "name": "Silence", + "description": "Intimidate or incentivise target into remaining silent or prevent target from speaking out. A threat actor may cow a target into silence as a special case of deterrence. Or they may buy the target\u2019s silence. Or they may repress or restrict the target\u2019s speech. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.002.md", + "external_id": "T0139.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5b6aaad5-7166-4321-ae82-b9300a2ddad7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5b6aaad5-7166-4321-ae82-b9300a2ddad7.json index 70671be..ecb514a 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5b6aaad5-7166-4321-ae82-b9300a2ddad7.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5b6aaad5-7166-4321-ae82-b9300a2ddad7.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--8e15485e-1631-4178-8da2-e86150b9d873", + "id": "bundle--8c4e5ccf-06b0-434d-b9ce-a9de90240c74", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5b6aaad5-7166-4321-ae82-b9300a2ddad7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.236325Z", - "modified": "2023-09-28T21:25:13.236325Z", + "created": "2024-08-02T17:12:32.375987Z", + "modified": "2024-08-02T17:12:32.375987Z", "name": "Develop Audio-Based Content", "description": "Creating and editing false or misleading audio artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include creating completely new audio content, repurposing existing audio artefacts (including cheap fakes), or using AI-generated audio creation and editing technologies (including deepfakes).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5ba86be4-c8ba-458c-abea-2ad706d7ddd9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5ba86be4-c8ba-458c-abea-2ad706d7ddd9.json new file mode 100644 index 0000000..8e4a5da --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5ba86be4-c8ba-458c-abea-2ad706d7ddd9.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--770cbf35-9a8b-4abb-8de0-dc966249ef4c", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--5ba86be4-c8ba-458c-abea-2ad706d7ddd9", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.433022Z", + "modified": "2024-08-02T17:12:32.433022Z", + "name": "Animal Account Imagery", + "description": "Animal used in account imagery.

An influence operation might flesh out its account by uploading a profile picture, increasing its perceived authenticity.

People sometimes legitimately use images of animals as their profile pictures (e.g. of their pets), and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.003.md", + "external_id": "T0145.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bbea132-9da6-42f7-93e9-71f0a9cf311d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bbea132-9da6-42f7-93e9-71f0a9cf311d.json index 1576b02..326489f 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bbea132-9da6-42f7-93e9-71f0a9cf311d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bbea132-9da6-42f7-93e9-71f0a9cf311d.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a387b741-b82e-4d20-8103-66107fb30e72", + "id": "bundle--c3876de9-7079-46e1-9bf6-1cc71613610b", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5bbea132-9da6-42f7-93e9-71f0a9cf311d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.273641Z", - "modified": "2023-09-28T21:25:13.273641Z", + "created": "2024-08-02T17:12:32.409621Z", + "modified": "2024-08-02T17:12:32.409621Z", "name": "Use Affiliate Marketing Programmes", "description": "Use Affiliate Marketing Programmes", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bc895e8-eb26-43ec-8469-ab665092970d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bc895e8-eb26-43ec-8469-ab665092970d.json index c3a60a6..baadcba 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bc895e8-eb26-43ec-8469-ab665092970d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bc895e8-eb26-43ec-8469-ab665092970d.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b72ed1a8-650b-4630-ace2-3cf62bb3b7e9", + "id": "bundle--d823ed68-575e-430b-b9f8-869e20f4e75d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5bc895e8-eb26-43ec-8469-ab665092970d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.21013Z", - "modified": "2023-09-28T21:25:13.21013Z", + "created": "2024-08-02T17:12:32.347214Z", + "modified": "2024-08-02T17:12:32.347214Z", "name": "Dox", "description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bca3084-f5b0-48a8-934c-7f2c03bfd2c3.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bca3084-f5b0-48a8-934c-7f2c03bfd2c3.json index 5bcd146..f5c2717 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bca3084-f5b0-48a8-934c-7f2c03bfd2c3.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5bca3084-f5b0-48a8-934c-7f2c03bfd2c3.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--978ff4cd-1e44-405b-a442-00e2316ef23c", + "id": "bundle--5388c880-5f56-4dc6-8f2d-d99188993717", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5bca3084-f5b0-48a8-934c-7f2c03bfd2c3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.278976Z", - "modified": "2023-09-28T21:25:13.278976Z", + "created": "2024-08-02T17:12:32.414942Z", + "modified": "2024-08-02T17:12:32.414942Z", "name": "Change Names of Information Assets", "description": "Changing names or brand names of information assets such as accounts, channels, pages etc. An operation may change the names or brand names of its assets throughout an operation to avoid detection or alter the names of newly acquired or repurposed assets to fit operational narratives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5d4cafe2-42cc-4c41-8ce7-41256e1383f7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5d4cafe2-42cc-4c41-8ce7-41256e1383f7.json index 58f64fa..b7ef649 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5d4cafe2-42cc-4c41-8ce7-41256e1383f7.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5d4cafe2-42cc-4c41-8ce7-41256e1383f7.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--80f1b645-a5bc-4172-b736-c96f9e8872d3", + "id": "bundle--35dd4d54-8557-42d5-acc5-c60aac924f17", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5d4cafe2-42cc-4c41-8ce7-41256e1383f7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.202853Z", - "modified": "2023-09-28T21:25:13.202853Z", - "name": "Bait Legitimate Influencers", - "description": "Credibility in a social media environment is often a function of the size of a user's network. \"Influencers\" are so-called because of their reach, typically understood as: 1) the size of their network (i.e. the number of followers, perhaps weighted by their own influence); and 2) The rate at which their comments are re-circulated (these two metrics are related). Add traditional media players at all levels of credibility and professionalism to this, and the number of potential influencial carriers available for unwitting amplification becomes substantial. By targeting high-influence people and organisations in all types of media with narratives and content engineered to appeal their emotional or ideological drivers, influence campaigns are able to add perceived credibility to their messaging via saturation and adoption by trusted agents such as celebrities, journalists and local leaders.", + "created": "2024-08-02T17:12:32.343367Z", + "modified": "2024-08-02T17:12:32.343367Z", + "name": "Bait Influencer", + "description": "Influencers are people on social media platforms who have large audiences.

Threat Actors can try to trick Influencers such as celebrities, journalists, or local leaders who aren\u2019t associated with their campaign into amplifying campaign content. This gives them access to the Influencer\u2019s audience without having to go through the effort of building it themselves, and it helps legitimise their message by associating it with the Influencer, benefitting from their audience\u2019s trust in them.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "conduct-pump-priming" + "phase_name": "maximise-exposure" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec.json new file mode 100644 index 0000000..04bcbfa --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--3ee115e5-28e8-4efe-8bc6-aa423550c1bf", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.421799Z", + "modified": "2024-08-02T17:12:32.421799Z", + "name": "Undermine", + "description": "Weaken, debilitate, or subvert a target or their actions. An influence operation may be designed to disparage an opponent; sabotage an opponent\u2019s systems or processes; compromise an opponent\u2019s relationships or support system; impair an opponent\u2019s capability; or thwart an opponent\u2019s initiative. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.md", + "external_id": "T0135" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5daa2f8a-2460-4cdd-ae55-b70f439a9f51.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5daa2f8a-2460-4cdd-ae55-b70f439a9f51.json index 11bb94c..c19a5e9 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5daa2f8a-2460-4cdd-ae55-b70f439a9f51.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5daa2f8a-2460-4cdd-ae55-b70f439a9f51.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1248df96-38fb-436f-a12e-c422f7877c8f", + "id": "bundle--09d6d1d5-d274-43d7-b43f-8b54b24cc601", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5daa2f8a-2460-4cdd-ae55-b70f439a9f51", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.269813Z", - "modified": "2023-09-28T21:25:13.269813Z", + "created": "2024-08-02T17:12:32.407532Z", + "modified": "2024-08-02T17:12:32.407532Z", "name": "One-Way Direct Posting", "description": "Direct posting refers to a method of posting content via a one-way messaging service, where the recipient cannot directly respond to the poster\u2019s messaging. An influence operation may post directly to promote operation narratives to the target audience without allowing opportunities for fact-checking or disagreement, creating a false sense of support for the narrative.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5dc224b1-c69e-496d-91f7-e8ce4fd3f166.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5dc224b1-c69e-496d-91f7-e8ce4fd3f166.json index 1a38e50..8ec3071 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5dc224b1-c69e-496d-91f7-e8ce4fd3f166.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5dc224b1-c69e-496d-91f7-e8ce4fd3f166.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a312ddbb-cff2-46ba-8251-c28251b91dfa", + "id": "bundle--332a1517-7fc5-4f25-8679-b461f778b8f3", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5dc224b1-c69e-496d-91f7-e8ce4fd3f166", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.288478Z", - "modified": "2023-09-28T21:25:13.288478Z", + "created": "2024-08-02T17:12:32.419551Z", + "modified": "2024-08-02T17:12:32.419551Z", "name": "Content Focused", "description": "Measure the performance of campaign content", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5e7541d8-2b43-4443-89d9-7362ca78944c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5e7541d8-2b43-4443-89d9-7362ca78944c.json index e455f5a..7232f7e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5e7541d8-2b43-4443-89d9-7362ca78944c.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5e7541d8-2b43-4443-89d9-7362ca78944c.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--0bbc8289-e38c-4a0d-a910-613213b96d98", + "id": "bundle--2a022589-ca2c-432b-8ddc-39d06a24534f", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5e7541d8-2b43-4443-89d9-7362ca78944c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.273494Z", - "modified": "2023-09-28T21:25:13.273494Z", + "created": "2024-08-02T17:12:32.409423Z", + "modified": "2024-08-02T17:12:32.409423Z", "name": "Incentivize Sharing", "description": "Incentivizing content sharing refers to actions that encourage users to share content themselves, reducing the need for the operation itself to post and promote its own content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf.json index 14d77ef..c426ab6 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--4db02a9a-26f2-454e-be56-3a043e3a6794", + "id": "bundle--a98f4227-3754-4a70-b762-31824fb49e60", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.232379Z", - "modified": "2023-09-28T21:25:13.232379Z", + "created": "2024-08-02T17:12:32.3734Z", + "modified": "2024-08-02T17:12:32.3734Z", "name": "Develop Image-Based Content", "description": "Creating and editing false or misleading visual artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include photographing staged real-life situations, repurposing existing digital images, or using image creation and editing technologies.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--61df6490-ca2c-41b7-a251-ded790a03a71.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--61df6490-ca2c-41b7-a251-ded790a03a71.json index cb742c3..068ac07 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--61df6490-ca2c-41b7-a251-ded790a03a71.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--61df6490-ca2c-41b7-a251-ded790a03a71.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c267cae6-67ed-4bdf-844a-e71d1b6b6faa", + "id": "bundle--404214ff-d4dc-42c9-b81f-bf2b6e2e6b13", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--61df6490-ca2c-41b7-a251-ded790a03a71", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.196042Z", - "modified": "2023-09-28T21:25:13.196042Z", + "created": "2024-08-02T17:12:32.336388Z", + "modified": "2024-08-02T17:12:32.336388Z", "name": "Conduct Fundraising", "description": "Fundraising campaigns refer to an influence operation\u2019s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services166 on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns to promote operation messaging while raising money to support its activities.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62036130-6083-43e3-b1e0-8ab0822bedda.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62036130-6083-43e3-b1e0-8ab0822bedda.json index d0f70d5..d3be817 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62036130-6083-43e3-b1e0-8ab0822bedda.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62036130-6083-43e3-b1e0-8ab0822bedda.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f47cb1e5-935f-4a46-bc30-ea62bfd13d04", + "id": "bundle--9f496bf0-5511-4290-b236-919760e8562d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--62036130-6083-43e3-b1e0-8ab0822bedda", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.258527Z", - "modified": "2023-09-28T21:25:13.258527Z", + "created": "2024-08-02T17:12:32.401797Z", + "modified": "2024-08-02T17:12:32.401797Z", "name": "Use Hashtags", "description": "Use a dedicated, existing hashtag for the campaign/incident.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--625fe1a6-ee9d-45c8-9912-9e9f6e87dc85.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--625fe1a6-ee9d-45c8-9912-9e9f6e87dc85.json index d86c160..d2bf0f2 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--625fe1a6-ee9d-45c8-9912-9e9f6e87dc85.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--625fe1a6-ee9d-45c8-9912-9e9f6e87dc85.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f4eb45b9-d9f6-4f5d-9885-d74afc20cf6a", + "id": "bundle--0c164a85-8945-4c03-b3ab-8d17b6a52cbf", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--625fe1a6-ee9d-45c8-9912-9e9f6e87dc85", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.226454Z", - "modified": "2023-09-28T21:25:13.226454Z", + "created": "2024-08-02T17:12:32.366827Z", + "modified": "2024-08-02T17:12:32.366827Z", "name": "Identify Existing Conspiracy Narratives/Suspicions", "description": "An influence operation may assess preexisting conspiracy theories or suspicions in a population to identify existing narratives that support operational objectives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6270bd3c-efcf-4778-8512-065abffe9a88.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6270bd3c-efcf-4778-8512-065abffe9a88.json new file mode 100644 index 0000000..0f40d1c --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6270bd3c-efcf-4778-8512-065abffe9a88.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--7ce7cd13-ce43-45be-8775-40033c407422", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--6270bd3c-efcf-4778-8512-065abffe9a88", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.387376Z", + "modified": "2024-08-02T17:12:32.387376Z", + "name": "Romantic Suitor Persona", + "description": "A person with a romantic suitor persona presents themselves as seeking a romantic or physical connection with another person.

While presenting as seeking a romantic or physical connection is not an indication of inauthentic behaviour, threat actors can use dating apps, social media channels or dating websites to fabricate romantic suitors to lure targets they can blackmail, extract information from, deceive or trick into giving them money (T0143.002: Fabricated Persona, T0097.109: Romantic Suitor Persona).

Honeypotting in espionage and Big Butchering in scamming are commonly associated with romantic suitor personas.

Associated Techniques and Sub-techniques
T0104.002: Dating App: Analysts can use this sub-technique for tagging cases where an account has been identified as using a dating platform.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.109.md", + "external_id": "T0097.109" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62a0eef8-a23a-4fbf-bb17-17ea636213cc.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62a0eef8-a23a-4fbf-bb17-17ea636213cc.json new file mode 100644 index 0000000..58326c4 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62a0eef8-a23a-4fbf-bb17-17ea636213cc.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--323ed344-8e55-49fb-b6b9-158c788b1d9e", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--62a0eef8-a23a-4fbf-bb17-17ea636213cc", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.426585Z", + "modified": "2024-08-02T17:12:32.426585Z", + "name": "Scam", + "description": "Defraud a target or trick a target into doing something that benefits the attacker. A typical scam is where a fraudster convinces a target to pay for something without the intention of ever delivering anything in return. Alternatively, the fraudster may promise benefits which never materialise, such as a fake cure. Criminals often exploit a fear or crisis or generate a sense of urgency. They may use deepfakes to impersonate authority figures or individuals in distress. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.002.md", + "external_id": "T0137.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62eb26b8-d555-46a5-831d-c6b55909a9c4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62eb26b8-d555-46a5-831d-c6b55909a9c4.json new file mode 100644 index 0000000..7c5704c --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--62eb26b8-d555-46a5-831d-c6b55909a9c4.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--82eba7d2-f57d-451a-93b3-4312ddf1f54a", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--62eb26b8-d555-46a5-831d-c6b55909a9c4", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.424819Z", + "modified": "2024-08-02T17:12:32.424819Z", + "name": "Cultivate Support for Ally", + "description": "Elevate or fortify the public backing for a partner. Governments may interfere in other countries\u2019 elections by covertly favouring a party or candidate aligned with their interests. They may also mount an influence operation to bolster the reputation of an ally under attack. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.006.md", + "external_id": "T0136.006" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--63ed1a5a-835e-4a51-9b95-0f0525a95186.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--63ed1a5a-835e-4a51-9b95-0f0525a95186.json new file mode 100644 index 0000000..8ef3ce1 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--63ed1a5a-835e-4a51-9b95-0f0525a95186.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--5d172599-a09d-4587-abd3-8ce43f1418f8", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--63ed1a5a-835e-4a51-9b95-0f0525a95186", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.388973Z", + "modified": "2024-08-02T17:12:32.388973Z", + "name": "Institutional Persona", + "description": "This Technique can be used to indicate that an entity is presenting itself as an institution. If the organisation is presenting itself as having one of the personas listed below then these Techniques should be used instead, as they indicate both that the entity presented itself as an institution, and the type of persona they presented:

T0097.201: Local Institution Persona
T0097.202: News Outlet Persona
T0097.203: Fact Checking Organisation Persona
T0097.204: Think Tank Persona
T0097.205: Business Persona
T0097.206: Government Institution Persona
T0097.207: NGO Persona
T0097.208: Social Cause Persona", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.200.md", + "external_id": "T0097.200" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--648ac47f-a288-454a-a784-3f2111c0b76b.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--648ac47f-a288-454a-a784-3f2111c0b76b.json new file mode 100644 index 0000000..677c462 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--648ac47f-a288-454a-a784-3f2111c0b76b.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--c1822293-ab7e-4d6a-9ab6-17fb5c1a3b7a", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--648ac47f-a288-454a-a784-3f2111c0b76b", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.423338Z", + "modified": "2024-08-02T17:12:32.423338Z", + "name": "Justify Action", + "description": "To convince others to exonerate you of a perceived wrongdoing. When an actor finds it untenable to deny doing something, they may attempt to exonerate themselves with disinformation which claims the action was reasonable. This is a special case of \u201cDefend Reputation\u201d. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.002.md", + "external_id": "T0136.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--64bcccb9-4d10-4eed-8c49-8816ecfd78a3.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--64bcccb9-4d10-4eed-8c49-8816ecfd78a3.json index 58a4ccd..e987598 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--64bcccb9-4d10-4eed-8c49-8816ecfd78a3.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--64bcccb9-4d10-4eed-8c49-8816ecfd78a3.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--1bfb4da1-b2c7-4513-a1a0-ba3b41e7e8b4", + "id": "bundle--36db7159-129e-40af-896e-6c70921f3880", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--64bcccb9-4d10-4eed-8c49-8816ecfd78a3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.248612Z", - "modified": "2023-09-28T21:25:13.248612Z", + "created": "2024-08-02T17:12:32.382901Z", + "modified": "2024-08-02T17:12:32.382901Z", "name": "Outsource Content Creation to External Organisations", "description": "An influence operation may outsource content creation to external companies to avoid attribution, increase the rate of content creation, or improve content quality, i.e., by employing an organisation that can create content in the target audience\u2019s native language. Employed organisations may include marketing companies for tailored advertisements or external content farms for high volumes of targeted media.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--651a5188-f38a-42be-a253-d1b90cbd28e1.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--651a5188-f38a-42be-a253-d1b90cbd28e1.json index 14e1c41..0004183 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--651a5188-f38a-42be-a253-d1b90cbd28e1.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--651a5188-f38a-42be-a253-d1b90cbd28e1.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--bd950293-02f9-4b39-8300-902ec3a625f1", + "id": "bundle--7992d67b-9b2a-4b21-b9c0-1cab374a318a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--651a5188-f38a-42be-a253-d1b90cbd28e1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.275963Z", - "modified": "2023-09-28T21:25:13.275963Z", + "created": "2024-08-02T17:12:32.412165Z", + "modified": "2024-08-02T17:12:32.412165Z", "name": "Goad People into Harmful Action (Stop Hitting Yourself)", "description": "Goad people into actions that violate terms of service or will lead to having their content or accounts taken down.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--66e1a3b9-d837-4eaa-9cdf-900663a8708d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--66e1a3b9-d837-4eaa-9cdf-900663a8708d.json new file mode 100644 index 0000000..db78b19 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--66e1a3b9-d837-4eaa-9cdf-900663a8708d.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--27d5a163-7617-4dbf-973b-2082460b702b", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--66e1a3b9-d837-4eaa-9cdf-900663a8708d", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.388554Z", + "modified": "2024-08-02T17:12:32.388554Z", + "name": "Government Employee Persona", + "description": "A person who presents as an active or previous civil servant has the government employee persona. These are professionals hired to serve in government institutions and departments, not officials selected to represent constituents, or assigned official roles in government (such as heads of departments).

Presenting as a government employee is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in government to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.112: Government Employee Persona). They may also impersonate existing government employees (T0143.003: Impersonated Persona, T0097.112: Government Employee Persona).

Legitimate government employees could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.112: Government Employee Persona). For example, a government employee could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Analysts should use this technique to document people who present as an active or previous government official, such as heads of government departments, leaders of countries, and members of government selected to represent constituents.
T0097.206: Government Institution Persona: People presenting as members of a government may also present a government institution which they are associated with.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.112.md", + "external_id": "T0097.112" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--67afaa3d-ffd7-4ad5-bcb0-e77962c084cf.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--67afaa3d-ffd7-4ad5-bcb0-e77962c084cf.json index e434fd7..195c614 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--67afaa3d-ffd7-4ad5-bcb0-e77962c084cf.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--67afaa3d-ffd7-4ad5-bcb0-e77962c084cf.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--550cf650-4fca-47bf-99bf-38d539ff020f", + "id": "bundle--c3dc8d66-8904-476b-8c75-f3cb67c57345", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--67afaa3d-ffd7-4ad5-bcb0-e77962c084cf", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.287935Z", - "modified": "2023-09-28T21:25:13.287935Z", + "created": "2024-08-02T17:12:32.418954Z", + "modified": "2024-08-02T17:12:32.418954Z", "name": "Post Borderline Content", "description": "Post Borderline Content", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--690761b6-8afd-4dd5-954e-174de362d1b0.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--690761b6-8afd-4dd5-954e-174de362d1b0.json index dc2480a..e823b12 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--690761b6-8afd-4dd5-954e-174de362d1b0.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--690761b6-8afd-4dd5-954e-174de362d1b0.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--fe132d72-069e-4271-a67f-ed52829263fd", + "id": "bundle--fe45e0ab-8bf7-4231-ab56-320f9c452254", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--690761b6-8afd-4dd5-954e-174de362d1b0", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.274229Z", - "modified": "2023-09-28T21:25:13.274229Z", + "created": "2024-08-02T17:12:32.41053Z", + "modified": "2024-08-02T17:12:32.41053Z", "name": "Direct Users to Alternative Platforms", "description": "Direct users to alternative platforms refers to encouraging users to move from the platform on which they initially viewed operation content and engage with content on alternate information channels, including separate social media channels and inauthentic websites. An operation may drive users to alternative platforms to diversify its information channels and ensure the target audience knows where to access operation content if the initial platform suspends, flags, or otherwise removes original operation assets and content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--694bafc2-bd74-40c9-89f2-2ad033f079f4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--694bafc2-bd74-40c9-89f2-2ad033f079f4.json index da98474..d7244cd 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--694bafc2-bd74-40c9-89f2-2ad033f079f4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--694bafc2-bd74-40c9-89f2-2ad033f079f4.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b8dd9a3e-54bb-497e-85a4-8defb61203a9", + "id": "bundle--268527bb-bf74-49c6-85b6-ac3d88e30b21", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--694bafc2-bd74-40c9-89f2-2ad033f079f4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.215512Z", - "modified": "2023-09-28T21:25:13.215512Z", + "created": "2024-08-02T17:12:32.356167Z", + "modified": "2024-08-02T17:12:32.356167Z", "name": "Demographic Segmentation", "description": "An influence operation may target populations based on demographic segmentation, including age, gender, and income. Demographic segmentation may be useful for influence operations aiming to change state policies that affect a specific population sector. For example, an influence operation attempting to influence Medicare funding in the United States would likely target U.S. voters over 65 years of age.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--69f4e3bb-a587-468a-8a0c-31f9acd931b6.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--69f4e3bb-a587-468a-8a0c-31f9acd931b6.json new file mode 100644 index 0000000..e0583c4 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--69f4e3bb-a587-468a-8a0c-31f9acd931b6.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--cedc1d79-597f-4b15-a872-4964c8f6f4b6", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--69f4e3bb-a587-468a-8a0c-31f9acd931b6", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.423136Z", + "modified": "2024-08-02T17:12:32.423136Z", + "name": "Defend Reputaton", + "description": "Preserve a positive perception in the public\u2019s mind following an accusation or adverse event. When accused of a wrongful act, an actor may engage in denial, counter accusations, whataboutism, or conspiracy theories to distract public attention and attempt to maintain a positive image. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.001.md", + "external_id": "T0136.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6aa772c8-f51f-428e-a7e5-2d69dd8d4add.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6aa772c8-f51f-428e-a7e5-2d69dd8d4add.json index 88cf201..0e27de1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6aa772c8-f51f-428e-a7e5-2d69dd8d4add.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6aa772c8-f51f-428e-a7e5-2d69dd8d4add.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--035818f7-856d-4ba5-95fc-958ee847e7a9", + "id": "bundle--d8f896a2-bcc4-4e33-9da8-f11d3612bda1", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6aa772c8-f51f-428e-a7e5-2d69dd8d4add", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.290026Z", - "modified": "2023-09-28T21:25:13.290026Z", + "created": "2024-08-02T17:12:32.421176Z", + "modified": "2024-08-02T17:12:32.421176Z", "name": "Measure Effectiveness Indicators (or KPIs)", "description": "Ensuring that Key Performance Indicators are identified and tracked, so that the performance and effectiveness of campaigns, and elements of campaigns, can be measured, during and after their execution.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6ae4a4d2-4ac8-4764-ac9f-7261c5c882e0.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6ae4a4d2-4ac8-4764-ac9f-7261c5c882e0.json new file mode 100644 index 0000000..226b683 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6ae4a4d2-4ac8-4764-ac9f-7261c5c882e0.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--b76e4fc3-76d9-44d7-bf7c-b8b04fe8d04b", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--6ae4a4d2-4ac8-4764-ac9f-7261c5c882e0", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431094Z", + "modified": "2024-08-02T17:12:32.431094Z", + "name": "Authentic Persona", + "description": "An individual or institution presenting a persona that legitimately matches who or what they are is presenting an authentic persona.

For example, an account which presents as being managed by a member of a country\u2019s military, and is legitimately managed by that person, would be presenting an authentic persona (T0143.001: Authentic Persona, T0097.105: Military Personnel).

Sometimes people can authentically present themselves as who they are while still participating in malicious/inauthentic activity; a legitimate journalist (T0143.001: Authentic Persona, T0097.102: Journalist Persona) may accept bribes to promote products, or they could be tricked by threat actors into sharing an operation\u2019s narrative.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.001.md", + "external_id": "T0143.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6b23206e-6a5a-4173-ab1a-17e6cc9a9d2d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6b23206e-6a5a-4173-ab1a-17e6cc9a9d2d.json index 5a1a8e4..3500e72 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6b23206e-6a5a-4173-ab1a-17e6cc9a9d2d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6b23206e-6a5a-4173-ab1a-17e6cc9a9d2d.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--0d797adb-8ff1-4179-8df8-d4745c497fac", + "id": "bundle--e7f5fee3-5ee2-461c-80f2-3648ca690eb7", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6b23206e-6a5a-4173-ab1a-17e6cc9a9d2d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.205963Z", - "modified": "2023-09-28T21:25:13.205963Z", + "created": "2024-08-02T17:12:32.344511Z", + "modified": "2024-08-02T17:12:32.344511Z", "name": "Seed Distortions", "description": "Try a wide variety of messages in the early hours surrounding an incident or event, to give a misleading account or impression.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6b495bb5-d2ab-4da7-9530-a1aadd488803.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6b495bb5-d2ab-4da7-9530-a1aadd488803.json index 285465e..441c168 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6b495bb5-d2ab-4da7-9530-a1aadd488803.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6b495bb5-d2ab-4da7-9530-a1aadd488803.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--176fdd25-54ff-4895-b020-0f1dc02ca98c", + "id": "bundle--3573afad-e6b8-474e-9912-8e8462443590", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6b495bb5-d2ab-4da7-9530-a1aadd488803", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.278837Z", - "modified": "2023-09-28T21:25:13.278837Z", + "created": "2024-08-02T17:12:32.414755Z", + "modified": "2024-08-02T17:12:32.414755Z", "name": "Launder Information Assets", "description": "Laundering occurs when an influence operation acquires control of previously legitimate information assets such as accounts, channels, pages etc. from third parties through sale or exchange and often in contravention of terms of use. Influence operations use laundered assets to reach target audience members from within an existing information community and to complicate attribution.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6c001f2c-b143-4d9b-91d7-5a663152cdb5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6c001f2c-b143-4d9b-91d7-5a663152cdb5.json new file mode 100644 index 0000000..c0ae0b2 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6c001f2c-b143-4d9b-91d7-5a663152cdb5.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--f205f7c5-effe-49df-8c80-5efc717947dc", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--6c001f2c-b143-4d9b-91d7-5a663152cdb5", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.359091Z", + "modified": "2024-08-02T17:12:32.359091Z", + "name": "Domestic Political Advantage", + "description": "Favourable position vis-\u00e0-vis national or sub-national political opponents such as political parties, interest groups, politicians, candidates. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-strategy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.002.md", + "external_id": "T0074.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6d75e3ac-e923-4815-8e9b-3e6af9e1baa0.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6d75e3ac-e923-4815-8e9b-3e6af9e1baa0.json index 21cd232..3da87d9 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6d75e3ac-e923-4815-8e9b-3e6af9e1baa0.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6d75e3ac-e923-4815-8e9b-3e6af9e1baa0.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--252f0334-ec98-439f-b90f-b31a46a96c3b", + "id": "bundle--29d47f91-effa-4c50-bdeb-6cf90b632049", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6d75e3ac-e923-4815-8e9b-3e6af9e1baa0", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.257306Z", - "modified": "2023-09-28T21:25:13.257306Z", + "created": "2024-08-02T17:12:32.399894Z", + "modified": "2024-08-02T17:12:32.399894Z", "name": "Audio Livestream", "description": "An audio livestream refers to an online audio broadcast capability that allows for real-time communication to closed or open networks.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6db47704-ba87-402d-933a-de90f5aa8965.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6db47704-ba87-402d-933a-de90f5aa8965.json index 152c202..cd60390 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6db47704-ba87-402d-933a-de90f5aa8965.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6db47704-ba87-402d-933a-de90f5aa8965.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--24f54852-1d9e-42e7-8384-ace8434150ad", + "id": "bundle--f62e5056-c584-4efc-82eb-72f549f4178b", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6db47704-ba87-402d-933a-de90f5aa8965", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.250085Z", - "modified": "2023-09-28T21:25:13.250085Z", + "created": "2024-08-02T17:12:32.3934Z", + "modified": "2024-08-02T17:12:32.3934Z", "name": "Establish Inauthentic News Sites", "description": "Modern computational propaganda makes use of a cadre of imposter news sites spreading globally. These sites, sometimes motivated by concerns other than propaganda--for instance, click-based revenue--often have some superficial markers of authenticity, such as naming and site-design. But many can be quickly exposed with reference to their owenership, reporting history and adverstising details.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6e525f48-d8d6-4484-8838-208eb00bd2a8.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6e525f48-d8d6-4484-8838-208eb00bd2a8.json index ee39736..ea2a1e3 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6e525f48-d8d6-4484-8838-208eb00bd2a8.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6e525f48-d8d6-4484-8838-208eb00bd2a8.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e3f35a6b-10ed-42ac-94ca-4a8982b62f6f", + "id": "bundle--709c6002-3adc-47f9-a6fa-4955f369aaca", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6e525f48-d8d6-4484-8838-208eb00bd2a8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.259452Z", - "modified": "2023-09-28T21:25:13.259452Z", + "created": "2024-08-02T17:12:32.402812Z", + "modified": "2024-08-02T17:12:32.402812Z", "name": "Media Sharing Networks", "description": "Media sharing networks refer to services whose primary function is the hosting and sharing of specific forms of media. Examples include Instagram, Snapchat, TikTok, Youtube, SoundCloud.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a.json index 28ad384..76f393b 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--01d02a20-4b54-4cdb-a142-69019421de5b", + "id": "bundle--2b605246-08c4-4033-87d8-ad65d9e75f56", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.239842Z", - "modified": "2023-09-28T21:25:13.239842Z", + "created": "2024-08-02T17:12:32.377225Z", + "modified": "2024-08-02T17:12:32.377225Z", "name": "Create Inauthentic Accounts", "description": "Inauthentic accounts include bot accounts, cyborg accounts, sockpuppet accounts, and anonymous accounts.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6faf71ca-1e32-4134-8a7c-79b25f7f3615.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6faf71ca-1e32-4134-8a7c-79b25f7f3615.json index 3c74d65..21e2de0 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6faf71ca-1e32-4134-8a7c-79b25f7f3615.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--6faf71ca-1e32-4134-8a7c-79b25f7f3615.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e2690a89-3cc6-441f-99f4-60fa1607de73", + "id": "bundle--feeed3d4-0274-43af-9eef-7f5cfcd9cfe8", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--6faf71ca-1e32-4134-8a7c-79b25f7f3615", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.217222Z", - "modified": "2023-09-28T21:25:13.217222Z", + "created": "2024-08-02T17:12:32.357634Z", + "modified": "2024-08-02T17:12:32.357634Z", "name": "Determine Target Audiences", "description": "Determining the target audiences (segments of the population) who will receive campaign narratives and artefacts intended to achieve the strategic ends.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--70717452-f7e3-4ce8-956f-39a4d34c5cfb.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--70717452-f7e3-4ce8-956f-39a4d34c5cfb.json index 8b1d349..4574732 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--70717452-f7e3-4ce8-956f-39a4d34c5cfb.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--70717452-f7e3-4ce8-956f-39a4d34c5cfb.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--291fa157-975f-433f-8dd2-ca4f9a53979c", + "id": "bundle--525e5f85-8c8f-42a3-8db1-13b5bd40b089", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--70717452-f7e3-4ce8-956f-39a4d34c5cfb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.190139Z", - "modified": "2023-09-28T21:25:13.190139Z", + "created": "2024-08-02T17:12:32.328302Z", + "modified": "2024-08-02T17:12:32.328302Z", "name": "Facilitate State Propaganda", "description": "Organise citizens around pro-state messaging. Coordinate paid or volunteer groups to push state propaganda.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72207f73-5b54-4cd4-b453-746a61eb3e28.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72207f73-5b54-4cd4-b453-746a61eb3e28.json index ef43691..0ba6dde 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72207f73-5b54-4cd4-b453-746a61eb3e28.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72207f73-5b54-4cd4-b453-746a61eb3e28.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--89c5bd5c-55e6-4a88-a00a-5b6dca031dcc", + "id": "bundle--85440c9e-6851-4af9-882f-4e6df09e0ec6", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--72207f73-5b54-4cd4-b453-746a61eb3e28", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.19624Z", - "modified": "2023-09-28T21:25:13.19624Z", + "created": "2024-08-02T17:12:32.336655Z", + "modified": "2024-08-02T17:12:32.336655Z", "name": "Conduct Crowdfunding Campaigns", "description": "An influence operation may Conduct Crowdfunding Campaigns on platforms such as GoFundMe, GiveSendGo, Tipeee, Patreon, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72268aef-baf4-4606-a3ba-837950a54f52.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72268aef-baf4-4606-a3ba-837950a54f52.json new file mode 100644 index 0000000..560e2b7 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72268aef-baf4-4606-a3ba-837950a54f52.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--46ed6e04-0b5c-4f47-ab60-84adb077a768", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--72268aef-baf4-4606-a3ba-837950a54f52", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.390521Z", + "modified": "2024-08-02T17:12:32.390521Z", + "name": "News Outlet Persona", + "description": "An institution with a news outlet persona presents itself as an organisation which delivers new information to its target audience.

While presenting as a news outlet is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by news organisations. Threat actors can fabricate news organisations (T0143.002: Fabricated Persona, T0097.202: News Outlet Persona), or they can impersonate existing news outlets (T0143.003: Impersonated Persona, T0097.202: News Outlet Persona).

Legitimate news organisations could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.202: News Outlet Persona).

Associated Techniques and Sub-techniques
T0097.102: Journalist Persona: Institutions presenting as news outlets may also present journalists working within the organisation.
T0097.201: Local Institution Persona: Institutions presenting as news outlets may present as being a local news outlet.
T0097.203: Fact Checking Organisation Persona: Institutions presenting as news outlets may also deliver a fact checking service (e.g. The UK\u2019s BBC News has the fact checking service BBC Verify). When an actor presents as the fact checking arm of a news outlet, they are presenting both a News Outlet Persona and a Fact Checking Organisation Persona.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.202.md", + "external_id": "T0097.202" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--729483ae-39cf-416e-8d38-da06f1fc5991.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--729483ae-39cf-416e-8d38-da06f1fc5991.json new file mode 100644 index 0000000..4e0a485 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--729483ae-39cf-416e-8d38-da06f1fc5991.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--49f68c1e-b6c5-40bb-9377-0ac96e152eed", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--729483ae-39cf-416e-8d38-da06f1fc5991", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.430495Z", + "modified": "2024-08-02T17:12:32.430495Z", + "name": "Acquire Compromised Asset", + "description": "Threat Actors may take over existing assets not owned by them through nefarious means, such as using technical exploits, hacking, purchasing compromised accounts from the dark web, or social engineering.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0141.md", + "external_id": "T0141" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72df7e55-dc60-4a7e-9928-ed41ac0e1581.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72df7e55-dc60-4a7e-9928-ed41ac0e1581.json index 1e59cee..37f5b15 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72df7e55-dc60-4a7e-9928-ed41ac0e1581.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--72df7e55-dc60-4a7e-9928-ed41ac0e1581.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--0fdeeeff-528e-4912-9c08-1764c2aaf5b7", + "id": "bundle--fe5bebc7-4009-4af5-815b-e0d985d7bf5c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--72df7e55-dc60-4a7e-9928-ed41ac0e1581", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.271321Z", - "modified": "2023-09-28T21:25:13.271321Z", + "created": "2024-08-02T17:12:32.408236Z", + "modified": "2024-08-02T17:12:32.408236Z", "name": "Attract Traditional Media", "description": "Deliver content by attracting the attention of traditional media (earned media).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--741c08dd-2dd3-4c6f-8d08-32481f4cb61f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--741c08dd-2dd3-4c6f-8d08-32481f4cb61f.json new file mode 100644 index 0000000..46edbc2 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--741c08dd-2dd3-4c6f-8d08-32481f4cb61f.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--0c2e26d6-f627-4bf2-80b1-2a3d05c836d4", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--741c08dd-2dd3-4c6f-8d08-32481f4cb61f", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.429741Z", + "modified": "2024-08-02T17:12:32.429741Z", + "name": "Defame", + "description": "Attempt to damage the target\u2019s personal reputation by impugning their character. This can range from subtle attempts to misrepresent or insinuate, to obvious attempts to denigrate or disparage, to blatant attempts to malign or vilify. Slander applies to oral expression. Libel applies to written or pictorial material. Defamation is often carried out by online trolls. The sole aim here is to cause harm to the target. If the threat actor uses defamation as a means of undermining the target, then choose sub-technique \u201cSmear\u201d of technique \u201cUndermine\u201d instead. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.001.md", + "external_id": "T0140.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7475b7e6-1095-4ae1-a995-10ab1a6c838a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7475b7e6-1095-4ae1-a995-10ab1a6c838a.json index 8f1410f..13a6b55 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7475b7e6-1095-4ae1-a995-10ab1a6c838a.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7475b7e6-1095-4ae1-a995-10ab1a6c838a.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--da11a350-8ab9-4edb-b0cc-07f7d5208e04", + "id": "bundle--737c8f46-b4c5-43f0-8871-f5203700e51f", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7475b7e6-1095-4ae1-a995-10ab1a6c838a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.229346Z", - "modified": "2023-09-28T21:25:13.229346Z", + "created": "2024-08-02T17:12:32.369661Z", + "modified": "2024-08-02T17:12:32.369661Z", "name": "Deceptively Labelled or Translated", "description": "An influence operation may take authentic content from other sources and add deceptive labels or deceptively translate the content into other langauges.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--75a5c211-2590-498c-ad3a-129c912d5cd2.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--75a5c211-2590-498c-ad3a-129c912d5cd2.json index b323c16..e5225bd 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--75a5c211-2590-498c-ad3a-129c912d5cd2.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--75a5c211-2590-498c-ad3a-129c912d5cd2.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--258e85d1-9e27-41b6-b565-e839da19f584", + "id": "bundle--7c16fd50-62ec-4b66-9fc6-a0454d87268f", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--75a5c211-2590-498c-ad3a-129c912d5cd2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.191114Z", - "modified": "2023-09-28T21:25:13.191114Z", + "created": "2024-08-02T17:12:32.331268Z", + "modified": "2024-08-02T17:12:32.331268Z", "name": "Develop Competing Narratives", "description": "Advance competing narratives connected to same issue ie: on one hand deny incident while at same time expresses dismiss. Suppressing or discouraging narratives already spreading requires an alternative. The most simple set of narrative techniques in response would be the construction and promotion of contradictory alternatives centred on denial, deflection, dismissal, counter-charges, excessive standards of proof, bias in prohibition or enforcement, and so on. These competing narratives allow loyalists cover, but are less compelling to opponents and fence-sitters than campaigns built around existing narratives or highly explanatory master narratives. Competing narratives, as such, are especially useful in the \"firehose of misinformation\" approach.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--77574742-25a0-4375-a2c8-d5b54e1360aa.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--77574742-25a0-4375-a2c8-d5b54e1360aa.json index 2d25af3..049ff32 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--77574742-25a0-4375-a2c8-d5b54e1360aa.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--77574742-25a0-4375-a2c8-d5b54e1360aa.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c243daa5-72d3-44b7-b15f-607b744b87d5", + "id": "bundle--c1e126ba-4545-4fd1-b5a4-df0a44c941ba", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--77574742-25a0-4375-a2c8-d5b54e1360aa", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.215004Z", - "modified": "2023-09-28T21:25:13.215004Z", + "created": "2024-08-02T17:12:32.355793Z", + "modified": "2024-08-02T17:12:32.355793Z", "name": "Geographic Segmentation", "description": "An influence operation may target populations in a specific geographic location, such as a region, state, or city. An influence operation may use geographic segmentation to Create Localised Content (see: Establish Legitimacy).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--779fe6e8-44ee-4f36-ab93-9daa867001d4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--779fe6e8-44ee-4f36-ab93-9daa867001d4.json index 638e572..5cb08a2 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--779fe6e8-44ee-4f36-ab93-9daa867001d4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--779fe6e8-44ee-4f36-ab93-9daa867001d4.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b4b36fa4-d2c2-4122-9a26-e3221bcdcda2", + "id": "bundle--9f3ad8d3-ae70-4c24-bb42-bf51ed912884", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--779fe6e8-44ee-4f36-ab93-9daa867001d4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.237308Z", - "modified": "2023-09-28T21:25:13.237308Z", + "created": "2024-08-02T17:12:32.376384Z", + "modified": "2024-08-02T17:12:32.376384Z", "name": "Deceptively Edit Audio (Cheap Fakes)", "description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--77cb282d-d6e6-4d86-87bf-08a2483bdbb6.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--77cb282d-d6e6-4d86-87bf-08a2483bdbb6.json index fb4d595..5fe3b86 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--77cb282d-d6e6-4d86-87bf-08a2483bdbb6.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--77cb282d-d6e6-4d86-87bf-08a2483bdbb6.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--46e473a1-d709-413c-a20b-a07be00df40c", + "id": "bundle--f8f64ce8-48f8-4f4e-a447-ee09899bfade", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--77cb282d-d6e6-4d86-87bf-08a2483bdbb6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.202323Z", - "modified": "2023-09-28T21:25:13.202323Z", + "created": "2024-08-02T17:12:32.342854Z", + "modified": "2024-08-02T17:12:32.342854Z", "name": "Online Polls", "description": "Create fake online polls, or manipulate existing online polls. Data gathering tactic to target those who engage, and potentially their networks of friends/followers as well", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5.json index 0a548d3..b23d3c4 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--faae5d76-627b-4cb2-aca4-e5e0a342e40b", + "id": "bundle--0e6eb2b8-c68d-40d0-ac6f-651494719c8d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.257486Z", - "modified": "2023-09-28T21:25:13.257486Z", + "created": "2024-08-02T17:12:32.400087Z", + "modified": "2024-08-02T17:12:32.400087Z", "name": "Social Networks", "description": "Social media are interactive digital channels that facilitate the creation and sharing of information, ideas, interests, and other forms of expression through virtual communities and networks.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78cf4cd6-a8a0-408f-a5e8-d6f1491aace8.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78cf4cd6-a8a0-408f-a5e8-d6f1491aace8.json index a88a098..2be0869 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78cf4cd6-a8a0-408f-a5e8-d6f1491aace8.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78cf4cd6-a8a0-408f-a5e8-d6f1491aace8.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f9f60bd1-8fc0-4df6-a7b8-cf90378796af", + "id": "bundle--553864cc-f533-42ec-b650-a286be29fd3f", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--78cf4cd6-a8a0-408f-a5e8-d6f1491aace8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.278041Z", - "modified": "2023-09-28T21:25:13.278041Z", + "created": "2024-08-02T17:12:32.41414Z", + "modified": "2024-08-02T17:12:32.41414Z", "name": "Use Pseudonyms", "description": "An operation may use pseudonyms, or fake names, to mask the identity of operational accounts, channels, pages etc., publish anonymous content, or otherwise use falsified personas to conceal the identity of the operation. An operation may coordinate pseudonyms across multiple platforms, for example, by writing an article under a pseudonym and then posting a link to the article on social media on an account, channel, or page with the same falsified name.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78ff99d8-dce8-4f4e-9dc2-3f37f154a39d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78ff99d8-dce8-4f4e-9dc2-3f37f154a39d.json index 6593a81..541f107 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78ff99d8-dce8-4f4e-9dc2-3f37f154a39d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--78ff99d8-dce8-4f4e-9dc2-3f37f154a39d.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b7d6a53c-a9ed-44a3-a1d1-84ef0d342f9a", + "id": "bundle--c446d440-549e-4aa9-ba41-4492a2ce1daa", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--78ff99d8-dce8-4f4e-9dc2-3f37f154a39d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.259826Z", - "modified": "2023-09-28T21:25:13.259826Z", + "created": "2024-08-02T17:12:32.40304Z", + "modified": "2024-08-02T17:12:32.40304Z", "name": "Photo Sharing", "description": "Examples include Instagram, Snapchat, Flickr, etc", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7b32abce-e101-4dc3-98db-30b79c0c8397.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7b32abce-e101-4dc3-98db-30b79c0c8397.json index 2670805..e34c591 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7b32abce-e101-4dc3-98db-30b79c0c8397.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7b32abce-e101-4dc3-98db-30b79c0c8397.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d8b477d9-a711-4fa8-9365-0a9b887fe22c", + "id": "bundle--8eec3736-f862-4ca7-8efd-689e0dfb6ae9", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7b32abce-e101-4dc3-98db-30b79c0c8397", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.212278Z", - "modified": "2023-09-28T21:25:13.212278Z", + "created": "2024-08-02T17:12:32.352216Z", + "modified": "2024-08-02T17:12:32.352216Z", "name": "Pay for Physical Action", "description": "Paying for physical action occurs when an influence operation pays individuals to act in the physical realm. An influence operation may pay for physical action to create specific situations and frame them in a way that supports operation narratives, for example, paying a group of people to burn a car to later post an image of the burning car and frame it as an act of protest.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3.json index cb82ad0..16dcb40 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3.json @@ -1,16 +1,16 @@ { "type": "bundle", - "id": "bundle--4fad99fd-bde0-40eb-8fbf-ade474cc4d6a", + "id": "bundle--ecdb442e-b776-4eda-b607-0433dfd78c34", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.233365Z", - "modified": "2023-09-28T21:25:13.233365Z", + "created": "2024-08-02T17:12:32.374151Z", + "modified": "2024-08-02T17:12:32.374151Z", "name": "Develop AI-Generated Images (Deepfakes)", - "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.", + "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.

Associated Techniques and Sub-techniques:
T0145.002: AI-Generated Account Imagery: Analysts should use this sub-technique to document use of AI generated imagery in accounts\u2019 profile pictures or other account imagery.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7bcb15ef-d371-4b1e-8768-30784e9d7b87.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7bcb15ef-d371-4b1e-8768-30784e9d7b87.json new file mode 100644 index 0000000..9af4806 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7bcb15ef-d371-4b1e-8768-30784e9d7b87.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--e68da775-9c4d-4253-9160-3f5fa2d6d8ab", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--7bcb15ef-d371-4b1e-8768-30784e9d7b87", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.426878Z", + "modified": "2024-08-02T17:12:32.426878Z", + "name": "Raise Funds", + "description": "Solicit donations for a cause. Popular conspiracy theorists can attract financial contributions from their followers. Fighting back against the establishment is a popular crowdfunding narrative. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.003.md", + "external_id": "T0137.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7d5ba27c-12c7-4a30-8624-e1ea6670f0f8.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7d5ba27c-12c7-4a30-8624-e1ea6670f0f8.json index 500afd1..e6d7f9c 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7d5ba27c-12c7-4a30-8624-e1ea6670f0f8.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7d5ba27c-12c7-4a30-8624-e1ea6670f0f8.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--3fd2c1db-d8ab-4dda-a02c-0b9c76cdf2b1", + "id": "bundle--e076c448-5a8c-464e-88ee-dea6478fb020", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7d5ba27c-12c7-4a30-8624-e1ea6670f0f8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.208447Z", - "modified": "2023-09-28T21:25:13.208447Z", + "created": "2024-08-02T17:12:32.345448Z", + "modified": "2024-08-02T17:12:32.345448Z", "name": "Boycott/\"Cancel\" Opponents", "description": "Cancel culture refers to the phenomenon in which individuals collectively refrain from supporting an individual, organisation, business, or other entity, usually following a real or falsified controversy. An influence operation may exploit cancel culture by emphasising an adversary\u2019s problematic or disputed behaviour and presenting its own content as an alternative.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7d69d231-78a6-4a98-a715-c0edd9adafce.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7d69d231-78a6-4a98-a715-c0edd9adafce.json index 017edb8..76852cb 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7d69d231-78a6-4a98-a715-c0edd9adafce.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7d69d231-78a6-4a98-a715-c0edd9adafce.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9f22ca6d-ae97-4d0c-97f0-681666deabe4", + "id": "bundle--5c356f8b-5577-4cb8-8291-c7b7e93fb1e2", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7d69d231-78a6-4a98-a715-c0edd9adafce", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.227018Z", - "modified": "2023-09-28T21:25:13.227018Z", + "created": "2024-08-02T17:12:32.367396Z", + "modified": "2024-08-02T17:12:32.367396Z", "name": "Identify Target Audience Adversaries", "description": "An influence operation may identify or create a real or imaginary adversary to centre operation narratives against. A real adversary may include certain politicians or political parties while imaginary adversaries may include falsified \u201cdeep state\u201d62 actors that, according to conspiracies, run the state behind public view.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7e3a06ee-c109-4901-8720-69c46fe04a76.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7e3a06ee-c109-4901-8720-69c46fe04a76.json index 65fdee1..5b58667 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7e3a06ee-c109-4901-8720-69c46fe04a76.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7e3a06ee-c109-4901-8720-69c46fe04a76.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--4181f639-bb14-4c23-8d63-6c935086311f", + "id": "bundle--4ccdfff8-9d24-45a2-b339-97061f6ef9d6", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7e3a06ee-c109-4901-8720-69c46fe04a76", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.273944Z", - "modified": "2023-09-28T21:25:13.273944Z", + "created": "2024-08-02T17:12:32.410054Z", + "modified": "2024-08-02T17:12:32.410054Z", "name": "Manipulate Platform Algorithm", "description": "Manipulating a platform algorithm refers to conducting activity on a platform in a way that intentionally targets its underlying algorithm. After analysing a platform\u2019s algorithm (see: Select Platforms), an influence operation may use a platform in a way that increases its content exposure, avoids content removal, or otherwise benefits the operation\u2019s strategy. For example, an influence operation may use bots to amplify its posts so that the platform\u2019s algorithm recognises engagement with operation content and further promotes the content on user timelines.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7e812f7d-f8a5-4636-b354-3d93561eda49.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7e812f7d-f8a5-4636-b354-3d93561eda49.json new file mode 100644 index 0000000..1e9128e --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7e812f7d-f8a5-4636-b354-3d93561eda49.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--c6d7f96c-09fd-4f48-b3bf-3f1f45b2c266", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--7e812f7d-f8a5-4636-b354-3d93561eda49", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.392145Z", + "modified": "2024-08-02T17:12:32.392145Z", + "name": "Government Institution Persona", + "description": "Institutions which present themselves as governments, or government ministries, are presenting a government institution persona.

While presenting as a government institution is not an indication of inauthentic behaviour, threat actors may impersonate existing government institutions as part of their operation (T0143.003: Impersonated Persona, T0097.206: Government Institution Persona), to add legitimacy to their narratives, or discredit the government.

Legitimate government institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.206: Government Institution Persona). For example, a government institution could be used by elected officials to spread inauthentic narratives.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Institutions presenting as governments may also present officials working within the organisation.
T0097.112: Government Employee Persona: Institutions presenting as governments may also present employees working within the organisation.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.206.md", + "external_id": "T0097.206" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7f338181-2e4b-435b-a190-7044f3867aa3.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7f338181-2e4b-435b-a190-7044f3867aa3.json index bc87e6c..9771e98 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7f338181-2e4b-435b-a190-7044f3867aa3.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7f338181-2e4b-435b-a190-7044f3867aa3.json @@ -1,16 +1,16 @@ { "type": "bundle", - "id": "bundle--2be49de2-ce8a-4896-b1a5-9ce484d594d7", + "id": "bundle--b85e911a-535d-465e-b913-4882f6588211", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7f338181-2e4b-435b-a190-7044f3867aa3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.257828Z", - "modified": "2023-09-28T21:25:13.257828Z", - "name": "Dating Apps", - "description": "Dating Apps", + "created": "2024-08-02T17:12:32.400595Z", + "modified": "2024-08-02T17:12:32.400595Z", + "name": "Dating App", + "description": "\u201cDating App\u201d refers to any platform (or platform feature) in which the ostensive purpose is for users to develop a physical/romantic relationship with other users.

Threat Actors can exploit users\u2019 quest for love to trick them into doing things like revealing sensitive information or giving them money.

Examples include Tinder, Bumble, Grindr, Facebook Dating, Tantan, Badoo, Plenty of Fish, hinge, LOVOO, OkCupid, happn, and Mamba.

Associated Techniques and Sub-techniques
T0097.109: Romantic Suitor Persona: Analysts can use this sub-technique for tagging cases where an account presents itself as seeking a romantic or physical connection with another person.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7fdc6b19-0d37-43a9-8144-f0c180a13ed0.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7fdc6b19-0d37-43a9-8144-f0c180a13ed0.json index 5f1b10d..e3f8cf5 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7fdc6b19-0d37-43a9-8144-f0c180a13ed0.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--7fdc6b19-0d37-43a9-8144-f0c180a13ed0.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--ee890f9c-7aa9-4769-b09b-96f72b516e2d", + "id": "bundle--7fd030e6-a782-47cb-b36c-435f645663d6", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--7fdc6b19-0d37-43a9-8144-f0c180a13ed0", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.289726Z", - "modified": "2023-09-28T21:25:13.289726Z", + "created": "2024-08-02T17:12:32.420751Z", + "modified": "2024-08-02T17:12:32.420751Z", "name": "Knowledge", "description": "Measure current system state with respect to the effectiveness of influencing knowledge.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--81abb4fa-705e-430f-ba54-34bf7bd467f7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--81abb4fa-705e-430f-ba54-34bf7bd467f7.json index 86d9f8b..1f0f59f 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--81abb4fa-705e-430f-ba54-34bf7bd467f7.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--81abb4fa-705e-430f-ba54-34bf7bd467f7.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--44b54358-5c40-480e-aa9a-68360f78d977", + "id": "bundle--a0734a2b-050b-4fbb-8f59-113ea5306ba4", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--81abb4fa-705e-430f-ba54-34bf7bd467f7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.24201Z", - "modified": "2023-09-28T21:25:13.24201Z", + "created": "2024-08-02T17:12:32.377997Z", + "modified": "2024-08-02T17:12:32.377997Z", "name": "Create Sockpuppet Accounts", "description": "Sockpuppet accounts refer to falsified accounts that either promote the influence operation\u2019s own material or attack critics of the material online. Individuals who control sockpuppet accounts also man at least one other user account.67 Sockpuppet accounts help legitimise operation narratives by providing an appearance of external support for the material and discrediting opponents of the operation.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531.json index eb8d8cf..480c9da 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--8b272661-09cc-485e-a4a9-f983697c165a", + "id": "bundle--c25b7334-461a-4bd7-b212-e5364f469386", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.222094Z", - "modified": "2023-09-28T21:25:13.222094Z", + "created": "2024-08-02T17:12:32.362876Z", + "modified": "2024-08-02T17:12:32.362876Z", "name": "Map Target Audience Information Environment", "description": "Mapping the target audience information environment analyses the information space itself, including social media analytics, web traffic, and media surveys. Mapping the information environment may help the influence operation determine the most realistic and popular information channels to reach its target audience. Mapping the target audience information environment aids influence operations in determining the most vulnerable areas of the information space to target with messaging.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425.json index 277393a..2dae5cf 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f6cacb16-0506-4b2e-8559-ce74533b4c37", + "id": "bundle--a72ec7de-1cf4-422b-aa1e-59b767522808", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.284035Z", - "modified": "2023-09-28T21:25:13.284035Z", + "created": "2024-08-02T17:12:32.417236Z", + "modified": "2024-08-02T17:12:32.417236Z", "name": "Conceal Infrastructure", "description": "Conceal the campaign's infrastructure to avoid takedown and attribution.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8314b253-72a3-46c0-8ee5-6fa02aa9a8fa.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8314b253-72a3-46c0-8ee5-6fa02aa9a8fa.json new file mode 100644 index 0000000..309e409 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8314b253-72a3-46c0-8ee5-6fa02aa9a8fa.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--27defb3a-696f-4990-bb1b-6aca5e2b1c2c", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--8314b253-72a3-46c0-8ee5-6fa02aa9a8fa", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.432872Z", + "modified": "2024-08-02T17:12:32.432872Z", + "name": "AI-Generated Account Imagery", + "description": "AI Generated images used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived legitimacy. By using an AI-generated picture for this purpose, they are able to present themselves as a real person without compromising their own identity, or risking detection by taking a real person\u2019s existing profile picture.

Associated Techniques and Sub-techniques
T0086.002: Develop AI-Generated Images (Deepfakes): Analysts should use this sub-technique to document use of AI generated imagery used to support narratives.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.002.md", + "external_id": "T0145.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--836e9eef-b446-4f68-805f-0f10116d6e7f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--836e9eef-b446-4f68-805f-0f10116d6e7f.json index fb38426..3bdae42 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--836e9eef-b446-4f68-805f-0f10116d6e7f.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--836e9eef-b446-4f68-805f-0f10116d6e7f.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9734e977-7c5e-483b-8834-ee061a78b2a5", + "id": "bundle--a8f0bcb3-c0c7-41e9-aac4-15844410ca65", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--836e9eef-b446-4f68-805f-0f10116d6e7f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.271782Z", - "modified": "2023-09-28T21:25:13.271782Z", + "created": "2024-08-02T17:12:32.408436Z", + "modified": "2024-08-02T17:12:32.408436Z", "name": "Amplify Existing Narrative", "description": "An influence operation may amplify existing narratives that align with its narratives to support operation objectives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--83b4e2db-265f-4f88-9b35-26df05c561e9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--83b4e2db-265f-4f88-9b35-26df05c561e9.json index 0e32b99..c7c21fe 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--83b4e2db-265f-4f88-9b35-26df05c561e9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--83b4e2db-265f-4f88-9b35-26df05c561e9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e14dfa60-3fa4-40b9-a9c8-e6bba6a3da3c", + "id": "bundle--5837cfd1-1ad3-4aeb-97b7-55094e9ad712", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--83b4e2db-265f-4f88-9b35-26df05c561e9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.288335Z", - "modified": "2023-09-28T21:25:13.288335Z", + "created": "2024-08-02T17:12:32.419355Z", + "modified": "2024-08-02T17:12:32.419355Z", "name": "People Focused", "description": "Measure the performance individuals in achieving campaign goals", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8432d382-0ce8-4507-97ea-95be10de3488.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8432d382-0ce8-4507-97ea-95be10de3488.json index 5831ed3..c51976c 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8432d382-0ce8-4507-97ea-95be10de3488.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8432d382-0ce8-4507-97ea-95be10de3488.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e24e8526-c107-4744-961b-cee963ea47f8", + "id": "bundle--47d3cd8e-d4aa-4f3b-ad1e-94a917b5985c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8432d382-0ce8-4507-97ea-95be10de3488", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.261294Z", - "modified": "2023-09-28T21:25:13.261294Z", + "created": "2024-08-02T17:12:32.403875Z", + "modified": "2024-08-02T17:12:32.403875Z", "name": "Anonymous Message Boards", "description": "Examples include the Chans", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--84e0fdf7-3bba-4e66-a575-6a32a7f8eca6.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--84e0fdf7-3bba-4e66-a575-6a32a7f8eca6.json index 0eb2cce..6ad73c7 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--84e0fdf7-3bba-4e66-a575-6a32a7f8eca6.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--84e0fdf7-3bba-4e66-a575-6a32a7f8eca6.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9b597d94-be87-41cd-b342-dbfedd246ba6", + "id": "bundle--ccc34fcf-cbe6-483d-97f0-9f8a11c408a0", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--84e0fdf7-3bba-4e66-a575-6a32a7f8eca6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.201835Z", - "modified": "2023-09-28T21:25:13.201835Z", + "created": "2024-08-02T17:12:32.342508Z", + "modified": "2024-08-02T17:12:32.342508Z", "name": "Edit Open-Source Content", "description": "An influence operation may edit open-source content, such as collaborative blogs or encyclopaedias, to promote its narratives on outlets with existing credibility and audiences. Editing open-source content may allow an operation to post content on platforms without dedicating resources to the creation and maintenance of its own assets.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6.json new file mode 100644 index 0000000..129ffc9 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--efdc4265-c1aa-4754-a939-cf553de61740", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.432566Z", + "modified": "2024-08-02T17:12:32.432566Z", + "name": "Establish Account Imagery", + "description": "Introduce visual elements to an account where a platform allows this functionality (e.g. a profile picture, a cover photo, etc).\u00a0

Threat Actors who don\u2019t want to use pictures of themselves in their social media accounts may use alternate imagery to make their account appear more legitimate.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.md", + "external_id": "T0145" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--872f0dc3-202e-4e9a-a4fc-0457252aecae.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--872f0dc3-202e-4e9a-a4fc-0457252aecae.json index fa9cafc..4296666 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--872f0dc3-202e-4e9a-a4fc-0457252aecae.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--872f0dc3-202e-4e9a-a4fc-0457252aecae.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f4b606e2-9fad-4ac5-80ad-5aa833e3e505", + "id": "bundle--3d80125c-5286-4f62-937a-83e439fe7277", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--872f0dc3-202e-4e9a-a4fc-0457252aecae", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.272585Z", - "modified": "2023-09-28T21:25:13.272585Z", + "created": "2024-08-02T17:12:32.408629Z", + "modified": "2024-08-02T17:12:32.408629Z", "name": "Cross-Posting", "description": "Cross-posting refers to posting the same message to multiple internet discussions, social media platforms or accounts, or news groups at one time. An influence operation may post content online in multiple communities and platforms to increase the chances of content exposure to the target audience.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8958b87c-85fd-478f-ae01-8952c787d9b7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8958b87c-85fd-478f-ae01-8952c787d9b7.json new file mode 100644 index 0000000..f9bb17d --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8958b87c-85fd-478f-ae01-8952c787d9b7.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--ab8d3d48-7a12-41fe-85c4-914ecb6455e6", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--8958b87c-85fd-478f-ae01-8952c787d9b7", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.427325Z", + "modified": "2024-08-02T17:12:32.427325Z", + "name": "Sell Items under False Pretences", + "description": "Offer products for sale under false pretences. Campaigns may hijack or create causes built on disinformation to sell promotional merchandise. Or charlatans may amplify victims\u2019 unfounded fears to sell them items of questionable utility such as supplements or survival gear. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.004.md", + "external_id": "T0137.004" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--89b88c22-0686-4d28-9c2b-e0c6ac31a4ab.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--89b88c22-0686-4d28-9c2b-e0c6ac31a4ab.json index 0cd8ad2..fa478f7 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--89b88c22-0686-4d28-9c2b-e0c6ac31a4ab.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--89b88c22-0686-4d28-9c2b-e0c6ac31a4ab.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f9174bbe-53b5-4b79-a0b5-a91001121ad9", + "id": "bundle--322772a5-9302-4046-83e9-8622c00a8156", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--89b88c22-0686-4d28-9c2b-e0c6ac31a4ab", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.274087Z", - "modified": "2023-09-28T21:25:13.274087Z", + "created": "2024-08-02T17:12:32.410247Z", + "modified": "2024-08-02T17:12:32.410247Z", "name": "Bypass Content Blocking", "description": "Bypassing content blocking refers to actions taken to circumvent network security measures that prevent users from accessing certain servers, resources, or other online spheres. An influence operation may bypass content blocking to proliferate its content on restricted areas of the internet. Common strategies for bypassing content blocking include: - Altering IP addresses to avoid IP filtering - Using a Virtual Private Network (VPN) to avoid IP filtering - Using a Content Delivery Network (CDN) to avoid IP filtering - Enabling encryption to bypass packet inspection blocking - Manipulating text to avoid filtering by keywords - Posting content on multiple platforms to avoid platform-specific removals - Using local facilities or modified DNS servers to avoid DNS filtering", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ac60812-17d7-4e9f-911e-64467233a9b3.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ac60812-17d7-4e9f-911e-64467233a9b3.json new file mode 100644 index 0000000..7fc7df9 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ac60812-17d7-4e9f-911e-64467233a9b3.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--8cd6fe4f-45b0-4f85-a28c-b078b0a1df54", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--8ac60812-17d7-4e9f-911e-64467233a9b3", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.429391Z", + "modified": "2024-08-02T17:12:32.429391Z", + "name": "Deter", + "description": "Prevent target from taking an action for fear of the consequences. Deterrence occurs in the mind of the target, who fears they will be worse off if they take an action than if they don\u2019t. When making threats, aggressors may bluff, feign irrationality, or engage in brinksmanship.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.003.md", + "external_id": "T0139.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ad58740-d5c1-40bb-9091-f98adfe8d89f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ad58740-d5c1-40bb-9091-f98adfe8d89f.json index aab6501..5e84b7f 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ad58740-d5c1-40bb-9091-f98adfe8d89f.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ad58740-d5c1-40bb-9091-f98adfe8d89f.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--4809dcfc-d737-4b26-a64f-dc3a0e169fff", + "id": "bundle--59bb2471-3c8b-42e2-8d53-16fd8e1a6aa2", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8ad58740-d5c1-40bb-9091-f98adfe8d89f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.221088Z", - "modified": "2023-09-28T21:25:13.221088Z", + "created": "2024-08-02T17:12:32.362029Z", + "modified": "2024-08-02T17:12:32.362029Z", "name": "Dismay", "description": "Threaten the critic or narrator of events. For instance, threaten journalists or news outlets reporting on a story.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8b991b67-9df8-42e7-b11a-5ed1bc41c5a5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8b991b67-9df8-42e7-b11a-5ed1bc41c5a5.json index bb4b61c..c712bd8 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8b991b67-9df8-42e7-b11a-5ed1bc41c5a5.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8b991b67-9df8-42e7-b11a-5ed1bc41c5a5.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--365f2f37-f3ff-4860-a3e4-0483fa47f85b", + "id": "bundle--696cc266-4361-4af2-99ec-68c00f467627", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8b991b67-9df8-42e7-b11a-5ed1bc41c5a5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.286669Z", - "modified": "2023-09-28T21:25:13.286669Z", + "created": "2024-08-02T17:12:32.418215Z", + "modified": "2024-08-02T17:12:32.418215Z", "name": "Obfuscate Payment", "description": "Obfuscate Payment", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8c7832cb-8877-4f54-8e05-7e6df9a3d2b4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8c7832cb-8877-4f54-8e05-7e6df9a3d2b4.json index a4c51d2..122803f 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8c7832cb-8877-4f54-8e05-7e6df9a3d2b4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8c7832cb-8877-4f54-8e05-7e6df9a3d2b4.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--53238178-5df8-45c7-8c4d-e52866041ef7", + "id": "bundle--48b71da7-7e9d-4a52-bc14-d888f701afdf", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8c7832cb-8877-4f54-8e05-7e6df9a3d2b4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.237844Z", - "modified": "2023-09-28T21:25:13.237844Z", + "created": "2024-08-02T17:12:32.376603Z", + "modified": "2024-08-02T17:12:32.376603Z", "name": "Obtain Private Documents", "description": "Procuring documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can include authentic non-public documents, authentic non-public documents have been altered, or inauthentic documents intended to appear as if they are authentic non-public documents. All of these types of documents can be \"leaked\" during later stages in the operation.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34.json index f6885c6..556b097 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d2deeef7-35df-411f-ba0b-1f7a1afd8e89", + "id": "bundle--392a6d8f-be6e-4f2c-bffd-07ee02f4b901", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.230461Z", - "modified": "2023-09-28T21:25:13.230461Z", + "created": "2024-08-02T17:12:32.370419Z", + "modified": "2024-08-02T17:12:32.370419Z", "name": "Develop Text-Based Content", "description": "Creating and editing false or misleading text-based artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ecbc28c-36e9-4d9a-8578-b9e20552d732.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ecbc28c-36e9-4d9a-8578-b9e20552d732.json index fdf4a23..2a5ebff 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ecbc28c-36e9-4d9a-8578-b9e20552d732.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8ecbc28c-36e9-4d9a-8578-b9e20552d732.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1625cc08-ec5c-4dc5-8f31-ac3c3b82696d", + "id": "bundle--923f47f4-76e3-4ceb-a471-236540b119cd", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8ecbc28c-36e9-4d9a-8578-b9e20552d732", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.225334Z", - "modified": "2023-09-28T21:25:13.225334Z", + "created": "2024-08-02T17:12:32.366252Z", + "modified": "2024-08-02T17:12:32.366252Z", "name": "Identify Existing Prejudices", "description": "An influence operation may exploit existing racial, religious, demographic, or social prejudices to further polarise its target audience from the rest of the public.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8f545c7e-f2ba-4541-9004-dbe50fcc0b0f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8f545c7e-f2ba-4541-9004-dbe50fcc0b0f.json index cfb00ff..80a1069 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8f545c7e-f2ba-4541-9004-dbe50fcc0b0f.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8f545c7e-f2ba-4541-9004-dbe50fcc0b0f.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--b80c4c48-25fa-4119-a1ba-3308730cd6e0", + "id": "bundle--e3f773da-1722-45b3-84f1-4c7564b017eb", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8f545c7e-f2ba-4541-9004-dbe50fcc0b0f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.246767Z", - "modified": "2023-09-28T21:25:13.246767Z", + "created": "2024-08-02T17:12:32.381311Z", + "modified": "2024-08-02T17:12:32.381311Z", "name": "Utilise Butterfly Attacks", "description": "Butterfly attacks occur when operators pretend to be members of a certain social group, usually a group that struggles for representation. An influence operation may mimic a group to insert controversial statements into the discourse, encourage the spread of operation content, or promote harassment among group members. Unlike astroturfing, butterfly attacks aim to infiltrate and discredit existing grassroots movements, organisations, and media campaigns.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8f83d6b8-01f4-406c-a3da-48a040e46139.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8f83d6b8-01f4-406c-a3da-48a040e46139.json index 0a67e77..e51cf58 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8f83d6b8-01f4-406c-a3da-48a040e46139.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--8f83d6b8-01f4-406c-a3da-48a040e46139.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--8da9150a-6066-47c5-b2f0-c3af7a835c29", + "id": "bundle--c2e843e2-3de3-4dde-9869-fd069f567c35", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--8f83d6b8-01f4-406c-a3da-48a040e46139", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.267811Z", - "modified": "2023-09-28T21:25:13.267811Z", + "created": "2024-08-02T17:12:32.406729Z", + "modified": "2024-08-02T17:12:32.406729Z", "name": "Traditional Media", "description": "Examples include TV, Radio, Newspaper, billboards", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905.json new file mode 100644 index 0000000..ab70da2 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--948392b0-3f6a-409f-adc4-7e251b735684", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.428073Z", + "modified": "2024-08-02T17:12:32.428073Z", + "name": "Motivate to Act", + "description": "Persuade, impel, or provoke the target to behave in a specific manner favourable to the attacker. Some common behaviours are joining, subscribing, voting, buying, demonstrating, fighting, retreating, resigning, boycotting.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.md", + "external_id": "T0138" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4.json index a3d3ee3..da8ced6 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4.json @@ -1,16 +1,16 @@ { "type": "bundle", - "id": "bundle--c2672c45-6c00-485a-b41f-4f3f22f4a3da", + "id": "bundle--1f3237eb-94c9-4daa-a4bf-2ff797e9b2bc", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.249041Z", - "modified": "2023-09-28T21:25:13.249041Z", - "name": "Create Personas", - "description": "Creating fake people, often with accounts across multiple platforms. These personas can be as simple as a name, can contain slightly more background like location, profile pictures, backstory, or can be effectively backstopped with indicators like fake identity documents.", + "created": "2024-08-02T17:12:32.383296Z", + "modified": "2024-08-02T17:12:32.383296Z", + "name": "Present Persona", + "description": "This Technique contains different types of personas commonly taken on by threat actors during influence operations.

Analysts should use T0097\u2019s sub-techniques to document the type of persona which an account is presenting. For example, an account which describes itself as being a journalist can be tagged with T0097.102: Journalist Persona.

Personas presented by individuals include:

T0097.100: Individual Persona
T0097.101: Local Persona
T0097.102: Journalist Persona
T0097.103: Activist Persona
T0097.104: Hacktivist Persona
T0097.105: Military Personnel Persona
T0097.106: Recruiter Persona
T0097.107: Researcher Persona
T0097.108: Expert Persona
T0097.109: Romantic Suitor Persona
T0097.110: Party Official Persona
T0097.111: Government Official Persona
T0097.112: Government Employee Persona

This Technique also houses institutional personas commonly taken on by threat actors:

T0097.200: Institutional Persona
T0097.201: Local Institution Persona
T0097.202: News Outlet Persona
T0097.203: Fact Checking Organisation Persona
T0097.204: Think Tank Persona
T0097.205: Business Persona
T0097.206: Government Institution Persona
T0097.207: NGO Persona
T0097.208: Social Cause Persona

By using a persona, a threat actor is adding the perceived legitimacy of the persona to their narratives and activities.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--90ca8c39-a644-4007-b3d6-68fabc90b531.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--90ca8c39-a644-4007-b3d6-68fabc90b531.json index a322a84..39b7cc6 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--90ca8c39-a644-4007-b3d6-68fabc90b531.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--90ca8c39-a644-4007-b3d6-68fabc90b531.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a9ad2033-ec65-4d87-95cd-b87cb08c9e08", + "id": "bundle--03229f01-0521-4388-87c7-bd90c7cdf583", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--90ca8c39-a644-4007-b3d6-68fabc90b531", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.207469Z", - "modified": "2023-09-28T21:25:13.207469Z", + "created": "2024-08-02T17:12:32.345087Z", + "modified": "2024-08-02T17:12:32.345087Z", "name": "Censor Social Media as a Political Force", "description": "Use political influence or the power of state to stop critical social media comments. Government requested/driven content take downs (see Google Transperancy reports).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--930ddf1d-7dc9-4fb2-9f5c-be928d2eb909.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--930ddf1d-7dc9-4fb2-9f5c-be928d2eb909.json new file mode 100644 index 0000000..ba655f0 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--930ddf1d-7dc9-4fb2-9f5c-be928d2eb909.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--56de8e35-0c52-47af-b6ab-6d7583f0f996", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--930ddf1d-7dc9-4fb2-9f5c-be928d2eb909", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.384404Z", + "modified": "2024-08-02T17:12:32.384404Z", + "name": "Journalist Persona", + "description": "A person with a journalist persona presents themselves as a reporter or journalist delivering news, conducting interviews, investigations etc.

While presenting as a journalist is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as journalists. Threat actors can fabricate journalists to give the appearance of legitimacy, justifying the actor\u2019s requests for interviews, etc (T0143.002: Fabricated Persona, T0097.102: Journalist Persona).

People who have legitimately developed a persona as a journalist (T0143.001: Authentic Persona, T0097.102: Journalist Persona) can use it for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a trusted journalist to provide legitimacy to a false narrative or be tricked into doing so without the journalist\u2019s knowledge.

Associated Techniques and Sub-techniques
T0097.202: News Organisation Persona: People with a journalist persona may present as being part of a news organisation.
T0097.101: Local Persona: People with a journalist persona may present themselves as local reporters.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.102.md", + "external_id": "T0097.102" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab.json new file mode 100644 index 0000000..9a8ead3 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--6af72ee0-3eb6-4734-9b06-1c290a2ec7e9", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.430948Z", + "modified": "2024-08-02T17:12:32.430948Z", + "name": "Persona Legitimacy", + "description": "This Technique contains sub-techniques which analysts can use to assert whether an account is presenting an authentic, fabricated, or parody persona:

T0143.001: Authentic Persona
T0143.002: Fabricated Persona
T0143.003: Impersonated Persona
T0143.004: Parody Persona", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.md", + "external_id": "T0143" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--95e3e261-2f42-4ff0-a1f9-4eb2c5998284.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--95e3e261-2f42-4ff0-a1f9-4eb2c5998284.json index f0df611..7ad75dd 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--95e3e261-2f42-4ff0-a1f9-4eb2c5998284.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--95e3e261-2f42-4ff0-a1f9-4eb2c5998284.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--02a239ab-1987-4ca4-83c4-a7d330a043ee", + "id": "bundle--a209e9f6-23b5-4105-b926-567da17e791d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--95e3e261-2f42-4ff0-a1f9-4eb2c5998284", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.194292Z", - "modified": "2023-09-28T21:25:13.194292Z", + "created": "2024-08-02T17:12:32.333954Z", + "modified": "2024-08-02T17:12:32.333954Z", "name": "Create Inauthentic Websites", "description": "Create media assets to support inauthentic organisations (e.g. think tank), people (e.g. experts) and/or serve as sites to distribute malware/launch phishing operations.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877.json index 9ebc305..f529554 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a1a1ca61-1375-4e4a-bb5b-58ddbfc42589", + "id": "bundle--24690303-fd4b-4843-9e6e-986ae754a79d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.227892Z", - "modified": "2023-09-28T21:25:13.227892Z", + "created": "2024-08-02T17:12:32.368664Z", + "modified": "2024-08-02T17:12:32.368664Z", "name": "Reuse Existing Content", "description": "When an operation recycles content from its own previous operations or plagiarises from external operations. An operation may launder information to conserve resources that would have otherwise been utilised to develop new content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--976faac5-b7e1-4a1d-b52f-4878109e2dc9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--976faac5-b7e1-4a1d-b52f-4878109e2dc9.json new file mode 100644 index 0000000..c97c6b4 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--976faac5-b7e1-4a1d-b52f-4878109e2dc9.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--66ff537c-e42a-45f7-879f-e1771c1a3fe8", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--976faac5-b7e1-4a1d-b52f-4878109e2dc9", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.385218Z", + "modified": "2024-08-02T17:12:32.385218Z", + "name": "Hacktivist Persona", + "description": "A person with a hacktivist persona presents themselves as an activist who conducts offensive cyber operations or builds technical infrastructure for political purposes, rather than the financial motivations commonly attributed to hackers; hacktivists are hacker activists who use their technical knowledge to take political action.

Hacktivists can build technical infrastructure to support other activists, including secure communication channels and surveillance and censorship circumvention. They can also conduct DDOS attacks and other offensive cyber operations, aiming to take down digital assets or gain access to proprietary information. An influence operation may use hacktivist personas to support their operational narratives and legitimise their operational activities.

Fabricated Hacktivists are sometimes referred to as \u201cFaketivists\u201d.

Associated Techniques and Sub-techniques
T0097.103: Activist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as someone engaged in activism but doesn\u2019t present themselves as using technical tools and methods to achieve their goals.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.104.md", + "external_id": "T0097.104" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--97ba7c89-f5d0-49a4-a661-f8317b44cf20.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--97ba7c89-f5d0-49a4-a661-f8317b44cf20.json new file mode 100644 index 0000000..3dbb8e4 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--97ba7c89-f5d0-49a4-a661-f8317b44cf20.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--f32fd612-9b34-4ac9-b5d3-27f6cb04f9cc", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--97ba7c89-f5d0-49a4-a661-f8317b44cf20", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.390969Z", + "modified": "2024-08-02T17:12:32.390969Z", + "name": "Fact Checking Organisation Persona", + "description": "An institution with a fact checking organisation persona presents itself as an organisation which produces reports which assess the validity of others\u2019 reporting / statements.

While presenting as a fact checking organisation is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by fact checking organisations. Threat actors can fabricate fact checking organisations (T0143.002: Fabricated Persona, T0097.202: News Outlet Persona), or they can impersonate existing fact checking outlets (T0143.003: Impersonated Persona, T0097.202: News Outlet Persona).

Legitimate fact checking organisations could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.202: News Outlet Persona).

Associated Techniques and Sub-techniques
T0097.102: Journalist Persona: Institutions presenting as fact checking organisations may also present journalists working within the organisation.
T0097.202: News Outlet Persona: Fact checking organisations may present as operating as part of a larger news outlet (e.g. The UK\u2019s BBC News has the fact checking service BBC Verify). When an actor presents as the fact checking arm of a news outlet, they are presenting both a News Outlet Persona and a Fact Checking Organisation Persona.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.203.md", + "external_id": "T0097.203" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9a4a16c5-a671-4469-a854-ef45cb0e38ab.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9a4a16c5-a671-4469-a854-ef45cb0e38ab.json index 8baed6b..fd2b975 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9a4a16c5-a671-4469-a854-ef45cb0e38ab.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9a4a16c5-a671-4469-a854-ef45cb0e38ab.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--101b7134-7968-4519-b646-97a16c144932", + "id": "bundle--33b0dc81-83d3-40bf-a8c4-7f1093d7d9ea", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9a4a16c5-a671-4469-a854-ef45cb0e38ab", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.242187Z", - "modified": "2023-09-28T21:25:13.242187Z", + "created": "2024-08-02T17:12:32.378342Z", + "modified": "2024-08-02T17:12:32.378342Z", "name": "Recruit Malign Actors", "description": "Operators recruit bad actors paying recruiting, or exerting control over individuals includes trolls, partisans, and contractors.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9a5261b8-5051-47ed-a4f6-bdbb7b6edcb4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9a5261b8-5051-47ed-a4f6-bdbb7b6edcb4.json index fdd627d..7cdea20 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9a5261b8-5051-47ed-a4f6-bdbb7b6edcb4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9a5261b8-5051-47ed-a4f6-bdbb7b6edcb4.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--5e661b9e-3bfd-46f7-9eb2-e2ba412e5750", + "id": "bundle--b36ff8be-48de-4d60-b074-e0e5d67094a7", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9a5261b8-5051-47ed-a4f6-bdbb7b6edcb4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.268804Z", - "modified": "2023-09-28T21:25:13.268804Z", + "created": "2024-08-02T17:12:32.40712Z", + "modified": "2024-08-02T17:12:32.40712Z", "name": "Share Memes", "description": "Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9affd892-2479-4843-99d1-1e1a9f7f1020.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9affd892-2479-4843-99d1-1e1a9f7f1020.json index ed45196..350dc7f 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9affd892-2479-4843-99d1-1e1a9f7f1020.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9affd892-2479-4843-99d1-1e1a9f7f1020.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c27ea363-c6cc-4aec-8169-8e052e9da971", + "id": "bundle--1b4eb58c-5b5e-4672-aa47-3dd4636be763", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9affd892-2479-4843-99d1-1e1a9f7f1020", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.278442Z", - "modified": "2023-09-28T21:25:13.278442Z", + "created": "2024-08-02T17:12:32.414425Z", + "modified": "2024-08-02T17:12:32.414425Z", "name": "Distance Reputable Individuals from Operation", "description": "Distancing reputable individuals from the operation occurs when enlisted individuals, such as celebrities or subject matter experts, actively disengage themselves from operation activities and messaging. Individuals may distance themselves from the operation by deleting old posts or statements, unfollowing operation information assets, or otherwise detaching themselves from the operation\u2019s timeline. An influence operation may want reputable individuals to distance themselves from the operation to reduce operation exposure, particularly if the operation aims to remove all evidence.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2.json index f546fb7..03cdd59 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1a7acf27-5570-465e-8714-4abc793fff57", + "id": "bundle--4f026833-45b0-40b1-ad22-605302a20b58", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.254245Z", - "modified": "2023-09-28T21:25:13.254245Z", + "created": "2024-08-02T17:12:32.396005Z", + "modified": "2024-08-02T17:12:32.396005Z", "name": "Co-Opt Influencers", "description": "Co-opt Influencers", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b667c6e-5bc3-4c1e-b114-6f679a662b5d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b667c6e-5bc3-4c1e-b114-6f679a662b5d.json index f2473d1..ddab7a8 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b667c6e-5bc3-4c1e-b114-6f679a662b5d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b667c6e-5bc3-4c1e-b114-6f679a662b5d.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1ac2fddc-3c33-473c-8d1f-434206949d04", + "id": "bundle--ac7352bc-292a-4e82-89a5-0df0a3caa3ef", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9b667c6e-5bc3-4c1e-b114-6f679a662b5d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.274682Z", - "modified": "2023-09-28T21:25:13.274682Z", + "created": "2024-08-02T17:12:32.411168Z", + "modified": "2024-08-02T17:12:32.411168Z", "name": "Block Content", "description": "Content blocking refers to actions taken to restrict internet access or render certain areas of the internet inaccessible. An influence operation may restrict content based on both network and content attributes.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b66eaf5-5b03-46b8-b076-cf1da3593745.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b66eaf5-5b03-46b8-b076-cf1da3593745.json index 0139327..a8fb4fc 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b66eaf5-5b03-46b8-b076-cf1da3593745.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b66eaf5-5b03-46b8-b076-cf1da3593745.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--11884a99-bcac-461e-8a41-a764abefd26b", + "id": "bundle--60f6e0ff-8cfd-4855-8933-5dc42591af1d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9b66eaf5-5b03-46b8-b076-cf1da3593745", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.219588Z", - "modified": "2023-09-28T21:25:13.219588Z", + "created": "2024-08-02T17:12:32.360819Z", + "modified": "2024-08-02T17:12:32.360819Z", "name": "Discredit Credible Sources", "description": "Plan to delegitimize the media landscape and degrade public trust in reporting, by discrediting credible sources. This makes it easier to promote influence operation content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b6b3dea-54ac-4e00-bd92-380555205afe.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b6b3dea-54ac-4e00-bd92-380555205afe.json index ad96d1e..ebee594 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b6b3dea-54ac-4e00-bd92-380555205afe.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9b6b3dea-54ac-4e00-bd92-380555205afe.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--3db186aa-93e3-4f76-ad40-8012e853f9b8", + "id": "bundle--c96f44cb-647d-4df9-ba24-67f9fd65359e", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9b6b3dea-54ac-4e00-bd92-380555205afe", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.260838Z", - "modified": "2023-09-28T21:25:13.260838Z", + "created": "2024-08-02T17:12:32.403681Z", + "modified": "2024-08-02T17:12:32.403681Z", "name": "Discussion Forums", "description": "Platforms for finding, discussing, and sharing information and opinions. Examples include Reddit, Quora, Digg, message boards, interest-based discussion forums, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9cf02828-bd4c-4b04-a9f0-bb67ec3b0493.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9cf02828-bd4c-4b04-a9f0-bb67ec3b0493.json index f42a968..b423f4b 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9cf02828-bd4c-4b04-a9f0-bb67ec3b0493.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9cf02828-bd4c-4b04-a9f0-bb67ec3b0493.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--81faea92-2ee5-4a46-968a-c4afd56650d2", + "id": "bundle--14187f9e-f0f2-413d-9320-0e0acde61759", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9cf02828-bd4c-4b04-a9f0-bb67ec3b0493", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.19059Z", - "modified": "2023-09-28T21:25:13.19059Z", + "created": "2024-08-02T17:12:32.329903Z", + "modified": "2024-08-02T17:12:32.329903Z", "name": "Leverage Existing Narratives", "description": "Use or adapt existing narrative themes, where narratives are the baseline stories of a target audience. Narratives form the bedrock of our worldviews. New information is understood through a process firmly grounded in this bedrock. If new information is not consitent with the prevailing narratives of an audience, it will be ignored. Effective campaigns will frame their misinformation in the context of these narratives. Highly effective campaigns will make extensive use of audience-appropriate archetypes and meta-narratives throughout their content creation and amplifiction practices.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9e081185-12f4-41f0-8379-95b688e1d80f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9e081185-12f4-41f0-8379-95b688e1d80f.json new file mode 100644 index 0000000..07007ac --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9e081185-12f4-41f0-8379-95b688e1d80f.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--59a64fc4-3e15-4297-937b-8710bbc13751", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--9e081185-12f4-41f0-8379-95b688e1d80f", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.427609Z", + "modified": "2024-08-02T17:12:32.427609Z", + "name": "Extort", + "description": "Coerce money or favours from a target by threatening to expose or corrupt information. Ransomware criminals typically demand money. Intelligence agencies demand national secrets. Sexual predators demand favours. The leverage may be critical, sensitive, or embarrassing information. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.005.md", + "external_id": "T0137.005" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9e80abf9-0991-47c3-982c-b33e66640d10.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9e80abf9-0991-47c3-982c-b33e66640d10.json index b8ad171..88ac5fe 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9e80abf9-0991-47c3-982c-b33e66640d10.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9e80abf9-0991-47c3-982c-b33e66640d10.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1228a23c-2c6c-4637-91c5-c7b2559b4b92", + "id": "bundle--449ab655-870f-4eeb-9c23-76bda1f0b8bb", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9e80abf9-0991-47c3-982c-b33e66640d10", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.220627Z", - "modified": "2023-09-28T21:25:13.220627Z", + "created": "2024-08-02T17:12:32.361644Z", + "modified": "2024-08-02T17:12:32.361644Z", "name": "Distract", "description": "Shift attention to a different narrative or actor, for instance by accusing critics of the same activity that they\u2019ve accused you of (e.g. police brutality).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9ec25bd4-7dcd-4bbf-9e2f-6170af84e166.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9ec25bd4-7dcd-4bbf-9e2f-6170af84e166.json index 1ae07a5..c623088 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9ec25bd4-7dcd-4bbf-9e2f-6170af84e166.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9ec25bd4-7dcd-4bbf-9e2f-6170af84e166.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--5d99dbb9-c10c-44d5-8899-fc037e734e5a", + "id": "bundle--09a26d13-85fd-4b83-b664-4d24021b34b5", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9ec25bd4-7dcd-4bbf-9e2f-6170af84e166", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.222626Z", - "modified": "2023-09-28T21:25:13.222626Z", + "created": "2024-08-02T17:12:32.363333Z", + "modified": "2024-08-02T17:12:32.363333Z", "name": "Monitor Social Media Analytics", "description": "An influence operation may use social media analytics to determine which factors will increase the operation content\u2019s exposure to its target audience on social media platforms, including views, interactions, and sentiment relating to topics and content types. The social media platform itself or a third-party tool may collect the metrics.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9f99239e-f22e-4db4-9681-c20e511b4c35.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9f99239e-f22e-4db4-9681-c20e511b4c35.json new file mode 100644 index 0000000..b301aac --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--9f99239e-f22e-4db4-9681-c20e511b4c35.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--3de471d2-af7a-4fa0-b0ac-709b2a60ea4e", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--9f99239e-f22e-4db4-9681-c20e511b4c35", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.371475Z", + "modified": "2024-08-02T17:12:32.371475Z", + "name": "Develop Document", + "description": "Produce text in the form of a document.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "develop-content" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.004.md", + "external_id": "T0085.004" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a09594d3-c930-451a-8eb6-7e2d748618bb.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a09594d3-c930-451a-8eb6-7e2d748618bb.json index f2b5beb..1f9f4fa 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a09594d3-c930-451a-8eb6-7e2d748618bb.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a09594d3-c930-451a-8eb6-7e2d748618bb.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f801ebb9-e614-4433-a8be-4d5ffb1f3456", + "id": "bundle--8af1e8f8-186d-401d-962a-275f39de3bbc", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a09594d3-c930-451a-8eb6-7e2d748618bb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.284619Z", - "modified": "2023-09-28T21:25:13.284619Z", + "created": "2024-08-02T17:12:32.417423Z", + "modified": "2024-08-02T17:12:32.417423Z", "name": "Conceal Sponsorship", "description": "Concealing sponsorship aims to mislead or obscure the identity of the hidden sponsor behind an operation rather than entity publicly running the operation. Operations that conceal sponsorship may maintain visible falsified groups, news outlets, non-profits, or other organisations, but seek to mislead or obscure the identity sponsoring, funding, or otherwise supporting these entities. Influence operations may use a variety of techniques to mask the location of their social media accounts to complicate attribution and conceal evidence of foreign interference. Operation accounts may set their location to a false place, often the location of the operation\u2019s target audience, and post in the region\u2019s language", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a09fbbeb-58ef-4e7a-8183-5eaa668200c9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a09fbbeb-58ef-4e7a-8183-5eaa668200c9.json index 846afd4..57c7366 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a09fbbeb-58ef-4e7a-8183-5eaa668200c9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a09fbbeb-58ef-4e7a-8183-5eaa668200c9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--7d449efd-1211-4de5-aa8d-30aa2498f23a", + "id": "bundle--0ed1decc-a90a-4a9c-86c6-e7055c8986d8", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a09fbbeb-58ef-4e7a-8183-5eaa668200c9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.280245Z", - "modified": "2023-09-28T21:25:13.280245Z", + "created": "2024-08-02T17:12:32.415759Z", + "modified": "2024-08-02T17:12:32.415759Z", "name": "Delete URLs", "description": "URL deletion occurs when an influence operation completely removes its website registration, rendering the URL inaccessible. An influence operation may delete its URLs to complicate attribution or remove online documentation that the operation ever occurred.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a24e779c-0f44-493b-862d-00693bf34ca4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a24e779c-0f44-493b-862d-00693bf34ca4.json index d55e74f..2a6c1cd 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a24e779c-0f44-493b-862d-00693bf34ca4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a24e779c-0f44-493b-862d-00693bf34ca4.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--ba186b33-e2d6-4cca-a8ef-490d0fb59a39", + "id": "bundle--fbb5de73-bc99-4218-8e16-c73efb5a24d3", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a24e779c-0f44-493b-862d-00693bf34ca4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.258181Z", - "modified": "2023-09-28T21:25:13.258181Z", + "created": "2024-08-02T17:12:32.40143Z", + "modified": "2024-08-02T17:12:32.40143Z", "name": "Interest-Based Networks", "description": "Examples include smaller and niche networks including Gettr, Truth Social, Parler, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a3fe7752-dbfa-4918-912f-c492c8593c68.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a3fe7752-dbfa-4918-912f-c492c8593c68.json index 152024a..35e9ad5 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a3fe7752-dbfa-4918-912f-c492c8593c68.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a3fe7752-dbfa-4918-912f-c492c8593c68.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--0f66521c-a8c9-4b14-a55d-48f5f0c5af67", + "id": "bundle--618d1361-e300-470d-92cd-f27943d56ad8", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a3fe7752-dbfa-4918-912f-c492c8593c68", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.228888Z", - "modified": "2023-09-28T21:25:13.228888Z", + "created": "2024-08-02T17:12:32.369332Z", + "modified": "2024-08-02T17:12:32.369332Z", "name": "Plagiarise Content", "description": "An influence operation may take content from other sources without proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a468ff54-27eb-4e6d-b709-a9830017df86.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a468ff54-27eb-4e6d-b709-a9830017df86.json index bfc6ec5..339dd2a 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a468ff54-27eb-4e6d-b709-a9830017df86.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a468ff54-27eb-4e6d-b709-a9830017df86.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a36f2a60-b5d4-4e72-92f1-5737543f78d5", + "id": "bundle--79427304-6f36-4613-a759-4433c7e2ea15", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a468ff54-27eb-4e6d-b709-a9830017df86", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.217051Z", - "modified": "2023-09-28T21:25:13.217051Z", + "created": "2024-08-02T17:12:32.357307Z", + "modified": "2024-08-02T17:12:32.357307Z", "name": "Political Segmentation", "description": "An influence operation may target populations based on their political affiliations, especially when aiming to manipulate voting or change policy.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a50d7269-9365-46f0-ba81-27964e422faa.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a50d7269-9365-46f0-ba81-27964e422faa.json index 4c7953d..d9b2cf8 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a50d7269-9365-46f0-ba81-27964e422faa.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a50d7269-9365-46f0-ba81-27964e422faa.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1798fcce-1d38-4ca7-9af2-9a298cb3f276", + "id": "bundle--269f625f-65f9-4bab-9a85-5df24077c230", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a50d7269-9365-46f0-ba81-27964e422faa", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.253297Z", - "modified": "2023-09-28T21:25:13.253297Z", + "created": "2024-08-02T17:12:32.395176Z", + "modified": "2024-08-02T17:12:32.395176Z", "name": "Co-Opt Trusted Individuals", "description": "Co-Opt Trusted Individuals", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a5ef7a55-8c38-4210-ad39-ccb22c9dd70c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a5ef7a55-8c38-4210-ad39-ccb22c9dd70c.json new file mode 100644 index 0000000..f128935 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a5ef7a55-8c38-4210-ad39-ccb22c9dd70c.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--819cb02b-80a6-4f53-9002-4d8b67156cfc", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--a5ef7a55-8c38-4210-ad39-ccb22c9dd70c", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.390107Z", + "modified": "2024-08-02T17:12:32.390107Z", + "name": "Local Institution Persona", + "description": "Institutions which present themselves as operating in a particular geography, or as having local knowledge relevant to a narrative, are presenting a local institution persona.

While presenting as a local institution is not an indication of inauthentic behaviour, threat actors may present themselves as such (T0143.002: Fabricated Persona, T0097.201: Local Institution Persona) to add credibility to their narratives, or misrepresent the real opinions of locals in the area.

Legitimate local institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.201: Local Institution Persona). For example, a local institution could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.101: Local Persona: Institutions presenting as local may also present locals working within the organisation.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.201.md", + "external_id": "T0097.201" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a60b4d87-cca8-4e17-a51c-f9c2af96aef4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a60b4d87-cca8-4e17-a51c-f9c2af96aef4.json index 484fe57..067fa8e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a60b4d87-cca8-4e17-a51c-f9c2af96aef4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a60b4d87-cca8-4e17-a51c-f9c2af96aef4.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--ee250e81-e413-4e74-a7af-bc22a38de77a", + "id": "bundle--e7079fe7-4289-474d-ae05-86f8c2f60622", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a60b4d87-cca8-4e17-a51c-f9c2af96aef4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.232905Z", - "modified": "2023-09-28T21:25:13.232905Z", + "created": "2024-08-02T17:12:32.373732Z", + "modified": "2024-08-02T17:12:32.373732Z", "name": "Develop Memes", "description": "Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a62e0c69-0c29-4c71-a326-1a7c3e19b74d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a62e0c69-0c29-4c71-a326-1a7c3e19b74d.json new file mode 100644 index 0000000..466378a --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a62e0c69-0c29-4c71-a326-1a7c3e19b74d.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--13bf5f67-371d-4dd1-af5e-b79103709324", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--a62e0c69-0c29-4c71-a326-1a7c3e19b74d", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.384037Z", + "modified": "2024-08-02T17:12:32.384037Z", + "name": "Local Persona", + "description": "A person with a local persona presents themselves as living in a particular geography or having local knowledge relevant to a narrative.

While presenting as a local is not an indication of inauthentic behaviour,\u00a0 an influence operation may have its narratives amplified by people presenting as local to a target area. Threat actors can fabricate locals (T0143.002: Fabricated Persona, T0097.101: Local Persona) to add credibility to their narratives, or to misrepresent the real opinions of locals in the area.

People who are legitimate locals (T0143.001: Authentic Persona, T0097.101: Local Persona) can use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a local to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.201: Local Institution Persona: Analysts should use this sub-technique to catalogue cases where an institution is presenting as a local, such as a local news organisation or local business.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.101.md", + "external_id": "T0097.101" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a925711a-dbfb-41b1-bd81-70d41dbaa69c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a925711a-dbfb-41b1-bd81-70d41dbaa69c.json index 6669981..4f53e32 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a925711a-dbfb-41b1-bd81-70d41dbaa69c.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--a925711a-dbfb-41b1-bd81-70d41dbaa69c.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--73231c6b-2a95-4275-8b84-c9ba51c6a67d", + "id": "bundle--2ae52e51-7205-4ffc-8ab0-349e86652a92", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a925711a-dbfb-41b1-bd81-70d41dbaa69c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.289032Z", - "modified": "2023-09-28T21:25:13.289032Z", + "created": "2024-08-02T17:12:32.42017Z", + "modified": "2024-08-02T17:12:32.42017Z", "name": "Behaviour Changes", "description": "Monitor and evaluate behaviour changes from misinformation incidents.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--abb6518d-50fe-4428-9bca-a6e3c6ed4de4.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--abb6518d-50fe-4428-9bca-a6e3c6ed4de4.json index 60c421b..fdec294 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--abb6518d-50fe-4428-9bca-a6e3c6ed4de4.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--abb6518d-50fe-4428-9bca-a6e3c6ed4de4.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--62feab5d-3c84-4997-a43c-d7c8cb062244", + "id": "bundle--921422ee-9269-4e35-8c08-60e2d968a36c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--abb6518d-50fe-4428-9bca-a6e3c6ed4de4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.243711Z", - "modified": "2023-09-28T21:25:13.243711Z", + "created": "2024-08-02T17:12:32.379974Z", + "modified": "2024-08-02T17:12:32.379974Z", "name": "Create Community or Sub-Group", "description": "When there is not an existing community or sub-group that meets a campaign's goals, an influence operation may seek to create a community or sub-group.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ad410829-2fb3-490b-b470-f5f859d45942.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ad410829-2fb3-490b-b470-f5f859d45942.json index 2a3cb12..81dad23 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ad410829-2fb3-490b-b470-f5f859d45942.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ad410829-2fb3-490b-b470-f5f859d45942.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b1f1a94d-df1b-4365-8318-ed9eb78a5b38", + "id": "bundle--be1ed7ef-2bde-4791-b080-0b92aeafda06", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ad410829-2fb3-490b-b470-f5f859d45942", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.212724Z", - "modified": "2023-09-28T21:25:13.212724Z", + "created": "2024-08-02T17:12:32.3534Z", + "modified": "2024-08-02T17:12:32.3534Z", "name": "Continue to Amplify", "description": "continue narrative or message amplification after the main incident work has finished", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--adaaa726-50fe-47e2-b92d-de0d65c9250c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--adaaa726-50fe-47e2-b92d-de0d65c9250c.json index 731e1f2..3d1ef25 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--adaaa726-50fe-47e2-b92d-de0d65c9250c.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--adaaa726-50fe-47e2-b92d-de0d65c9250c.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--83dd141c-b669-4041-b82c-c7959b8ef5e5", + "id": "bundle--25f411ed-6dee-4a27-8928-ea3d607590a9", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--adaaa726-50fe-47e2-b92d-de0d65c9250c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.245794Z", - "modified": "2023-09-28T21:25:13.245794Z", + "created": "2024-08-02T17:12:32.38078Z", + "modified": "2024-08-02T17:12:32.38078Z", "name": "Infiltrate Existing Networks", "description": "Operators deceptively insert social assets into existing networks as group members in order to influence the members of the network and the wider information environment that the network impacts.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2695cde-5f12-4e6a-b55a-e31220cb4bd7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2695cde-5f12-4e6a-b55a-e31220cb4bd7.json index 2d25e9c..445f1c6 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2695cde-5f12-4e6a-b55a-e31220cb4bd7.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2695cde-5f12-4e6a-b55a-e31220cb4bd7.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--17d04a57-d9ab-454d-b58c-3de6ec7591f5", + "id": "bundle--0c1ff1c4-0d4c-46c0-a14e-c59254dc9a83", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b2695cde-5f12-4e6a-b55a-e31220cb4bd7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.241564Z", - "modified": "2023-09-28T21:25:13.241564Z", + "created": "2024-08-02T17:12:32.377807Z", + "modified": "2024-08-02T17:12:32.377807Z", "name": "Create Bot Accounts", "description": "Bots refer to autonomous internet users that interact with systems or other users while imitating traditional human behaviour. Bots use a variety of tools to stay active without direct human operation, including artificial intelligence and big data analytics. For example, an individual may programme a Twitter bot to retweet a tweet every time it contains a certain keyword or hashtag. An influence operation may use bots to increase its exposure and artificially promote its content across the internet without dedicating additional time or human resources. Amplifier bots promote operation content through reposts, shares, and likes to increase the content\u2019s online popularity. Hacker bots are traditionally covert bots running on computer scripts that rarely engage with users and work primarily as agents of larger cyberattacks, such as a Distributed Denial of Service attacks. Spammer bots are programmed to post content on social media or in comment sections, usually as a supplementary tool. Impersonator bots102 pose as real people by mimicking human behaviour, complicating their detection.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2a7561a-28ad-426c-a249-f415b5f11cee.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2a7561a-28ad-426c-a249-f415b5f11cee.json index bbbf569..63b1c20 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2a7561a-28ad-426c-a249-f415b5f11cee.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2a7561a-28ad-426c-a249-f415b5f11cee.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--43acb4af-cad3-4f39-9a4e-85e50a99a0cb", + "id": "bundle--3bd63009-fede-4746-b9d6-e632bd4fc348", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b2a7561a-28ad-426c-a249-f415b5f11cee", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.214046Z", - "modified": "2023-09-28T21:25:13.214046Z", + "created": "2024-08-02T17:12:32.355029Z", + "modified": "2024-08-02T17:12:32.355029Z", "name": "Respond to Breaking News Event or Active Crisis", "description": "Media attention on a story or event is heightened during a breaking news event, where unclear facts and incomplete information increase speculation, rumours, and conspiracy theories, which are all vulnerable to manipulation.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2c62262-d3cc-49a9-830c-9d6f0bb95082.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2c62262-d3cc-49a9-830c-9d6f0bb95082.json new file mode 100644 index 0000000..abd2285 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b2c62262-d3cc-49a9-830c-9d6f0bb95082.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--3977e365-5420-4902-84dc-071660324890", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--b2c62262-d3cc-49a9-830c-9d6f0bb95082", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431468Z", + "modified": "2024-08-02T17:12:32.431468Z", + "name": "Impersonated Persona", + "description": "Threat actors may impersonate existing individuals or institutions to conceal their network identity, add legitimacy to content, or harm the impersonated target\u2019s reputation. This Technique covers situations where an actor presents themselves as another existing individual or institution.

This Technique was previously called Prepare Assets Impersonating Legitimate Entities and used the ID T0099.

Associated Techniques and Sub-techniques
T0097: Presented Persona: Analysts can use the sub-techniques of T0097: Presented Persona to categorise the type of impersonation. For example, a document developed by a threat actor which falsely presented as a letter from a government department could be documented using T0085.004: Develop Document, T0143.003: Impersonated Persona, and T0097.206: Government Institution Persona.
T0145.001: Copy Account Imagery: Actors may take existing accounts\u2019 profile pictures as part of their impersonation efforts.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.003.md", + "external_id": "T0143.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b3bb61ca-5472-42b0-807e-bd8657fc05b2.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b3bb61ca-5472-42b0-807e-bd8657fc05b2.json index 616ca85..ee63a43 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b3bb61ca-5472-42b0-807e-bd8657fc05b2.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b3bb61ca-5472-42b0-807e-bd8657fc05b2.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--11a86bba-6125-47ce-9b2f-9eaaebe2e558", + "id": "bundle--ebcc5d14-0680-4337-a9d5-ee56735796f1", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b3bb61ca-5472-42b0-807e-bd8657fc05b2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.212997Z", - "modified": "2023-09-28T21:25:13.212997Z", + "created": "2024-08-02T17:12:32.354177Z", + "modified": "2024-08-02T17:12:32.354177Z", "name": "Prepare Physical Broadcast Capabilities", "description": "Create or coopt broadcast capabilities (e.g. TV, radio etc).", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b43dbee2-e1e2-40e5-bea1-45630d55d30b.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b43dbee2-e1e2-40e5-bea1-45630d55d30b.json index 024270e..40ce8ef 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b43dbee2-e1e2-40e5-bea1-45630d55d30b.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b43dbee2-e1e2-40e5-bea1-45630d55d30b.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d8d105a8-cd5a-43b3-b7d2-d7bc67d241eb", + "id": "bundle--aeeda24a-372c-4599-9027-7681789c5570", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b43dbee2-e1e2-40e5-bea1-45630d55d30b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.253721Z", - "modified": "2023-09-28T21:25:13.253721Z", + "created": "2024-08-02T17:12:32.395629Z", + "modified": "2024-08-02T17:12:32.395629Z", "name": "Co-Opt Grassroots Groups", "description": "Co-Opt Grassroots Groups", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b4ed63e5-e8db-4057-989b-3ff5ad8c000c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b4ed63e5-e8db-4057-989b-3ff5ad8c000c.json index d734e97..f48f6ec 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b4ed63e5-e8db-4057-989b-3ff5ad8c000c.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b4ed63e5-e8db-4057-989b-3ff5ad8c000c.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--39d120e6-c8ed-4266-bf26-7761ec0b14be", + "id": "bundle--1b07ecfa-5eec-476d-ac36-5bf8021aaf76", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b4ed63e5-e8db-4057-989b-3ff5ad8c000c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.199668Z", - "modified": "2023-09-28T21:25:13.199668Z", + "created": "2024-08-02T17:12:32.341425Z", + "modified": "2024-08-02T17:12:32.341425Z", "name": "Amplify Existing Conspiracy Theory Narratives", "description": "An influence operation may amplify an existing conspiracy theory narrative that aligns with its incident or campaign goals. By amplifying existing conspiracy theory narratives, operators can leverage the power of the existing communities that support and propagate those theories without needing to expend resources creating new narratives or building momentum and buy in around new narratives.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b502f8ae-e296-4dd7-83ea-8d737f8d3fb1.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b502f8ae-e296-4dd7-83ea-8d737f8d3fb1.json new file mode 100644 index 0000000..50e54df --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b502f8ae-e296-4dd7-83ea-8d737f8d3fb1.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--e5135cb5-702e-460c-b704-58b236484c36", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--b502f8ae-e296-4dd7-83ea-8d737f8d3fb1", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.429946Z", + "modified": "2024-08-02T17:12:32.429946Z", + "name": "Intimidate", + "description": "Coerce, bully, or frighten the target. An influence operation may use intimidation to compel the target to act against their will. Or the goal may be to frighten or even terrify the target into silence or submission. In some cases, the goal is simply to make the victim suffer. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.002.md", + "external_id": "T0140.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b6644001-8597-4f9f-a2a4-8005c54e8a39.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b6644001-8597-4f9f-a2a4-8005c54e8a39.json index 6d99547..4c03f6e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b6644001-8597-4f9f-a2a4-8005c54e8a39.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b6644001-8597-4f9f-a2a4-8005c54e8a39.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--ebf20341-3807-4c24-b379-895bd3980650", + "id": "bundle--3ab18020-167e-480c-95b9-9c4fef952923", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b6644001-8597-4f9f-a2a4-8005c54e8a39", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.285674Z", - "modified": "2023-09-28T21:25:13.285674Z", + "created": "2024-08-02T17:12:32.417826Z", + "modified": "2024-08-02T17:12:32.417826Z", "name": "Use Shell Organisations", "description": "Use Shell Organisations to conceal sponsorship.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b69275ef-ba3d-409f-a857-40d4d1870dca.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b69275ef-ba3d-409f-a857-40d4d1870dca.json index 540c0fe..4cef170 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b69275ef-ba3d-409f-a857-40d4d1870dca.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--b69275ef-ba3d-409f-a857-40d4d1870dca.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--63c0e6ef-c461-4698-9759-d0f347e8e166", + "id": "bundle--67d2528d-7b95-401d-b1a8-b171f6f552d1", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--b69275ef-ba3d-409f-a857-40d4d1870dca", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.261742Z", - "modified": "2023-09-28T21:25:13.261742Z", + "created": "2024-08-02T17:12:32.404069Z", + "modified": "2024-08-02T17:12:32.404069Z", "name": "Bookmarking and Content Curation", "description": "Platforms for searching, sharing, and curating content and media. Examples include Pinterest, Flipboard, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bacbdfd3-f8c2-4126-a9f3-1b75576fa5e7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bacbdfd3-f8c2-4126-a9f3-1b75576fa5e7.json index f218d6c..0bb6907 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bacbdfd3-f8c2-4126-a9f3-1b75576fa5e7.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bacbdfd3-f8c2-4126-a9f3-1b75576fa5e7.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--5c108ebb-4363-4c7f-80bb-83cb4e0d5d4d", + "id": "bundle--2281b5c6-13a0-4fbc-b026-249ba44c070c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bacbdfd3-f8c2-4126-a9f3-1b75576fa5e7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.193213Z", - "modified": "2023-09-28T21:25:13.193213Z", + "created": "2024-08-02T17:12:32.333012Z", + "modified": "2024-08-02T17:12:32.333012Z", "name": "Cultivate Ignorant Agents", "description": "Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state\u2019s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as \"useful idiots\" or \"unwitting agents\".", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6.json index 04da77b..5f8fec6 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c07ff311-3d5e-425f-89e4-7a0ca285ea69", + "id": "bundle--85b5d7a4-45a0-4f4e-8d4b-13a04795f1c3", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.277655Z", - "modified": "2023-09-28T21:25:13.277655Z", + "created": "2024-08-02T17:12:32.413994Z", + "modified": "2024-08-02T17:12:32.413994Z", "name": "Conceal Information Assets", "description": "Conceal the identity or provenance of campaign information assets such as accounts, channels, pages etc. to avoid takedown and attribution.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb25b4aa-9223-40ea-a28a-0dd675e91e46.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb25b4aa-9223-40ea-a28a-0dd675e91e46.json index 880b93f..f0e9ac5 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb25b4aa-9223-40ea-a28a-0dd675e91e46.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb25b4aa-9223-40ea-a28a-0dd675e91e46.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1ced6e16-e4ec-4d34-9e55-bb3ae59422cc", + "id": "bundle--62456d7c-97e1-4aa7-952e-da0812cc4219", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bb25b4aa-9223-40ea-a28a-0dd675e91e46", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.256038Z", - "modified": "2023-09-28T21:25:13.256038Z", + "created": "2024-08-02T17:12:32.399125Z", + "modified": "2024-08-02T17:12:32.399125Z", "name": "Create Echo Chambers/Filter Bubbles", "description": "Create Echo Chambers/Filter Bubbles", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb8da71f-108a-4c46-a1ef-d24ef1c8a661.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb8da71f-108a-4c46-a1ef-d24ef1c8a661.json index 77e2ddf..b1ab443 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb8da71f-108a-4c46-a1ef-d24ef1c8a661.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb8da71f-108a-4c46-a1ef-d24ef1c8a661.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f558b836-5337-4444-91c9-0cf26810d7f3", + "id": "bundle--45a7f277-a96e-4d71-bd0f-a04a5393ec90", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bb8da71f-108a-4c46-a1ef-d24ef1c8a661", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.227215Z", - "modified": "2023-09-28T21:25:13.227215Z", + "created": "2024-08-02T17:12:32.367712Z", + "modified": "2024-08-02T17:12:32.367712Z", "name": "Identify Media System Vulnerabilities", "description": "An influence operation may exploit existing weaknesses in a target\u2019s media system. These weaknesses may include existing biases among media agencies, vulnerability to false news agencies on social media, or existing distrust of traditional media sources. An existing distrust among the public in the media system\u2019s credibility holds high potential for exploitation by an influence operation when establishing alternative news agencies to spread operation content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132.json index 0f42624..51a791c 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--24a7bb49-9370-45e2-8d2e-bef184e723d0", + "id": "bundle--be590165-68bf-42e1-93a3-4b85ce827365", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.288832Z", - "modified": "2023-09-28T21:25:13.288832Z", + "created": "2024-08-02T17:12:32.419973Z", + "modified": "2024-08-02T17:12:32.419973Z", "name": "Measure Effectiveness", "description": "A metric used to measure a current system state. \u201cAre we on track to achieve the intended new system state within the planned timescale?\u201d", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835.json index 1345b00..8ff365e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--51f16e01-ddc2-4041-b0c4-1ace51e2a411", + "id": "bundle--a6a37e35-0f27-4cba-96ad-ec1578a7091d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.20799Z", - "modified": "2023-09-28T21:25:13.20799Z", + "created": "2024-08-02T17:12:32.34527Z", + "modified": "2024-08-02T17:12:32.34527Z", "name": "Harass", "description": "Threatening or harassing believers of opposing narratives refers to the use of intimidation techniques, including cyberbullying and doxing, to discourage opponents from voicing their dissent. An influence operation may threaten or harass believers of the opposing narratives to deter individuals from posting or proliferating conflicting content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bd1295e0-67b2-419d-b2b4-a832552dbcc6.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bd1295e0-67b2-419d-b2b4-a832552dbcc6.json index a9dcb74..bbf28fe 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bd1295e0-67b2-419d-b2b4-a832552dbcc6.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bd1295e0-67b2-419d-b2b4-a832552dbcc6.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9bd0cd35-ffee-45f2-863f-07a636d8b149", + "id": "bundle--797b30f7-35a2-4bc6-aba6-91cdb40b9bf4", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bd1295e0-67b2-419d-b2b4-a832552dbcc6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.203875Z", - "modified": "2023-09-28T21:25:13.203875Z", + "created": "2024-08-02T17:12:32.343749Z", + "modified": "2024-08-02T17:12:32.343749Z", "name": "Seed Kernel of Truth", "description": "Wrap lies or altered context/facts around truths. Influence campaigns pursue a variety of objectives with respect to target audiences, prominent among them: 1. undermine a narrative commonly referenced in the target audience; or 2. promote a narrative less common in the target audience, but preferred by the attacker. In both cases, the attacker is presented with a heavy lift. They must change the relative importance of various narratives in the interpretation of events, despite contrary tendencies. When messaging makes use of factual reporting to promote these adjustments in the narrative space, they are less likely to be dismissed out of hand; when messaging can juxtapose a (factual) truth about current affairs with the (abstract) truth explicated in these narratives, propagandists can undermine or promote them selectively. Context matters.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159.json index 37757bb..f503582 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--05ac0b59-e461-4cc8-b8ad-0dceab66ba3f", + "id": "bundle--4eba4184-d0b7-4656-a7f5-df76306feeff", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.217367Z", - "modified": "2023-09-28T21:25:13.217367Z", + "created": "2024-08-02T17:12:32.358298Z", + "modified": "2024-08-02T17:12:32.358298Z", "name": "Determine Strategic Ends", "description": "These are the long-term end-states the campaign aims to bring about. They typically involve an advantageous position vis-a-vis competitors in terms of power or influence. The strategic goal may be to improve or simply to hold one\u2019s position. Competition occurs in the public sphere in the domains of war, diplomacy, politics, economics, and ideology, and can play out between armed groups, nation-states, political parties, corporations, interest groups, or individuals. ", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bfce790b-dfd6-46ca-8fab-c2d72f21bba2.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bfce790b-dfd6-46ca-8fab-c2d72f21bba2.json index 1c33af1..76c2a71 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bfce790b-dfd6-46ca-8fab-c2d72f21bba2.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--bfce790b-dfd6-46ca-8fab-c2d72f21bba2.json @@ -1,16 +1,16 @@ { "type": "bundle", - "id": "bundle--3f72857f-1333-4d11-92ff-3c439f53b967", + "id": "bundle--affd34a4-6073-481a-bb25-468bde308e9c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--bfce790b-dfd6-46ca-8fab-c2d72f21bba2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.210877Z", - "modified": "2023-09-28T21:25:13.210877Z", - "name": "Hijack Existing Hashtag", - "description": "Take over an existing hashtag to drive exposure.", + "created": "2024-08-02T17:12:32.349076Z", + "modified": "2024-08-02T17:12:32.349076Z", + "name": "Flood Existing Hashtag", + "description": "Hashtags can be used by communities to collate information they post about particular topics (such as their interests, or current events) and users can find communities to join by exploring hashtags they\u2019re interested in.

Threat actors can flood an existing hashtag to try to ruin hashtag functionality, posting content unrelated to the hashtag alongside it, making it a less reliable source of relevant information. They may also try to flood existing hashtags with campaign content, with the intent of maximising exposure to users.

This Technique covers cases where threat actors flood existing hashtags with campaign content.

This Technique covers behaviours previously documented by T0019.002: Hijack Hashtags, which has since been deprecated. This Technique was previously called Hijack Existing Hashtag.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c060ec87-d4d7-4de0-9f1d-9a9a42c05446.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c060ec87-d4d7-4de0-9f1d-9a9a42c05446.json new file mode 100644 index 0000000..299c319 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c060ec87-d4d7-4de0-9f1d-9a9a42c05446.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--ae677af1-90d5-4d69-9600-03097080c1be", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--c060ec87-d4d7-4de0-9f1d-9a9a42c05446", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.432726Z", + "modified": "2024-08-02T17:12:32.432726Z", + "name": "Copy Account Imagery", + "description": "Account imagery copied from an existing account.

Analysts may use reverse image search tools to try to identify previous uses of account imagery (e.g. a profile picture) by other accounts.

Threat Actors have been known to copy existing accounts\u2019 imagery to impersonate said accounts, or to provide imagery for unrelated accounts which aren\u2019t intended to impersonate the original assets\u2019 owner.

Associated Techniques and Sub-techniques
T0143.003: Impersonated Persona: Actors may copy existing accounts\u2019 imagery in an attempt to impersonate them.
T0143.004: Parody Persona: Actors may copy existing accounts\u2019 imagery as part of a parody of that account.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.001.md", + "external_id": "T0145.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c1182f49-4318-486f-81be-d44b99300343.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c1182f49-4318-486f-81be-d44b99300343.json index 049c584..1883ce1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c1182f49-4318-486f-81be-d44b99300343.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c1182f49-4318-486f-81be-d44b99300343.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--86ce3fed-b02a-4c77-a96a-e20269aab38a", + "id": "bundle--07fe3d5c-c239-4a0d-86a6-7fdc0c6de342", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c1182f49-4318-486f-81be-d44b99300343", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.244257Z", - "modified": "2023-09-28T21:25:13.244257Z", + "created": "2024-08-02T17:12:32.380189Z", + "modified": "2024-08-02T17:12:32.380189Z", "name": "Acquire/Recruit Network", "description": "Operators acquire an existing network by paying, recruiting, or exerting control over the leaders of the existing network.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c171dd41-42d0-45c2-806e-3cb518ba0357.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c171dd41-42d0-45c2-806e-3cb518ba0357.json index e643f1e..adff7fc 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c171dd41-42d0-45c2-806e-3cb518ba0357.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c171dd41-42d0-45c2-806e-3cb518ba0357.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e8818de7-2f10-41c3-94b7-a2b3a178af7f", + "id": "bundle--cff4f4d0-4f88-43cd-8b58-789a8d081a6d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c171dd41-42d0-45c2-806e-3cb518ba0357", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.28818Z", - "modified": "2023-09-28T21:25:13.28818Z", + "created": "2024-08-02T17:12:32.419159Z", + "modified": "2024-08-02T17:12:32.419159Z", "name": "Measure Performance", "description": "A metric used to determine the accomplishment of actions. \u201cAre the actions being executed as planned?\u201d", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c254c765-c83d-4ae3-880e-7a253ef02d37.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c254c765-c83d-4ae3-880e-7a253ef02d37.json index 7fa3254..8d9d99c 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c254c765-c83d-4ae3-880e-7a253ef02d37.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c254c765-c83d-4ae3-880e-7a253ef02d37.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--8b1dfa5a-2f5f-4cc7-a59e-2cb4026d76da", + "id": "bundle--cd16b35c-2509-4789-ac82-bb9f1e483896", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c254c765-c83d-4ae3-880e-7a253ef02d37", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.227652Z", - "modified": "2023-09-28T21:25:13.227652Z", + "created": "2024-08-02T17:12:32.368347Z", + "modified": "2024-08-02T17:12:32.368347Z", "name": "Integrate Target Audience Vulnerabilities into Narrative", "description": "An influence operation may seek to exploit the preexisting weaknesses, fears, and enemies of the target audience for integration into the operation\u2019s narratives and overall strategy. Integrating existing vulnerabilities into the operational approach conserves resources by exploiting already weak areas of the target information environment instead of forcing the operation to create new vulnerabilities in the environment.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c25ad637-cfa5-40c0-a23c-f741d8f4319e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c25ad637-cfa5-40c0-a23c-f741d8f4319e.json index a391527..63bb56e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c25ad637-cfa5-40c0-a23c-f741d8f4319e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c25ad637-cfa5-40c0-a23c-f741d8f4319e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d638e19b-53a6-4891-a98c-5ddf1ede1aa7", + "id": "bundle--e0d116c6-40f0-4362-b4be-63285d280115", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c25ad637-cfa5-40c0-a23c-f741d8f4319e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.28864Z", - "modified": "2023-09-28T21:25:13.28864Z", + "created": "2024-08-02T17:12:32.419768Z", + "modified": "2024-08-02T17:12:32.419768Z", "name": "View Focused", "description": "View Focused", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c26749da-f15d-48d7-ac1f-e2a2a49b9930.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c26749da-f15d-48d7-ac1f-e2a2a49b9930.json index 01a8a89..1593dae 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c26749da-f15d-48d7-ac1f-e2a2a49b9930.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c26749da-f15d-48d7-ac1f-e2a2a49b9930.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--33629583-b133-4b39-a0e1-802b66e93ecd", + "id": "bundle--ac0280ea-543e-4c43-9fec-d08581624fb3", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c26749da-f15d-48d7-ac1f-e2a2a49b9930", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.260345Z", - "modified": "2023-09-28T21:25:13.260345Z", + "created": "2024-08-02T17:12:32.403485Z", + "modified": "2024-08-02T17:12:32.403485Z", "name": "Audio Sharing", "description": "Examples include podcasting apps, Soundcloud, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c31542d3-d9c4-4fe4-ac5d-47632225a425.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c31542d3-d9c4-4fe4-ac5d-47632225a425.json index 08cbb82..dd00e36 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c31542d3-d9c4-4fe4-ac5d-47632225a425.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c31542d3-d9c4-4fe4-ac5d-47632225a425.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--073151db-cac5-433a-9f60-621575b31d8d", + "id": "bundle--6e3bb498-ad99-4bf3-a37a-62abe5003681", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c31542d3-d9c4-4fe4-ac5d-47632225a425", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.275608Z", - "modified": "2023-09-28T21:25:13.275608Z", + "created": "2024-08-02T17:12:32.41195Z", + "modified": "2024-08-02T17:12:32.41195Z", "name": "Report Non-Violative Opposing Content", "description": "Reporting opposing content refers to notifying and providing an instance of a violation of a platform\u2019s guidelines and policies for conduct on the platform. In addition to simply reporting the content, an operation may leverage copyright regulations to trick social media and web platforms into removing opposing content by manipulating the content to appear in violation of copyright laws. Reporting opposing content facilitates the suppression of contradictory information and allows operation narratives to take priority in the information space.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c4213e65-a7cc-42a5-a3a7-2d8040258625.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c4213e65-a7cc-42a5-a3a7-2d8040258625.json index e5fdb86..f01288b 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c4213e65-a7cc-42a5-a3a7-2d8040258625.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c4213e65-a7cc-42a5-a3a7-2d8040258625.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--b9f7cc66-4b76-4975-bdc6-1185bedb125d", + "id": "bundle--1fc71209-444c-41f5-9856-fdb1b9deaf45", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c4213e65-a7cc-42a5-a3a7-2d8040258625", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.242875Z", - "modified": "2023-09-28T21:25:13.242875Z", + "created": "2024-08-02T17:12:32.379162Z", + "modified": "2024-08-02T17:12:32.379162Z", "name": "Build Network", "description": "Operators build their own network, creating links between accounts -- whether authentic or inauthentic -- in order amplify and promote narratives and artefacts, and encourage further growth of ther network, as well as the ongoing sharing and engagement with operational content.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5.json index 69f679d..a291072 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f6fd79ff-671f-4d54-8f98-00b29e1a727b", + "id": "bundle--5a2a0c84-c66a-402a-ad77-7748cea56666", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.235323Z", - "modified": "2023-09-28T21:25:13.235323Z", + "created": "2024-08-02T17:12:32.375552Z", + "modified": "2024-08-02T17:12:32.375552Z", "name": "Develop AI-Generated Videos (Deepfakes)", "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c5274385-9abf-45cb-9ef6-faf86145d5ef.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c5274385-9abf-45cb-9ef6-faf86145d5ef.json new file mode 100644 index 0000000..72a7360 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c5274385-9abf-45cb-9ef6-faf86145d5ef.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--e5282a5f-dca1-4e33-87b7-8a955562abb3", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--c5274385-9abf-45cb-9ef6-faf86145d5ef", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.43014Z", + "modified": "2024-08-02T17:12:32.43014Z", + "name": "Spread Hate", + "description": "Publish and/or propagate demeaning, derisive, or humiliating content targeting an individual or group of individuals with the intent to cause emotional, psychological, or physical distress. Hate speech can cause harm directly or incite others to harm the target. It often aims to stigmatise the target by singling out immutable characteristics such as colour, race, religion, national or ethnic origin, gender, gender identity, sexual orientation, age, disease, or mental or physical disability. Thus, promoting hatred online may involve racism, antisemitism, Islamophobia, xenophobia, sexism, misogyny, homophobia, transphobia, ageism, ableism, or any combination thereof. Motivations for hate speech range from group preservation to ideological superiority to the unbridled infliction of suffering. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.003.md", + "external_id": "T0140.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c54dd9c4-5b7b-47a9-bb40-e63967b2ec33.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c54dd9c4-5b7b-47a9-bb40-e63967b2ec33.json index 6e5d1dc..960b00f 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c54dd9c4-5b7b-47a9-bb40-e63967b2ec33.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c54dd9c4-5b7b-47a9-bb40-e63967b2ec33.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a343186b-5a3d-488c-9bc8-d4c824e172f2", + "id": "bundle--d6716496-4fb3-45d0-952c-ae495249d063", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c54dd9c4-5b7b-47a9-bb40-e63967b2ec33", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.265873Z", - "modified": "2023-09-28T21:25:13.265873Z", + "created": "2024-08-02T17:12:32.405713Z", + "modified": "2024-08-02T17:12:32.405713Z", "name": "Email", "description": "Delivering content and narratives via email. This can include using list management or high-value individually targeted messaging.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c7017017-4965-4dad-a970-e748b7080a19.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c7017017-4965-4dad-a970-e748b7080a19.json index b9165f1..346f23c 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c7017017-4965-4dad-a970-e748b7080a19.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c7017017-4965-4dad-a970-e748b7080a19.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--04b0bac0-17d7-4d70-81e7-deba3d598eb9", + "id": "bundle--f0c9eec6-005e-4ea3-a6f3-288dcb33eb1f", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c7017017-4965-4dad-a970-e748b7080a19", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.245253Z", - "modified": "2023-09-28T21:25:13.245253Z", + "created": "2024-08-02T17:12:32.380585Z", + "modified": "2024-08-02T17:12:32.380585Z", "name": "Acquire Botnets", "description": "A botnet is a group of bots that can function in coordination with each other.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c729368d-246a-47eb-8e4b-ab5b0a3510ec.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c729368d-246a-47eb-8e4b-ab5b0a3510ec.json index 4ba2cdc..ea121d2 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c729368d-246a-47eb-8e4b-ab5b0a3510ec.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c729368d-246a-47eb-8e4b-ab5b0a3510ec.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f582fcf6-1a98-477d-aa9b-4724ff7eae87", + "id": "bundle--bdd4f31b-25ac-464c-9a5e-dc194b3a3f64", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c729368d-246a-47eb-8e4b-ab5b0a3510ec", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.223592Z", - "modified": "2023-09-28T21:25:13.223592Z", + "created": "2024-08-02T17:12:32.364767Z", + "modified": "2024-08-02T17:12:32.364767Z", "name": "Assess Degree/Type of Media Access", "description": "An influence operation may survey a target audience\u2019s Internet availability and degree of media freedom to determine which target audience members will have access to operation content and on which platforms. An operation may face more difficulty targeting an information environment with heavy restrictions and media control than an environment with independent media, freedom of speech and of the press, and individual liberties.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c73c3210-6414-46c8-9885-a3b3e405da56.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c73c3210-6414-46c8-9885-a3b3e405da56.json index 7a840fc..25f291a 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c73c3210-6414-46c8-9885-a3b3e405da56.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c73c3210-6414-46c8-9885-a3b3e405da56.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--adfa29dc-e815-43a8-bc30-4d5d0b26c5aa", + "id": "bundle--40deeaef-e68e-41e0-9fcb-e0d97d323fff", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c73c3210-6414-46c8-9885-a3b3e405da56", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.287453Z", - "modified": "2023-09-28T21:25:13.287453Z", + "created": "2024-08-02T17:12:32.418409Z", + "modified": "2024-08-02T17:12:32.418409Z", "name": "Exploit TOS/Content Moderation", "description": "Exploiting weaknesses in platforms' terms of service and content moderation policies to avoid takedowns and platform actions.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c80ef7af-3f51-4be5-b42a-19d29ab40a53.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c80ef7af-3f51-4be5-b42a-19d29ab40a53.json index c9dd56c..542aee1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c80ef7af-3f51-4be5-b42a-19d29ab40a53.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--c80ef7af-3f51-4be5-b42a-19d29ab40a53.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f1453378-cf4b-4ea7-ba38-e64e77d4dd7d", + "id": "bundle--cea69cd2-a82c-4c1b-a82e-843052c30b2a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c80ef7af-3f51-4be5-b42a-19d29ab40a53", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.28615Z", - "modified": "2023-09-28T21:25:13.28615Z", + "created": "2024-08-02T17:12:32.418021Z", + "modified": "2024-08-02T17:12:32.418021Z", "name": "Use Cryptocurrency", "description": "Use Cryptocurrency to conceal sponsorship. Examples include Bitcoin, Monero, and Etherium.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cb324e3c-1041-4a26-9fa8-da45547b7dcc.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cb324e3c-1041-4a26-9fa8-da45547b7dcc.json index 51e14bc..a6287be 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cb324e3c-1041-4a26-9fa8-da45547b7dcc.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cb324e3c-1041-4a26-9fa8-da45547b7dcc.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--73c1f5eb-a924-4c1a-8bc7-157de4037202", + "id": "bundle--f65bca1e-bc82-4f40-9e8c-60259b97befe", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cb324e3c-1041-4a26-9fa8-da45547b7dcc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.29032Z", - "modified": "2023-09-28T21:25:13.29032Z", + "created": "2024-08-02T17:12:32.421597Z", + "modified": "2024-08-02T17:12:32.421597Z", "name": "Social Media Engagement", "description": "Monitor and evaluate social media engagement in misinformation incidents.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce1e088c-d061-490c-a13a-3cbe4216a86e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce1e088c-d061-490c-a13a-3cbe4216a86e.json index 3140f11..3a41ec9 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce1e088c-d061-490c-a13a-3cbe4216a86e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce1e088c-d061-490c-a13a-3cbe4216a86e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--db48f90c-2233-4b2b-924f-a89b94258b02", + "id": "bundle--4f3f9538-6cdd-495f-b39b-514594be60dc", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ce1e088c-d061-490c-a13a-3cbe4216a86e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.287776Z", - "modified": "2023-09-28T21:25:13.287776Z", + "created": "2024-08-02T17:12:32.418604Z", + "modified": "2024-08-02T17:12:32.418604Z", "name": "Legacy Web Content", "description": "Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce4a9eee-7437-43ce-ac86-c1921f5c01a7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce4a9eee-7437-43ce-ac86-c1921f5c01a7.json index 64b6aa9..ccaf755 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce4a9eee-7437-43ce-ac86-c1921f5c01a7.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce4a9eee-7437-43ce-ac86-c1921f5c01a7.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--2b5b9408-3d82-42ee-aa4e-8715f2b1cedb", + "id": "bundle--b168fc9e-993a-4474-9713-73373e8c1801", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ce4a9eee-7437-43ce-ac86-c1921f5c01a7", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.234844Z", - "modified": "2023-09-28T21:25:13.234844Z", + "created": "2024-08-02T17:12:32.375242Z", + "modified": "2024-08-02T17:12:32.375242Z", "name": "Develop Video-Based Content", "description": "Creating and editing false or misleading video artefacts, often aligned with one or more specific narratives, for use in a disinformation campaign. This may include staging videos of purportedly real situations, repurposing existing video artefacts, or using AI-generated video creation and editing technologies (including deepfakes).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce5b400c-6f82-4095-936b-617857800da8.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce5b400c-6f82-4095-936b-617857800da8.json index dc1a741..05ed4ca 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce5b400c-6f82-4095-936b-617857800da8.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ce5b400c-6f82-4095-936b-617857800da8.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--a3bb18cd-22f3-438c-a048-da2efa0af730", + "id": "bundle--bee53e50-d915-4e84-aba4-782abd21ad0a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ce5b400c-6f82-4095-936b-617857800da8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.211643Z", - "modified": "2023-09-28T21:25:13.211643Z", + "created": "2024-08-02T17:12:32.350548Z", + "modified": "2024-08-02T17:12:32.350548Z", "name": "Conduct Swarming", "description": "Swarming refers to the coordinated use of accounts to overwhelm the information space with operation content. Unlike information flooding, swarming centres exclusively around a specific event or actor rather than a general narrative. Swarming relies on \u201chorizontal communication\u201d between information assets rather than a top-down, vertical command-and-control approach.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cec91e97-76c8-4a1f-8397-a06939a558ef.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cec91e97-76c8-4a1f-8397-a06939a558ef.json index 0b3af46..1cf33ad 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cec91e97-76c8-4a1f-8397-a06939a558ef.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cec91e97-76c8-4a1f-8397-a06939a558ef.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--373c231e-4baf-4c98-8239-4371748a475c", + "id": "bundle--75e6e009-b221-45fa-86b9-b76ce5b3ebe2", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--cec91e97-76c8-4a1f-8397-a06939a558ef", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.211971Z", - "modified": "2023-09-28T21:25:13.211971Z", + "created": "2024-08-02T17:12:32.35121Z", + "modified": "2024-08-02T17:12:32.35121Z", "name": "Inauthentic Sites Amplify News and Narratives", "description": "Inauthentic sites circulate cross-post stories and amplify narratives. Often these sites have no masthead, bylines or attribution.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cf4ee6a4-f503-425c-a069-3245de145582.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cf4ee6a4-f503-425c-a069-3245de145582.json new file mode 100644 index 0000000..9e7a368 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--cf4ee6a4-f503-425c-a069-3245de145582.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--298bb425-a758-4ef0-9aa1-d2ee15283fd8", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--cf4ee6a4-f503-425c-a069-3245de145582", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.43387Z", + "modified": "2024-08-02T17:12:32.43387Z", + "name": "Stock Image Account Imagery", + "description": "Stock images used in account imagery.

Stock image websites produce photos of people in various situations. Threat Actors can purchase or appropriate these images for use in their account imagery, increasing perceived legitimacy while avoiding the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).\u00a0

Stock images tend to include physically attractive people, and this can benefit threat actors by increasing attention given to their posts.

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.007.md", + "external_id": "T0145.007" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a.json new file mode 100644 index 0000000..5d2f24b --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--271b65bc-d0d2-4961-97f1-13c6b5188cf4", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.425893Z", + "modified": "2024-08-02T17:12:32.425893Z", + "name": "Make Money", + "description": "Profit from disinformation, conspiracy theories, or online harm. In some cases, the sole objective is financial gain, in other cases the objective is both financial and political. Making money may also be a way to sustain a political campaign. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.md", + "external_id": "T0137" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": false, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d13ff5af-16fd-4b32-8e14-f2e0980c15fb.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d13ff5af-16fd-4b32-8e14-f2e0980c15fb.json index ee21657..d527c30 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d13ff5af-16fd-4b32-8e14-f2e0980c15fb.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d13ff5af-16fd-4b32-8e14-f2e0980c15fb.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--fddd299e-bacd-4c46-9967-3b38b5bf4dc3", + "id": "bundle--a0725b42-ea34-44b3-a52e-edaf7aa87f6d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d13ff5af-16fd-4b32-8e14-f2e0980c15fb", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.225998Z", - "modified": "2023-09-28T21:25:13.225998Z", + "created": "2024-08-02T17:12:32.366531Z", + "modified": "2024-08-02T17:12:32.366531Z", "name": "Identify Existing Fissures", "description": "An influence operation may identify existing fissures to pit target populations against one another or facilitate a \u201cdivide-and-conquer\" approach to tailor operation narratives along the divides.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d1ad0738-1f52-4fab-b0d1-640b551d7f6a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d1ad0738-1f52-4fab-b0d1-640b551d7f6a.json index 564338f..74008dc 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d1ad0738-1f52-4fab-b0d1-640b551d7f6a.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d1ad0738-1f52-4fab-b0d1-640b551d7f6a.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--952e939f-4ff6-4716-9800-9ac3671f7aa2", + "id": "bundle--ba6bebac-5475-4596-8918-dc54f60b8dce", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d1ad0738-1f52-4fab-b0d1-640b551d7f6a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.191652Z", - "modified": "2023-09-28T21:25:13.191652Z", + "created": "2024-08-02T17:12:32.33212Z", + "modified": "2024-08-02T17:12:32.33212Z", "name": "Create Inauthentic Social Media Pages and Groups", "description": "Create key social engineering assets needed to amplify content, manipulate algorithms, fool public and/or specific incident/campaign targets. Computational propaganda depends substantially on false perceptions of credibility and acceptance. By creating fake users and groups with a variety of interests and commitments, attackers can ensure that their messages both come from trusted sources and appear more widely adopted than they actually are.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d1f55d22-f487-48ec-a810-a9f74220c02e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d1f55d22-f487-48ec-a810-a9f74220c02e.json index bd7b661..4a4bef3 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d1f55d22-f487-48ec-a810-a9f74220c02e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d1f55d22-f487-48ec-a810-a9f74220c02e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--ef0d8657-c475-4cfb-8a3e-b690151ee2fe", + "id": "bundle--5e2eb779-9c70-4e1e-9d4e-6ba41bd84c04", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d1f55d22-f487-48ec-a810-a9f74220c02e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.212585Z", - "modified": "2023-09-28T21:25:13.212585Z", + "created": "2024-08-02T17:12:32.35304Z", + "modified": "2024-08-02T17:12:32.35304Z", "name": "Play the Long Game", "description": "Play the long game refers to two phenomena: 1. To plan messaging and allow it to grow organically without conducting your own amplification. This is methodical and slow and requires years for the message to take hold 2. To develop a series of seemingly disconnected messaging narratives that eventually combine into a new narrative.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d2536dd3-53a5-4fc1-b508-1697cf0dafde.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d2536dd3-53a5-4fc1-b508-1697cf0dafde.json index 68fb007..bf1aa68 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d2536dd3-53a5-4fc1-b508-1697cf0dafde.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d2536dd3-53a5-4fc1-b508-1697cf0dafde.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d11bf15d-911d-4c37-af5d-e6352f6d86a0", + "id": "bundle--94010742-6525-4836-8c4a-91b4191770d9", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d2536dd3-53a5-4fc1-b508-1697cf0dafde", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.289186Z", - "modified": "2023-09-28T21:25:13.289186Z", + "created": "2024-08-02T17:12:32.420363Z", + "modified": "2024-08-02T17:12:32.420363Z", "name": "Content", "description": "Measure current system state with respect to the effectiveness of campaign content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d3e83913-e2d5-4dad-b917-2363100c6ca0.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d3e83913-e2d5-4dad-b917-2363100c6ca0.json new file mode 100644 index 0000000..3193591 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d3e83913-e2d5-4dad-b917-2363100c6ca0.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--0358a056-3e68-4fc0-bbd9-dfab1493e465", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d3e83913-e2d5-4dad-b917-2363100c6ca0", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.386035Z", + "modified": "2024-08-02T17:12:32.386035Z", + "name": "Recruiter Persona", + "description": "A person with a recruiter persona presents themselves as a potential employer or provider of freelance work.

While presenting as a recruiter is not an indication of inauthentic behaviour, threat actors fabricate recruiters (T0143.002: Fabricated Persona, T0097.106: Recruiter Persona) to justify asking for personal information from their targets or to trick targets into working for the threat actors (without revealing who they are).

Associated Techniques and Sub-techniques
T0097.205: Business Persona: People with a recruiter persona may present as being part of a business which they are recruiting for.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.106.md", + "external_id": "T0097.106" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d4813d4a-2afe-4c0e-8ddb-b21973bb283a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d4813d4a-2afe-4c0e-8ddb-b21973bb283a.json index 5da3c61..a6bfef7 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d4813d4a-2afe-4c0e-8ddb-b21973bb283a.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d4813d4a-2afe-4c0e-8ddb-b21973bb283a.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1527d206-4039-4429-ab9b-d8dc9d89bde4", + "id": "bundle--c73fd955-288f-4ce0-8037-dfa71f0697ec", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d4813d4a-2afe-4c0e-8ddb-b21973bb283a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.263231Z", - "modified": "2023-09-28T21:25:13.263231Z", + "created": "2024-08-02T17:12:32.404679Z", + "modified": "2024-08-02T17:12:32.404679Z", "name": "Formal Diplomatic Channels", "description": "Leveraging formal, traditional, diplomatic channels to communicate with foreign governments (written documents, meetings, summits, diplomatic visits, etc). This type of diplomacy is conducted by diplomats of one nation with diplomats and other officials of another nation or international organisation.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d4e35ba1-f83d-41b4-a862-caabb634cc3e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d4e35ba1-f83d-41b4-a862-caabb634cc3e.json index efb9426..736e3a9 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d4e35ba1-f83d-41b4-a862-caabb634cc3e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d4e35ba1-f83d-41b4-a862-caabb634cc3e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--38c9097d-041d-4b8c-b5aa-f809fcddf104", + "id": "bundle--84445f98-861e-4960-9aca-67f32edce74b", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d4e35ba1-f83d-41b4-a862-caabb634cc3e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.262253Z", - "modified": "2023-09-28T21:25:13.262253Z", + "created": "2024-08-02T17:12:32.404285Z", + "modified": "2024-08-02T17:12:32.404285Z", "name": "Blogging and Publishing Networks", "description": "Examples include WordPress, Blogger, Weebly, Tumblr, Medium, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d522f417-ba0e-4e2d-ae96-df2c1fd607e6.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d522f417-ba0e-4e2d-ae96-df2c1fd607e6.json index 6e560ab..3a125db 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d522f417-ba0e-4e2d-ae96-df2c1fd607e6.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d522f417-ba0e-4e2d-ae96-df2c1fd607e6.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--13ba1199-ec7d-4f4a-a3ab-4b21b9d84531", + "id": "bundle--464681c5-0bc3-49fa-8d6d-f5db396b2ad9", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d522f417-ba0e-4e2d-ae96-df2c1fd607e6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.244787Z", - "modified": "2023-09-28T21:25:13.244787Z", + "created": "2024-08-02T17:12:32.380386Z", + "modified": "2024-08-02T17:12:32.380386Z", "name": "Fund Proxies", "description": "An influence operation may fund proxies, or external entities that work for the operation. An operation may recruit/train users with existing sympathies towards the operation\u2019s narratives and/or goals as proxies. Funding proxies serves various purposes including: - Diversifying operation locations to complicate attribution - Reducing the workload for direct operation assets", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d556b582-dd00-44d7-8c2f-74fb48c755fa.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d556b582-dd00-44d7-8c2f-74fb48c755fa.json new file mode 100644 index 0000000..4e6a07e --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d556b582-dd00-44d7-8c2f-74fb48c755fa.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--12c704f2-e7ca-46bb-9ffb-2ddf73386151", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d556b582-dd00-44d7-8c2f-74fb48c755fa", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.430653Z", + "modified": "2024-08-02T17:12:32.430653Z", + "name": "Acquire Compromised Account", + "description": "Threat Actors can take over existing users\u2019 accounts to distribute campaign content.

The actor may maintain the asset\u2019s previous identity to capitalise on the perceived legitimacy its previous owner had cultivated.

The actor may completely rebrand the account to exploit its existing reach, or relying on the account\u2019s history to avoid more stringent automated content moderation rules applied to new accounts.

See also [Mitre ATT&CK\u2019s T1586 Compromise Accounts](https://attack.mitre.org/techniques/T1586/) for more technical information on how threat actors may achieve this objective.

This Technique was previously called Compromise Legitimate Accounts, and used the ID T0011.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0141.001.md", + "external_id": "T0141.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d592cbac-8fcd-4569-8a7a-4e5c6a0b08e7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d592cbac-8fcd-4569-8a7a-4e5c6a0b08e7.json new file mode 100644 index 0000000..a9a6295 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d592cbac-8fcd-4569-8a7a-4e5c6a0b08e7.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--04bf51d7-e54b-4e81-910e-678ddc739bea", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d592cbac-8fcd-4569-8a7a-4e5c6a0b08e7", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431712Z", + "modified": "2024-08-02T17:12:32.431712Z", + "name": "Parody Persona", + "description": "Parody is a form of artistic expression that imitates the style or characteristics of a particular work, genre, or individual in a humorous or satirical way, often to comment on or critique the original work or subject matter. People may present as parodies to create humour or make a point by exaggerating or altering elements of the original, while still maintaining recognizable elements.

The use of parody is not an indication of inauthentic or malicious behaviour; parody allows people to present ideas or criticisms in a comedic or exaggerated manner, softening the impact of sensitive or contentious topics. Because parody is often protected as a form of free speech or artistic expression, it provides a legal and social framework for discussing controversial issues.

However, parody personas may be perceived as authentic personas, leading to people mistakenly believing that a parody account\u2019s statements represent the real opinions of a parodied target. Threat actors may also use the guise of parody to spread campaign content. Parody personas may disclaim that they are operating as a parody, however this is not always the case, and is not always given prominence.

Associated Techniques and Sub-techniques T0097: Presented Persona: Analysts can use the sub-techniques of T0097: Presented Persona to categorise the type of parody.\u00a0For example, an account presenting as a parody of a business could be documented using T0097.205: Business Persona and T0143.003: Parody Persona.
T0145.001: Copy Account Imagery: Actors may take existing accounts\u2019 profile pictures as part of their parody efforts.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.004.md", + "external_id": "T0143.004" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d60dd224-14bd-4b6e-9960-a789a8370fdf.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d60dd224-14bd-4b6e-9960-a789a8370fdf.json new file mode 100644 index 0000000..a9e327f --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d60dd224-14bd-4b6e-9960-a789a8370fdf.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--1b640941-49dd-43c9-ab92-bceabaaae95f", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d60dd224-14bd-4b6e-9960-a789a8370fdf", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.429055Z", + "modified": "2024-08-02T17:12:32.429055Z", + "name": "Discourage", + "description": "To make a target disinclined or reluctant to act. Manipulators use disinformation to cause targets to question the utility, legality, or morality of taking an action. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.001.md", + "external_id": "T0139.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d615efdc-7296-4254-90f5-99d2986d97fa.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d615efdc-7296-4254-90f5-99d2986d97fa.json index 36f0df4..017d855 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d615efdc-7296-4254-90f5-99d2986d97fa.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d615efdc-7296-4254-90f5-99d2986d97fa.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f30f110f-e961-42e4-8860-7d669c49f406", + "id": "bundle--ed140e16-fef1-4b95-a330-04a151e374de", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d615efdc-7296-4254-90f5-99d2986d97fa", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.276393Z", - "modified": "2023-09-28T21:25:13.276393Z", + "created": "2024-08-02T17:12:32.412541Z", + "modified": "2024-08-02T17:12:32.412541Z", "name": "Exploit Platform TOS/Content Moderation", "description": "Exploit Platform TOS/Content Moderation", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d65af8b6-91ce-490e-8978-014ff995a2ac.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d65af8b6-91ce-490e-8978-014ff995a2ac.json index 43e5a84..92221da 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d65af8b6-91ce-490e-8978-014ff995a2ac.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d65af8b6-91ce-490e-8978-014ff995a2ac.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1c171b0d-279e-4c8c-a34a-04d3e5ae149b", + "id": "bundle--e4fca68b-0103-4f6c-a0ca-e37f3cfa6074", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d65af8b6-91ce-490e-8978-014ff995a2ac", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.274512Z", - "modified": "2023-09-28T21:25:13.274512Z", + "created": "2024-08-02T17:12:32.410935Z", + "modified": "2024-08-02T17:12:32.410935Z", "name": "Delete Opposing Content", "description": "Deleting opposing content refers to the removal of content that conflicts with operational narratives from selected platforms. An influence operation may delete opposing content to censor contradictory information from the target audience, allowing operation narratives to take priority in the information space.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d6681707-afcc-4656-91ca-779bc303d944.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d6681707-afcc-4656-91ca-779bc303d944.json new file mode 100644 index 0000000..e487b2a --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d6681707-afcc-4656-91ca-779bc303d944.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--e279aad0-5e26-4c71-9be4-5b02c3dd0dcf", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d6681707-afcc-4656-91ca-779bc303d944", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.359885Z", + "modified": "2024-08-02T17:12:32.359885Z", + "name": "Ideological Advantage", + "description": "Favourable position domestically or internationally in the market for ideas, beliefs, and world views. Competition plays out among faith systems, political systems, and value systems. It can involve sub-national, national or supra-national movements. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-strategy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.004.md", + "external_id": "T0074.004" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d696b89b-9686-42ff-b3c4-5a4d5ecaa17a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d696b89b-9686-42ff-b3c4-5a4d5ecaa17a.json index 0797441..f3457a0 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d696b89b-9686-42ff-b3c4-5a4d5ecaa17a.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d696b89b-9686-42ff-b3c4-5a4d5ecaa17a.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--0e6424ec-4e04-4e9b-81d9-02f02b9e1436", + "id": "bundle--e316f4a2-fc1a-4902-893c-17259754d032", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--d696b89b-9686-42ff-b3c4-5a4d5ecaa17a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.21355Z", - "modified": "2023-09-28T21:25:13.21355Z", + "created": "2024-08-02T17:12:32.354685Z", + "modified": "2024-08-02T17:12:32.354685Z", "name": "Degrade Adversary", "description": "Plan to degrade an adversary\u2019s image or ability to act. This could include preparation and use of harmful information about the adversary\u2019s actions or reputation.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d9381123-f2ef-419a-b895-8f2147e26b15.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d9381123-f2ef-419a-b895-8f2147e26b15.json new file mode 100644 index 0000000..a504fa6 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--d9381123-f2ef-419a-b895-8f2147e26b15.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--975a0eb6-22c5-47ab-ba85-f665600d38c8", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--d9381123-f2ef-419a-b895-8f2147e26b15", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.386986Z", + "modified": "2024-08-02T17:12:32.386986Z", + "name": "Expert Persona", + "description": "A person with an expert persona presents themselves as having expertise or experience in a field. Commonly the persona\u2019s expertise will be called upon to add credibility to a given narrative.

While presenting as an expert is not an indication of inauthentic behaviour,\u00a0 an influence operation may have its narratives amplified by people presenting as experts. Threat actors can fabricate experts (T0143.002: Fabricated Persona, T0097.107: Researcher Persona) to add credibility to their narratives.

People who are legitimate experts (T0143.001: Authentic Persona, T0097.107: Researcher Persona) can make mistakes, use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as an expert to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.107: Researcher Persona: People who present as experts may also present as conducting or having conducted research into their specialist subject.
T0097.204: Think Tank Persona: People with an expert persona may present as being part of a think tank.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.108.md", + "external_id": "T0097.108" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--da4ae172-c8c8-4eb1-bc03-c5198624c8a2.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--da4ae172-c8c8-4eb1-bc03-c5198624c8a2.json index 4845398..35e0c27 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--da4ae172-c8c8-4eb1-bc03-c5198624c8a2.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--da4ae172-c8c8-4eb1-bc03-c5198624c8a2.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--cc458a26-a004-4463-a6a4-e173f0fa2ced", + "id": "bundle--363c0950-5bd4-40f9-bc9b-bb371936df3b", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--da4ae172-c8c8-4eb1-bc03-c5198624c8a2", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.262725Z", - "modified": "2023-09-28T21:25:13.262725Z", + "created": "2024-08-02T17:12:32.404483Z", + "modified": "2024-08-02T17:12:32.404483Z", "name": "Consumer Review Networks", "description": "Platforms for finding, reviewing, and sharing information about brands, products, services, restaurants, travel destinations, etc. Examples include Yelp, TripAdvisor, etc.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--da5fb984-37a6-4152-a078-e2af40c0844f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--da5fb984-37a6-4152-a078-e2af40c0844f.json index 6ce4707..ca57400 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--da5fb984-37a6-4152-a078-e2af40c0844f.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--da5fb984-37a6-4152-a078-e2af40c0844f.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d0d8a13e-21cb-4923-a3d5-75bb95aa8dc9", + "id": "bundle--c94455c5-7eb7-4b00-ba5e-1aba46b70272", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--da5fb984-37a6-4152-a078-e2af40c0844f", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.280677Z", - "modified": "2023-09-28T21:25:13.280677Z", + "created": "2024-08-02T17:12:32.416284Z", + "modified": "2024-08-02T17:12:32.416284Z", "name": "Deny Involvement", "description": "Without \"smoking gun\" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in \"Demand insurmountable proof\", specifically the asymmetric disadvantage for truth-tellers in a \"firehose of misinformation\" environment.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--db93e285-c516-40b0-bb5a-36bbaf5c08b9.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--db93e285-c516-40b0-bb5a-36bbaf5c08b9.json index d740570..e135791 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--db93e285-c516-40b0-bb5a-36bbaf5c08b9.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--db93e285-c516-40b0-bb5a-36bbaf5c08b9.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--c8ff294a-e87b-48e0-99e9-6e0c7aac17d1", + "id": "bundle--bcce6c50-4def-4f15-afed-c0e040e9d18f", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--db93e285-c516-40b0-bb5a-36bbaf5c08b9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.24082Z", - "modified": "2023-09-28T21:25:13.24082Z", + "created": "2024-08-02T17:12:32.377614Z", + "modified": "2024-08-02T17:12:32.377614Z", "name": "Create Cyborg Accounts", "description": "Cyborg accounts refer to partly manned, partly automated social media accounts. Cyborg accounts primarily act as bots, but a human operator periodically takes control of the account to engage with real social media users by responding to comments and posting original content. Influence operations may use cyborg accounts to reduce the amount of direct human input required to maintain a regular account but increase the apparent legitimacy of the cyborg account by occasionally breaking its bot-like behaviour with human interaction.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--db9eafc0-261b-48d0-97a2-1c92dcb4026a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--db9eafc0-261b-48d0-97a2-1c92dcb4026a.json index dd308ca..ff8f101 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--db9eafc0-261b-48d0-97a2-1c92dcb4026a.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--db9eafc0-261b-48d0-97a2-1c92dcb4026a.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9a159563-ed34-4c87-b36c-3d45dfd98874", + "id": "bundle--e359f323-60e9-44f4-97fe-ebbdf40e5f50", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--db9eafc0-261b-48d0-97a2-1c92dcb4026a", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.264206Z", - "modified": "2023-09-28T21:25:13.264206Z", + "created": "2024-08-02T17:12:32.405072Z", + "modified": "2024-08-02T17:12:32.405072Z", "name": "TV", "description": "TV", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--dd415f9d-ce3a-44c6-9237-f8ceeb52a6a3.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--dd415f9d-ce3a-44c6-9237-f8ceeb52a6a3.json index 8c69dd7..eae7c1e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--dd415f9d-ce3a-44c6-9237-f8ceeb52a6a3.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--dd415f9d-ce3a-44c6-9237-f8ceeb52a6a3.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--0028f8f2-2029-4674-899e-08cc2df5b923", + "id": "bundle--36bdfb84-9611-4c1b-9154-00975f05c0d8", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--dd415f9d-ce3a-44c6-9237-f8ceeb52a6a3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.283543Z", - "modified": "2023-09-28T21:25:13.283543Z", + "created": "2024-08-02T17:12:32.417055Z", + "modified": "2024-08-02T17:12:32.417055Z", "name": "Misattribute Activity", "description": "Misattributed activity refers to incorrectly attributed operation activity. For example, a state sponsored influence operation may conduct operation activity in a way that mimics another state so that external entities misattribute activity to the incorrect state. An operation may misattribute their activities to complicate attribution, avoid detection, or frame an adversary for negative behaviour.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ddc4a9e6-a371-4f16-91b6-c71139a154ce.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ddc4a9e6-a371-4f16-91b6-c71139a154ce.json index 0b671e1..c8a492e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ddc4a9e6-a371-4f16-91b6-c71139a154ce.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ddc4a9e6-a371-4f16-91b6-c71139a154ce.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--936cc62f-49d5-42cc-a50d-c254338bdac3", + "id": "bundle--a1e9e1a9-51a2-4fa0-8f7a-eff63f4d773e", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ddc4a9e6-a371-4f16-91b6-c71139a154ce", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.273783Z", - "modified": "2023-09-28T21:25:13.273783Z", + "created": "2024-08-02T17:12:32.409853Z", + "modified": "2024-08-02T17:12:32.409853Z", "name": "Use Contests and Prizes", "description": "Use Contests and Prizes", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ddc9d571-88a9-4246-bbbf-075bfed721f8.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ddc9d571-88a9-4246-bbbf-075bfed721f8.json index 405db8d..e2ea7c0 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ddc9d571-88a9-4246-bbbf-075bfed721f8.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ddc9d571-88a9-4246-bbbf-075bfed721f8.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--5dc19d43-3858-4fb8-9aef-a4ecc7975c57", + "id": "bundle--e6f59b47-3d6c-4939-a2f9-2a17b3831a20", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ddc9d571-88a9-4246-bbbf-075bfed721f8", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.212859Z", - "modified": "2023-09-28T21:25:13.212859Z", + "created": "2024-08-02T17:12:32.353767Z", + "modified": "2024-08-02T17:12:32.353767Z", "name": "Sell Merchandise", "description": "Sell mechandise refers to getting the message or narrative into physical space in the offline world while making money", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--dde28850-4198-4223-81b5-ff9b30b4e04f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--dde28850-4198-4223-81b5-ff9b30b4e04f.json new file mode 100644 index 0000000..ba2393f --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--dde28850-4198-4223-81b5-ff9b30b4e04f.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--3d59d219-dc61-4b98-856c-4866476e5312", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--dde28850-4198-4223-81b5-ff9b30b4e04f", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.385665Z", + "modified": "2024-08-02T17:12:32.385665Z", + "name": "Military Personnel Persona", + "description": "A person with a military personnel persona presents themselves as a serving member or veteran of a military organisation operating in an official capacity on behalf of a government.

While presenting as military personnel is not an indication of inauthentic behaviour,\u00a0 an influence operation may have its narratives amplified by people presenting as military personnel. Threat actors can fabricate military personnel (T0143.002: Fabricated Persona, T0097.105: Military Personnel Persona) to pose as experts on military topics, or to discredit geopolitical adversaries by pretending to be one of their military personnel and spreading discontent.

People who have legitimately developed a military persona (T0143.001: Authentic Persona, T0097.105: Military Personnel Persona) can use it for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a member of the military to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.105.md", + "external_id": "T0097.105" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--deb9a225-0803-4a1f-b37b-3a10c3e7ca79.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--deb9a225-0803-4a1f-b37b-3a10c3e7ca79.json index 43e8385..8209a9e 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--deb9a225-0803-4a1f-b37b-3a10c3e7ca79.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--deb9a225-0803-4a1f-b37b-3a10c3e7ca79.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f5fb276b-1487-426d-8190-8184c5005759", + "id": "bundle--c08f9446-50a2-4f22-84de-162e7ac6c3a4", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--deb9a225-0803-4a1f-b37b-3a10c3e7ca79", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.281952Z", - "modified": "2023-09-28T21:25:13.281952Z", + "created": "2024-08-02T17:12:32.416479Z", + "modified": "2024-08-02T17:12:32.416479Z", "name": "Delete Accounts/Account Activity", "description": "Deleting accounts and account activity occurs when an influence operation removes its online social media assets, including social media accounts, posts, likes, comments, and other online artefacts. An influence operation may delete its accounts and account activity to complicate attribution or remove online documentation that the operation ever occurred.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--df5189cc-29b5-41d1-a20f-bd641f5946be.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--df5189cc-29b5-41d1-a20f-bd641f5946be.json new file mode 100644 index 0000000..aa03db7 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--df5189cc-29b5-41d1-a20f-bd641f5946be.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--cbfbbb44-2808-4b40-98fe-4f67f6484ddf", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--df5189cc-29b5-41d1-a20f-bd641f5946be", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.371835Z", + "modified": "2024-08-02T17:12:32.371835Z", + "name": "Develop Book", + "description": "Produce text content in the form of a book.\u00a0

This technique covers both e-books and physical books, however, the former is more easily deployed by threat actors given the lower cost to develop.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "develop-content" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.005.md", + "external_id": "T0085.005" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--df9f74e6-1a56-4515-910e-d58a386bbf1f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--df9f74e6-1a56-4515-910e-d58a386bbf1f.json new file mode 100644 index 0000000..4b97080 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--df9f74e6-1a56-4515-910e-d58a386bbf1f.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--237d3da3-1228-4079-a59d-3636266cf63b", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--df9f74e6-1a56-4515-910e-d58a386bbf1f", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.433467Z", + "modified": "2024-08-02T17:12:32.433467Z", + "name": "Illustrated Character Account Imagery", + "description": "A cartoon/illustrated/anime character used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

People sometimes legitimately use images of illustrated characters as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0145.005.md", + "external_id": "T0145.005" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0acfceb-4541-438f-ba33-734f9a666c7d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0acfceb-4541-438f-ba33-734f9a666c7d.json index 9b432de..afbe0e1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0acfceb-4541-438f-ba33-734f9a666c7d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0acfceb-4541-438f-ba33-734f9a666c7d.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--83472169-1104-44ab-8c40-3d22590924b2", + "id": "bundle--4da55a9f-6cf6-4dba-9253-6e20b2ce2935", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e0acfceb-4541-438f-ba33-734f9a666c7d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.195756Z", - "modified": "2023-09-28T21:25:13.195756Z", + "created": "2024-08-02T17:12:32.335938Z", + "modified": "2024-08-02T17:12:32.335938Z", "name": "Create Hashtags and Search Artefacts", "description": "Create one or more hashtags and/or hashtag groups. Many incident-based campaigns will create hashtags to promote their fabricated event. Creating a hashtag for an incident can have two important effects: 1. Create a perception of reality around an event. Certainly only \"real\" events would be discussed in a hashtag. After all, the event has a name!, and 2. Publicise the story more widely through trending lists and search behaviour. Asset needed to direct/control/manage \"conversation\" connected to launching new incident/campaign with new hashtag for applicable social media sites).", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0b7c795-eae2-4494-a3c9-52bc68c6df06.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0b7c795-eae2-4494-a3c9-52bc68c6df06.json index 23de6ff..1c7a77d 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0b7c795-eae2-4494-a3c9-52bc68c6df06.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0b7c795-eae2-4494-a3c9-52bc68c6df06.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--0fd36e6c-bf7f-4bb3-9412-220b3c84823a", + "id": "bundle--4b25cc5d-6431-4fb2-9211-773b32b42f6d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e0b7c795-eae2-4494-a3c9-52bc68c6df06", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.195612Z", - "modified": "2023-09-28T21:25:13.195612Z", + "created": "2024-08-02T17:12:32.335744Z", + "modified": "2024-08-02T17:12:32.335744Z", "name": "Raise Funds from Ignorant Agents", "description": "Raising funds from ignorant agents may include scams, donations intended for one stated purpose but then used for another, etc.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea.json index 4c70975..6d47cff 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9490e61c-6abf-46dd-81c3-2fa54fe2559b", + "id": "bundle--0f518362-e7ce-4296-bd55-9cba5a40c9c0", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.250542Z", - "modified": "2023-09-28T21:25:13.250542Z", + "created": "2024-08-02T17:12:32.393803Z", + "modified": "2024-08-02T17:12:32.393803Z", "name": "Create Inauthentic News Sites", "description": "Create Inauthentic News Sites", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e22e3d7d-40fc-4a5e-8d6c-d528b9f78e8e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e22e3d7d-40fc-4a5e-8d6c-d528b9f78e8e.json index 0850163..c50ac72 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e22e3d7d-40fc-4a5e-8d6c-d528b9f78e8e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e22e3d7d-40fc-4a5e-8d6c-d528b9f78e8e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d341052e-6550-4dd9-8b48-2f54f7e02bff", + "id": "bundle--d0bcb4be-6d94-4139-ae4f-bacf5f909305", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e22e3d7d-40fc-4a5e-8d6c-d528b9f78e8e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.275468Z", - "modified": "2023-09-28T21:25:13.275468Z", + "created": "2024-08-02T17:12:32.411758Z", + "modified": "2024-08-02T17:12:32.411758Z", "name": "Suppress Opposition", "description": "Operators can suppress the opposition by exploiting platform content moderation tools and processes like reporting non-violative content to platforms for takedown and goading opposition actors into taking actions that result in platform action or target audience disapproval.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e27cf6aa-69bc-434b-ac68-b0164d0b3421.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e27cf6aa-69bc-434b-ac68-b0164d0b3421.json index e0e9b4c..3d58c98 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e27cf6aa-69bc-434b-ac68-b0164d0b3421.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e27cf6aa-69bc-434b-ac68-b0164d0b3421.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--2820078e-14f2-484a-95dc-3d09835d11ff", + "id": "bundle--0373e42e-524d-4a1b-8892-ac36649c47cd", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e27cf6aa-69bc-434b-ac68-b0164d0b3421", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.229867Z", - "modified": "2023-09-28T21:25:13.229867Z", + "created": "2024-08-02T17:12:32.370006Z", + "modified": "2024-08-02T17:12:32.370006Z", "name": "Appropriate Content", "description": "An influence operation may take content from other sources with proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources. Examples include the appropriation of content from one inauthentic news site to another inauthentic news site or network in ways that align with the originators licencing or terms of service.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e41b04e4-b8c2-4f66-93d7-c148f3378008.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e41b04e4-b8c2-4f66-93d7-c148f3378008.json new file mode 100644 index 0000000..f8540ee --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e41b04e4-b8c2-4f66-93d7-c148f3378008.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--b3b188d6-3ac7-4529-b27b-95edf54abad9", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--e41b04e4-b8c2-4f66-93d7-c148f3378008", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.38815Z", + "modified": "2024-08-02T17:12:32.38815Z", + "name": "Government Official Persona", + "description": "A person who presents as an active or previous government official has the government official persona. These are officials serving in government, such as heads of government departments, leaders of countries, and members of government selected to represent constituents.

Presenting as a government official is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in government to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.111: Government Official Persona). They may also impersonate existing members of government (T0143.003: Impersonated Persona, T0097.111: Government Official Persona).

Legitimate government officials could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.111: Government Official Persona). For example, a government official could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.110: Party Official Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting as a member of a political party.\u00a0

Not all government officials are political party officials (such as outside experts brought into government) and not all political party officials are government officials (such as people standing for office who are not yet working in government).

T0097.206: Government Institution Persona: People presenting as members of a government may also represent a government institution which they are associated with.

T0097.112: Government Employee Persona: Analysts should use this sub-technique to document people presenting as professionals hired to serve in government institutions and departments, not officials selected to represent constituents, or assigned official roles in government (such as heads of departments).", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.111.md", + "external_id": "T0097.111" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e47ae747-d83d-433d-a69a-f6d0970fed5e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e47ae747-d83d-433d-a69a-f6d0970fed5e.json index 3f92df0..3136bf1 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e47ae747-d83d-433d-a69a-f6d0970fed5e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e47ae747-d83d-433d-a69a-f6d0970fed5e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--11022964-a69e-4a5e-afa1-356b0aff36c9", + "id": "bundle--318a9d2c-9acb-49ee-8d47-9b3d7aa02425", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e47ae747-d83d-433d-a69a-f6d0970fed5e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.208935Z", - "modified": "2023-09-28T21:25:13.208935Z", + "created": "2024-08-02T17:12:32.345613Z", + "modified": "2024-08-02T17:12:32.345613Z", "name": "Harass People Based on Identities", "description": "Examples include social identities like gender, sexuality, race, ethnicity, religion, ability, nationality, etc. as well as roles and occupations like journalist or activist.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e4ad5ad8-f52d-48a0-8fce-33157f885a3e.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e4ad5ad8-f52d-48a0-8fce-33157f885a3e.json index 2a73709..235c49d 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e4ad5ad8-f52d-48a0-8fce-33157f885a3e.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e4ad5ad8-f52d-48a0-8fce-33157f885a3e.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--4c885d9a-e5e9-4dc3-ab63-3fe9f3acf87b", + "id": "bundle--26ff4cfa-6206-476b-9995-7fa1090f8ef5", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e4ad5ad8-f52d-48a0-8fce-33157f885a3e", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.233879Z", - "modified": "2023-09-28T21:25:13.233879Z", + "created": "2024-08-02T17:12:32.374513Z", + "modified": "2024-08-02T17:12:32.374513Z", "name": "Deceptively Edit Images (Cheap Fakes)", "description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e4ea9ed6-b158-4cdc-95c2-749383d2a388.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e4ea9ed6-b158-4cdc-95c2-749383d2a388.json new file mode 100644 index 0000000..2a298f4 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e4ea9ed6-b158-4cdc-95c2-749383d2a388.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--3f63454f-6557-4761-9c39-7da473c155e2", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--e4ea9ed6-b158-4cdc-95c2-749383d2a388", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.386542Z", + "modified": "2024-08-02T17:12:32.386542Z", + "name": "Researcher Persona", + "description": "A person with a researcher persona presents themselves as conducting research (e.g. for academic institutions, or think tanks), or having previously conducted research.

While presenting as a researcher is not an indication of inauthentic behaviour,\u00a0 an influence operation may have its narratives amplified by people presenting as researchers. Threat actors can fabricate researchers (T0143.002: Fabricated Persona, T0097.107: Researcher Persona) to add credibility to their narratives.

People who are legitimate researchers (T0143.001: Authentic Persona, T0097.107: Researcher Persona) can use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a Researcher to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.204: Think Tank Persona: People with a researcher persona may present as being part of a think tank.
T0097.108: Expert Persona: People who present as researching a given topic are likely to also present as having expertise in the area.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.107.md", + "external_id": "T0097.107" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e60f54a3-9972-43b8-8359-ee21d781acae.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e60f54a3-9972-43b8-8359-ee21d781acae.json index 25ae1bc..0062755 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e60f54a3-9972-43b8-8359-ee21d781acae.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e60f54a3-9972-43b8-8359-ee21d781acae.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9d66dc2a-8e13-4735-b5c7-c058fa686cf2", + "id": "bundle--a1ebb9d0-8c55-4dae-b7c7-65a194fb844c", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e60f54a3-9972-43b8-8359-ee21d781acae", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.236836Z", - "modified": "2023-09-28T21:25:13.236836Z", + "created": "2024-08-02T17:12:32.376186Z", + "modified": "2024-08-02T17:12:32.376186Z", "name": "Develop AI-Generated Audio (Deepfakes)", "description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e6ab2793-a059-4354-bb60-045afb019833.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e6ab2793-a059-4354-bb60-045afb019833.json index 401bad1..b98479b 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e6ab2793-a059-4354-bb60-045afb019833.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e6ab2793-a059-4354-bb60-045afb019833.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e556b6e0-4c8d-4d7f-ae51-7b9f0d625217", + "id": "bundle--bc079bd9-c79a-4160-a848-16274673a308", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e6ab2793-a059-4354-bb60-045afb019833", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.21116Z", - "modified": "2023-09-28T21:25:13.21116Z", + "created": "2024-08-02T17:12:32.349745Z", + "modified": "2024-08-02T17:12:32.349745Z", "name": "Bots Amplify via Automated Forwarding and Reposting", "description": "Automated forwarding and reposting refer to the proliferation of operation content using automated means, such as artificial intelligence or social media bots. An influence operation may use automated activity to increase content exposure without dedicating the resources, including personnel and time, traditionally required to forward and repost content. Use bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more \"popular\" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e7b62982-106f-4234-9545-9466c687d1b5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e7b62982-106f-4234-9545-9466c687d1b5.json index df8eb64..64002b2 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e7b62982-106f-4234-9545-9466c687d1b5.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--e7b62982-106f-4234-9545-9466c687d1b5.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d2749ee7-7179-48c3-998d-43b21534cef2", + "id": "bundle--0a531c75-af81-4699-b26d-d47b9c7eea5a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e7b62982-106f-4234-9545-9466c687d1b5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.280391Z", - "modified": "2023-09-28T21:25:13.280391Z", + "created": "2024-08-02T17:12:32.415971Z", + "modified": "2024-08-02T17:12:32.415971Z", "name": "Coordinate on Encrypted/Closed Networks", "description": "Coordinate on encrypted/ closed networks", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea0d5988-af73-4b09-8040-7bb2fbadaa3c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea0d5988-af73-4b09-8040-7bb2fbadaa3c.json index 8ee9dea..5c46364 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea0d5988-af73-4b09-8040-7bb2fbadaa3c.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea0d5988-af73-4b09-8040-7bb2fbadaa3c.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--f5e16a97-95c6-427c-b091-5a1aa3753b3e", + "id": "bundle--d22c737c-dced-49a1-9a0a-2dfc54d1f164", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ea0d5988-af73-4b09-8040-7bb2fbadaa3c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.198581Z", - "modified": "2023-09-28T21:25:13.198581Z", + "created": "2024-08-02T17:12:32.337504Z", + "modified": "2024-08-02T17:12:32.337504Z", "name": "Trial Content", "description": "Iteratively test incident performance (messages, content etc), e.g. A/B test headline/content enagagement metrics; website and/or funding campaign conversion rates", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea762d7a-8852-4d91-b44f-4754aa079313.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea762d7a-8852-4d91-b44f-4754aa079313.json index bdd84af..5274b4a 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea762d7a-8852-4d91-b44f-4754aa079313.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea762d7a-8852-4d91-b44f-4754aa079313.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--99fac1cb-a119-4923-9e74-a6858ad3e7a5", + "id": "bundle--90036e2f-d5b0-477f-b401-53a369ff8b3d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ea762d7a-8852-4d91-b44f-4754aa079313", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.282986Z", - "modified": "2023-09-28T21:25:13.282986Z", + "created": "2024-08-02T17:12:32.41687Z", + "modified": "2024-08-02T17:12:32.41687Z", "name": "Remove Post Origins", "description": "Removing post origins refers to the elimination of evidence that indicates the initial source of operation content, often to complicate attribution. An influence operation may remove post origins by deleting watermarks, renaming files, or removing embedded links in its content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea788455-90c6-4f47-97b1-862d30ef7d12.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea788455-90c6-4f47-97b1-862d30ef7d12.json index b52dddd..fff8a96 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea788455-90c6-4f47-97b1-862d30ef7d12.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ea788455-90c6-4f47-97b1-862d30ef7d12.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--4dd79d38-b18a-4b1f-b601-740c6893c9a0", + "id": "bundle--d19f670c-e76b-4367-ae8b-7909a0356a2d", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ea788455-90c6-4f47-97b1-862d30ef7d12", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.199178Z", - "modified": "2023-09-28T21:25:13.199178Z", + "created": "2024-08-02T17:12:32.337907Z", + "modified": "2024-08-02T17:12:32.337907Z", "name": "Leverage Conspiracy Theory Narratives", "description": "\"Conspiracy narratives\" appeal to the human desire for explanatory order, by invoking the participation of poweful (often sinister) actors in pursuit of their own political goals. These narratives are especially appealing when an audience is low-information, marginalised or otherwise inclined to reject the prevailing explanation. Conspiracy narratives are an important component of the \"firehose of falsehoods\" model.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb037d2a-82a7-4bcb-bffd-e7791de21d1c.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb037d2a-82a7-4bcb-bffd-e7791de21d1c.json index 9b2e52b..7c734f4 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb037d2a-82a7-4bcb-bffd-e7791de21d1c.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb037d2a-82a7-4bcb-bffd-e7791de21d1c.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--de727a3f-959f-4171-a484-ec5ae2adca13", + "id": "bundle--3b976a3c-a0a7-4500-a605-904940bc13ab", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--eb037d2a-82a7-4bcb-bffd-e7791de21d1c", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.279929Z", - "modified": "2023-09-28T21:25:13.279929Z", + "created": "2024-08-02T17:12:32.415366Z", + "modified": "2024-08-02T17:12:32.415366Z", "name": "Generate Content Unrelated to Narrative", "description": "An influence operation may mix its own operation content with legitimate news or external unrelated content to disguise operational objectives, narratives, or existence. For example, an operation may generate \"lifestyle\" or \"cuisine\" content alongside regular operation content.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb63894c-aad1-47f0-98ee-0fa5e07ed3f3.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb63894c-aad1-47f0-98ee-0fa5e07ed3f3.json index 726f3c6..6663cfc 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb63894c-aad1-47f0-98ee-0fa5e07ed3f3.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb63894c-aad1-47f0-98ee-0fa5e07ed3f3.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--3769fb81-89fd-406d-b23c-4b6dc06b29ce", + "id": "bundle--a90e665c-0e5a-4617-b44c-c3c5c1cf0cb0", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--eb63894c-aad1-47f0-98ee-0fa5e07ed3f3", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.200222Z", - "modified": "2023-09-28T21:25:13.200222Z", + "created": "2024-08-02T17:12:32.341849Z", + "modified": "2024-08-02T17:12:32.341849Z", "name": "Develop Original Conspiracy Theory Narratives", "description": "While this requires more resources than amplifying existing conspiracy theory narratives, an influence operation may develop original conspiracy theory narratives in order to achieve greater control and alignment over the narrative and their campaign goals. Prominent examples include the USSR's Operation INFEKTION disinformation campaign run by the KGB in the 1980s to plant the idea that the United States had invented HIV/AIDS as part of a biological weapons research project at Fort Detrick, Maryland. More recently, Fort Detrick featured prominently in a new conspiracy theory narratives around the origins of the COVID-19 outbreak and pandemic.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb66afed-6c29-4947-a422-c380c5caeda5.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb66afed-6c29-4947-a422-c380c5caeda5.json index f96df27..7225afb 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb66afed-6c29-4947-a422-c380c5caeda5.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb66afed-6c29-4947-a422-c380c5caeda5.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--d7169852-a0a8-4aa1-a31c-940f1e6300c5", + "id": "bundle--cb8a96cd-1f04-4b73-9c3d-1e9e2451b61a", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--eb66afed-6c29-4947-a422-c380c5caeda5", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.264749Z", - "modified": "2023-09-28T21:25:13.264749Z", + "created": "2024-08-02T17:12:32.405316Z", + "modified": "2024-08-02T17:12:32.405316Z", "name": "Newspaper", "description": "Newspaper", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb67513e-b6e8-42e1-a95b-197f64c21588.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb67513e-b6e8-42e1-a95b-197f64c21588.json index b9a0f23..fe5875c 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb67513e-b6e8-42e1-a95b-197f64c21588.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eb67513e-b6e8-42e1-a95b-197f64c21588.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--0dd5363a-3f7f-4d84-9077-3e1b1ba601f6", + "id": "bundle--7666e7aa-19d6-4697-ac65-e802781c1d28", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--eb67513e-b6e8-42e1-a95b-197f64c21588", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.279479Z", - "modified": "2023-09-28T21:25:13.279479Z", + "created": "2024-08-02T17:12:32.415225Z", + "modified": "2024-08-02T17:12:32.415225Z", "name": "Conceal Network Identity", "description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ec8424e6-c7de-4543-b943-f0c4cc9ac63d.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ec8424e6-c7de-4543-b943-f0c4cc9ac63d.json index 63e9fff..7d1b0bb 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ec8424e6-c7de-4543-b943-f0c4cc9ac63d.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ec8424e6-c7de-4543-b943-f0c4cc9ac63d.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--5a61b038-2b91-4fa8-920d-12d91c0a17e6", + "id": "bundle--6097cd10-6aad-43f7-9183-191bb46d9d19", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ec8424e6-c7de-4543-b943-f0c4cc9ac63d", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.238381Z", - "modified": "2023-09-28T21:25:13.238381Z", + "created": "2024-08-02T17:12:32.376796Z", + "modified": "2024-08-02T17:12:32.376796Z", "name": "Obtain Authentic Documents", "description": "Procure authentic documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can be \"leaked\" during later stages in the operation.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ee594da3-8999-481e-90b3-e8c2e965ae28.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ee594da3-8999-481e-90b3-e8c2e965ae28.json new file mode 100644 index 0000000..b3955f8 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ee594da3-8999-481e-90b3-e8c2e965ae28.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--9b60f356-1a61-4812-9e32-e7bbe66bc351", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--ee594da3-8999-481e-90b3-e8c2e965ae28", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.42446Z", + "modified": "2024-08-02T17:12:32.42446Z", + "name": "Cultvate Support for Initiative", + "description": "Elevate or fortify the public backing for a policy, operation, or idea. Domestic and foreign actors can use artificial means to fabricate or amplify public support for a proposal or action. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.005.md", + "external_id": "T0136.005" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eef34262-0822-4727-83f5-2e608babc396.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eef34262-0822-4727-83f5-2e608babc396.json index fe1183f..1d7d753 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eef34262-0822-4727-83f5-2e608babc396.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--eef34262-0822-4727-83f5-2e608babc396.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--468bacd2-f967-4259-8fbb-42324bd38b02", + "id": "bundle--7c67f841-9fdb-4a33-ad46-0cb973b1dad8", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--eef34262-0822-4727-83f5-2e608babc396", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.196666Z", - "modified": "2023-09-28T21:25:13.196666Z", + "created": "2024-08-02T17:12:32.336982Z", + "modified": "2024-08-02T17:12:32.336982Z", "name": "Purchase Targeted Advertisements", "description": "Create or fund advertisements targeted at specific populations", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ef3dcdcd-bd97-48e0-9d15-3e482a72c979.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ef3dcdcd-bd97-48e0-9d15-3e482a72c979.json index 74fa99a..7a39e57 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ef3dcdcd-bd97-48e0-9d15-3e482a72c979.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--ef3dcdcd-bd97-48e0-9d15-3e482a72c979.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--3eefd179-69a8-412e-a016-73c93f1447aa", + "id": "bundle--0630aceb-d155-4d23-a439-a04c789a8882", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ef3dcdcd-bd97-48e0-9d15-3e482a72c979", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.242733Z", - "modified": "2023-09-28T21:25:13.242733Z", + "created": "2024-08-02T17:12:32.378944Z", + "modified": "2024-08-02T17:12:32.378944Z", "name": "Enlist Troll Accounts", "description": "An influence operation may hire trolls, or human operators of fake accounts that aim to provoke others by posting and amplifying content about controversial issues. Trolls can serve to discredit an influence operation\u2019s opposition or bring attention to the operation\u2019s cause through debate. Classic trolls refer to regular people who troll for personal reasons, such as attention-seeking or boredom. Classic trolls may advance operation narratives by coincidence but are not directly affiliated with any larger operation. Conversely, hybrid trolls act on behalf of another institution, such as a state or financial organisation, and post content with a specific ideological goal. Hybrid trolls may be highly advanced and institutionalised or less organised and work for a single individual.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f328541f-2537-4db7-8a05-1c76ed26d3eb.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f328541f-2537-4db7-8a05-1c76ed26d3eb.json new file mode 100644 index 0000000..f5a38ff --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f328541f-2537-4db7-8a05-1c76ed26d3eb.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--1879b787-e893-47ef-b3bf-5b197bcf4b01", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--f328541f-2537-4db7-8a05-1c76ed26d3eb", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.431241Z", + "modified": "2024-08-02T17:12:32.431241Z", + "name": "Fabricated Persona", + "description": "An individual or institution pretending to have a persona without any legitimate claim to that persona is presenting a fabricated persona, such as a person who presents themselves as a member of a country\u2019s military without having worked in any capacity with the military (T0143.002: Fabricated Persona, T0097.105: Military Personnel).

Sometimes real people can present entirely fabricated personas; they can use real names and photos on social media while also pretending to have credentials or traits they don\u2019t have in real life.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0143.002.md", + "external_id": "T0143.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f601eb03-79d0-4c00-b07d-4b4647c37efd.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f601eb03-79d0-4c00-b07d-4b4647c37efd.json index 03d576d..8b8dbca 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f601eb03-79d0-4c00-b07d-4b4647c37efd.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f601eb03-79d0-4c00-b07d-4b4647c37efd.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--bc827c4b-80b4-4b2c-abf4-183ec998f9f1", + "id": "bundle--4dff5d6c-9098-4000-9b9d-9be21eba61bd", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f601eb03-79d0-4c00-b07d-4b4647c37efd", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.212419Z", - "modified": "2023-09-28T21:25:13.212419Z", + "created": "2024-08-02T17:12:32.352658Z", + "modified": "2024-08-02T17:12:32.352658Z", "name": "Conduct Symbolic Action", "description": "Symbolic action refers to activities specifically intended to advance an operation\u2019s narrative by signalling something to the audience, for example, a military parade supporting a state\u2019s narrative of military superiority. An influence operation may use symbolic action to create falsified evidence supporting operation narratives in the physical information space.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f99e6f94-8c7d-42d7-8343-8d959643f721.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f99e6f94-8c7d-42d7-8343-8d959643f721.json new file mode 100644 index 0000000..1b1bed1 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--f99e6f94-8c7d-42d7-8343-8d959643f721.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--38e19efb-3745-4c9d-aa99-03f0f2839e0d", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--f99e6f94-8c7d-42d7-8343-8d959643f721", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.392573Z", + "modified": "2024-08-02T17:12:32.392573Z", + "name": "NGO Persona", + "description": "Institutions which present themselves as an NGO (Non-Governmental Organisation), an organisation which provides services or advocates for public policy (while not being directly affiliated with any government), are presenting an NGO persona.

While presenting as an NGO is not an indication of inauthentic behaviour, NGO personas are commonly used by threat actors (such as intelligence services) as a front for their operational activity (T0143.002: Fabricated Persona, T0097.207: NGO Persona). They are created to give legitimacy to the influence operation and potentially infiltrate grassroots movements

Legitimate NGOs could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.207: NGO Persona). For example, an NGO could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques:
T0097.103: Activist Persona: Institutions presenting as activist groups may also present activists working within the organisation.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.207.md", + "external_id": "T0097.207" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fa4e9051-46d7-45b4-a65b-9376b003ad2a.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fa4e9051-46d7-45b4-a65b-9376b003ad2a.json new file mode 100644 index 0000000..5c95be8 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fa4e9051-46d7-45b4-a65b-9376b003ad2a.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--56ab2139-d2c6-4dda-851b-e353a4617c6b", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--fa4e9051-46d7-45b4-a65b-9376b003ad2a", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.387783Z", + "modified": "2024-08-02T17:12:32.387783Z", + "name": "Party Official Persona", + "description": "A person who presents as an official member of a political party, such as leaders of political parties, candidates standing to represent constituents, and campaign staff.

Presenting as an official of a political party is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in political parties to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.110: Party Official Persona). They may also impersonate existing officials of political parties (T0143.003: Impersonated Persona, T0097.110: Party Official Persona).

Legitimate members of political parties could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.110: Party Official Persona). For example, an electoral candidate could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting as a member of a government.\u00a0

Some party officials will also be government officials. For example, in the United Kingdom the head of government is commonly also the head of their political party.

Some party officials won\u2019t be government officials. For example, members of a party standing in an election, or party officials who work outside of government (e.g. campaign staff).", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.110.md", + "external_id": "T0097.110" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--faa5450d-6d1f-4700-93bd-fd2d59a79e60.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--faa5450d-6d1f-4700-93bd-fd2d59a79e60.json new file mode 100644 index 0000000..ea7c0d3 --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--faa5450d-6d1f-4700-93bd-fd2d59a79e60.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--b78b03de-b682-4d55-a341-33c92144e388", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--faa5450d-6d1f-4700-93bd-fd2d59a79e60", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.391786Z", + "modified": "2024-08-02T17:12:32.391786Z", + "name": "Business Persona", + "description": "An institution with a business persona presents itself as a for-profit organisation which provides goods or services for a price.

While presenting as a business is not an indication of inauthentic behaviour, business personas may be used by threat actors as a front for their operational activity (T0143.002: Fabricated Persona, T0097.205: Business Persona).

Threat actors may also impersonate existing businesses (T0143.003: Impersonated Persona, T0097.205: Business Persona) to exploit their brand or cause reputational damage.

Legitimate businesses could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.205: Business Persona). For example, a business could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-legitimacy" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0097.205.md", + "external_id": "T0097.205" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--faacbfa9-600a-4cfb-8afe-844a186d72b3.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--faacbfa9-600a-4cfb-8afe-844a186d72b3.json new file mode 100644 index 0000000..18f6b6c --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--faacbfa9-600a-4cfb-8afe-844a186d72b3.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--ad2e4b12-4e18-415c-a1c2-aa76fa284ca4", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--faacbfa9-600a-4cfb-8afe-844a186d72b3", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.426286Z", + "modified": "2024-08-02T17:12:32.426286Z", + "name": "Generate Ad Revenue", + "description": "Earn income from digital advertisements published alongside inauthentic content. Conspiratorial, false, or provocative content drives internet traffic. Content owners earn money from impressions of, or clicks on, or conversions of ads published on their websites, social media profiles, or streaming services, or ads published when their content appears in search engine results. Fraudsters simulate impressions, clicks, and conversions, or they spin up inauthentic sites or social media profiles just to generate ad revenue. Conspiracy theorists and political operators generate ad revenue as a byproduct of their operation or as a means of sustaining their campaign. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.001.md", + "external_id": "T0137.001" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fb6f8352-c368-49a3-b7d4-f1ee5a3fb370.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fb6f8352-c368-49a3-b7d4-f1ee5a3fb370.json index 611a939..9668f4d 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fb6f8352-c368-49a3-b7d4-f1ee5a3fb370.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fb6f8352-c368-49a3-b7d4-f1ee5a3fb370.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--9f6a7730-a0d0-4964-9d8c-d9494abda36e", + "id": "bundle--776f2340-1377-4bd0-806c-d0f8faba569f", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fb6f8352-c368-49a3-b7d4-f1ee5a3fb370", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.269329Z", - "modified": "2023-09-28T21:25:13.269329Z", + "created": "2024-08-02T17:12:32.407338Z", + "modified": "2024-08-02T17:12:32.407338Z", "name": "Post Violative Content to Provoke Takedown and Backlash", "description": "Post Violative Content to Provoke Takedown and Backlash.", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fc986d09-410d-45ac-b4b4-161ff339147f.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fc986d09-410d-45ac-b4b4-161ff339147f.json new file mode 100644 index 0000000..be6c21f --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fc986d09-410d-45ac-b4b4-161ff339147f.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--e19a9a90-2bdd-4dfd-b4fd-b862e2780e0f", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--fc986d09-410d-45ac-b4b4-161ff339147f", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.425208Z", + "modified": "2024-08-02T17:12:32.425208Z", + "name": "Recruit Members", + "description": "Motivate followers to join or subscribe as members of the team. Organisations may mount recruitment drives that use propaganda to entice sympathisers to sign up. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.007.md", + "external_id": "T0136.007" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fd04fba0-0e20-40f9-868d-e8effcf6dab6.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fd04fba0-0e20-40f9-868d-e8effcf6dab6.json index 92b3fc9..f5beb2c 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fd04fba0-0e20-40f9-868d-e8effcf6dab6.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fd04fba0-0e20-40f9-868d-e8effcf6dab6.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--de1fabaa-fdff-49ae-98f7-47fd112825a9", + "id": "bundle--4199e72d-8919-4165-9a81-9e7dbe022331", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fd04fba0-0e20-40f9-868d-e8effcf6dab6", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.276552Z", - "modified": "2023-09-28T21:25:13.276552Z", + "created": "2024-08-02T17:12:32.412744Z", + "modified": "2024-08-02T17:12:32.412744Z", "name": "Platform Filtering", "description": "Platform filtering refers to the decontextualization of information as claims cross platforms (from Joan Donovan https://www.hks.harvard.edu/publications/disinformation-design-use-evidence-collages-and-platform-filtering-media-manipulation)", "kill_chain_phases": [ diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fdc7e2f8-dfb1-4353-a59f-f88d3b15eee7.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fdc7e2f8-dfb1-4353-a59f-f88d3b15eee7.json new file mode 100644 index 0000000..393e41e --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fdc7e2f8-dfb1-4353-a59f-f88d3b15eee7.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--24990453-cead-47ba-94ae-a5c06c8552bf", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--fdc7e2f8-dfb1-4353-a59f-f88d3b15eee7", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.422406Z", + "modified": "2024-08-02T17:12:32.422406Z", + "name": "Subvert", + "description": "Sabotage, destroy, or damage a system, process, or relationship. The classic example is the Soviet strategy of \u201cactive measures\u201d involving deniable covert activities such as political influence, the use of front organisations, the orchestration of domestic unrest, and the spread of disinformation. ", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "plan-objectives" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.003.md", + "external_id": "T0135.003" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fde45c5f-c612-4969-b104-d96a60e6d888.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fde45c5f-c612-4969-b104-d96a60e6d888.json new file mode 100644 index 0000000..24dc9fd --- /dev/null +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fde45c5f-c612-4969-b104-d96a60e6d888.json @@ -0,0 +1,39 @@ +{ + "type": "bundle", + "id": "bundle--6b1fab63-3a77-44bc-85c1-9884caca7655", + "objects": [ + { + "type": "attack-pattern", + "spec_version": "2.1", + "id": "attack-pattern--fde45c5f-c612-4969-b104-d96a60e6d888", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.430799Z", + "modified": "2024-08-02T17:12:32.430799Z", + "name": "Acquire Compromised Website", + "description": "Threat Actors may take over existing websites to publish or amplify inauthentic narratives. This includes the defacement of websites, and cases where websites\u2019 personas are maintained to add credence to threat actors\u2019 narratives.

See also [Mitre ATT&CK\u2019s T1584 Compromise Infrastructure](https://attack.mitre.org/techniques/T1584/) for more technical information on how threat actors may achieve this objective.", + "kill_chain_phases": [ + { + "kill_chain_name": "mitre-attack", + "phase_name": "establish-assets" + } + ], + "external_references": [ + { + "source_name": "mitre-attack", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0141.002.md", + "external_id": "T0141.002" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_is_subtechnique": true, + "x_mitre_platforms": [ + "Windows", + "Linux", + "Mac" + ], + "x_mitre_version": "2.1" + } + ] +} diff --git a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fe5cf0f2-3792-4cab-b546-a9af7a5aa319.json b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fe5cf0f2-3792-4cab-b546-a9af7a5aa319.json index 0855bdf..5dae16f 100644 --- a/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fe5cf0f2-3792-4cab-b546-a9af7a5aa319.json +++ b/generated_files/DISARM_STIX/attack-pattern/attack-pattern--fe5cf0f2-3792-4cab-b546-a9af7a5aa319.json @@ -1,20 +1,20 @@ { "type": "bundle", - "id": "bundle--baff5a4e-b285-4b1c-8ae5-8c04c6b6a308", + "id": "bundle--583a2f10-cdf4-4168-b8df-8f9bfa895892", "objects": [ { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--fe5cf0f2-3792-4cab-b546-a9af7a5aa319", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.242543Z", - "modified": "2023-09-28T21:25:13.242543Z", + "created": "2024-08-02T17:12:32.378752Z", + "modified": "2024-08-02T17:12:32.378752Z", "name": "Recruit Partisans", "description": "Operators recruit partisans (ideologically-aligned individuals) to support the campaign.", "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", - "phase_name": "establish-social-assets" + "phase_name": "establish-assets" } ], "external_references": [ diff --git a/generated_files/DISARM_STIX/identity/identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82.json b/generated_files/DISARM_STIX/identity/identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82.json index a2d2237..7e7b9f5 100644 --- a/generated_files/DISARM_STIX/identity/identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82.json +++ b/generated_files/DISARM_STIX/identity/identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82.json @@ -1,13 +1,13 @@ { "type": "bundle", - "id": "bundle--4543104f-8a29-4c78-9423-a8cac4a38a91", + "id": "bundle--84e14668-c4b2-44c5-848f-2c838cff866b", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.178304Z", - "modified": "2023-09-28T21:25:13.178304Z", + "created": "2024-08-02T17:12:32.312276Z", + "modified": "2024-08-02T17:12:32.312276Z", "name": "DISARM Foundation", "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", "identity_class": "organization" diff --git a/generated_files/DISARM_STIX/marking-definition/marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31.json b/generated_files/DISARM_STIX/marking-definition/marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31.json index 94a8d8e..f73aec3 100644 --- a/generated_files/DISARM_STIX/marking-definition/marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31.json +++ b/generated_files/DISARM_STIX/marking-definition/marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31.json @@ -1,13 +1,13 @@ { "type": "bundle", - "id": "bundle--1deabce9-1a97-4864-9494-98d3838b845a", + "id": "bundle--447aba78-89f2-4f5a-aaf9-79efec091252", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.178561Z", + "created": "2024-08-02T17:12:32.313302Z", "definition_type": "statement", "name": "DISARM Foundation", "definition": { diff --git a/generated_files/DISARM_STIX/relationship/relationship--000f3d69-4afe-49b5-a106-5213a9d63bb7.json b/generated_files/DISARM_STIX/relationship/relationship--000f3d69-4afe-49b5-a106-5213a9d63bb7.json new file mode 100644 index 0000000..d29493b --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--000f3d69-4afe-49b5-a106-5213a9d63bb7.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--27ac72d5-fa16-44fe-85c4-097df8b63f04", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--000f3d69-4afe-49b5-a106-5213a9d63bb7", + "created": "2024-08-02T17:12:32.441053Z", + "modified": "2024-08-02T17:12:32.441053Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--df5189cc-29b5-41d1-a20f-bd641f5946be", + "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--00e32dc0-885f-4d8c-a668-6866f00cb494.json b/generated_files/DISARM_STIX/relationship/relationship--00e32dc0-885f-4d8c-a668-6866f00cb494.json new file mode 100644 index 0000000..71b254f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--00e32dc0-885f-4d8c-a668-6866f00cb494.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--2a437c1f-a48f-48f9-b2f3-cc43caca4b63", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--00e32dc0-885f-4d8c-a668-6866f00cb494", + "created": "2024-08-02T17:12:32.437365Z", + "modified": "2024-08-02T17:12:32.437365Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--1d917530-027d-4f82-b380-404c320dc783", + "target_ref": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--01daebfb-3b40-4a94-9d9f-b937747dc480.json b/generated_files/DISARM_STIX/relationship/relationship--01daebfb-3b40-4a94-9d9f-b937747dc480.json new file mode 100644 index 0000000..563fb88 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--01daebfb-3b40-4a94-9d9f-b937747dc480.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--da534f4e-c632-4e83-b228-3073598dc0ea", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--01daebfb-3b40-4a94-9d9f-b937747dc480", + "created": "2024-08-02T17:12:32.434806Z", + "modified": "2024-08-02T17:12:32.434806Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--72207f73-5b54-4cd4-b453-746a61eb3e28", + "target_ref": "attack-pattern--61df6490-ca2c-41b7-a251-ded790a03a71", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--025bccc9-30f8-4125-b84e-648df58b3b13.json b/generated_files/DISARM_STIX/relationship/relationship--025bccc9-30f8-4125-b84e-648df58b3b13.json new file mode 100644 index 0000000..5b37f61 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--025bccc9-30f8-4125-b84e-648df58b3b13.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--9baf816c-82d2-43a6-9eea-17a1c285d682", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--025bccc9-30f8-4125-b84e-648df58b3b13", + "created": "2024-08-02T17:12:32.453417Z", + "modified": "2024-08-02T17:12:32.453417Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99", + "target_ref": "attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--050c8b29-f94f-40f3-975b-8cf1e214fddf.json b/generated_files/DISARM_STIX/relationship/relationship--050c8b29-f94f-40f3-975b-8cf1e214fddf.json new file mode 100644 index 0000000..090d8dc --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--050c8b29-f94f-40f3-975b-8cf1e214fddf.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--9df758e6-9b63-44c3-ba98-a737808115b1", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--050c8b29-f94f-40f3-975b-8cf1e214fddf", + "created": "2024-08-02T17:12:32.463185Z", + "modified": "2024-08-02T17:12:32.463185Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e7b62982-106f-4234-9545-9466c687d1b5", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--05840c3e-34ef-49be-a231-d39ad1faae96.json b/generated_files/DISARM_STIX/relationship/relationship--05840c3e-34ef-49be-a231-d39ad1faae96.json new file mode 100644 index 0000000..2afd10d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--05840c3e-34ef-49be-a231-d39ad1faae96.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0d0f05cb-2d9b-46d3-83b3-54eb773a8a66", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--05840c3e-34ef-49be-a231-d39ad1faae96", + "created": "2024-08-02T17:12:32.465037Z", + "modified": "2024-08-02T17:12:32.465037Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--b6644001-8597-4f9f-a2a4-8005c54e8a39", + "target_ref": "attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--063f9539-81fc-47b6-a0a4-577c0989ee16.json b/generated_files/DISARM_STIX/relationship/relationship--063f9539-81fc-47b6-a0a4-577c0989ee16.json new file mode 100644 index 0000000..ac489cf --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--063f9539-81fc-47b6-a0a4-577c0989ee16.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--84f34bca-662f-4a06-b489-995063fd74e8", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--063f9539-81fc-47b6-a0a4-577c0989ee16", + "created": "2024-08-02T17:12:32.476433Z", + "modified": "2024-08-02T17:12:32.476433Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--410e8ae7-e11d-44ff-8f10-3ec29798a9e0", + "target_ref": "attack-pattern--0c2c22ae-5115-4b91-9e0f-08259e6aad99", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--07b41de1-19a9-445e-8d5c-21126231bd97.json b/generated_files/DISARM_STIX/relationship/relationship--07b41de1-19a9-445e-8d5c-21126231bd97.json new file mode 100644 index 0000000..5866352 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--07b41de1-19a9-445e-8d5c-21126231bd97.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--154cff75-8356-4cc3-9858-cb1c875140cc", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--07b41de1-19a9-445e-8d5c-21126231bd97", + "created": "2024-08-02T17:12:32.476199Z", + "modified": "2024-08-02T17:12:32.476199Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d592cbac-8fcd-4569-8a7a-4e5c6a0b08e7", + "target_ref": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--0842bbd9-8779-4830-8211-d56a7df758bc.json b/generated_files/DISARM_STIX/relationship/relationship--0842bbd9-8779-4830-8211-d56a7df758bc.json new file mode 100644 index 0000000..2301c2d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--0842bbd9-8779-4830-8211-d56a7df758bc.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--6fb8131e-8863-499a-a8a6-350e76b3815b", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0842bbd9-8779-4830-8211-d56a7df758bc", + "created": "2024-08-02T17:12:32.474903Z", + "modified": "2024-08-02T17:12:32.474903Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--b502f8ae-e296-4dd7-83ea-8d737f8d3fb1", + "target_ref": "attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--089a31c6-accd-409b-b4c3-0eb30911d163.json b/generated_files/DISARM_STIX/relationship/relationship--089a31c6-accd-409b-b4c3-0eb30911d163.json new file mode 100644 index 0000000..70835cf --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--089a31c6-accd-409b-b4c3-0eb30911d163.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--07512f7f-6771-46ec-b040-6db8f84a2211", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--089a31c6-accd-409b-b4c3-0eb30911d163", + "created": "2024-08-02T17:12:32.450348Z", + "modified": "2024-08-02T17:12:32.450348Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--97ba7c89-f5d0-49a4-a661-f8317b44cf20", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--0adc9df9-b5e2-4c59-886d-b7f53f5e83b5.json b/generated_files/DISARM_STIX/relationship/relationship--0adc9df9-b5e2-4c59-886d-b7f53f5e83b5.json new file mode 100644 index 0000000..4905a79 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--0adc9df9-b5e2-4c59-886d-b7f53f5e83b5.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4c6e7d48-14bc-47f6-b343-8804ee0511a0", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0adc9df9-b5e2-4c59-886d-b7f53f5e83b5", + "created": "2024-08-02T17:12:32.463639Z", + "modified": "2024-08-02T17:12:32.463639Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--deb9a225-0803-4a1f-b37b-3a10c3e7ca79", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--0cc310ba-a0b6-4fa4-adec-b859ba96092f.json b/generated_files/DISARM_STIX/relationship/relationship--0cc310ba-a0b6-4fa4-adec-b859ba96092f.json new file mode 100644 index 0000000..abaf0b3 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--0cc310ba-a0b6-4fa4-adec-b859ba96092f.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--6c81440c-d0e2-4375-b5d5-e8c36129913a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0cc310ba-a0b6-4fa4-adec-b859ba96092f", + "created": "2024-08-02T17:12:32.464817Z", + "modified": "2024-08-02T17:12:32.464817Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb", + "target_ref": "attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--0cd0a45c-6751-48b3-ab61-e0a94f4fafd9.json b/generated_files/DISARM_STIX/relationship/relationship--0cd0a45c-6751-48b3-ab61-e0a94f4fafd9.json new file mode 100644 index 0000000..0c34375 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--0cd0a45c-6751-48b3-ab61-e0a94f4fafd9.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--44914c18-83be-4fc4-929c-93fa9e6c861b", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--0cd0a45c-6751-48b3-ab61-e0a94f4fafd9", + "created": "2024-08-02T17:12:32.435493Z", + "modified": "2024-08-02T17:12:32.435493Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7d5ba27c-12c7-4a30-8624-e1ea6670f0f8", + "target_ref": "attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1086eb5d-f95a-460e-99f0-add25b544883.json b/generated_files/DISARM_STIX/relationship/relationship--1086eb5d-f95a-460e-99f0-add25b544883.json new file mode 100644 index 0000000..f1e8cf3 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1086eb5d-f95a-460e-99f0-add25b544883.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--cf6abea7-fa2b-420b-bb3d-8be0ba6edc4d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1086eb5d-f95a-460e-99f0-add25b544883", + "created": "2024-08-02T17:12:32.455029Z", + "modified": "2024-08-02T17:12:32.455029Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--78ff99d8-dce8-4f4e-9dc2-3f37f154a39d", + "target_ref": "attack-pattern--6e525f48-d8d6-4484-8838-208eb00bd2a8", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--10d37af7-07f7-452b-b401-123c2a2abedc.json b/generated_files/DISARM_STIX/relationship/relationship--10d37af7-07f7-452b-b401-123c2a2abedc.json new file mode 100644 index 0000000..410b371 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--10d37af7-07f7-452b-b401-123c2a2abedc.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--6deffce1-906d-49ef-938d-3a9ca49809c2", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--10d37af7-07f7-452b-b401-123c2a2abedc", + "created": "2024-08-02T17:12:32.447271Z", + "modified": "2024-08-02T17:12:32.447271Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--39f767f7-bc22-4611-8a39-3584c5bbdd5a", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--11cbd45e-c9e7-4338-b95b-657edd1afedf.json b/generated_files/DISARM_STIX/relationship/relationship--11cbd45e-c9e7-4338-b95b-657edd1afedf.json new file mode 100644 index 0000000..280a3f5 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--11cbd45e-c9e7-4338-b95b-657edd1afedf.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e2fe99a8-2c9c-4361-9651-f07626bac504", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--11cbd45e-c9e7-4338-b95b-657edd1afedf", + "created": "2024-08-02T17:12:32.448548Z", + "modified": "2024-08-02T17:12:32.448548Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d3e83913-e2d5-4dad-b917-2363100c6ca0", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--156fb6c1-bbeb-4d79-8e53-b1a0504b826b.json b/generated_files/DISARM_STIX/relationship/relationship--156fb6c1-bbeb-4d79-8e53-b1a0504b826b.json new file mode 100644 index 0000000..44514b7 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--156fb6c1-bbeb-4d79-8e53-b1a0504b826b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fc9ea119-aea5-4a21-aa42-f7a5665b088e", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--156fb6c1-bbeb-4d79-8e53-b1a0504b826b", + "created": "2024-08-02T17:12:32.45979Z", + "modified": "2024-08-02T17:12:32.45979Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d65af8b6-91ce-490e-8978-014ff995a2ac", + "target_ref": "attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--16bd1f97-9919-4208-a94e-0d459d47baef.json b/generated_files/DISARM_STIX/relationship/relationship--16bd1f97-9919-4208-a94e-0d459d47baef.json new file mode 100644 index 0000000..4acea80 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--16bd1f97-9919-4208-a94e-0d459d47baef.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--2321614e-7b09-413f-8282-eda01c1b94d1", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--16bd1f97-9919-4208-a94e-0d459d47baef", + "created": "2024-08-02T17:12:32.43567Z", + "modified": "2024-08-02T17:12:32.43567Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb", + "target_ref": "attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--170161bb-06ee-43f2-9b93-7c10bd31c1ad.json b/generated_files/DISARM_STIX/relationship/relationship--170161bb-06ee-43f2-9b93-7c10bd31c1ad.json new file mode 100644 index 0000000..df889aa --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--170161bb-06ee-43f2-9b93-7c10bd31c1ad.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--6c4b0743-47eb-4558-9310-2fe7110e88b5", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--170161bb-06ee-43f2-9b93-7c10bd31c1ad", + "created": "2024-08-02T17:12:32.469243Z", + "modified": "2024-08-02T17:12:32.469243Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--fdc7e2f8-dfb1-4353-a59f-f88d3b15eee7", + "target_ref": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1926a20f-29a4-4440-9f6f-7e08c9b9b57d.json b/generated_files/DISARM_STIX/relationship/relationship--1926a20f-29a4-4440-9f6f-7e08c9b9b57d.json new file mode 100644 index 0000000..9ca9d46 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1926a20f-29a4-4440-9f6f-7e08c9b9b57d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--c25c6976-3172-44f8-847e-cac66ca62444", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1926a20f-29a4-4440-9f6f-7e08c9b9b57d", + "created": "2024-08-02T17:12:32.450944Z", + "modified": "2024-08-02T17:12:32.450944Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7e812f7d-f8a5-4636-b354-3d93561eda49", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--19f1005a-d61b-411b-bc1e-94ec1835a336.json b/generated_files/DISARM_STIX/relationship/relationship--19f1005a-d61b-411b-bc1e-94ec1835a336.json new file mode 100644 index 0000000..92206d4 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--19f1005a-d61b-411b-bc1e-94ec1835a336.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--ad69725b-eba1-403f-ba57-21f90673ee96", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--19f1005a-d61b-411b-bc1e-94ec1835a336", + "created": "2024-08-02T17:12:32.43833Z", + "modified": "2024-08-02T17:12:32.43833Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--9b66eaf5-5b03-46b8-b076-cf1da3593745", + "target_ref": "attack-pattern--5414f74d-0b10-4562-ad9d-e5e1093e255a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1a1a95f4-12ec-4fb3-9847-04154050c820.json b/generated_files/DISARM_STIX/relationship/relationship--1a1a95f4-12ec-4fb3-9847-04154050c820.json new file mode 100644 index 0000000..cfd146e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1a1a95f4-12ec-4fb3-9847-04154050c820.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--ea3c74d0-1014-4590-a08a-c7c82c56f957", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1a1a95f4-12ec-4fb3-9847-04154050c820", + "created": "2024-08-02T17:12:32.456153Z", + "modified": "2024-08-02T17:12:32.456153Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--9a5261b8-5051-47ed-a4f6-bdbb7b6edcb4", + "target_ref": "attack-pattern--1997947a-7e08-4ea9-802c-85391d561266", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1aa80662-3728-4774-9961-077c2c5bbdbf.json b/generated_files/DISARM_STIX/relationship/relationship--1aa80662-3728-4774-9961-077c2c5bbdbf.json new file mode 100644 index 0000000..686b525 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1aa80662-3728-4774-9961-077c2c5bbdbf.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--2e3c5bed-0fee-4613-8cee-8d5810246eb8", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1aa80662-3728-4774-9961-077c2c5bbdbf", + "created": "2024-08-02T17:12:32.470256Z", + "modified": "2024-08-02T17:12:32.470256Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--0dc4a07b-94cb-4743-b812-3fc3c8288551", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1bcb57b6-0e8d-4e7a-b455-3cee4a9e366a.json b/generated_files/DISARM_STIX/relationship/relationship--1bcb57b6-0e8d-4e7a-b455-3cee4a9e366a.json new file mode 100644 index 0000000..dc7e662 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1bcb57b6-0e8d-4e7a-b455-3cee4a9e366a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--7655b8a1-0e6e-48b1-b449-1c22fb09c0f7", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1bcb57b6-0e8d-4e7a-b455-3cee4a9e366a", + "created": "2024-08-02T17:12:32.439687Z", + "modified": "2024-08-02T17:12:32.439687Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--594993b4-86a3-455b-af59-61f167d7fd93", + "target_ref": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1d6dee53-1e87-4859-9a89-fa4f373e9587.json b/generated_files/DISARM_STIX/relationship/relationship--1d6dee53-1e87-4859-9a89-fa4f373e9587.json new file mode 100644 index 0000000..6e4f3ef --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1d6dee53-1e87-4859-9a89-fa4f373e9587.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--b368d113-dfde-4e72-80e1-120d7986d968", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1d6dee53-1e87-4859-9a89-fa4f373e9587", + "created": "2024-08-02T17:12:32.46151Z", + "modified": "2024-08-02T17:12:32.46151Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae", + "target_ref": "attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1dcde9ab-7411-4303-891c-9e733976b93c.json b/generated_files/DISARM_STIX/relationship/relationship--1dcde9ab-7411-4303-891c-9e733976b93c.json new file mode 100644 index 0000000..94facb0 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1dcde9ab-7411-4303-891c-9e733976b93c.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e86d0b51-3a7e-42d0-b618-5d04b5b717cd", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1dcde9ab-7411-4303-891c-9e733976b93c", + "created": "2024-08-02T17:12:32.463427Z", + "modified": "2024-08-02T17:12:32.463427Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--da5fb984-37a6-4152-a078-e2af40c0844f", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1e683113-77cd-42f3-b19b-8eb033d82da2.json b/generated_files/DISARM_STIX/relationship/relationship--1e683113-77cd-42f3-b19b-8eb033d82da2.json new file mode 100644 index 0000000..c66864f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1e683113-77cd-42f3-b19b-8eb033d82da2.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--5cfdf832-a555-4284-98d1-93b7af429eb4", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1e683113-77cd-42f3-b19b-8eb033d82da2", + "created": "2024-08-02T17:12:32.470746Z", + "modified": "2024-08-02T17:12:32.470746Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--ee594da3-8999-481e-90b3-e8c2e965ae28", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1ea19ad6-4924-441c-97b2-9386ae1e66e7.json b/generated_files/DISARM_STIX/relationship/relationship--1ea19ad6-4924-441c-97b2-9386ae1e66e7.json new file mode 100644 index 0000000..285b6e6 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1ea19ad6-4924-441c-97b2-9386ae1e66e7.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0d38bd13-1eef-4b4a-afe8-572857d651ee", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ea19ad6-4924-441c-97b2-9386ae1e66e7", + "created": "2024-08-02T17:12:32.434902Z", + "modified": "2024-08-02T17:12:32.434902Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--b4ed63e5-e8db-4057-989b-3ff5ad8c000c", + "target_ref": "attack-pattern--ea788455-90c6-4f47-97b1-862d30ef7d12", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1ee6fbfa-b319-4bd7-9c35-daccb745cfe1.json b/generated_files/DISARM_STIX/relationship/relationship--1ee6fbfa-b319-4bd7-9c35-daccb745cfe1.json new file mode 100644 index 0000000..4a987f3 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1ee6fbfa-b319-4bd7-9c35-daccb745cfe1.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4500a40b-9698-4e37-b4be-2a2c999a8910", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1ee6fbfa-b319-4bd7-9c35-daccb745cfe1", + "created": "2024-08-02T17:12:32.442711Z", + "modified": "2024-08-02T17:12:32.442711Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e60f54a3-9972-43b8-8359-ee21d781acae", + "target_ref": "attack-pattern--5b6aaad5-7166-4321-ae82-b9300a2ddad7", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--1fe75ff3-bf65-434b-b7ef-9a9a158bc159.json b/generated_files/DISARM_STIX/relationship/relationship--1fe75ff3-bf65-434b-b7ef-9a9a158bc159.json new file mode 100644 index 0000000..82f0c18 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--1fe75ff3-bf65-434b-b7ef-9a9a158bc159.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--45d27005-628d-430e-98a7-0a823eb2461b", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--1fe75ff3-bf65-434b-b7ef-9a9a158bc159", + "created": "2024-08-02T17:12:32.472628Z", + "modified": "2024-08-02T17:12:32.472628Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--8958b87c-85fd-478f-ae01-8952c787d9b7", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--2231f705-2c4c-4593-9401-e05c124df454.json b/generated_files/DISARM_STIX/relationship/relationship--2231f705-2c4c-4593-9401-e05c124df454.json new file mode 100644 index 0000000..014f23f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--2231f705-2c4c-4593-9401-e05c124df454.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--3f438575-4085-40eb-a5ae-263381418a7a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2231f705-2c4c-4593-9401-e05c124df454", + "created": "2024-08-02T17:12:32.460362Z", + "modified": "2024-08-02T17:12:32.460362Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--651a5188-f38a-42be-a253-d1b90cbd28e1", + "target_ref": "attack-pattern--e22e3d7d-40fc-4a5e-8d6c-d528b9f78e8e", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--22858b0c-ab6e-448d-a9cf-d4eebc9d203b.json b/generated_files/DISARM_STIX/relationship/relationship--22858b0c-ab6e-448d-a9cf-d4eebc9d203b.json new file mode 100644 index 0000000..75750ad --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--22858b0c-ab6e-448d-a9cf-d4eebc9d203b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--bc846942-ee54-468a-b797-fcb86471afee", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--22858b0c-ab6e-448d-a9cf-d4eebc9d203b", + "created": "2024-08-02T17:12:32.44041Z", + "modified": "2024-08-02T17:12:32.44041Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e27cf6aa-69bc-434b-ac68-b0164d0b3421", + "target_ref": "attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--231df415-9e93-4fc9-9fc8-757b1d554717.json b/generated_files/DISARM_STIX/relationship/relationship--231df415-9e93-4fc9-9fc8-757b1d554717.json new file mode 100644 index 0000000..9316cd2 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--231df415-9e93-4fc9-9fc8-757b1d554717.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--ac1825f9-762a-4cd6-a7ae-ab63c21d14ab", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--231df415-9e93-4fc9-9fc8-757b1d554717", + "created": "2024-08-02T17:12:32.437615Z", + "modified": "2024-08-02T17:12:32.437615Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a468ff54-27eb-4e6d-b709-a9830017df86", + "target_ref": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--25921009-96dd-4dfd-99aa-2a5b5c564b75.json b/generated_files/DISARM_STIX/relationship/relationship--25921009-96dd-4dfd-99aa-2a5b5c564b75.json new file mode 100644 index 0000000..163d350 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--25921009-96dd-4dfd-99aa-2a5b5c564b75.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fb4d3be3-badc-4493-ac4c-05da2176023f", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--25921009-96dd-4dfd-99aa-2a5b5c564b75", + "created": "2024-08-02T17:12:32.471106Z", + "modified": "2024-08-02T17:12:32.471106Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--62eb26b8-d555-46a5-831d-c6b55909a9c4", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--25acdc48-2496-4c9f-96c9-e5e4f2a67a4f.json b/generated_files/DISARM_STIX/relationship/relationship--25acdc48-2496-4c9f-96c9-e5e4f2a67a4f.json new file mode 100644 index 0000000..52fb7b1 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--25acdc48-2496-4c9f-96c9-e5e4f2a67a4f.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--872f4e0e-6751-4103-8b9d-a1e95ce2ea51", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--25acdc48-2496-4c9f-96c9-e5e4f2a67a4f", + "created": "2024-08-02T17:12:32.472854Z", + "modified": "2024-08-02T17:12:32.472854Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--9e081185-12f4-41f0-8379-95b688e1d80f", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--26c6fa26-40a0-44e9-9ef4-58b04967882d.json b/generated_files/DISARM_STIX/relationship/relationship--26c6fa26-40a0-44e9-9ef4-58b04967882d.json new file mode 100644 index 0000000..33fce02 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--26c6fa26-40a0-44e9-9ef4-58b04967882d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--c805bee2-5e12-44a6-a591-4030a9549a0e", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26c6fa26-40a0-44e9-9ef4-58b04967882d", + "created": "2024-08-02T17:12:32.474548Z", + "modified": "2024-08-02T17:12:32.474548Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--8ac60812-17d7-4e9f-911e-64467233a9b3", + "target_ref": "attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--26ec708c-aa87-4b21-b26b-717a07144c82.json b/generated_files/DISARM_STIX/relationship/relationship--26ec708c-aa87-4b21-b26b-717a07144c82.json new file mode 100644 index 0000000..1ef72f5 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--26ec708c-aa87-4b21-b26b-717a07144c82.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--568ddbf0-4663-4712-a582-6c91240e1e00", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--26ec708c-aa87-4b21-b26b-717a07144c82", + "created": "2024-08-02T17:12:32.46013Z", + "modified": "2024-08-02T17:12:32.46013Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291", + "target_ref": "attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--29bd0f63-fc52-4e9a-a40f-b1e2dd529372.json b/generated_files/DISARM_STIX/relationship/relationship--29bd0f63-fc52-4e9a-a40f-b1e2dd529372.json new file mode 100644 index 0000000..604a22c --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--29bd0f63-fc52-4e9a-a40f-b1e2dd529372.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0318f76d-3f30-42f5-8ae9-097ceaeb51d9", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--29bd0f63-fc52-4e9a-a40f-b1e2dd529372", + "created": "2024-08-02T17:12:32.459327Z", + "modified": "2024-08-02T17:12:32.459327Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--ddc4a9e6-a371-4f16-91b6-c71139a154ce", + "target_ref": "attack-pattern--5e7541d8-2b43-4443-89d9-7362ca78944c", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--2bd9135a-f7c7-436e-a05a-ca5ff39d897c.json b/generated_files/DISARM_STIX/relationship/relationship--2bd9135a-f7c7-436e-a05a-ca5ff39d897c.json new file mode 100644 index 0000000..1eb3c1a --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--2bd9135a-f7c7-436e-a05a-ca5ff39d897c.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f22c4b3c-bac6-4be1-985e-76286dac4b7a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2bd9135a-f7c7-436e-a05a-ca5ff39d897c", + "created": "2024-08-02T17:12:32.475147Z", + "modified": "2024-08-02T17:12:32.475147Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d556b582-dd00-44d7-8c2f-74fb48c755fa", + "target_ref": "attack-pattern--729483ae-39cf-416e-8d38-da06f1fc5991", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--2d022115-b5d8-4210-8445-c7795cecd15b.json b/generated_files/DISARM_STIX/relationship/relationship--2d022115-b5d8-4210-8445-c7795cecd15b.json new file mode 100644 index 0000000..7d706cb --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--2d022115-b5d8-4210-8445-c7795cecd15b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--cb5f9c4d-2a05-456c-bb12-45a23eb601be", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--2d022115-b5d8-4210-8445-c7795cecd15b", + "created": "2024-08-02T17:12:32.442261Z", + "modified": "2024-08-02T17:12:32.442261Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc", + "target_ref": "attack-pattern--ce4a9eee-7437-43ce-ac86-c1921f5c01a7", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--3058a530-8d79-4261-a4f7-df1df8efad3b.json b/generated_files/DISARM_STIX/relationship/relationship--3058a530-8d79-4261-a4f7-df1df8efad3b.json new file mode 100644 index 0000000..83baced --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--3058a530-8d79-4261-a4f7-df1df8efad3b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--9f62579f-d4c4-496c-9983-b0121cc28766", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3058a530-8d79-4261-a4f7-df1df8efad3b", + "created": "2024-08-02T17:12:32.468507Z", + "modified": "2024-08-02T17:12:32.468507Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--cb324e3c-1041-4a26-9fa8-da45547b7dcc", + "target_ref": "attack-pattern--6aa772c8-f51f-428e-a7e5-2d69dd8d4add", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--31b07b2b-114a-4b48-b01e-cb434788ca3d.json b/generated_files/DISARM_STIX/relationship/relationship--31b07b2b-114a-4b48-b01e-cb434788ca3d.json new file mode 100644 index 0000000..041df94 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--31b07b2b-114a-4b48-b01e-cb434788ca3d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--b0bdedc7-66c4-45c9-a288-47b4b9a2b5b6", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--31b07b2b-114a-4b48-b01e-cb434788ca3d", + "created": "2024-08-02T17:12:32.452117Z", + "modified": "2024-08-02T17:12:32.452117Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a50d7269-9365-46f0-ba81-27964e422faa", + "target_ref": "attack-pattern--283333f5-e161-4195-9070-5a7c22505adf", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--34431358-ede6-4604-9d1f-324127534cea.json b/generated_files/DISARM_STIX/relationship/relationship--34431358-ede6-4604-9d1f-324127534cea.json new file mode 100644 index 0000000..ec41671 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--34431358-ede6-4604-9d1f-324127534cea.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--cf1911f9-b2cc-4f8e-8016-9a039a8d33cc", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--34431358-ede6-4604-9d1f-324127534cea", + "created": "2024-08-02T17:12:32.455178Z", + "modified": "2024-08-02T17:12:32.455178Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8", + "target_ref": "attack-pattern--6e525f48-d8d6-4484-8838-208eb00bd2a8", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--366c2e49-0ddb-4dc8-92fc-8eae364df624.json b/generated_files/DISARM_STIX/relationship/relationship--366c2e49-0ddb-4dc8-92fc-8eae364df624.json new file mode 100644 index 0000000..57d27d0 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--366c2e49-0ddb-4dc8-92fc-8eae364df624.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--5a2203b6-c2e1-424c-b20d-77975407d3b9", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--366c2e49-0ddb-4dc8-92fc-8eae364df624", + "created": "2024-08-02T17:12:32.449588Z", + "modified": "2024-08-02T17:12:32.449588Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--66e1a3b9-d837-4eaa-9cdf-900663a8708d", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--372e3ddd-2c5f-42b1-9440-516e4f6ef017.json b/generated_files/DISARM_STIX/relationship/relationship--372e3ddd-2c5f-42b1-9440-516e4f6ef017.json new file mode 100644 index 0000000..7d1c02e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--372e3ddd-2c5f-42b1-9440-516e4f6ef017.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--ff8cba12-246c-44bb-a1e9-3533437b5430", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--372e3ddd-2c5f-42b1-9440-516e4f6ef017", + "created": "2024-08-02T17:12:32.454346Z", + "modified": "2024-08-02T17:12:32.454346Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403", + "target_ref": "attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--3808e749-4ede-4084-805f-241913923417.json b/generated_files/DISARM_STIX/relationship/relationship--3808e749-4ede-4084-805f-241913923417.json new file mode 100644 index 0000000..ecf26cd --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--3808e749-4ede-4084-805f-241913923417.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--504434c0-24f4-46ce-80c0-bc177612e6b4", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3808e749-4ede-4084-805f-241913923417", + "created": "2024-08-02T17:12:32.465277Z", + "modified": "2024-08-02T17:12:32.465277Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c80ef7af-3f51-4be5-b42a-19d29ab40a53", + "target_ref": "attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--3829da40-4cbf-49eb-8917-8b43bcb536c9.json b/generated_files/DISARM_STIX/relationship/relationship--3829da40-4cbf-49eb-8917-8b43bcb536c9.json new file mode 100644 index 0000000..4816992 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--3829da40-4cbf-49eb-8917-8b43bcb536c9.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--ab012f99-bc19-42c4-b6cf-02f5a4f8542a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3829da40-4cbf-49eb-8917-8b43bcb536c9", + "created": "2024-08-02T17:12:32.460029Z", + "modified": "2024-08-02T17:12:32.460029Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5", + "target_ref": "attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--3a0f56b1-7ab6-4e1d-82b1-8d0deeb9bb07.json b/generated_files/DISARM_STIX/relationship/relationship--3a0f56b1-7ab6-4e1d-82b1-8d0deeb9bb07.json new file mode 100644 index 0000000..5a683cc --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--3a0f56b1-7ab6-4e1d-82b1-8d0deeb9bb07.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--924ffe69-4949-4f32-a572-ee3d94f2a957", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3a0f56b1-7ab6-4e1d-82b1-8d0deeb9bb07", + "created": "2024-08-02T17:12:32.463896Z", + "modified": "2024-08-02T17:12:32.463896Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--3c489170-87fc-4f62-92cc-6b885cb8d3b8.json b/generated_files/DISARM_STIX/relationship/relationship--3c489170-87fc-4f62-92cc-6b885cb8d3b8.json new file mode 100644 index 0000000..bbcff20 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--3c489170-87fc-4f62-92cc-6b885cb8d3b8.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--b2986c98-6b3b-4127-9d00-9d5009e7012d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3c489170-87fc-4f62-92cc-6b885cb8d3b8", + "created": "2024-08-02T17:12:32.436202Z", + "modified": "2024-08-02T17:12:32.436202Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--4282febe-c8a6-46da-863c-f19081615d80", + "target_ref": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--3db92cd4-5bcf-4e90-a76a-267239073948.json b/generated_files/DISARM_STIX/relationship/relationship--3db92cd4-5bcf-4e90-a76a-267239073948.json new file mode 100644 index 0000000..c8626b1 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--3db92cd4-5bcf-4e90-a76a-267239073948.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--6f406d25-6a6b-49ec-b171-d30952370d97", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3db92cd4-5bcf-4e90-a76a-267239073948", + "created": "2024-08-02T17:12:32.467786Z", + "modified": "2024-08-02T17:12:32.467786Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7fdc6b19-0d37-43a9-8144-f0c180a13ed0", + "target_ref": "attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--3fe97582-50f0-46d0-82e9-2599faef18f9.json b/generated_files/DISARM_STIX/relationship/relationship--3fe97582-50f0-46d0-82e9-2599faef18f9.json new file mode 100644 index 0000000..299a09b --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--3fe97582-50f0-46d0-82e9-2599faef18f9.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--a7135d5f-0082-498c-8a75-957d3c1e8524", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3fe97582-50f0-46d0-82e9-2599faef18f9", + "created": "2024-08-02T17:12:32.452951Z", + "modified": "2024-08-02T17:12:32.452951Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--bb25b4aa-9223-40ea-a28a-0dd675e91e46", + "target_ref": "attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--3ff580e2-f3ef-496d-b112-b46d3dcd6fca.json b/generated_files/DISARM_STIX/relationship/relationship--3ff580e2-f3ef-496d-b112-b46d3dcd6fca.json new file mode 100644 index 0000000..479c796 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--3ff580e2-f3ef-496d-b112-b46d3dcd6fca.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--c9299463-d3ca-46b5-98e6-5298a573b38c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--3ff580e2-f3ef-496d-b112-b46d3dcd6fca", + "created": "2024-08-02T17:12:32.468055Z", + "modified": "2024-08-02T17:12:32.468055Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c", + "target_ref": "attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--40c2086c-389d-4197-b712-54223ddc9a0a.json b/generated_files/DISARM_STIX/relationship/relationship--40c2086c-389d-4197-b712-54223ddc9a0a.json new file mode 100644 index 0000000..80b8990 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--40c2086c-389d-4197-b712-54223ddc9a0a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4d51d708-1cdd-44b1-ab14-8b094586c30f", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--40c2086c-389d-4197-b712-54223ddc9a0a", + "created": "2024-08-02T17:12:32.436333Z", + "modified": "2024-08-02T17:12:32.436333Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--ce5b400c-6f82-4095-936b-617857800da8", + "target_ref": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--4180b276-b34f-4965-b31d-56a3e7f77a94.json b/generated_files/DISARM_STIX/relationship/relationship--4180b276-b34f-4965-b31d-56a3e7f77a94.json new file mode 100644 index 0000000..fe9a48f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--4180b276-b34f-4965-b31d-56a3e7f77a94.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--b4815167-3151-42a6-84b5-1825b1cd036c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4180b276-b34f-4965-b31d-56a3e7f77a94", + "created": "2024-08-02T17:12:32.451376Z", + "modified": "2024-08-02T17:12:32.451376Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--422b6ba9-3ad0-4e6f-9f00-b044e5d657a1", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--41e95a18-7fa8-436e-b74c-194ca81ac126.json b/generated_files/DISARM_STIX/relationship/relationship--41e95a18-7fa8-436e-b74c-194ca81ac126.json new file mode 100644 index 0000000..ed46827 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--41e95a18-7fa8-436e-b74c-194ca81ac126.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--3c4a0c05-9f6c-4045-b949-3054b7b17b39", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--41e95a18-7fa8-436e-b74c-194ca81ac126", + "created": "2024-08-02T17:12:32.435934Z", + "modified": "2024-08-02T17:12:32.435934Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--bfce790b-dfd6-46ca-8fab-c2d72f21bba2", + "target_ref": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--42839b24-556c-4f42-a29c-2a52f5938b5e.json b/generated_files/DISARM_STIX/relationship/relationship--42839b24-556c-4f42-a29c-2a52f5938b5e.json new file mode 100644 index 0000000..a5aaa4d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--42839b24-556c-4f42-a29c-2a52f5938b5e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fe524cc3-5368-491c-979d-6adfd530ac6b", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--42839b24-556c-4f42-a29c-2a52f5938b5e", + "created": "2024-08-02T17:12:32.459557Z", + "modified": "2024-08-02T17:12:32.459557Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--89b88c22-0686-4d28-9c2b-e0c6ac31a4ab", + "target_ref": "attack-pattern--7e3a06ee-c109-4901-8720-69c46fe04a76", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--43c952d0-443f-4e6a-9f2a-547d69a05494.json b/generated_files/DISARM_STIX/relationship/relationship--43c952d0-443f-4e6a-9f2a-547d69a05494.json new file mode 100644 index 0000000..8d33f66 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--43c952d0-443f-4e6a-9f2a-547d69a05494.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--008367b4-69eb-4365-a623-6eaa3294cf85", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43c952d0-443f-4e6a-9f2a-547d69a05494", + "created": "2024-08-02T17:12:32.478031Z", + "modified": "2024-08-02T17:12:32.478031Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--0e605049-ac7a-46a9-bbac-ef0a69e160cb", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--43d3f1aa-dce6-41c5-901f-340c33150299.json b/generated_files/DISARM_STIX/relationship/relationship--43d3f1aa-dce6-41c5-901f-340c33150299.json new file mode 100644 index 0000000..0da3a1f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--43d3f1aa-dce6-41c5-901f-340c33150299.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0052d047-f100-48bf-b094-82650b2889cf", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--43d3f1aa-dce6-41c5-901f-340c33150299", + "created": "2024-08-02T17:12:32.464398Z", + "modified": "2024-08-02T17:12:32.464398Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--dd415f9d-ce3a-44c6-9237-f8ceeb52a6a3", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--460f1b43-0951-44fb-8735-e6e68d3c14ac.json b/generated_files/DISARM_STIX/relationship/relationship--460f1b43-0951-44fb-8735-e6e68d3c14ac.json new file mode 100644 index 0000000..359b7e0 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--460f1b43-0951-44fb-8735-e6e68d3c14ac.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4160aca1-9f54-4e53-92ba-39496d1285d5", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--460f1b43-0951-44fb-8735-e6e68d3c14ac", + "created": "2024-08-02T17:12:32.452605Z", + "modified": "2024-08-02T17:12:32.452605Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--9b081fd3-0714-483e-bd7b-a30defc85cd2", + "target_ref": "attack-pattern--283333f5-e161-4195-9070-5a7c22505adf", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--4717c1e4-c6f6-426b-8d4b-38cb5f03b47c.json b/generated_files/DISARM_STIX/relationship/relationship--4717c1e4-c6f6-426b-8d4b-38cb5f03b47c.json new file mode 100644 index 0000000..bfe2907 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--4717c1e4-c6f6-426b-8d4b-38cb5f03b47c.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--deda250d-3d0c-4917-905a-147824a8eaed", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4717c1e4-c6f6-426b-8d4b-38cb5f03b47c", + "created": "2024-08-02T17:12:32.45405Z", + "modified": "2024-08-02T17:12:32.45405Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7f338181-2e4b-435b-a190-7044f3867aa3", + "target_ref": "attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--489c49a3-53da-4808-989b-950f8f78e447.json b/generated_files/DISARM_STIX/relationship/relationship--489c49a3-53da-4808-989b-950f8f78e447.json new file mode 100644 index 0000000..1ef166a --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--489c49a3-53da-4808-989b-950f8f78e447.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--1a5757c0-bea5-4231-9466-7081bef5d28e", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--489c49a3-53da-4808-989b-950f8f78e447", + "created": "2024-08-02T17:12:32.435402Z", + "modified": "2024-08-02T17:12:32.435402Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9", + "target_ref": "attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--4959f9bd-1a2c-41d4-b43e-b4669166cd7e.json b/generated_files/DISARM_STIX/relationship/relationship--4959f9bd-1a2c-41d4-b43e-b4669166cd7e.json new file mode 100644 index 0000000..78bf652 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--4959f9bd-1a2c-41d4-b43e-b4669166cd7e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--1dc6e478-8670-41cc-bc2b-69d5f1adac9d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4959f9bd-1a2c-41d4-b43e-b4669166cd7e", + "created": "2024-08-02T17:12:32.469728Z", + "modified": "2024-08-02T17:12:32.469728Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--69f4e3bb-a587-468a-8a0c-31f9acd931b6", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--4d03e4b6-29ab-42ca-b342-e17eda61d6e2.json b/generated_files/DISARM_STIX/relationship/relationship--4d03e4b6-29ab-42ca-b342-e17eda61d6e2.json new file mode 100644 index 0000000..06fbe6e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--4d03e4b6-29ab-42ca-b342-e17eda61d6e2.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--73725eac-60dd-4c91-ae4a-c79b3ef6df92", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4d03e4b6-29ab-42ca-b342-e17eda61d6e2", + "created": "2024-08-02T17:12:32.462647Z", + "modified": "2024-08-02T17:12:32.462647Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3437993c-c521-4145-a2d8-b860399876b0", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--4d311002-0910-4439-85a0-fe9d68b8f340.json b/generated_files/DISARM_STIX/relationship/relationship--4d311002-0910-4439-85a0-fe9d68b8f340.json new file mode 100644 index 0000000..a9973f9 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--4d311002-0910-4439-85a0-fe9d68b8f340.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f6a18afc-7aff-459e-b683-5fb5f125b689", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4d311002-0910-4439-85a0-fe9d68b8f340", + "created": "2024-08-02T17:12:32.451602Z", + "modified": "2024-08-02T17:12:32.451602Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e0f07568-5a2b-429d-94b9-b1ff3c17adea", + "target_ref": "attack-pattern--6db47704-ba87-402d-933a-de90f5aa8965", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--4df27b00-6e56-4499-a6c5-1c40b4a14c93.json b/generated_files/DISARM_STIX/relationship/relationship--4df27b00-6e56-4499-a6c5-1c40b4a14c93.json new file mode 100644 index 0000000..9a81205 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--4df27b00-6e56-4499-a6c5-1c40b4a14c93.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e038a03a-5307-4cb6-839a-6b93978073b2", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4df27b00-6e56-4499-a6c5-1c40b4a14c93", + "created": "2024-08-02T17:12:32.466831Z", + "modified": "2024-08-02T17:12:32.466831Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c25ad637-cfa5-40c0-a23c-f741d8f4319e", + "target_ref": "attack-pattern--c171dd41-42d0-45c2-806e-3cb518ba0357", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--4ed2403c-2e03-43b8-9455-2b5a2afc0db8.json b/generated_files/DISARM_STIX/relationship/relationship--4ed2403c-2e03-43b8-9455-2b5a2afc0db8.json new file mode 100644 index 0000000..0b70c7c --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--4ed2403c-2e03-43b8-9455-2b5a2afc0db8.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--770ac453-406d-4385-a06b-c371868b33b4", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4ed2403c-2e03-43b8-9455-2b5a2afc0db8", + "created": "2024-08-02T17:12:32.466224Z", + "modified": "2024-08-02T17:12:32.466224Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--83b4e2db-265f-4f88-9b35-26df05c561e9", + "target_ref": "attack-pattern--c171dd41-42d0-45c2-806e-3cb518ba0357", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--4f1c76d7-af06-4408-aa06-f50dfd5c0ea6.json b/generated_files/DISARM_STIX/relationship/relationship--4f1c76d7-af06-4408-aa06-f50dfd5c0ea6.json new file mode 100644 index 0000000..d0872c7 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--4f1c76d7-af06-4408-aa06-f50dfd5c0ea6.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4c082213-4e9b-4f7a-87bc-2d2a9db4187f", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--4f1c76d7-af06-4408-aa06-f50dfd5c0ea6", + "created": "2024-08-02T17:12:32.455657Z", + "modified": "2024-08-02T17:12:32.455657Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--eb66afed-6c29-4947-a422-c380c5caeda5", + "target_ref": "attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--503103ed-f83c-4b98-a260-270085e23f89.json b/generated_files/DISARM_STIX/relationship/relationship--503103ed-f83c-4b98-a260-270085e23f89.json new file mode 100644 index 0000000..5ba8fcf --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--503103ed-f83c-4b98-a260-270085e23f89.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--9e128f63-e48b-4576-9858-189c7c15342d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--503103ed-f83c-4b98-a260-270085e23f89", + "created": "2024-08-02T17:12:32.459926Z", + "modified": "2024-08-02T17:12:32.459926Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--9b667c6e-5bc3-4c1e-b114-6f679a662b5d", + "target_ref": "attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--514b9655-3393-4d9a-ba7f-661845a7a3e2.json b/generated_files/DISARM_STIX/relationship/relationship--514b9655-3393-4d9a-ba7f-661845a7a3e2.json new file mode 100644 index 0000000..5a6b8a7 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--514b9655-3393-4d9a-ba7f-661845a7a3e2.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--60328be5-e989-4e5a-9ac5-7e784342fcd7", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--514b9655-3393-4d9a-ba7f-661845a7a3e2", + "created": "2024-08-02T17:12:32.443738Z", + "modified": "2024-08-02T17:12:32.443738Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1", + "target_ref": "attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--51717459-dc66-4c95-916f-b562336b1e3d.json b/generated_files/DISARM_STIX/relationship/relationship--51717459-dc66-4c95-916f-b562336b1e3d.json new file mode 100644 index 0000000..3cf9ae1 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--51717459-dc66-4c95-916f-b562336b1e3d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--553c23e3-ac8b-4a09-836c-63251500e225", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--51717459-dc66-4c95-916f-b562336b1e3d", + "created": "2024-08-02T17:12:32.47575Z", + "modified": "2024-08-02T17:12:32.47575Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--f328541f-2537-4db7-8a05-1c76ed26d3eb", + "target_ref": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--51964223-9b30-45fe-935e-56993ca644b5.json b/generated_files/DISARM_STIX/relationship/relationship--51964223-9b30-45fe-935e-56993ca644b5.json new file mode 100644 index 0000000..a561192 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--51964223-9b30-45fe-935e-56993ca644b5.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--127b6010-a62c-4d09-a865-e30fb573982d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--51964223-9b30-45fe-935e-56993ca644b5", + "created": "2024-08-02T17:12:32.443461Z", + "modified": "2024-08-02T17:12:32.443461Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea", + "target_ref": "attack-pattern--8c7832cb-8877-4f54-8e05-7e6df9a3d2b4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--542dfa94-5bb2-43b0-af29-d5f0e8c3954d.json b/generated_files/DISARM_STIX/relationship/relationship--542dfa94-5bb2-43b0-af29-d5f0e8c3954d.json new file mode 100644 index 0000000..fc26d24 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--542dfa94-5bb2-43b0-af29-d5f0e8c3954d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--5da897d5-eff2-484b-9542-88648f189d58", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--542dfa94-5bb2-43b0-af29-d5f0e8c3954d", + "created": "2024-08-02T17:12:32.461324Z", + "modified": "2024-08-02T17:12:32.461324Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--78cf4cd6-a8a0-408f-a5e8-d6f1491aace8", + "target_ref": "attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--5479dcea-be91-4714-8446-46a5ab4a0da9.json b/generated_files/DISARM_STIX/relationship/relationship--5479dcea-be91-4714-8446-46a5ab4a0da9.json new file mode 100644 index 0000000..c3d723e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--5479dcea-be91-4714-8446-46a5ab4a0da9.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--bdf18608-ceba-456e-8740-b3dacb9f8f5c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5479dcea-be91-4714-8446-46a5ab4a0da9", + "created": "2024-08-02T17:12:32.443274Z", + "modified": "2024-08-02T17:12:32.443274Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--ec8424e6-c7de-4543-b943-f0c4cc9ac63d", + "target_ref": "attack-pattern--8c7832cb-8877-4f54-8e05-7e6df9a3d2b4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--54c1cbd7-5e99-4911-be1b-ec708f309367.json b/generated_files/DISARM_STIX/relationship/relationship--54c1cbd7-5e99-4911-be1b-ec708f309367.json new file mode 100644 index 0000000..651afb3 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--54c1cbd7-5e99-4911-be1b-ec708f309367.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--9b46eac2-d3a1-4348-a5cf-efda7c368173", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--54c1cbd7-5e99-4911-be1b-ec708f309367", + "created": "2024-08-02T17:12:32.436461Z", + "modified": "2024-08-02T17:12:32.436461Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69", + "target_ref": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--57f8fb9d-bf8c-4de6-b4f2-d8d1f6c78378.json b/generated_files/DISARM_STIX/relationship/relationship--57f8fb9d-bf8c-4de6-b4f2-d8d1f6c78378.json new file mode 100644 index 0000000..3ec61d2 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--57f8fb9d-bf8c-4de6-b4f2-d8d1f6c78378.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--22e95f5e-c15c-4268-94f4-e0eec22fb428", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--57f8fb9d-bf8c-4de6-b4f2-d8d1f6c78378", + "created": "2024-08-02T17:12:32.440532Z", + "modified": "2024-08-02T17:12:32.440532Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03", + "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--583e9ab6-d417-41dd-874e-9f7ba16d990d.json b/generated_files/DISARM_STIX/relationship/relationship--583e9ab6-d417-41dd-874e-9f7ba16d990d.json new file mode 100644 index 0000000..be8e267 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--583e9ab6-d417-41dd-874e-9f7ba16d990d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--a955853b-1581-40fe-9432-9c3b7faf327a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--583e9ab6-d417-41dd-874e-9f7ba16d990d", + "created": "2024-08-02T17:12:32.449979Z", + "modified": "2024-08-02T17:12:32.449979Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a5ef7a55-8c38-4210-ad39-ccb22c9dd70c", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--5a176546-96f2-4ecf-bc9d-ea243cf76794.json b/generated_files/DISARM_STIX/relationship/relationship--5a176546-96f2-4ecf-bc9d-ea243cf76794.json new file mode 100644 index 0000000..fc609fc --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--5a176546-96f2-4ecf-bc9d-ea243cf76794.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--35db783a-bcb6-4dc3-9c48-209b6236f15f", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5a176546-96f2-4ecf-bc9d-ea243cf76794", + "created": "2024-08-02T17:12:32.439912Z", + "modified": "2024-08-02T17:12:32.439912Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--bb8da71f-108a-4c46-a1ef-d24ef1c8a661", + "target_ref": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--5acbd3da-5562-479f-be24-aec1313cbbdf.json b/generated_files/DISARM_STIX/relationship/relationship--5acbd3da-5562-479f-be24-aec1313cbbdf.json new file mode 100644 index 0000000..29ed0f9 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--5acbd3da-5562-479f-be24-aec1313cbbdf.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--a45c1d41-d92d-45c1-a436-c2afe8727c3e", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5acbd3da-5562-479f-be24-aec1313cbbdf", + "created": "2024-08-02T17:12:32.47371Z", + "modified": "2024-08-02T17:12:32.47371Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--29a3ec78-469a-43b8-b0ae-9f34c58316f2", + "target_ref": "attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--5ae50051-9941-497b-8b5b-f02658ee7751.json b/generated_files/DISARM_STIX/relationship/relationship--5ae50051-9941-497b-8b5b-f02658ee7751.json new file mode 100644 index 0000000..98ba5de --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--5ae50051-9941-497b-8b5b-f02658ee7751.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--9a598692-fe22-4dfb-a79a-235079f8a2a4", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5ae50051-9941-497b-8b5b-f02658ee7751", + "created": "2024-08-02T17:12:32.440162Z", + "modified": "2024-08-02T17:12:32.440162Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a3fe7752-dbfa-4918-912f-c492c8593c68", + "target_ref": "attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--5ea0820e-aa71-42f7-8b18-7c6aa56e32be.json b/generated_files/DISARM_STIX/relationship/relationship--5ea0820e-aa71-42f7-8b18-7c6aa56e32be.json new file mode 100644 index 0000000..0fb955d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--5ea0820e-aa71-42f7-8b18-7c6aa56e32be.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--7afdfd9a-d1ac-4ca3-8549-35f5b42e13dd", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5ea0820e-aa71-42f7-8b18-7c6aa56e32be", + "created": "2024-08-02T17:12:32.448161Z", + "modified": "2024-08-02T17:12:32.448161Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--976faac5-b7e1-4a1d-b52f-4878109e2dc9", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--5eeb73b2-67a1-4088-91ee-a84e29a7a773.json b/generated_files/DISARM_STIX/relationship/relationship--5eeb73b2-67a1-4088-91ee-a84e29a7a773.json new file mode 100644 index 0000000..ea4ae54 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--5eeb73b2-67a1-4088-91ee-a84e29a7a773.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fd1d63af-d9b0-4111-8692-4fffc1475302", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--5eeb73b2-67a1-4088-91ee-a84e29a7a773", + "created": "2024-08-02T17:12:32.435846Z", + "modified": "2024-08-02T17:12:32.435846Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635", + "target_ref": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--60337241-9131-42f0-a515-dc6bd082a52a.json b/generated_files/DISARM_STIX/relationship/relationship--60337241-9131-42f0-a515-dc6bd082a52a.json new file mode 100644 index 0000000..460033d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--60337241-9131-42f0-a515-dc6bd082a52a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fbcfbd02-6de4-407a-8afd-b8be0d43ca5c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--60337241-9131-42f0-a515-dc6bd082a52a", + "created": "2024-08-02T17:12:32.45812Z", + "modified": "2024-08-02T17:12:32.45812Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe", + "target_ref": "attack-pattern--872f0dc3-202e-4e9a-a4fc-0457252aecae", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6414fc2a-27cd-4e7b-9bea-9a8a38ad8e1c.json b/generated_files/DISARM_STIX/relationship/relationship--6414fc2a-27cd-4e7b-9bea-9a8a38ad8e1c.json new file mode 100644 index 0000000..c5a6017 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6414fc2a-27cd-4e7b-9bea-9a8a38ad8e1c.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--9c6b849c-c4a0-4d82-bc35-fb960b1be800", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6414fc2a-27cd-4e7b-9bea-9a8a38ad8e1c", + "created": "2024-08-02T17:12:32.474341Z", + "modified": "2024-08-02T17:12:32.474341Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5af23f8e-38df-48c6-b832-6f4589cd2590", + "target_ref": "attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6418791d-7823-4b45-ae87-4c2991b9993e.json b/generated_files/DISARM_STIX/relationship/relationship--6418791d-7823-4b45-ae87-4c2991b9993e.json new file mode 100644 index 0000000..7544df3 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6418791d-7823-4b45-ae87-4c2991b9993e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0bded14c-1eaf-4b01-8b68-c8ec41e92b05", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6418791d-7823-4b45-ae87-4c2991b9993e", + "created": "2024-08-02T17:12:32.449333Z", + "modified": "2024-08-02T17:12:32.449333Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--fa4e9051-46d7-45b4-a65b-9376b003ad2a", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6498a6ab-a2c2-408c-8cd9-8ff9fe935a48.json b/generated_files/DISARM_STIX/relationship/relationship--6498a6ab-a2c2-408c-8cd9-8ff9fe935a48.json new file mode 100644 index 0000000..c605272 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6498a6ab-a2c2-408c-8cd9-8ff9fe935a48.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0b545201-dfcc-4807-b4a7-1b37af0ecba1", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6498a6ab-a2c2-408c-8cd9-8ff9fe935a48", + "created": "2024-08-02T17:12:32.435224Z", + "modified": "2024-08-02T17:12:32.435224Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--84e0fdf7-3bba-4e66-a575-6a32a7f8eca6", + "target_ref": "attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6724659f-25b2-4eba-85fc-7bdf9629cbe4.json b/generated_files/DISARM_STIX/relationship/relationship--6724659f-25b2-4eba-85fc-7bdf9629cbe4.json new file mode 100644 index 0000000..7aabf60 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6724659f-25b2-4eba-85fc-7bdf9629cbe4.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--861a6860-5a4c-4d93-9cbb-0eb23b09214c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6724659f-25b2-4eba-85fc-7bdf9629cbe4", + "created": "2024-08-02T17:12:32.449773Z", + "modified": "2024-08-02T17:12:32.449773Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--63ed1a5a-835e-4a51-9b95-0f0525a95186", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--67d540af-a1e0-40c2-a51b-6af5dbaca337.json b/generated_files/DISARM_STIX/relationship/relationship--67d540af-a1e0-40c2-a51b-6af5dbaca337.json new file mode 100644 index 0000000..3ace19d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--67d540af-a1e0-40c2-a51b-6af5dbaca337.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--91785209-6f31-4a04-a676-71acbba5f9a4", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--67d540af-a1e0-40c2-a51b-6af5dbaca337", + "created": "2024-08-02T17:12:32.440862Z", + "modified": "2024-08-02T17:12:32.440862Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--9f99239e-f22e-4db4-9681-c20e511b4c35", + "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6827b732-0761-4c26-8abb-276ac10b38b4.json b/generated_files/DISARM_STIX/relationship/relationship--6827b732-0761-4c26-8abb-276ac10b38b4.json new file mode 100644 index 0000000..6035df9 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6827b732-0761-4c26-8abb-276ac10b38b4.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--30486191-b224-4221-a3eb-baa84cc69776", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6827b732-0761-4c26-8abb-276ac10b38b4", + "created": "2024-08-02T17:12:32.476928Z", + "modified": "2024-08-02T17:12:32.476928Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c060ec87-d4d7-4de0-9f1d-9a9a42c05446", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--68c1601b-19f0-479f-a455-4c1835c7b207.json b/generated_files/DISARM_STIX/relationship/relationship--68c1601b-19f0-479f-a455-4c1835c7b207.json new file mode 100644 index 0000000..b9b224f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--68c1601b-19f0-479f-a455-4c1835c7b207.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fea7029e-15a8-4c33-b42b-bf740374711b", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--68c1601b-19f0-479f-a455-4c1835c7b207", + "created": "2024-08-02T17:12:32.448775Z", + "modified": "2024-08-02T17:12:32.448775Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e4ea9ed6-b158-4cdc-95c2-749383d2a388", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--69279f8c-7c9f-4b63-a225-4989299f3e73.json b/generated_files/DISARM_STIX/relationship/relationship--69279f8c-7c9f-4b63-a225-4989299f3e73.json new file mode 100644 index 0000000..4544d75 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--69279f8c-7c9f-4b63-a225-4989299f3e73.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e6196631-eafe-40c8-b03a-7a06b38d71c3", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--69279f8c-7c9f-4b63-a225-4989299f3e73", + "created": "2024-08-02T17:12:32.477134Z", + "modified": "2024-08-02T17:12:32.477134Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--8314b253-72a3-46c0-8ee5-6fa02aa9a8fa", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6b46663a-a2da-4e4b-b3f7-cf5386126af4.json b/generated_files/DISARM_STIX/relationship/relationship--6b46663a-a2da-4e4b-b3f7-cf5386126af4.json new file mode 100644 index 0000000..f454fbe --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6b46663a-a2da-4e4b-b3f7-cf5386126af4.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--d28565e3-31d5-4d44-95de-f39396b8cf12", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b46663a-a2da-4e4b-b3f7-cf5386126af4", + "created": "2024-08-02T17:12:32.43672Z", + "modified": "2024-08-02T17:12:32.43672Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3a2f96fa-c3d0-4f54-a041-6807f0ea4955", + "target_ref": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6b9a11bb-a632-4459-ab38-7f72563b7c2a.json b/generated_files/DISARM_STIX/relationship/relationship--6b9a11bb-a632-4459-ab38-7f72563b7c2a.json new file mode 100644 index 0000000..ebc9631 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6b9a11bb-a632-4459-ab38-7f72563b7c2a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--1c1ab8d1-d9c2-4595-ad4e-4b40ddcd635a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6b9a11bb-a632-4459-ab38-7f72563b7c2a", + "created": "2024-08-02T17:12:32.434701Z", + "modified": "2024-08-02T17:12:32.434701Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e0b7c795-eae2-4494-a3c9-52bc68c6df06", + "target_ref": "attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6bd2ab8c-5f5e-44f1-9b26-8d698a33de04.json b/generated_files/DISARM_STIX/relationship/relationship--6bd2ab8c-5f5e-44f1-9b26-8d698a33de04.json new file mode 100644 index 0000000..6524c3f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6bd2ab8c-5f5e-44f1-9b26-8d698a33de04.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--af451f8c-c88e-4a89-b0fe-a3271dfb8b01", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6bd2ab8c-5f5e-44f1-9b26-8d698a33de04", + "created": "2024-08-02T17:12:32.43946Z", + "modified": "2024-08-02T17:12:32.43946Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d13ff5af-16fd-4b32-8e14-f2e0980c15fb", + "target_ref": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6d708051-2b92-4655-a8da-1741b308a91b.json b/generated_files/DISARM_STIX/relationship/relationship--6d708051-2b92-4655-a8da-1741b308a91b.json new file mode 100644 index 0000000..4494016 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6d708051-2b92-4655-a8da-1741b308a91b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f95d3771-8638-47c9-808a-7f18e093865a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6d708051-2b92-4655-a8da-1741b308a91b", + "created": "2024-08-02T17:12:32.476712Z", + "modified": "2024-08-02T17:12:32.476712Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3b7dd3e2-ff22-4b4b-813e-c31c2fb68029", + "target_ref": "attack-pattern--0c2c22ae-5115-4b91-9e0f-08259e6aad99", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6ee18aa7-5408-46a0-a780-c584b58f6528.json b/generated_files/DISARM_STIX/relationship/relationship--6ee18aa7-5408-46a0-a780-c584b58f6528.json new file mode 100644 index 0000000..d01354f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6ee18aa7-5408-46a0-a780-c584b58f6528.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--925d7a29-d520-46c5-9eb2-24e0bd2d32fa", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6ee18aa7-5408-46a0-a780-c584b58f6528", + "created": "2024-08-02T17:12:32.468798Z", + "modified": "2024-08-02T17:12:32.468798Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--16583ab1-7dae-470c-8bd1-b7ffa1f9b13f", + "target_ref": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--6f60ad1a-a99c-4fb5-b01a-81338c4b25af.json b/generated_files/DISARM_STIX/relationship/relationship--6f60ad1a-a99c-4fb5-b01a-81338c4b25af.json new file mode 100644 index 0000000..6e40f64 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--6f60ad1a-a99c-4fb5-b01a-81338c4b25af.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--493623e3-50ed-473e-a94c-8b9af3b89870", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--6f60ad1a-a99c-4fb5-b01a-81338c4b25af", + "created": "2024-08-02T17:12:32.451169Z", + "modified": "2024-08-02T17:12:32.451169Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--f99e6f94-8c7d-42d7-8343-8d959643f721", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--70d5245c-4930-4bfe-b58a-e73776bdd926.json b/generated_files/DISARM_STIX/relationship/relationship--70d5245c-4930-4bfe-b58a-e73776bdd926.json new file mode 100644 index 0000000..0b229d5 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--70d5245c-4930-4bfe-b58a-e73776bdd926.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--7c252425-2328-4a48-8ba2-d911b627e66b", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--70d5245c-4930-4bfe-b58a-e73776bdd926", + "created": "2024-08-02T17:12:32.439281Z", + "modified": "2024-08-02T17:12:32.439281Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648", + "target_ref": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--726afd71-b106-4593-b582-82964b359a88.json b/generated_files/DISARM_STIX/relationship/relationship--726afd71-b106-4593-b582-82964b359a88.json new file mode 100644 index 0000000..342bec7 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--726afd71-b106-4593-b582-82964b359a88.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--70c1505a-7456-46e6-b6d9-f8cbf832507b", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--726afd71-b106-4593-b582-82964b359a88", + "created": "2024-08-02T17:12:32.436057Z", + "modified": "2024-08-02T17:12:32.436057Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e6ab2793-a059-4354-bb60-045afb019833", + "target_ref": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--72abdeaa-c07b-409e-95d0-59de32dbb194.json b/generated_files/DISARM_STIX/relationship/relationship--72abdeaa-c07b-409e-95d0-59de32dbb194.json new file mode 100644 index 0000000..eebf18e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--72abdeaa-c07b-409e-95d0-59de32dbb194.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--c9b6e826-68f5-43c1-a750-c5cf28d4aef1", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--72abdeaa-c07b-409e-95d0-59de32dbb194", + "created": "2024-08-02T17:12:32.450166Z", + "modified": "2024-08-02T17:12:32.450166Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--72268aef-baf4-4606-a3ba-837950a54f52", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--771a6483-9bf3-48c8-b72c-dfa85a0a3350.json b/generated_files/DISARM_STIX/relationship/relationship--771a6483-9bf3-48c8-b72c-dfa85a0a3350.json new file mode 100644 index 0000000..78b071e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--771a6483-9bf3-48c8-b72c-dfa85a0a3350.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4b087519-79a4-43ad-902b-1375517e75bc", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--771a6483-9bf3-48c8-b72c-dfa85a0a3350", + "created": "2024-08-02T17:12:32.436592Z", + "modified": "2024-08-02T17:12:32.436592Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--cec91e97-76c8-4a1f-8397-a06939a558ef", + "target_ref": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--77329110-1e86-4d38-a361-15594db7fa7a.json b/generated_files/DISARM_STIX/relationship/relationship--77329110-1e86-4d38-a361-15594db7fa7a.json new file mode 100644 index 0000000..9065f6d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--77329110-1e86-4d38-a361-15594db7fa7a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--de8446d0-2c8c-4703-b342-812de6e2346b", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--77329110-1e86-4d38-a361-15594db7fa7a", + "created": "2024-08-02T17:12:32.439194Z", + "modified": "2024-08-02T17:12:32.439194Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157", + "target_ref": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--78552f8c-0fca-4561-a189-f9d643315fec.json b/generated_files/DISARM_STIX/relationship/relationship--78552f8c-0fca-4561-a189-f9d643315fec.json new file mode 100644 index 0000000..26e3be7 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--78552f8c-0fca-4561-a189-f9d643315fec.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--8fec5f0a-3273-4273-bbcb-381098dc4c7c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--78552f8c-0fca-4561-a189-f9d643315fec", + "created": "2024-08-02T17:12:32.444844Z", + "modified": "2024-08-02T17:12:32.444844Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--fe5cf0f2-3792-4cab-b546-a9af7a5aa319", + "target_ref": "attack-pattern--9a4a16c5-a671-4469-a854-ef45cb0e38ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--79fe1a67-0d97-4b57-9e15-2e25c9d4d0ea.json b/generated_files/DISARM_STIX/relationship/relationship--79fe1a67-0d97-4b57-9e15-2e25c9d4d0ea.json new file mode 100644 index 0000000..7018388 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--79fe1a67-0d97-4b57-9e15-2e25c9d4d0ea.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f7bd83a5-bb94-4f21-b912-62834685a8cd", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--79fe1a67-0d97-4b57-9e15-2e25c9d4d0ea", + "created": "2024-08-02T17:12:32.466613Z", + "modified": "2024-08-02T17:12:32.466613Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5dc224b1-c69e-496d-91f7-e8ce4fd3f166", + "target_ref": "attack-pattern--c171dd41-42d0-45c2-806e-3cb518ba0357", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--7b1f0b13-f4d8-4114-a647-fb023aabcd9e.json b/generated_files/DISARM_STIX/relationship/relationship--7b1f0b13-f4d8-4114-a647-fb023aabcd9e.json new file mode 100644 index 0000000..ff73b37 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--7b1f0b13-f4d8-4114-a647-fb023aabcd9e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--b6a951e0-b931-4ff5-a660-240a3e0e2908", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7b1f0b13-f4d8-4114-a647-fb023aabcd9e", + "created": "2024-08-02T17:12:32.439565Z", + "modified": "2024-08-02T17:12:32.439565Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--625fe1a6-ee9d-45c8-9912-9e9f6e87dc85", + "target_ref": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--7d00a61b-5c71-4554-9ca6-7b0f3e48dd79.json b/generated_files/DISARM_STIX/relationship/relationship--7d00a61b-5c71-4554-9ca6-7b0f3e48dd79.json new file mode 100644 index 0000000..c7bcd26 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--7d00a61b-5c71-4554-9ca6-7b0f3e48dd79.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--c15d3ee3-b59e-49ac-8ec4-3a4b575263f9", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7d00a61b-5c71-4554-9ca6-7b0f3e48dd79", + "created": "2024-08-02T17:12:32.441892Z", + "modified": "2024-08-02T17:12:32.441892Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e4ad5ad8-f52d-48a0-8fce-33157f885a3e", + "target_ref": "attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--7d7ef4ca-2567-48ff-ba3a-43cae1860a5e.json b/generated_files/DISARM_STIX/relationship/relationship--7d7ef4ca-2567-48ff-ba3a-43cae1860a5e.json new file mode 100644 index 0000000..de1e27f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--7d7ef4ca-2567-48ff-ba3a-43cae1860a5e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--aedc15cb-35e3-42dd-bba6-d6bb019ae5e0", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7d7ef4ca-2567-48ff-ba3a-43cae1860a5e", + "created": "2024-08-02T17:12:32.444677Z", + "modified": "2024-08-02T17:12:32.444677Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99", + "target_ref": "attack-pattern--9a4a16c5-a671-4469-a854-ef45cb0e38ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--7e59ea89-0604-4d20-98f9-df99c5f20e3e.json b/generated_files/DISARM_STIX/relationship/relationship--7e59ea89-0604-4d20-98f9-df99c5f20e3e.json new file mode 100644 index 0000000..72eacee --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--7e59ea89-0604-4d20-98f9-df99c5f20e3e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--30ba8294-23d1-4400-8b0f-8fdd13217194", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7e59ea89-0604-4d20-98f9-df99c5f20e3e", + "created": "2024-08-02T17:12:32.470476Z", + "modified": "2024-08-02T17:12:32.470476Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--150be76a-9bdc-4f1d-837c-6a845d1eda1c", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--7f0d136e-aeeb-4a62-adcc-a64b9033b155.json b/generated_files/DISARM_STIX/relationship/relationship--7f0d136e-aeeb-4a62-adcc-a64b9033b155.json new file mode 100644 index 0000000..3a3186b --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--7f0d136e-aeeb-4a62-adcc-a64b9033b155.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--3ffb2caf-f911-41e1-b41f-2c6ee181aa41", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f0d136e-aeeb-4a62-adcc-a64b9033b155", + "created": "2024-08-02T17:12:32.439105Z", + "modified": "2024-08-02T17:12:32.439105Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c729368d-246a-47eb-8e4b-ab5b0a3510ec", + "target_ref": "attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--7f138fe5-7c8b-4c83-b595-4eac6b1db993.json b/generated_files/DISARM_STIX/relationship/relationship--7f138fe5-7c8b-4c83-b595-4eac6b1db993.json new file mode 100644 index 0000000..4f0fbca --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--7f138fe5-7c8b-4c83-b595-4eac6b1db993.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fe16adc6-2869-4882-9db0-99d0aca07ca5", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f138fe5-7c8b-4c83-b595-4eac6b1db993", + "created": "2024-08-02T17:12:32.475339Z", + "modified": "2024-08-02T17:12:32.475339Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--fde45c5f-c612-4969-b104-d96a60e6d888", + "target_ref": "attack-pattern--729483ae-39cf-416e-8d38-da06f1fc5991", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--7f3e3711-680c-4bcd-91c8-0c2867ec084d.json b/generated_files/DISARM_STIX/relationship/relationship--7f3e3711-680c-4bcd-91c8-0c2867ec084d.json new file mode 100644 index 0000000..6b59190 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--7f3e3711-680c-4bcd-91c8-0c2867ec084d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--c2b7f1e6-ca7f-4c6d-8f1c-90ba8adac766", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--7f3e3711-680c-4bcd-91c8-0c2867ec084d", + "created": "2024-08-02T17:12:32.437244Z", + "modified": "2024-08-02T17:12:32.437244Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--694bafc2-bd74-40c9-89f2-2ad033f079f4", + "target_ref": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--80212476-013a-4bd5-be66-d2773a78d0db.json b/generated_files/DISARM_STIX/relationship/relationship--80212476-013a-4bd5-be66-d2773a78d0db.json new file mode 100644 index 0000000..0a40e1e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--80212476-013a-4bd5-be66-d2773a78d0db.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--003cf95e-6a4f-4d16-ac52-b6d1b6edb46a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--80212476-013a-4bd5-be66-d2773a78d0db", + "created": "2024-08-02T17:12:32.448947Z", + "modified": "2024-08-02T17:12:32.448947Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d9381123-f2ef-419a-b895-8f2147e26b15", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8078fe4a-f9d6-45df-984f-aa5f305e0cee.json b/generated_files/DISARM_STIX/relationship/relationship--8078fe4a-f9d6-45df-984f-aa5f305e0cee.json new file mode 100644 index 0000000..32cc15d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8078fe4a-f9d6-45df-984f-aa5f305e0cee.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--ac86bf0f-c120-4709-9b17-eb2ba2f3869a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8078fe4a-f9d6-45df-984f-aa5f305e0cee", + "created": "2024-08-02T17:12:32.460968Z", + "modified": "2024-08-02T17:12:32.460968Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82", + "target_ref": "attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--81089a7f-ff64-48c5-b767-40c6bb4b6546.json b/generated_files/DISARM_STIX/relationship/relationship--81089a7f-ff64-48c5-b767-40c6bb4b6546.json new file mode 100644 index 0000000..921e144 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--81089a7f-ff64-48c5-b767-40c6bb4b6546.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e782fe6b-ee7c-425e-8f8f-4da07beb7c77", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--81089a7f-ff64-48c5-b767-40c6bb4b6546", + "created": "2024-08-02T17:12:32.452404Z", + "modified": "2024-08-02T17:12:32.452404Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--b43dbee2-e1e2-40e5-bea1-45630d55d30b", + "target_ref": "attack-pattern--283333f5-e161-4195-9070-5a7c22505adf", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--81d0f43c-a1eb-4af0-a8a0-66cd1c6f1d3f.json b/generated_files/DISARM_STIX/relationship/relationship--81d0f43c-a1eb-4af0-a8a0-66cd1c6f1d3f.json new file mode 100644 index 0000000..458d00c --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--81d0f43c-a1eb-4af0-a8a0-66cd1c6f1d3f.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--3e577052-579d-468c-bca0-8abf95f02987", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--81d0f43c-a1eb-4af0-a8a0-66cd1c6f1d3f", + "created": "2024-08-02T17:12:32.457526Z", + "modified": "2024-08-02T17:12:32.457526Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944", + "target_ref": "attack-pattern--872f0dc3-202e-4e9a-a4fc-0457252aecae", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--82147dcc-240d-4a64-9532-02da39174668.json b/generated_files/DISARM_STIX/relationship/relationship--82147dcc-240d-4a64-9532-02da39174668.json new file mode 100644 index 0000000..1e42094 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--82147dcc-240d-4a64-9532-02da39174668.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--67df8e1b-bb9f-47ed-b355-2b581ce6fac4", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--82147dcc-240d-4a64-9532-02da39174668", + "created": "2024-08-02T17:12:32.473126Z", + "modified": "2024-08-02T17:12:32.473126Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3628a6fd-b102-48a0-862b-9b66e80ee556", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--823e237c-e8c4-450f-9cbf-df9bdd0acb92.json b/generated_files/DISARM_STIX/relationship/relationship--823e237c-e8c4-450f-9cbf-df9bdd0acb92.json new file mode 100644 index 0000000..1b63a3e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--823e237c-e8c4-450f-9cbf-df9bdd0acb92.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--8656724a-9dcf-4dfd-8c1c-765b6c7d8b00", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--823e237c-e8c4-450f-9cbf-df9bdd0acb92", + "created": "2024-08-02T17:12:32.444301Z", + "modified": "2024-08-02T17:12:32.444301Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--b2695cde-5f12-4e6a-b55a-e31220cb4bd7", + "target_ref": "attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--85ed9ef9-dcf9-4f82-9243-c83d6ae5050b.json b/generated_files/DISARM_STIX/relationship/relationship--85ed9ef9-dcf9-4f82-9243-c83d6ae5050b.json new file mode 100644 index 0000000..e14ef9a --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--85ed9ef9-dcf9-4f82-9243-c83d6ae5050b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--8362f414-b34a-4353-83b0-59b890c544cd", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--85ed9ef9-dcf9-4f82-9243-c83d6ae5050b", + "created": "2024-08-02T17:12:32.450836Z", + "modified": "2024-08-02T17:12:32.450836Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--faa5450d-6d1f-4700-93bd-fd2d59a79e60", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8655812c-900b-44ac-a9a0-d427cd473b34.json b/generated_files/DISARM_STIX/relationship/relationship--8655812c-900b-44ac-a9a0-d427cd473b34.json new file mode 100644 index 0000000..90f3050 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8655812c-900b-44ac-a9a0-d427cd473b34.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e764483a-d7fd-41d4-88de-bc704b01644c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8655812c-900b-44ac-a9a0-d427cd473b34", + "created": "2024-08-02T17:12:32.43875Z", + "modified": "2024-08-02T17:12:32.43875Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1", + "target_ref": "attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--884209d0-0fe1-49bb-83bf-85efd7590c50.json b/generated_files/DISARM_STIX/relationship/relationship--884209d0-0fe1-49bb-83bf-85efd7590c50.json new file mode 100644 index 0000000..fc61cf6 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--884209d0-0fe1-49bb-83bf-85efd7590c50.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f0bbe28a-b283-4b89-9e69-ecaaaf378360", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--884209d0-0fe1-49bb-83bf-85efd7590c50", + "created": "2024-08-02T17:12:32.439788Z", + "modified": "2024-08-02T17:12:32.439788Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7d69d231-78a6-4a98-a715-c0edd9adafce", + "target_ref": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--89905450-65c8-4239-a28f-0f09c01fa399.json b/generated_files/DISARM_STIX/relationship/relationship--89905450-65c8-4239-a28f-0f09c01fa399.json new file mode 100644 index 0000000..cb4e091 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--89905450-65c8-4239-a28f-0f09c01fa399.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--8b72157a-d0f0-45f2-bfa1-75e2a0b6e911", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--89905450-65c8-4239-a28f-0f09c01fa399", + "created": "2024-08-02T17:12:32.460588Z", + "modified": "2024-08-02T17:12:32.460588Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4", + "target_ref": "attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8abd7e6d-926c-48a9-8d4e-9f526bd9ab47.json b/generated_files/DISARM_STIX/relationship/relationship--8abd7e6d-926c-48a9-8d4e-9f526bd9ab47.json new file mode 100644 index 0000000..1a0b8ea --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8abd7e6d-926c-48a9-8d4e-9f526bd9ab47.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--21d6a8a5-e68a-4167-bd1e-00baf3a55c43", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8abd7e6d-926c-48a9-8d4e-9f526bd9ab47", + "created": "2024-08-02T17:12:32.478239Z", + "modified": "2024-08-02T17:12:32.478239Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--cf4ee6a4-f503-425c-a069-3245de145582", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8b1fa5aa-9694-4306-8000-5476f9422fdb.json b/generated_files/DISARM_STIX/relationship/relationship--8b1fa5aa-9694-4306-8000-5476f9422fdb.json new file mode 100644 index 0000000..3f7a93f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8b1fa5aa-9694-4306-8000-5476f9422fdb.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--9f991ddc-166a-4aa8-9f87-dbec0e895822", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8b1fa5aa-9694-4306-8000-5476f9422fdb", + "created": "2024-08-02T17:12:32.44214Z", + "modified": "2024-08-02T17:12:32.44214Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c4e7d976-071a-4973-833e-3badef32b8c5", + "target_ref": "attack-pattern--ce4a9eee-7437-43ce-ac86-c1921f5c01a7", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8c611778-43a3-43bf-b43b-02aa547d31e2.json b/generated_files/DISARM_STIX/relationship/relationship--8c611778-43a3-43bf-b43b-02aa547d31e2.json new file mode 100644 index 0000000..b43f4d9 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8c611778-43a3-43bf-b43b-02aa547d31e2.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0ccdb9d1-0584-4d74-8284-7e75542227c3", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8c611778-43a3-43bf-b43b-02aa547d31e2", + "created": "2024-08-02T17:12:32.468287Z", + "modified": "2024-08-02T17:12:32.468287Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8", + "target_ref": "attack-pattern--6aa772c8-f51f-428e-a7e5-2d69dd8d4add", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8d7269a0-a864-4c37-8276-29397febfe34.json b/generated_files/DISARM_STIX/relationship/relationship--8d7269a0-a864-4c37-8276-29397febfe34.json new file mode 100644 index 0000000..0173ffc --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8d7269a0-a864-4c37-8276-29397febfe34.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4178dc5f-56cf-4fa5-bb63-a768ba8dd528", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8d7269a0-a864-4c37-8276-29397febfe34", + "created": "2024-08-02T17:12:32.445902Z", + "modified": "2024-08-02T17:12:32.445902Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d522f417-ba0e-4e2d-ae96-df2c1fd607e6", + "target_ref": "attack-pattern--c1182f49-4318-486f-81be-d44b99300343", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8e3dfbd7-a4c5-4430-9e78-ce24c4b66ada.json b/generated_files/DISARM_STIX/relationship/relationship--8e3dfbd7-a4c5-4430-9e78-ce24c4b66ada.json new file mode 100644 index 0000000..7196afb --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8e3dfbd7-a4c5-4430-9e78-ce24c4b66ada.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--6f59ca51-5f45-45cd-93a9-b1e92ee06c50", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e3dfbd7-a4c5-4430-9e78-ce24c4b66ada", + "created": "2024-08-02T17:12:32.475994Z", + "modified": "2024-08-02T17:12:32.475994Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--b2c62262-d3cc-49a9-830c-9d6f0bb95082", + "target_ref": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8e5361d9-e5f5-4c33-ad3b-c2f328243530.json b/generated_files/DISARM_STIX/relationship/relationship--8e5361d9-e5f5-4c33-ad3b-c2f328243530.json new file mode 100644 index 0000000..59112cd --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8e5361d9-e5f5-4c33-ad3b-c2f328243530.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e19a2f31-8a63-450e-862a-4d381bda8005", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8e5361d9-e5f5-4c33-ad3b-c2f328243530", + "created": "2024-08-02T17:12:32.442907Z", + "modified": "2024-08-02T17:12:32.442907Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--779fe6e8-44ee-4f36-ab93-9daa867001d4", + "target_ref": "attack-pattern--5b6aaad5-7166-4321-ae82-b9300a2ddad7", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8fadc280-2bf2-48f1-9ae0-2c873d5cf085.json b/generated_files/DISARM_STIX/relationship/relationship--8fadc280-2bf2-48f1-9ae0-2c873d5cf085.json new file mode 100644 index 0000000..c54e3ab --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8fadc280-2bf2-48f1-9ae0-2c873d5cf085.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--cb65ef3e-5842-44e9-bc02-2f65c23923a7", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8fadc280-2bf2-48f1-9ae0-2c873d5cf085", + "created": "2024-08-02T17:12:32.456046Z", + "modified": "2024-08-02T17:12:32.456046Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--8f83d6b8-01f4-406c-a3da-48a040e46139", + "target_ref": "attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8fb75375-1525-44ae-a06d-c011583c76d1.json b/generated_files/DISARM_STIX/relationship/relationship--8fb75375-1525-44ae-a06d-c011583c76d1.json new file mode 100644 index 0000000..62af0c1 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8fb75375-1525-44ae-a06d-c011583c76d1.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--a7477c78-68d3-429b-97cf-a90fcfc16672", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8fb75375-1525-44ae-a06d-c011583c76d1", + "created": "2024-08-02T17:12:32.44944Z", + "modified": "2024-08-02T17:12:32.44944Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e41b04e4-b8c2-4f66-93d7-c148f3378008", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--8fc9a902-7851-4ba0-88b8-7702912660f0.json b/generated_files/DISARM_STIX/relationship/relationship--8fc9a902-7851-4ba0-88b8-7702912660f0.json new file mode 100644 index 0000000..47377b0 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--8fc9a902-7851-4ba0-88b8-7702912660f0.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4aa95e4c-f38f-4d7d-81c9-38a9948ea652", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--8fc9a902-7851-4ba0-88b8-7702912660f0", + "created": "2024-08-02T17:12:32.44447Z", + "modified": "2024-08-02T17:12:32.44447Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--81abb4fa-705e-430f-ba54-34bf7bd467f7", + "target_ref": "attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--90dcd645-f7c0-445f-ae64-1673800a8d3a.json b/generated_files/DISARM_STIX/relationship/relationship--90dcd645-f7c0-445f-ae64-1673800a8d3a.json new file mode 100644 index 0000000..35ac1cf --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--90dcd645-f7c0-445f-ae64-1673800a8d3a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--27568ecb-6629-40a3-8674-f8cd8ff72262", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--90dcd645-f7c0-445f-ae64-1673800a8d3a", + "created": "2024-08-02T17:12:32.474175Z", + "modified": "2024-08-02T17:12:32.474175Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d60dd224-14bd-4b6e-9960-a789a8370fdf", + "target_ref": "attack-pattern--3be88ed6-1f7e-4c93-997c-600a8996293f", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--91305c8c-f82d-4809-9820-0348eeccd3c5.json b/generated_files/DISARM_STIX/relationship/relationship--91305c8c-f82d-4809-9820-0348eeccd3c5.json new file mode 100644 index 0000000..595edbd --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--91305c8c-f82d-4809-9820-0348eeccd3c5.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--12096c4a-0416-485e-9aa4-676643166370", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91305c8c-f82d-4809-9820-0348eeccd3c5", + "created": "2024-08-02T17:12:32.455546Z", + "modified": "2024-08-02T17:12:32.455546Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--db9eafc0-261b-48d0-97a2-1c92dcb4026a", + "target_ref": "attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--91885846-54dc-4165-8db9-1075a1f8813c.json b/generated_files/DISARM_STIX/relationship/relationship--91885846-54dc-4165-8db9-1075a1f8813c.json new file mode 100644 index 0000000..3d8229c --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--91885846-54dc-4165-8db9-1075a1f8813c.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--186f5d74-ab0d-493f-8357-3ee30b75ebe1", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91885846-54dc-4165-8db9-1075a1f8813c", + "created": "2024-08-02T17:12:32.447705Z", + "modified": "2024-08-02T17:12:32.447705Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--930ddf1d-7dc9-4fb2-9f5c-be928d2eb909", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--91941499-9520-4168-bbc7-c39c6084c06b.json b/generated_files/DISARM_STIX/relationship/relationship--91941499-9520-4168-bbc7-c39c6084c06b.json new file mode 100644 index 0000000..57e8eec --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--91941499-9520-4168-bbc7-c39c6084c06b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--cc969cf4-83bc-476d-8baa-13d239145c62", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--91941499-9520-4168-bbc7-c39c6084c06b", + "created": "2024-08-02T17:12:32.456354Z", + "modified": "2024-08-02T17:12:32.456354Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5daa2f8a-2460-4cdd-ae55-b70f439a9f51", + "target_ref": "attack-pattern--1997947a-7e08-4ea9-802c-85391d561266", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--9552c157-4d4a-483b-b81c-7a7837445ceb.json b/generated_files/DISARM_STIX/relationship/relationship--9552c157-4d4a-483b-b81c-7a7837445ceb.json new file mode 100644 index 0000000..948d409 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--9552c157-4d4a-483b-b81c-7a7837445ceb.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--ded62856-a592-4b5f-8b3c-50e7081957ae", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9552c157-4d4a-483b-b81c-7a7837445ceb", + "created": "2024-08-02T17:12:32.454519Z", + "modified": "2024-08-02T17:12:32.454519Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a24e779c-0f44-493b-862d-00693bf34ca4", + "target_ref": "attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--95a3e1ab-3a40-4a0a-9e31-49eecf1aac78.json b/generated_files/DISARM_STIX/relationship/relationship--95a3e1ab-3a40-4a0a-9e31-49eecf1aac78.json new file mode 100644 index 0000000..f69e432 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--95a3e1ab-3a40-4a0a-9e31-49eecf1aac78.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0e8e9628-d91c-4032-9d3c-6a20b2000b62", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--95a3e1ab-3a40-4a0a-9e31-49eecf1aac78", + "created": "2024-08-02T17:12:32.440652Z", + "modified": "2024-08-02T17:12:32.440652Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8", + "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--960a15c3-efaa-4105-9041-1cff93d20dbf.json b/generated_files/DISARM_STIX/relationship/relationship--960a15c3-efaa-4105-9041-1cff93d20dbf.json new file mode 100644 index 0000000..6e576fd --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--960a15c3-efaa-4105-9041-1cff93d20dbf.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--7b7e55da-0f84-4b05-874e-d7ff0803a239", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--960a15c3-efaa-4105-9041-1cff93d20dbf", + "created": "2024-08-02T17:12:32.438921Z", + "modified": "2024-08-02T17:12:32.438921Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5a279d23-6ba2-425c-bf72-20c6411ca5a7", + "target_ref": "attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--975fd38a-3395-464d-a9b7-7c8c3ea17dab.json b/generated_files/DISARM_STIX/relationship/relationship--975fd38a-3395-464d-a9b7-7c8c3ea17dab.json new file mode 100644 index 0000000..e9e0b02 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--975fd38a-3395-464d-a9b7-7c8c3ea17dab.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--a8c884e8-0748-4995-8f3e-cfaffad454f9", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--975fd38a-3395-464d-a9b7-7c8c3ea17dab", + "created": "2024-08-02T17:12:32.455936Z", + "modified": "2024-08-02T17:12:32.455936Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca", + "target_ref": "attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--9b577c6e-65c2-429c-9720-e5a2d8d4ce26.json b/generated_files/DISARM_STIX/relationship/relationship--9b577c6e-65c2-429c-9720-e5a2d8d4ce26.json new file mode 100644 index 0000000..7e8d9fe --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--9b577c6e-65c2-429c-9720-e5a2d8d4ce26.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--99ebae4d-fb3c-4d56-86b5-d6a963f8e92c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9b577c6e-65c2-429c-9720-e5a2d8d4ce26", + "created": "2024-08-02T17:12:32.46244Z", + "modified": "2024-08-02T17:12:32.46244Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--eb037d2a-82a7-4bcb-bffd-e7791de21d1c", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--9b905f35-fcb5-4088-b729-e6fd1ee6669b.json b/generated_files/DISARM_STIX/relationship/relationship--9b905f35-fcb5-4088-b729-e6fd1ee6669b.json new file mode 100644 index 0000000..da164fe --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--9b905f35-fcb5-4088-b729-e6fd1ee6669b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--31a5270c-b3b8-49a7-bfa8-7d9cfb53c5ca", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9b905f35-fcb5-4088-b729-e6fd1ee6669b", + "created": "2024-08-02T17:12:32.471589Z", + "modified": "2024-08-02T17:12:32.471589Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--4e33bf6a-c042-4673-b72a-c4121e0aae0d", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--9d12512b-e964-4da6-bbd3-e431e77763dd.json b/generated_files/DISARM_STIX/relationship/relationship--9d12512b-e964-4da6-bbd3-e431e77763dd.json new file mode 100644 index 0000000..a5b84df --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--9d12512b-e964-4da6-bbd3-e431e77763dd.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--5cf07bb2-9a8c-4498-a5ca-0290751e920c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9d12512b-e964-4da6-bbd3-e431e77763dd", + "created": "2024-08-02T17:12:32.460689Z", + "modified": "2024-08-02T17:12:32.460689Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1", + "target_ref": "attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--9ef09fc6-903b-4b14-ab94-ad2dd6d3859b.json b/generated_files/DISARM_STIX/relationship/relationship--9ef09fc6-903b-4b14-ab94-ad2dd6d3859b.json new file mode 100644 index 0000000..7c1cbfb --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--9ef09fc6-903b-4b14-ab94-ad2dd6d3859b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--7e5b3b75-6b62-46d1-bcdb-a56086189d7d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--9ef09fc6-903b-4b14-ab94-ad2dd6d3859b", + "created": "2024-08-02T17:12:32.455394Z", + "modified": "2024-08-02T17:12:32.455394Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--8432d382-0ce8-4507-97ea-95be10de3488", + "target_ref": "attack-pattern--9b6b3dea-54ac-4e00-bd92-380555205afe", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a0a2647d-69ee-4a43-8c90-588668c44d4c.json b/generated_files/DISARM_STIX/relationship/relationship--a0a2647d-69ee-4a43-8c90-588668c44d4c.json new file mode 100644 index 0000000..669e9f4 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a0a2647d-69ee-4a43-8c90-588668c44d4c.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--7c394a6d-d6da-402d-a7f7-b9a8fb7a204e", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a0a2647d-69ee-4a43-8c90-588668c44d4c", + "created": "2024-08-02T17:12:32.454863Z", + "modified": "2024-08-02T17:12:32.454863Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12", + "target_ref": "attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a0bc46c3-b1f7-4de0-8d41-ad6c626ae84d.json b/generated_files/DISARM_STIX/relationship/relationship--a0bc46c3-b1f7-4de0-8d41-ad6c626ae84d.json new file mode 100644 index 0000000..b6acb88 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a0bc46c3-b1f7-4de0-8d41-ad6c626ae84d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f49991f8-0b5f-4e26-b05f-cd64680645de", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a0bc46c3-b1f7-4de0-8d41-ad6c626ae84d", + "created": "2024-08-02T17:12:32.456254Z", + "modified": "2024-08-02T17:12:32.456254Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--fb6f8352-c368-49a3-b7d4-f1ee5a3fb370", + "target_ref": "attack-pattern--1997947a-7e08-4ea9-802c-85391d561266", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a3b0c1b3-71fd-4b8c-b275-80bdaea6ad92.json b/generated_files/DISARM_STIX/relationship/relationship--a3b0c1b3-71fd-4b8c-b275-80bdaea6ad92.json new file mode 100644 index 0000000..ac3b2ac --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a3b0c1b3-71fd-4b8c-b275-80bdaea6ad92.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--29f097ee-ca16-43d4-bd6e-b849f492011f", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a3b0c1b3-71fd-4b8c-b275-80bdaea6ad92", + "created": "2024-08-02T17:12:32.458996Z", + "modified": "2024-08-02T17:12:32.458996Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9", + "target_ref": "attack-pattern--872f0dc3-202e-4e9a-a4fc-0457252aecae", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a4b58981-0a68-43da-823f-362da1cb7702.json b/generated_files/DISARM_STIX/relationship/relationship--a4b58981-0a68-43da-823f-362da1cb7702.json new file mode 100644 index 0000000..609af97 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a4b58981-0a68-43da-823f-362da1cb7702.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--37174a1c-4162-4bd4-a828-61edc0544216", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a4b58981-0a68-43da-823f-362da1cb7702", + "created": "2024-08-02T17:12:32.46208Z", + "modified": "2024-08-02T17:12:32.46208Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5bca3084-f5b0-48a8-934c-7f2c03bfd2c3", + "target_ref": "attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a5034924-c0be-49de-b0fa-e2e2e28f486e.json b/generated_files/DISARM_STIX/relationship/relationship--a5034924-c0be-49de-b0fa-e2e2e28f486e.json new file mode 100644 index 0000000..24f7fe8 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a5034924-c0be-49de-b0fa-e2e2e28f486e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--eb019a8d-7d72-4b79-abeb-2df9edebbcff", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a5034924-c0be-49de-b0fa-e2e2e28f486e", + "created": "2024-08-02T17:12:32.477321Z", + "modified": "2024-08-02T17:12:32.477321Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5ba86be4-c8ba-458c-abea-2ad706d7ddd9", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a51bafef-e93f-46ce-b9ab-7175f4147e51.json b/generated_files/DISARM_STIX/relationship/relationship--a51bafef-e93f-46ce-b9ab-7175f4147e51.json new file mode 100644 index 0000000..b49c406 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a51bafef-e93f-46ce-b9ab-7175f4147e51.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0f5adf79-fd00-4731-a3bc-82d74ba28461", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a51bafef-e93f-46ce-b9ab-7175f4147e51", + "created": "2024-08-02T17:12:32.445087Z", + "modified": "2024-08-02T17:12:32.445087Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--ef3dcdcd-bd97-48e0-9d15-3e482a72c979", + "target_ref": "attack-pattern--9a4a16c5-a671-4469-a854-ef45cb0e38ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a64a0665-7765-44f2-9815-77f14b7e0cdc.json b/generated_files/DISARM_STIX/relationship/relationship--a64a0665-7765-44f2-9815-77f14b7e0cdc.json new file mode 100644 index 0000000..5838ec6 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a64a0665-7765-44f2-9815-77f14b7e0cdc.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--16d045ed-282e-4fbc-ae06-e584f7331239", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a64a0665-7765-44f2-9815-77f14b7e0cdc", + "created": "2024-08-02T17:12:32.467064Z", + "modified": "2024-08-02T17:12:32.467064Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a925711a-dbfb-41b1-bd81-70d41dbaa69c", + "target_ref": "attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a6dd71ba-47f1-4bcb-8335-b3f8cd3393c8.json b/generated_files/DISARM_STIX/relationship/relationship--a6dd71ba-47f1-4bcb-8335-b3f8cd3393c8.json new file mode 100644 index 0000000..1ec75a0 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a6dd71ba-47f1-4bcb-8335-b3f8cd3393c8.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--208d8bfb-6964-4160-b5c3-0436028b170c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a6dd71ba-47f1-4bcb-8335-b3f8cd3393c8", + "created": "2024-08-02T17:12:32.466003Z", + "modified": "2024-08-02T17:12:32.466003Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--67afaa3d-ffd7-4ad5-bcb0-e77962c084cf", + "target_ref": "attack-pattern--c73c3210-6414-46c8-9885-a3b3e405da56", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a77fdd52-addf-40c0-bcba-32a8d5c35123.json b/generated_files/DISARM_STIX/relationship/relationship--a77fdd52-addf-40c0-bcba-32a8d5c35123.json new file mode 100644 index 0000000..89bdfa4 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a77fdd52-addf-40c0-bcba-32a8d5c35123.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--723d4045-58f1-45ae-9d31-c5ca59b813b4", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a77fdd52-addf-40c0-bcba-32a8d5c35123", + "created": "2024-08-02T17:12:32.445516Z", + "modified": "2024-08-02T17:12:32.445516Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9", + "target_ref": "attack-pattern--c4213e65-a7cc-42a5-a3a7-2d8040258625", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--a8d3ceb0-3bd4-4fda-9c3c-bf25a9a9bd8e.json b/generated_files/DISARM_STIX/relationship/relationship--a8d3ceb0-3bd4-4fda-9c3c-bf25a9a9bd8e.json new file mode 100644 index 0000000..4d84d6b --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--a8d3ceb0-3bd4-4fda-9c3c-bf25a9a9bd8e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4804e2ac-44aa-48a1-b963-3aa93dcf1661", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--a8d3ceb0-3bd4-4fda-9c3c-bf25a9a9bd8e", + "created": "2024-08-02T17:12:32.461673Z", + "modified": "2024-08-02T17:12:32.461673Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--9affd892-2479-4843-99d1-1e1a9f7f1020", + "target_ref": "attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--ab6e26e2-eb6f-4f30-a37e-715d8d39a26e.json b/generated_files/DISARM_STIX/relationship/relationship--ab6e26e2-eb6f-4f30-a37e-715d8d39a26e.json new file mode 100644 index 0000000..b3287ba --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--ab6e26e2-eb6f-4f30-a37e-715d8d39a26e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--3b15657c-e2de-4ec1-bff7-5c234c032e3a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab6e26e2-eb6f-4f30-a37e-715d8d39a26e", + "created": "2024-08-02T17:12:32.456677Z", + "modified": "2024-08-02T17:12:32.456677Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1", + "target_ref": "attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--ab7fb70c-bfe0-40e4-9133-7552e0f80dd1.json b/generated_files/DISARM_STIX/relationship/relationship--ab7fb70c-bfe0-40e4-9133-7552e0f80dd1.json new file mode 100644 index 0000000..f5cd4d6 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--ab7fb70c-bfe0-40e4-9133-7552e0f80dd1.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--31ac8413-653f-4c54-97a6-6d5baccbbd9e", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ab7fb70c-bfe0-40e4-9133-7552e0f80dd1", + "created": "2024-08-02T17:12:32.473463Z", + "modified": "2024-08-02T17:12:32.473463Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--01ad5f44-da00-491f-84e8-3ba8da154c45", + "target_ref": "attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--ac091cb4-0da7-4b12-b875-f488edd6de42.json b/generated_files/DISARM_STIX/relationship/relationship--ac091cb4-0da7-4b12-b875-f488edd6de42.json new file mode 100644 index 0000000..7c93ef7 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--ac091cb4-0da7-4b12-b875-f488edd6de42.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--249a76b8-7064-4bfc-b832-40f8b1a7782d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac091cb4-0da7-4b12-b875-f488edd6de42", + "created": "2024-08-02T17:12:32.446637Z", + "modified": "2024-08-02T17:12:32.446637Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--8f545c7e-f2ba-4541-9004-dbe50fcc0b0f", + "target_ref": "attack-pattern--adaaa726-50fe-47e2-b92d-de0d65c9250c", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--ac8acbb9-b6dd-4c5c-a4a1-df3d39c3dd7a.json b/generated_files/DISARM_STIX/relationship/relationship--ac8acbb9-b6dd-4c5c-a4a1-df3d39c3dd7a.json new file mode 100644 index 0000000..32d88c4 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--ac8acbb9-b6dd-4c5c-a4a1-df3d39c3dd7a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--2de2a90b-619e-4fde-8306-e4e86aa94147", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ac8acbb9-b6dd-4c5c-a4a1-df3d39c3dd7a", + "created": "2024-08-02T17:12:32.447521Z", + "modified": "2024-08-02T17:12:32.447521Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a62e0c69-0c29-4c71-a326-1a7c3e19b74d", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--ae8bca9c-8952-4705-9eee-ed67b1333357.json b/generated_files/DISARM_STIX/relationship/relationship--ae8bca9c-8952-4705-9eee-ed67b1333357.json new file mode 100644 index 0000000..7690575 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--ae8bca9c-8952-4705-9eee-ed67b1333357.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--15105962-f7a6-44c1-b08a-ef35fbff3a61", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ae8bca9c-8952-4705-9eee-ed67b1333357", + "created": "2024-08-02T17:12:32.471338Z", + "modified": "2024-08-02T17:12:32.471338Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--fc986d09-410d-45ac-b4b4-161ff339147f", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--aee829bb-cb42-44aa-9f8e-e392ee5d480f.json b/generated_files/DISARM_STIX/relationship/relationship--aee829bb-cb42-44aa-9f8e-e392ee5d480f.json new file mode 100644 index 0000000..e555323 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--aee829bb-cb42-44aa-9f8e-e392ee5d480f.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--d6389c6d-14ce-412d-bbfa-da0dfbc3d6fc", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--aee829bb-cb42-44aa-9f8e-e392ee5d480f", + "created": "2024-08-02T17:12:32.437775Z", + "modified": "2024-08-02T17:12:32.437775Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--030976e3-fce8-434e-9ea8-a36ee2c0192e", + "target_ref": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--af6e3e4b-ee96-4223-8224-4708dbc6227a.json b/generated_files/DISARM_STIX/relationship/relationship--af6e3e4b-ee96-4223-8224-4708dbc6227a.json new file mode 100644 index 0000000..2edc3e8 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--af6e3e4b-ee96-4223-8224-4708dbc6227a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e43660cd-6bc6-47c8-a69a-ed5b5f7c8127", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--af6e3e4b-ee96-4223-8224-4708dbc6227a", + "created": "2024-08-02T17:12:32.469027Z", + "modified": "2024-08-02T17:12:32.469027Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--0765e40a-7204-4913-b24d-6793cf4f6590", + "target_ref": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b110b1a9-38f2-4d14-a0a0-42882595aac1.json b/generated_files/DISARM_STIX/relationship/relationship--b110b1a9-38f2-4d14-a0a0-42882595aac1.json new file mode 100644 index 0000000..d52f1bf --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b110b1a9-38f2-4d14-a0a0-42882595aac1.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--44182ac1-d052-427d-a8e9-a10396516583", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b110b1a9-38f2-4d14-a0a0-42882595aac1", + "created": "2024-08-02T17:12:32.437121Z", + "modified": "2024-08-02T17:12:32.437121Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--77574742-25a0-4375-a2c8-d5b54e1360aa", + "target_ref": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b3ba0ee9-0af5-4246-a9f1-e4fb89563970.json b/generated_files/DISARM_STIX/relationship/relationship--b3ba0ee9-0af5-4246-a9f1-e4fb89563970.json new file mode 100644 index 0000000..76859d1 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b3ba0ee9-0af5-4246-a9f1-e4fb89563970.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--27b9246c-4b00-47e4-a6a3-7f555bba56f5", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b3ba0ee9-0af5-4246-a9f1-e4fb89563970", + "created": "2024-08-02T17:12:32.448345Z", + "modified": "2024-08-02T17:12:32.448345Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--dde28850-4198-4223-81b5-ff9b30b4e04f", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b4b98b05-c3da-4ce9-8dd7-afaec2c029af.json b/generated_files/DISARM_STIX/relationship/relationship--b4b98b05-c3da-4ce9-8dd7-afaec2c029af.json new file mode 100644 index 0000000..58a99d7 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b4b98b05-c3da-4ce9-8dd7-afaec2c029af.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--bc726c75-3dff-4545-9daa-3422b74d0d71", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b4b98b05-c3da-4ce9-8dd7-afaec2c029af", + "created": "2024-08-02T17:12:32.464588Z", + "modified": "2024-08-02T17:12:32.464588Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a09594d3-c930-451a-8eb6-7e2d748618bb", + "target_ref": "attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b57a9910-f094-422d-9a22-7d73f00fb93e.json b/generated_files/DISARM_STIX/relationship/relationship--b57a9910-f094-422d-9a22-7d73f00fb93e.json new file mode 100644 index 0000000..9beafbb --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b57a9910-f094-422d-9a22-7d73f00fb93e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4c94d4a4-49a9-49e0-95b2-7f224448fc93", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b57a9910-f094-422d-9a22-7d73f00fb93e", + "created": "2024-08-02T17:12:32.438519Z", + "modified": "2024-08-02T17:12:32.438519Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--9ec25bd4-7dcd-4bbf-9e2f-6170af84e166", + "target_ref": "attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b63a1013-1ddd-4a02-83b1-e0ccc9969613.json b/generated_files/DISARM_STIX/relationship/relationship--b63a1013-1ddd-4a02-83b1-e0ccc9969613.json new file mode 100644 index 0000000..6b61a88 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b63a1013-1ddd-4a02-83b1-e0ccc9969613.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--431a2549-1437-4a0a-9125-3acaea5dee38", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b63a1013-1ddd-4a02-83b1-e0ccc9969613", + "created": "2024-08-02T17:12:32.435581Z", + "modified": "2024-08-02T17:12:32.435581Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--e47ae747-d83d-433d-a69a-f6d0970fed5e", + "target_ref": "attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b649a088-85c3-4412-8346-0d5aaad3d5f5.json b/generated_files/DISARM_STIX/relationship/relationship--b649a088-85c3-4412-8346-0d5aaad3d5f5.json new file mode 100644 index 0000000..b4783a5 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b649a088-85c3-4412-8346-0d5aaad3d5f5.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--621d3736-7232-49d1-a2d9-b117644df47f", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b649a088-85c3-4412-8346-0d5aaad3d5f5", + "created": "2024-08-02T17:12:32.437898Z", + "modified": "2024-08-02T17:12:32.437898Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--6c001f2c-b143-4d9b-91d7-5a663152cdb5", + "target_ref": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b85c988c-7c1f-42ea-aae3-af30a0bd413e.json b/generated_files/DISARM_STIX/relationship/relationship--b85c988c-7c1f-42ea-aae3-af30a0bd413e.json new file mode 100644 index 0000000..22f22e8 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b85c988c-7c1f-42ea-aae3-af30a0bd413e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--89728ad5-e795-494c-82d7-212c78f5af39", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b85c988c-7c1f-42ea-aae3-af30a0bd413e", + "created": "2024-08-02T17:12:32.435758Z", + "modified": "2024-08-02T17:12:32.435758Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5bc895e8-eb26-43ec-8469-ab665092970d", + "target_ref": "attack-pattern--bc2a6754-44d0-4fe3-8461-e3a4af895835", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b8a0ed52-ed5b-4f2e-b65d-3ddaed3207be.json b/generated_files/DISARM_STIX/relationship/relationship--b8a0ed52-ed5b-4f2e-b65d-3ddaed3207be.json new file mode 100644 index 0000000..78979ce --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b8a0ed52-ed5b-4f2e-b65d-3ddaed3207be.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--aa5f6c90-13fb-4d9c-a671-ed3ad7074113", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b8a0ed52-ed5b-4f2e-b65d-3ddaed3207be", + "created": "2024-08-02T17:12:32.438227Z", + "modified": "2024-08-02T17:12:32.438227Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d6681707-afcc-4656-91ca-779bc303d944", + "target_ref": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b8c2dc42-11c5-4f1b-944d-3a677029663f.json b/generated_files/DISARM_STIX/relationship/relationship--b8c2dc42-11c5-4f1b-944d-3a677029663f.json new file mode 100644 index 0000000..714c46a --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b8c2dc42-11c5-4f1b-944d-3a677029663f.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--2d4824b3-5252-4de8-886c-39c94e044d9b", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b8c2dc42-11c5-4f1b-944d-3a677029663f", + "created": "2024-08-02T17:12:32.475007Z", + "modified": "2024-08-02T17:12:32.475007Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c5274385-9abf-45cb-9ef6-faf86145d5ef", + "target_ref": "attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--b9b299a0-c628-4a4d-8efc-80c0d08e18df.json b/generated_files/DISARM_STIX/relationship/relationship--b9b299a0-c628-4a4d-8efc-80c0d08e18df.json new file mode 100644 index 0000000..0a6e66d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--b9b299a0-c628-4a4d-8efc-80c0d08e18df.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--58b16f90-36f8-4630-a709-81f975131d47", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--b9b299a0-c628-4a4d-8efc-80c0d08e18df", + "created": "2024-08-02T17:12:32.445287Z", + "modified": "2024-08-02T17:12:32.445287Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d", + "target_ref": "attack-pattern--c4213e65-a7cc-42a5-a3a7-2d8040258625", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--bd1412e1-704b-4803-91f0-5811f3410501.json b/generated_files/DISARM_STIX/relationship/relationship--bd1412e1-704b-4803-91f0-5811f3410501.json new file mode 100644 index 0000000..aff3362 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--bd1412e1-704b-4803-91f0-5811f3410501.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--91285a39-9efe-4d33-9af5-e8b2c8f56508", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bd1412e1-704b-4803-91f0-5811f3410501", + "created": "2024-08-02T17:12:32.441761Z", + "modified": "2024-08-02T17:12:32.441761Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7b6c328e-b050-4d76-8e11-ff3b3fe7dea3", + "target_ref": "attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--bdc05aaf-02e4-49b0-b230-fe2d536997bb.json b/generated_files/DISARM_STIX/relationship/relationship--bdc05aaf-02e4-49b0-b230-fe2d536997bb.json new file mode 100644 index 0000000..f90f6dd --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--bdc05aaf-02e4-49b0-b230-fe2d536997bb.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e7db118b-f6b7-4957-8c25-3c9fd3851d68", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bdc05aaf-02e4-49b0-b230-fe2d536997bb", + "created": "2024-08-02T17:12:32.455765Z", + "modified": "2024-08-02T17:12:32.455765Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5", + "target_ref": "attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--bdc6b769-1e8b-4c6d-aa34-f91fac8a0c9c.json b/generated_files/DISARM_STIX/relationship/relationship--bdc6b769-1e8b-4c6d-aa34-f91fac8a0c9c.json new file mode 100644 index 0000000..d026f91 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--bdc6b769-1e8b-4c6d-aa34-f91fac8a0c9c.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--719ee9de-10f3-476a-a788-b0a61e4d105f", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bdc6b769-1e8b-4c6d-aa34-f91fac8a0c9c", + "created": "2024-08-02T17:12:32.454653Z", + "modified": "2024-08-02T17:12:32.454653Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--62036130-6083-43e3-b1e0-8ab0822bedda", + "target_ref": "attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--be6f1a22-0e88-4330-b7ce-3942a5443ec5.json b/generated_files/DISARM_STIX/relationship/relationship--be6f1a22-0e88-4330-b7ce-3942a5443ec5.json new file mode 100644 index 0000000..42ab7ba --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--be6f1a22-0e88-4330-b7ce-3942a5443ec5.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--5934a961-a9d4-41a2-b538-30d115bb7940", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be6f1a22-0e88-4330-b7ce-3942a5443ec5", + "created": "2024-08-02T17:12:32.467546Z", + "modified": "2024-08-02T17:12:32.467546Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f", + "target_ref": "attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--be90c4af-cdb8-4f97-9093-f3f665095ae3.json b/generated_files/DISARM_STIX/relationship/relationship--be90c4af-cdb8-4f97-9093-f3f665095ae3.json new file mode 100644 index 0000000..88bcbc5 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--be90c4af-cdb8-4f97-9093-f3f665095ae3.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--023653f2-72eb-450d-aea5-a687d713b113", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--be90c4af-cdb8-4f97-9093-f3f665095ae3", + "created": "2024-08-02T17:12:32.4695Z", + "modified": "2024-08-02T17:12:32.4695Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--4f7361ac-3b52-443f-8b4c-4032bb290a80", + "target_ref": "attack-pattern--5d59ac02-0489-438c-84b8-7fe8c15d1fec", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--beb02da6-2198-445a-a643-e267055791fe.json b/generated_files/DISARM_STIX/relationship/relationship--beb02da6-2198-445a-a643-e267055791fe.json new file mode 100644 index 0000000..5371f89 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--beb02da6-2198-445a-a643-e267055791fe.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fb614981-2951-44b8-bf8e-cefefaec6f38", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--beb02da6-2198-445a-a643-e267055791fe", + "created": "2024-08-02T17:12:32.46551Z", + "modified": "2024-08-02T17:12:32.46551Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--8b991b67-9df8-42e7-b11a-5ed1bc41c5a5", + "target_ref": "attack-pattern--82f29899-fd06-43ef-b4d6-fc511d0fa425", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--befa7f53-a750-4e9a-ad3b-ba25187ce72b.json b/generated_files/DISARM_STIX/relationship/relationship--befa7f53-a750-4e9a-ad3b-ba25187ce72b.json new file mode 100644 index 0000000..f03b966 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--befa7f53-a750-4e9a-ad3b-ba25187ce72b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f0e47dd4-838b-4f7f-9639-69fa19eb18a1", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--befa7f53-a750-4e9a-ad3b-ba25187ce72b", + "created": "2024-08-02T17:12:32.46732Z", + "modified": "2024-08-02T17:12:32.46732Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d2536dd3-53a5-4fc1-b508-1697cf0dafde", + "target_ref": "attack-pattern--bb9d5f3e-471f-411b-9901-baf03b848132", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--bff67d5f-8327-40b0-b9f7-ffeb62282955.json b/generated_files/DISARM_STIX/relationship/relationship--bff67d5f-8327-40b0-b9f7-ffeb62282955.json new file mode 100644 index 0000000..68b6c5f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--bff67d5f-8327-40b0-b9f7-ffeb62282955.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--8bb85253-e556-4bf9-91a4-4d131fb1853d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--bff67d5f-8327-40b0-b9f7-ffeb62282955", + "created": "2024-08-02T17:12:32.443953Z", + "modified": "2024-08-02T17:12:32.443953Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--db93e285-c516-40b0-bb5a-36bbaf5c08b9", + "target_ref": "attack-pattern--6f020d80-d267-4e2a-8cd0-6d0dabe84f3a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c02c461b-222e-40af-bebe-781dc07e523d.json b/generated_files/DISARM_STIX/relationship/relationship--c02c461b-222e-40af-bebe-781dc07e523d.json new file mode 100644 index 0000000..6032d41 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c02c461b-222e-40af-bebe-781dc07e523d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--765cf639-64cb-4e9e-b95c-ed23b070c411", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c02c461b-222e-40af-bebe-781dc07e523d", + "created": "2024-08-02T17:12:32.477589Z", + "modified": "2024-08-02T17:12:32.477589Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--15cba133-fa27-4632-9996-22b74751749a", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c0666d0c-46d6-465a-a083-ff6617e48f5b.json b/generated_files/DISARM_STIX/relationship/relationship--c0666d0c-46d6-465a-a083-ff6617e48f5b.json new file mode 100644 index 0000000..90a0527 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c0666d0c-46d6-465a-a083-ff6617e48f5b.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--a2c47fec-b697-4d1d-9c44-4faf43c20cf7", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c0666d0c-46d6-465a-a083-ff6617e48f5b", + "created": "2024-08-02T17:12:32.446282Z", + "modified": "2024-08-02T17:12:32.446282Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c7017017-4965-4dad-a970-e748b7080a19", + "target_ref": "attack-pattern--c1182f49-4318-486f-81be-d44b99300343", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c0c59cf4-03ae-4298-9f1d-611fca8ad206.json b/generated_files/DISARM_STIX/relationship/relationship--c0c59cf4-03ae-4298-9f1d-611fca8ad206.json new file mode 100644 index 0000000..319fee2 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c0c59cf4-03ae-4298-9f1d-611fca8ad206.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--116fab93-1822-4f3f-99e2-dcd290f8f095", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c0c59cf4-03ae-4298-9f1d-611fca8ad206", + "created": "2024-08-02T17:12:32.461157Z", + "modified": "2024-08-02T17:12:32.461157Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e", + "target_ref": "attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c1c9cca1-06eb-4fd3-9314-15a4d5d545b6.json b/generated_files/DISARM_STIX/relationship/relationship--c1c9cca1-06eb-4fd3-9314-15a4d5d545b6.json new file mode 100644 index 0000000..6b1e97f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c1c9cca1-06eb-4fd3-9314-15a4d5d545b6.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--2f049ea9-d73d-4e4b-9d43-649c5b4b72a5", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c1c9cca1-06eb-4fd3-9314-15a4d5d545b6", + "created": "2024-08-02T17:12:32.441222Z", + "modified": "2024-08-02T17:12:32.441222Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--269dbccd-0cff-4f60-a0bf-253eba9bcc63", + "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c23de0ab-d8f1-48e0-96ea-f07b5c6f142e.json b/generated_files/DISARM_STIX/relationship/relationship--c23de0ab-d8f1-48e0-96ea-f07b5c6f142e.json new file mode 100644 index 0000000..aa3653c --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c23de0ab-d8f1-48e0-96ea-f07b5c6f142e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--bcb829d4-d558-4f7e-9b28-27bbf4775c4f", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c23de0ab-d8f1-48e0-96ea-f07b5c6f142e", + "created": "2024-08-02T17:12:32.464104Z", + "modified": "2024-08-02T17:12:32.464104Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--ea762d7a-8852-4d91-b44f-4754aa079313", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c2f7cc4a-df2a-4fec-b02a-8fdcec401e35.json b/generated_files/DISARM_STIX/relationship/relationship--c2f7cc4a-df2a-4fec-b02a-8fdcec401e35.json new file mode 100644 index 0000000..bc361a9 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c2f7cc4a-df2a-4fec-b02a-8fdcec401e35.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--8bf626a9-e23c-4518-9efe-95bd21d46b81", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c2f7cc4a-df2a-4fec-b02a-8fdcec401e35", + "created": "2024-08-02T17:12:32.453174Z", + "modified": "2024-08-02T17:12:32.453174Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c", + "target_ref": "attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c32ce954-9aae-48a5-abee-e0b8acec8fd2.json b/generated_files/DISARM_STIX/relationship/relationship--c32ce954-9aae-48a5-abee-e0b8acec8fd2.json new file mode 100644 index 0000000..0d4f0be --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c32ce954-9aae-48a5-abee-e0b8acec8fd2.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--461fd0e2-90a5-4dd3-8412-497f1d055133", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c32ce954-9aae-48a5-abee-e0b8acec8fd2", + "created": "2024-08-02T17:12:32.451856Z", + "modified": "2024-08-02T17:12:32.451856Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321", + "target_ref": "attack-pattern--6db47704-ba87-402d-933a-de90f5aa8965", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c4a912f8-840d-4232-a584-d2e577bf66d6.json b/generated_files/DISARM_STIX/relationship/relationship--c4a912f8-840d-4232-a584-d2e577bf66d6.json new file mode 100644 index 0000000..9c50df3 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c4a912f8-840d-4232-a584-d2e577bf66d6.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--d0ff02f9-b422-42e4-82f4-3ca19e8bac35", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c4a912f8-840d-4232-a584-d2e577bf66d6", + "created": "2024-08-02T17:12:32.459171Z", + "modified": "2024-08-02T17:12:32.459171Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--5bbea132-9da6-42f7-93e9-71f0a9cf311d", + "target_ref": "attack-pattern--5e7541d8-2b43-4443-89d9-7362ca78944c", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c86b532f-a32a-4801-90c4-36421c9ce24a.json b/generated_files/DISARM_STIX/relationship/relationship--c86b532f-a32a-4801-90c4-36421c9ce24a.json new file mode 100644 index 0000000..33daf56 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c86b532f-a32a-4801-90c4-36421c9ce24a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--2ce172fc-a54d-4c0d-8cea-6f062269020d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c86b532f-a32a-4801-90c4-36421c9ce24a", + "created": "2024-08-02T17:12:32.440286Z", + "modified": "2024-08-02T17:12:32.440286Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7475b7e6-1095-4ae1-a995-10ab1a6c838a", + "target_ref": "attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c89bea7d-e089-4546-8145-c698b6e98f99.json b/generated_files/DISARM_STIX/relationship/relationship--c89bea7d-e089-4546-8145-c698b6e98f99.json new file mode 100644 index 0000000..20f2bab --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c89bea7d-e089-4546-8145-c698b6e98f99.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f5e0a9dd-f372-4087-8cb0-a4c2775438e8", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c89bea7d-e089-4546-8145-c698b6e98f99", + "created": "2024-08-02T17:12:32.436845Z", + "modified": "2024-08-02T17:12:32.436845Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7b32abce-e101-4dc3-98db-30b79c0c8397", + "target_ref": "attack-pattern--0102376a-e896-4191-b3fb-e58188301822", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--c9cb5c30-9fbc-496f-b1a7-97d96d771d25.json b/generated_files/DISARM_STIX/relationship/relationship--c9cb5c30-9fbc-496f-b1a7-97d96d771d25.json new file mode 100644 index 0000000..8524e9e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--c9cb5c30-9fbc-496f-b1a7-97d96d771d25.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--afccf68f-aa25-4e46-b8db-2be1f978aba3", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--c9cb5c30-9fbc-496f-b1a7-97d96d771d25", + "created": "2024-08-02T17:12:32.44789Z", + "modified": "2024-08-02T17:12:32.44789Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--001e2693-c7a6-4615-b06a-90ae22d7b353", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--cafb835c-2756-46f2-8883-196135def28f.json b/generated_files/DISARM_STIX/relationship/relationship--cafb835c-2756-46f2-8883-196135def28f.json new file mode 100644 index 0000000..cbfa0f2 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--cafb835c-2756-46f2-8883-196135def28f.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--c1877b15-c8e1-47b3-88fd-1a9cd81c9d1a", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cafb835c-2756-46f2-8883-196135def28f", + "created": "2024-08-02T17:12:32.439016Z", + "modified": "2024-08-02T17:12:32.439016Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34", + "target_ref": "attack-pattern--8289a941-c379-4628-916a-2ddc12f4e531", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--cb870a35-17b3-4b0a-9887-cc4c6b5630a8.json b/generated_files/DISARM_STIX/relationship/relationship--cb870a35-17b3-4b0a-9887-cc4c6b5630a8.json new file mode 100644 index 0000000..450536a --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--cb870a35-17b3-4b0a-9887-cc4c6b5630a8.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--519c7572-d184-4d8f-867f-d0ef37772743", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cb870a35-17b3-4b0a-9887-cc4c6b5630a8", + "created": "2024-08-02T17:12:32.446467Z", + "modified": "2024-08-02T17:12:32.446467Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc", + "target_ref": "attack-pattern--adaaa726-50fe-47e2-b92d-de0d65c9250c", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--cc0fe0d0-f80a-4bb6-b6da-07ce5a75f25d.json b/generated_files/DISARM_STIX/relationship/relationship--cc0fe0d0-f80a-4bb6-b6da-07ce5a75f25d.json new file mode 100644 index 0000000..6216d96 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--cc0fe0d0-f80a-4bb6-b6da-07ce5a75f25d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fd4addb6-3afc-4aa3-9e8d-7ab96f228e51", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cc0fe0d0-f80a-4bb6-b6da-07ce5a75f25d", + "created": "2024-08-02T17:12:32.445702Z", + "modified": "2024-08-02T17:12:32.445702Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--abb6518d-50fe-4428-9bca-a6e3c6ed4de4", + "target_ref": "attack-pattern--c4213e65-a7cc-42a5-a3a7-2d8040258625", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--cd3c63ae-f158-4721-92bb-a0f31ddb7d99.json b/generated_files/DISARM_STIX/relationship/relationship--cd3c63ae-f158-4721-92bb-a0f31ddb7d99.json new file mode 100644 index 0000000..ce15e50 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--cd3c63ae-f158-4721-92bb-a0f31ddb7d99.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--eb9a6c7a-3d44-4f52-ae22-0f47a6868997", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--cd3c63ae-f158-4721-92bb-a0f31ddb7d99", + "created": "2024-08-02T17:12:32.442017Z", + "modified": "2024-08-02T17:12:32.442017Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--58b169c1-7e9a-4300-a98f-eb7baee8967f", + "target_ref": "attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--ce3d1864-d8a2-411b-93fa-7586cce39703.json b/generated_files/DISARM_STIX/relationship/relationship--ce3d1864-d8a2-411b-93fa-7586cce39703.json new file mode 100644 index 0000000..959b1a9 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--ce3d1864-d8a2-411b-93fa-7586cce39703.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e8949c1f-22e8-40b9-a641-2a004dac3a77", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ce3d1864-d8a2-411b-93fa-7586cce39703", + "created": "2024-08-02T17:12:32.441344Z", + "modified": "2024-08-02T17:12:32.441344Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--0b662d26-ea3d-45d2-87e8-b32296ad9227", + "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--d034e341-e394-414a-86ad-2650e26d71b5.json b/generated_files/DISARM_STIX/relationship/relationship--d034e341-e394-414a-86ad-2650e26d71b5.json new file mode 100644 index 0000000..8aec329 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--d034e341-e394-414a-86ad-2650e26d71b5.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--7de911de-872f-4e26-b516-97f8101336f1", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d034e341-e394-414a-86ad-2650e26d71b5", + "created": "2024-08-02T17:12:32.446869Z", + "modified": "2024-08-02T17:12:32.446869Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85", + "target_ref": "attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--d3501734-2bd1-4f32-be44-f515e3c9d4a0.json b/generated_files/DISARM_STIX/relationship/relationship--d3501734-2bd1-4f32-be44-f515e3c9d4a0.json new file mode 100644 index 0000000..2edfec5 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--d3501734-2bd1-4f32-be44-f515e3c9d4a0.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--24421a1f-e51d-423e-aeb9-beede0c7209d", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d3501734-2bd1-4f32-be44-f515e3c9d4a0", + "created": "2024-08-02T17:12:32.453664Z", + "modified": "2024-08-02T17:12:32.453664Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--6d75e3ac-e923-4815-8e9b-3e6af9e1baa0", + "target_ref": "attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--d40ca135-7884-4d87-8ff1-68fe96bc8fe6.json b/generated_files/DISARM_STIX/relationship/relationship--d40ca135-7884-4d87-8ff1-68fe96bc8fe6.json new file mode 100644 index 0000000..14f7013 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--d40ca135-7884-4d87-8ff1-68fe96bc8fe6.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0e2f6b79-8214-4e5c-af7e-db9286a6eacf", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d40ca135-7884-4d87-8ff1-68fe96bc8fe6", + "created": "2024-08-02T17:12:32.450685Z", + "modified": "2024-08-02T17:12:32.450685Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--15ca8e62-e179-4dd8-9f5e-427771e915a3", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--d497f5e2-c815-4103-80ef-66e973ce080a.json b/generated_files/DISARM_STIX/relationship/relationship--d497f5e2-c815-4103-80ef-66e973ce080a.json new file mode 100644 index 0000000..ce26afb --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--d497f5e2-c815-4103-80ef-66e973ce080a.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--c78e1dcb-291c-46af-a6a1-367edfca1caa", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d497f5e2-c815-4103-80ef-66e973ce080a", + "created": "2024-08-02T17:12:32.434382Z", + "modified": "2024-08-02T17:12:32.434382Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45", + "target_ref": "attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--d6140e04-b5d2-4627-a59c-13bdda3f4d19.json b/generated_files/DISARM_STIX/relationship/relationship--d6140e04-b5d2-4627-a59c-13bdda3f4d19.json new file mode 100644 index 0000000..f5fb7bb --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--d6140e04-b5d2-4627-a59c-13bdda3f4d19.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--5685049c-49d8-4af1-87e7-6374c8bc1010", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d6140e04-b5d2-4627-a59c-13bdda3f4d19", + "created": "2024-08-02T17:12:32.460484Z", + "modified": "2024-08-02T17:12:32.460484Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--d615efdc-7296-4254-90f5-99d2986d97fa", + "target_ref": "attack-pattern--e22e3d7d-40fc-4a5e-8d6c-d528b9f78e8e", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--d63fa14a-19c8-4c63-ac69-3198d8eb31c3.json b/generated_files/DISARM_STIX/relationship/relationship--d63fa14a-19c8-4c63-ac69-3198d8eb31c3.json new file mode 100644 index 0000000..5249536 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--d63fa14a-19c8-4c63-ac69-3198d8eb31c3.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f2915d08-cf8b-42d6-aac3-c0b534122fa7", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d63fa14a-19c8-4c63-ac69-3198d8eb31c3", + "created": "2024-08-02T17:12:32.455293Z", + "modified": "2024-08-02T17:12:32.455293Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c26749da-f15d-48d7-ac1f-e2a2a49b9930", + "target_ref": "attack-pattern--6e525f48-d8d6-4484-8838-208eb00bd2a8", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--d75e290c-a056-4383-92b1-119cc344dafe.json b/generated_files/DISARM_STIX/relationship/relationship--d75e290c-a056-4383-92b1-119cc344dafe.json new file mode 100644 index 0000000..29d454f --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--d75e290c-a056-4383-92b1-119cc344dafe.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--b81c8249-5519-42c7-afdf-01bde3936d58", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--d75e290c-a056-4383-92b1-119cc344dafe", + "created": "2024-08-02T17:12:32.477813Z", + "modified": "2024-08-02T17:12:32.477813Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--df9f74e6-1a56-4515-910e-d58a386bbf1f", + "target_ref": "attack-pattern--8704cb89-afd5-4d49-b016-72b77023dab6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--db118e6a-1c08-4dbf-ab67-ed0a3c9c205e.json b/generated_files/DISARM_STIX/relationship/relationship--db118e6a-1c08-4dbf-ab67-ed0a3c9c205e.json new file mode 100644 index 0000000..90735cd --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--db118e6a-1c08-4dbf-ab67-ed0a3c9c205e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--5b359fcc-56e7-407b-89fe-586f97fe2c74", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--db118e6a-1c08-4dbf-ab67-ed0a3c9c205e", + "created": "2024-08-02T17:12:32.435125Z", + "modified": "2024-08-02T17:12:32.435125Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733", + "target_ref": "attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--dbe73614-d8a9-49b6-aa3a-e62dc98a7c66.json b/generated_files/DISARM_STIX/relationship/relationship--dbe73614-d8a9-49b6-aa3a-e62dc98a7c66.json new file mode 100644 index 0000000..41f0678 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--dbe73614-d8a9-49b6-aa3a-e62dc98a7c66.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4075e59c-6843-4494-8abf-2971fef56fcc", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dbe73614-d8a9-49b6-aa3a-e62dc98a7c66", + "created": "2024-08-02T17:12:32.469989Z", + "modified": "2024-08-02T17:12:32.469989Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--648ac47f-a288-454a-a784-3f2111c0b76b", + "target_ref": "attack-pattern--07c764ee-1919-4e6f-a147-4db10d19c214", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--dc7a3d89-04b4-4d68-9217-ca07321f3cf3.json b/generated_files/DISARM_STIX/relationship/relationship--dc7a3d89-04b4-4d68-9217-ca07321f3cf3.json new file mode 100644 index 0000000..32e6575 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--dc7a3d89-04b4-4d68-9217-ca07321f3cf3.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--01d637f5-87d4-4d29-8591-ff53778032bf", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dc7a3d89-04b4-4d68-9217-ca07321f3cf3", + "created": "2024-08-02T17:12:32.441461Z", + "modified": "2024-08-02T17:12:32.441461Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--1e817a7b-5f96-48d0-a2f9-7ba53c168397", + "target_ref": "attack-pattern--8ea2fcce-e27e-4019-a773-70f3dddfab34", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--dd6621a0-c381-4050-a460-b6e59a2616b5.json b/generated_files/DISARM_STIX/relationship/relationship--dd6621a0-c381-4050-a460-b6e59a2616b5.json new file mode 100644 index 0000000..2cce97d --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--dd6621a0-c381-4050-a460-b6e59a2616b5.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--45ce191e-bcd4-4dd3-8dc5-15bb96a7e7a0", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--dd6621a0-c381-4050-a460-b6e59a2616b5", + "created": "2024-08-02T17:12:32.441586Z", + "modified": "2024-08-02T17:12:32.441586Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a60b4d87-cca8-4e17-a51c-f9c2af96aef4", + "target_ref": "attack-pattern--5f8a5d7e-fc17-48f2-a6fa-38fcf7843bdf", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--df5f654e-8031-4653-bb99-50ad0da6d0ed.json b/generated_files/DISARM_STIX/relationship/relationship--df5f654e-8031-4653-bb99-50ad0da6d0ed.json new file mode 100644 index 0000000..975b778 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--df5f654e-8031-4653-bb99-50ad0da6d0ed.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--f2e5b0f2-61f0-47f1-83ce-ada643f20ec2", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--df5f654e-8031-4653-bb99-50ad0da6d0ed", + "created": "2024-08-02T17:12:32.462974Z", + "modified": "2024-08-02T17:12:32.462974Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--a09fbbeb-58ef-4e7a-8183-5eaa668200c9", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--e01612ea-0cb3-40ce-8216-01a60f02d64f.json b/generated_files/DISARM_STIX/relationship/relationship--e01612ea-0cb3-40ce-8216-01a60f02d64f.json new file mode 100644 index 0000000..ceb6bcb --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--e01612ea-0cb3-40ce-8216-01a60f02d64f.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--5c577c60-4e11-43fc-85b6-bcee794b3068", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e01612ea-0cb3-40ce-8216-01a60f02d64f", + "created": "2024-08-02T17:12:32.452817Z", + "modified": "2024-08-02T17:12:32.452817Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72", + "target_ref": "attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--e27f9a78-1896-4b10-a4d7-988caa571061.json b/generated_files/DISARM_STIX/relationship/relationship--e27f9a78-1896-4b10-a4d7-988caa571061.json new file mode 100644 index 0000000..ff260d5 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--e27f9a78-1896-4b10-a4d7-988caa571061.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--8adfe22f-5999-48d1-a974-b12bebb250d2", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e27f9a78-1896-4b10-a4d7-988caa571061", + "created": "2024-08-02T17:12:32.435003Z", + "modified": "2024-08-02T17:12:32.435003Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--eb63894c-aad1-47f0-98ee-0fa5e07ed3f3", + "target_ref": "attack-pattern--ea788455-90c6-4f47-97b1-862d30ef7d12", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--e2f0bfc5-31af-4db5-8634-49b399001df3.json b/generated_files/DISARM_STIX/relationship/relationship--e2f0bfc5-31af-4db5-8634-49b399001df3.json new file mode 100644 index 0000000..a8a29a1 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--e2f0bfc5-31af-4db5-8634-49b399001df3.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--25b04af1-d238-499c-bcb0-bd77783b5b14", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e2f0bfc5-31af-4db5-8634-49b399001df3", + "created": "2024-08-02T17:12:32.447088Z", + "modified": "2024-08-02T17:12:32.447088Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--64bcccb9-4d10-4eed-8c49-8816ecfd78a3", + "target_ref": "attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--e39c7019-ac09-4202-ad2d-8ca0ed3c3eec.json b/generated_files/DISARM_STIX/relationship/relationship--e39c7019-ac09-4202-ad2d-8ca0ed3c3eec.json new file mode 100644 index 0000000..bc9931e --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--e39c7019-ac09-4202-ad2d-8ca0ed3c3eec.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--10680ea5-6c12-47e0-aa80-ccef63479ce2", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e39c7019-ac09-4202-ad2d-8ca0ed3c3eec", + "created": "2024-08-02T17:12:32.435314Z", + "modified": "2024-08-02T17:12:32.435314Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16", + "target_ref": "attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--e516deeb-46ba-423e-8cc4-9aaf73fcde99.json b/generated_files/DISARM_STIX/relationship/relationship--e516deeb-46ba-423e-8cc4-9aaf73fcde99.json new file mode 100644 index 0000000..fa32de6 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--e516deeb-46ba-423e-8cc4-9aaf73fcde99.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--9f0c2f2c-dff6-44b8-9b0c-c3c8c69008fb", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e516deeb-46ba-423e-8cc4-9aaf73fcde99", + "created": "2024-08-02T17:12:32.440038Z", + "modified": "2024-08-02T17:12:32.440038Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35", + "target_ref": "attack-pattern--9636ae57-0b93-41a0-8323-85109ee34877", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--e74eab3c-20f9-4b47-9c9f-1331bda6f2a4.json b/generated_files/DISARM_STIX/relationship/relationship--e74eab3c-20f9-4b47-9c9f-1331bda6f2a4.json new file mode 100644 index 0000000..8ab7fa1 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--e74eab3c-20f9-4b47-9c9f-1331bda6f2a4.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--4b8e3169-9f9f-42ab-bdd4-e1aff0d20e43", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e74eab3c-20f9-4b47-9c9f-1331bda6f2a4", + "created": "2024-08-02T17:12:32.471866Z", + "modified": "2024-08-02T17:12:32.471866Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--faacbfa9-600a-4cfb-8afe-844a186d72b3", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--e760da0c-640a-4962-abed-0c416b1e011f.json b/generated_files/DISARM_STIX/relationship/relationship--e760da0c-640a-4962-abed-0c416b1e011f.json new file mode 100644 index 0000000..0646d5c --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--e760da0c-640a-4962-abed-0c416b1e011f.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--dc8e1c3d-e952-4133-aa3b-e8063dfb6b97", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e760da0c-640a-4962-abed-0c416b1e011f", + "created": "2024-08-02T17:12:32.437486Z", + "modified": "2024-08-02T17:12:32.437486Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14", + "target_ref": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--e9a69513-1e41-4e21-aa68-2ee7d26f737e.json b/generated_files/DISARM_STIX/relationship/relationship--e9a69513-1e41-4e21-aa68-2ee7d26f737e.json new file mode 100644 index 0000000..74da4f3 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--e9a69513-1e41-4e21-aa68-2ee7d26f737e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--6caed2e5-4957-4a3b-b15d-8d43e33bee1c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--e9a69513-1e41-4e21-aa68-2ee7d26f737e", + "created": "2024-08-02T17:12:32.472379Z", + "modified": "2024-08-02T17:12:32.472379Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--7bcb15ef-d371-4b1e-8768-30784e9d7b87", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--eb82cf07-b346-4cb6-9b84-cc8418edbe11.json b/generated_files/DISARM_STIX/relationship/relationship--eb82cf07-b346-4cb6-9b84-cc8418edbe11.json new file mode 100644 index 0000000..cb7941a --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--eb82cf07-b346-4cb6-9b84-cc8418edbe11.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--44478ca5-12bc-4c2f-b50a-636f1e0b8976", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--eb82cf07-b346-4cb6-9b84-cc8418edbe11", + "created": "2024-08-02T17:12:32.439369Z", + "modified": "2024-08-02T17:12:32.439369Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--8ecbc28c-36e9-4d9a-8578-b9e20552d732", + "target_ref": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--ec7d1da9-fff6-4c53-a14b-9909bf9431a2.json b/generated_files/DISARM_STIX/relationship/relationship--ec7d1da9-fff6-4c53-a14b-9909bf9431a2.json new file mode 100644 index 0000000..054f172 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--ec7d1da9-fff6-4c53-a14b-9909bf9431a2.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--5115da13-e48a-491c-a733-7a5b7448d8da", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--ec7d1da9-fff6-4c53-a14b-9909bf9431a2", + "created": "2024-08-02T17:12:32.436969Z", + "modified": "2024-08-02T17:12:32.436969Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--f601eb03-79d0-4c00-b07d-4b4647c37efd", + "target_ref": "attack-pattern--0102376a-e896-4191-b3fb-e58188301822", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--edc0fb98-5036-45af-8f14-3fecd0dc0a3c.json b/generated_files/DISARM_STIX/relationship/relationship--edc0fb98-5036-45af-8f14-3fecd0dc0a3c.json new file mode 100644 index 0000000..fd56fd7 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--edc0fb98-5036-45af-8f14-3fecd0dc0a3c.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--07f60c8c-1b1f-4002-b7ad-d7c4688b5f7c", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--edc0fb98-5036-45af-8f14-3fecd0dc0a3c", + "created": "2024-08-02T17:12:32.474796Z", + "modified": "2024-08-02T17:12:32.474796Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--741c08dd-2dd3-4c6f-8d08-32481f4cb61f", + "target_ref": "attack-pattern--42aa38b3-77b9-48e0-b3ef-41e7e72e27ac", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--f33e7ae8-015a-4989-a252-b6854c715d2e.json b/generated_files/DISARM_STIX/relationship/relationship--f33e7ae8-015a-4989-a252-b6854c715d2e.json new file mode 100644 index 0000000..2a2083c --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--f33e7ae8-015a-4989-a252-b6854c715d2e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--1c0775b0-bd0b-46de-b70d-7262fe65fc66", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f33e7ae8-015a-4989-a252-b6854c715d2e", + "created": "2024-08-02T17:12:32.453868Z", + "modified": "2024-08-02T17:12:32.453868Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271", + "target_ref": "attack-pattern--78a2af04-ac4a-430b-b233-6223715a76f5", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--f3da117f-ba2b-49e0-a404-dfb3df33ce9e.json b/generated_files/DISARM_STIX/relationship/relationship--f3da117f-ba2b-49e0-a404-dfb3df33ce9e.json new file mode 100644 index 0000000..690becc --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--f3da117f-ba2b-49e0-a404-dfb3df33ce9e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--ca2b217e-f74b-413f-b5e7-e1b5cffa5091", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f3da117f-ba2b-49e0-a404-dfb3df33ce9e", + "created": "2024-08-02T17:12:32.449188Z", + "modified": "2024-08-02T17:12:32.449188Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--6270bd3c-efcf-4778-8512-065abffe9a88", + "target_ref": "attack-pattern--90b7e29e-1b62-485e-88b0-a4052cabafa4", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--f5418e2d-ccfc-4239-9990-ec2cc81c821e.json b/generated_files/DISARM_STIX/relationship/relationship--f5418e2d-ccfc-4239-9990-ec2cc81c821e.json new file mode 100644 index 0000000..a691fa5 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--f5418e2d-ccfc-4239-9990-ec2cc81c821e.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--6f194046-2b14-45f7-bbf1-4056acc597d7", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f5418e2d-ccfc-4239-9990-ec2cc81c821e", + "created": "2024-08-02T17:12:32.437999Z", + "modified": "2024-08-02T17:12:32.437999Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--2b1270a6-d432-453f-88cf-17fa38ec6f40", + "target_ref": "attack-pattern--bef6392b-f5a2-4a40-8b53-9a9377bea159", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--f77974d2-428a-4291-a6c9-efc73648f52d.json b/generated_files/DISARM_STIX/relationship/relationship--f77974d2-428a-4291-a6c9-efc73648f52d.json new file mode 100644 index 0000000..837ee43 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--f77974d2-428a-4291-a6c9-efc73648f52d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--2aa7a49a-0a16-44a3-aa1b-44438a703d34", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f77974d2-428a-4291-a6c9-efc73648f52d", + "created": "2024-08-02T17:12:32.472093Z", + "modified": "2024-08-02T17:12:32.472093Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--62a0eef8-a23a-4fbf-bb17-17ea636213cc", + "target_ref": "attack-pattern--d034fff5-0735-41e9-90a3-99a99671894a", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--f7a558ee-85bf-4a1a-a5c0-634e8e35199d.json b/generated_files/DISARM_STIX/relationship/relationship--f7a558ee-85bf-4a1a-a5c0-634e8e35199d.json new file mode 100644 index 0000000..80cc023 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--f7a558ee-85bf-4a1a-a5c0-634e8e35199d.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--fe1c9130-6699-404d-adf3-cb88bf076ff6", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7a558ee-85bf-4a1a-a5c0-634e8e35199d", + "created": "2024-08-02T17:12:32.465777Z", + "modified": "2024-08-02T17:12:32.465777Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--ce1e088c-d061-490c-a13a-3cbe4216a86e", + "target_ref": "attack-pattern--c73c3210-6414-46c8-9885-a3b3e405da56", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--f7be5566-14e3-4e0e-b790-9570529a9be8.json b/generated_files/DISARM_STIX/relationship/relationship--f7be5566-14e3-4e0e-b790-9570529a9be8.json new file mode 100644 index 0000000..4abc087 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--f7be5566-14e3-4e0e-b790-9570529a9be8.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--e5ca2b1d-96a2-4617-86d1-82c8166f42a8", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f7be5566-14e3-4e0e-b790-9570529a9be8", + "created": "2024-08-02T17:12:32.461883Z", + "modified": "2024-08-02T17:12:32.461883Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--6b495bb5-d2ab-4da7-9530-a1aadd488803", + "target_ref": "attack-pattern--baf9f97d-65f3-4290-a3c2-9ac624d64ad6", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--f87e26a8-754d-4476-b92d-e0572b1b8e64.json b/generated_files/DISARM_STIX/relationship/relationship--f87e26a8-754d-4476-b92d-e0572b1b8e64.json new file mode 100644 index 0000000..b9b1179 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--f87e26a8-754d-4476-b92d-e0572b1b8e64.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--38eef397-625f-4886-9af0-8e802ffb0d0e", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--f87e26a8-754d-4476-b92d-e0572b1b8e64", + "created": "2024-08-02T17:12:32.47553Z", + "modified": "2024-08-02T17:12:32.47553Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--6ae4a4d2-4ac8-4764-ac9f-7261c5c882e0", + "target_ref": "attack-pattern--95af4f5f-1bfc-4d54-9970-fc02e1f320ab", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--fbaf156b-fb40-420f-bd04-756e420fd8ac.json b/generated_files/DISARM_STIX/relationship/relationship--fbaf156b-fb40-420f-bd04-756e420fd8ac.json new file mode 100644 index 0000000..52ca7a5 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--fbaf156b-fb40-420f-bd04-756e420fd8ac.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--8d5e22ee-7b76-4ea9-86b3-ae71056eaf98", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fbaf156b-fb40-420f-bd04-756e420fd8ac", + "created": "2024-08-02T17:12:32.462254Z", + "modified": "2024-08-02T17:12:32.462254Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--eb67513e-b6e8-42e1-a95b-197f64c21588", + "target_ref": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--fd13e839-7850-4ee2-adb9-4aad43d3f2cb.json b/generated_files/DISARM_STIX/relationship/relationship--fd13e839-7850-4ee2-adb9-4aad43d3f2cb.json new file mode 100644 index 0000000..1623938 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--fd13e839-7850-4ee2-adb9-4aad43d3f2cb.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--8af66f28-027c-46a2-9967-19a62b75cca3", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--fd13e839-7850-4ee2-adb9-4aad43d3f2cb", + "created": "2024-08-02T17:12:32.473977Z", + "modified": "2024-08-02T17:12:32.473977Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--3af9d1c0-9a09-4dba-8975-a204e6951ac4", + "target_ref": "attack-pattern--9049818c-e7d7-4662-8d2c-589304cd9905", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/relationship/relationship--feaac006-8456-4170-a49d-8c614a0d97e2.json b/generated_files/DISARM_STIX/relationship/relationship--feaac006-8456-4170-a49d-8c614a0d97e2.json new file mode 100644 index 0000000..9254e39 --- /dev/null +++ b/generated_files/DISARM_STIX/relationship/relationship--feaac006-8456-4170-a49d-8c614a0d97e2.json @@ -0,0 +1,20 @@ +{ + "type": "bundle", + "id": "bundle--0ccfb118-6ef1-4bb6-918f-300d141a9682", + "objects": [ + { + "type": "relationship", + "spec_version": "2.1", + "id": "relationship--feaac006-8456-4170-a49d-8c614a0d97e2", + "created": "2024-08-02T17:12:32.460231Z", + "modified": "2024-08-02T17:12:32.460231Z", + "relationship_type": "subtechnique-of", + "description": "", + "source_ref": "attack-pattern--c31542d3-d9c4-4fe4-ac5d-47632225a425", + "target_ref": "attack-pattern--e22e3d7d-40fc-4a5e-8d6c-d528b9f78e8e", + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ] + } + ] +} diff --git a/generated_files/DISARM_STIX/x-mitre-matrix/x-mitre-matrix--0e0c1597-4b7d-43f1-b768-1c4a253c44df.json b/generated_files/DISARM_STIX/x-mitre-matrix/x-mitre-matrix--0e0c1597-4b7d-43f1-b768-1c4a253c44df.json index b5d6620..a3d8774 100644 --- a/generated_files/DISARM_STIX/x-mitre-matrix/x-mitre-matrix--0e0c1597-4b7d-43f1-b768-1c4a253c44df.json +++ b/generated_files/DISARM_STIX/x-mitre-matrix/x-mitre-matrix--0e0c1597-4b7d-43f1-b768-1c4a253c44df.json @@ -1,13 +1,13 @@ { "type": "bundle", - "id": "bundle--c2b53fd2-3ac4-4bd3-8bf3-8a8747b64414", + "id": "bundle--46c81fc0-27c7-4213-9ee7-f9ab0169832e", "objects": [ { "type": "x-mitre-matrix", "spec_version": "2.1", "id": "x-mitre-matrix--0e0c1597-4b7d-43f1-b768-1c4a253c44df", - "created": "2023-09-28T21:25:13.324673Z", - "modified": "2023-09-28T21:25:13.324673Z", + "created": "2024-08-02T17:12:32.484418Z", + "modified": "2024-08-02T17:12:32.484418Z", "name": "DISARM Framework", "description": "DISARM is a framework designed for describing and understanding disinformation incidents.", "tactic_refs": [ @@ -16,13 +16,13 @@ "x-mitre-tactic--1e005da9-56cc-4802-af90-b267d17a1ad1", "x-mitre-tactic--fd1e7dd3-63d0-4040-808e-3e61b9ddca86", "x-mitre-tactic--82039146-59a3-4353-b328-a422da34db6b", - "x-mitre-tactic--c4eaa2a6-7e86-4eb3-beaa-981a96d4724a", + "x-mitre-tactic--c6c75568-5369-4f9e-89c1-43307702a19c", "x-mitre-tactic--8f32bafc-edb2-4d3c-9b7e-e42a9147123b", "x-mitre-tactic--acaf8903-418f-425a-93dc-8e1bfb626876", "x-mitre-tactic--3c73d309-b066-44f9-ad81-866a64e438c9", "x-mitre-tactic--8a96b3ce-332e-4685-8ec6-5140eef192a4", "x-mitre-tactic--4a9c3d11-801b-4ee9-a5bc-b5bc042a92f9", - "x-mitre-tactic--9e114812-fcc3-4b44-b259-18a32d7babbc", + "x-mitre-tactic--03e4259c-83fc-40d6-9e20-1269a7adaac8", "x-mitre-tactic--f0505ac9-8979-49e4-a87c-d1109536a7db", "x-mitre-tactic--3fa1ad18-ca09-40ed-be45-f210b9c07e0b", "x-mitre-tactic--dffcf337-d4d9-449b-aa9c-6a97a891c5a9", diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--03e4259c-83fc-40d6-9e20-1269a7adaac8.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--03e4259c-83fc-40d6-9e20-1269a7adaac8.json new file mode 100644 index 0000000..1d820de --- /dev/null +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--03e4259c-83fc-40d6-9e20-1269a7adaac8.json @@ -0,0 +1,27 @@ +{ + "type": "bundle", + "id": "bundle--7d8c0da9-13c7-40f2-99e6-978017c316e8", + "objects": [ + { + "type": "x-mitre-tactic", + "spec_version": "2.1", + "id": "x-mitre-tactic--03e4259c-83fc-40d6-9e20-1269a7adaac8", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.324177Z", + "modified": "2024-08-02T17:12:32.324177Z", + "name": "Maximise Exposure", + "description": "Maximise exposure of the target audience to incident/campaign content via flooding, amplifying, and cross-posting.", + "external_references": [ + { + "source_name": "DISARM", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/tactics/TA17.md", + "external_id": "TA17" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_shortname": "maximise-exposure" + } + ] +} diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--19886784-0e07-474f-803c-30c443e65347.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--19886784-0e07-474f-803c-30c443e65347.json index 478aadc..1c76d7c 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--19886784-0e07-474f-803c-30c443e65347.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--19886784-0e07-474f-803c-30c443e65347.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--52a592b7-f9bb-473f-a5e2-3f9f1106ee6a", + "id": "bundle--442149fd-c3ba-4532-a9ba-3e97c92180a0", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--19886784-0e07-474f-803c-30c443e65347", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.186695Z", - "modified": "2023-09-28T21:25:13.186695Z", + "created": "2024-08-02T17:12:32.320822Z", + "modified": "2024-08-02T17:12:32.320822Z", "name": "Assess Effectiveness", "description": "Assess effectiveness of action, for use in future plans", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--1e005da9-56cc-4802-af90-b267d17a1ad1.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--1e005da9-56cc-4802-af90-b267d17a1ad1.json index b819598..cf2c8d6 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--1e005da9-56cc-4802-af90-b267d17a1ad1.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--1e005da9-56cc-4802-af90-b267d17a1ad1.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b32e4cab-100e-4f98-ac58-3637604bf819", + "id": "bundle--4899bab7-b6f8-4e03-9654-d1b82f3ff9a0", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--1e005da9-56cc-4802-af90-b267d17a1ad1", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.187205Z", - "modified": "2023-09-28T21:25:13.187205Z", + "created": "2024-08-02T17:12:32.321082Z", + "modified": "2024-08-02T17:12:32.321082Z", "name": "Target Audience Analysis", "description": "Identifying and analysing the target audience examines target audience member locations, political affiliations, financial situations, and other attributes that an influence operation may incorporate into its messaging strategy. During this tactic, influence operations may also identify existing similarities and differences between target audience members to unite like groups and divide opposing groups. Identifying and analysing target audience members allows influence operations to tailor operation strategy and content to their analysis.", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--3c73d309-b066-44f9-ad81-866a64e438c9.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--3c73d309-b066-44f9-ad81-866a64e438c9.json index 43b5760..e899281 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--3c73d309-b066-44f9-ad81-866a64e438c9.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--3c73d309-b066-44f9-ad81-866a64e438c9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--2a72125a-b7b2-4bbf-88d7-92d369bd8e5a", + "id": "bundle--4b1cb8d8-ab81-4b78-8fca-49fb129277fd", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--3c73d309-b066-44f9-ad81-866a64e438c9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.182957Z", - "modified": "2023-09-28T21:25:13.182957Z", + "created": "2024-08-02T17:12:32.319152Z", + "modified": "2024-08-02T17:12:32.319152Z", "name": "Select Channels and Affordances", "description": "Selecting platforms and affordances assesses which online or offline platforms and their associated affordances maximise an influence operation\u2019s ability to reach its target audience. To select the most appropriate platform(s), an operation may assess the technological affordances including platform algorithms, terms of service, permitted content types, or other attributes that determine platform usability and accessibility. Selecting platforms includes both choosing platforms on which the operation will publish its own content and platforms on which the operation will attempt to restrict adversarial content.", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--3fa1ad18-ca09-40ed-be45-f210b9c07e0b.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--3fa1ad18-ca09-40ed-be45-f210b9c07e0b.json index e92ce77..da4890a 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--3fa1ad18-ca09-40ed-be45-f210b9c07e0b.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--3fa1ad18-ca09-40ed-be45-f210b9c07e0b.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--40338e40-9ab4-470d-bf26-19bb94cf9045", + "id": "bundle--6b5c6735-b69e-4d71-8d85-fbe5fc37bfbf", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--3fa1ad18-ca09-40ed-be45-f210b9c07e0b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.185109Z", - "modified": "2023-09-28T21:25:13.185109Z", + "created": "2024-08-02T17:12:32.320208Z", + "modified": "2024-08-02T17:12:32.320208Z", "name": "Drive Offline Activity", "description": "Move incident/campaign from online to offline. Encouraging users to move from the platform on which they initially viewed operation content and engage in the physical information space or offline world. This may include operation-aligned rallies or protests, radio, newspaper, or billboards. An influence operation may drive to physical forums to diversify its information channels and facilitate spaces where the target audience can engage with both operation content and like-minded individuals offline.", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--431af018-56ae-406c-9648-4857f074fffc.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--431af018-56ae-406c-9648-4857f074fffc.json index 4c40014..7f8b329 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--431af018-56ae-406c-9648-4857f074fffc.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--431af018-56ae-406c-9648-4857f074fffc.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--4aef62b2-77b6-4405-8596-e2f470ee224c", + "id": "bundle--f7f0b2ef-f30f-4070-9f4d-1b1547f82f0e", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--431af018-56ae-406c-9648-4857f074fffc", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.180855Z", - "modified": "2023-09-28T21:25:13.180855Z", + "created": "2024-08-02T17:12:32.316693Z", + "modified": "2024-08-02T17:12:32.316693Z", "name": "Plan Objectives", "description": "Set clearly defined, measurable, and achievable objectives. In some cases achieving objectives ties execution of tactical tasks to reaching the desired strategic end state. In other cases, where there is no clearly defined strategic end state, the tactical objective may stand on its own. The objective statement should not specify the way and means of accomplishment but rather the goal the threat actor wishes to achieve. ", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--4a9c3d11-801b-4ee9-a5bc-b5bc042a92f9.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--4a9c3d11-801b-4ee9-a5bc-b5bc042a92f9.json index eee7027..6e88421 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--4a9c3d11-801b-4ee9-a5bc-b5bc042a92f9.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--4a9c3d11-801b-4ee9-a5bc-b5bc042a92f9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e3eeb954-2439-49c2-88bb-fcfd224bb58a", + "id": "bundle--fd1b176a-2423-440f-aa63-09b5387b1681", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--4a9c3d11-801b-4ee9-a5bc-b5bc042a92f9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.184288Z", - "modified": "2023-09-28T21:25:13.184288Z", + "created": "2024-08-02T17:12:32.319893Z", + "modified": "2024-08-02T17:12:32.319893Z", "name": "Deliver Content", "description": "Release content to general public or larger population", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--82039146-59a3-4353-b328-a422da34db6b.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--82039146-59a3-4353-b328-a422da34db6b.json index 0ac6cc0..03fb264 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--82039146-59a3-4353-b328-a422da34db6b.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--82039146-59a3-4353-b328-a422da34db6b.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--e92a0dc6-22a3-48af-ae7a-c3788871e273", + "id": "bundle--5b2f0531-0898-43fb-b50e-bada4fe95404", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--82039146-59a3-4353-b328-a422da34db6b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.182374Z", - "modified": "2023-09-28T21:25:13.182374Z", + "created": "2024-08-02T17:12:32.318087Z", + "modified": "2024-08-02T17:12:32.318087Z", "name": "Develop Content", "description": "Create or acquire text, images, and other content", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--8a96b3ce-332e-4685-8ec6-5140eef192a4.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--8a96b3ce-332e-4685-8ec6-5140eef192a4.json index 2869716..08efc8f 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--8a96b3ce-332e-4685-8ec6-5140eef192a4.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--8a96b3ce-332e-4685-8ec6-5140eef192a4.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--8fdbde27-7007-4be3-9741-d0e4a4dbd77f", + "id": "bundle--36c1be7b-91f0-4ae9-bc0d-9600a9913837", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--8a96b3ce-332e-4685-8ec6-5140eef192a4", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.183576Z", - "modified": "2023-09-28T21:25:13.183576Z", + "created": "2024-08-02T17:12:32.319623Z", + "modified": "2024-08-02T17:12:32.319623Z", "name": "Conduct Pump Priming", "description": "Release content on a targetted small scale, prior to general release, including releasing seed. Used for preparation before broader release, and as message honing. Used for preparation before broader release, and as message honing.", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--8f32bafc-edb2-4d3c-9b7e-e42a9147123b.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--8f32bafc-edb2-4d3c-9b7e-e42a9147123b.json index 6a5c153..3817d66 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--8f32bafc-edb2-4d3c-9b7e-e42a9147123b.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--8f32bafc-edb2-4d3c-9b7e-e42a9147123b.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--c561d450-ae76-4161-9598-67847531f587", + "id": "bundle--b38671b6-d748-4ff8-8932-e644a7074118", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--8f32bafc-edb2-4d3c-9b7e-e42a9147123b", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.187908Z", - "modified": "2023-09-28T21:25:13.187908Z", + "created": "2024-08-02T17:12:32.323279Z", + "modified": "2024-08-02T17:12:32.323279Z", "name": "Establish Legitimacy", "description": "Establish assets that create trust", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--acaf8903-418f-425a-93dc-8e1bfb626876.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--acaf8903-418f-425a-93dc-8e1bfb626876.json index b3023d0..07ecc99 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--acaf8903-418f-425a-93dc-8e1bfb626876.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--acaf8903-418f-425a-93dc-8e1bfb626876.json @@ -1,16 +1,16 @@ { "type": "bundle", - "id": "bundle--4c1911e5-a0b6-4ada-bae9-ee314503ac71", + "id": "bundle--a9eecd21-6a21-46b7-a79d-463ccabc5e15", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--acaf8903-418f-425a-93dc-8e1bfb626876", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.18167Z", - "modified": "2023-09-28T21:25:13.18167Z", + "created": "2024-08-02T17:12:32.317385Z", + "modified": "2024-08-02T17:12:32.317385Z", "name": "Microtarget", - "description": "Target very specific populations of people", + "description": "Actions taken which help target content to specific audiences identified and analysed as part of TA13: Target Audience Analysis.", "external_references": [ { "source_name": "DISARM", diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--b03163eb-7e81-4fed-9819-641bf7c99507.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--b03163eb-7e81-4fed-9819-641bf7c99507.json index a7d6b29..d79bcce 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--b03163eb-7e81-4fed-9819-641bf7c99507.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--b03163eb-7e81-4fed-9819-641bf7c99507.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--b9899bec-37bb-4032-a83e-c844d855b0db", + "id": "bundle--3e665718-cc2e-4727-8286-38854aaf7d0a", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--b03163eb-7e81-4fed-9819-641bf7c99507", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.179932Z", - "modified": "2023-09-28T21:25:13.179932Z", + "created": "2024-08-02T17:12:32.315732Z", + "modified": "2024-08-02T17:12:32.315732Z", "name": "Plan Strategy", "description": "Define the desired end state, i.e. the set of required conditions that defines achievement of all objectives.", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--c6c75568-5369-4f9e-89c1-43307702a19c.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--c6c75568-5369-4f9e-89c1-43307702a19c.json new file mode 100644 index 0000000..0555edb --- /dev/null +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--c6c75568-5369-4f9e-89c1-43307702a19c.json @@ -0,0 +1,27 @@ +{ + "type": "bundle", + "id": "bundle--e158fd41-24c9-4868-9fc0-706c1076e9ff", + "objects": [ + { + "type": "x-mitre-tactic", + "spec_version": "2.1", + "id": "x-mitre-tactic--c6c75568-5369-4f9e-89c1-43307702a19c", + "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", + "created": "2024-08-02T17:12:32.322106Z", + "modified": "2024-08-02T17:12:32.322106Z", + "name": "Establish Assets", + "description": "Establishing information assets generates messaging tools, including social media accounts, operation personnel, and organisations, including directly and indirectly managed assets. For assets under their direct control, the operation can add, change, or remove these assets at will. Establishing information assets allows an influence operation to promote messaging directly to the target audience without navigating through external entities. Many online influence operations create or compromise social media accounts as a primary vector of information dissemination.\n\nThis Tactic was previously called Establish Social Assets.", + "external_references": [ + { + "source_name": "DISARM", + "url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/tactics/TA15.md", + "external_id": "TA15" + } + ], + "object_marking_refs": [ + "marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31" + ], + "x_mitre_shortname": "establish-assets" + } + ] +} diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--dffcf337-d4d9-449b-aa9c-6a97a891c5a9.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--dffcf337-d4d9-449b-aa9c-6a97a891c5a9.json index 0e5249c..0d46fd6 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--dffcf337-d4d9-449b-aa9c-6a97a891c5a9.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--dffcf337-d4d9-449b-aa9c-6a97a891c5a9.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--5aecbbe7-4a9a-4a88-839f-7e13041260b2", + "id": "bundle--969ae781-05f1-4bef-a83d-a1dfbbf6ec67", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--dffcf337-d4d9-449b-aa9c-6a97a891c5a9", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.186189Z", - "modified": "2023-09-28T21:25:13.186189Z", + "created": "2024-08-02T17:12:32.320492Z", + "modified": "2024-08-02T17:12:32.320492Z", "name": "Persist in the Information Environment", "description": "Persist in the Information Space refers to taking measures that allow an operation to maintain its presence and avoid takedown by an external entity. Techniques in Persist in the Information Space help campaigns operate without detection and appear legitimate to the target audience and platform monitoring services. Influence operations on social media often persist online by varying the type of information assets and platforms used throughout the campaign.", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--f0505ac9-8979-49e4-a87c-d1109536a7db.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--f0505ac9-8979-49e4-a87c-d1109536a7db.json index f290eb7..a06d27a 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--f0505ac9-8979-49e4-a87c-d1109536a7db.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--f0505ac9-8979-49e4-a87c-d1109536a7db.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--58694133-2400-4c47-a4ac-6b2e76740824", + "id": "bundle--558c8a96-9961-4f4e-b383-07377fbbfcec", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--f0505ac9-8979-49e4-a87c-d1109536a7db", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.188786Z", - "modified": "2023-09-28T21:25:13.188786Z", + "created": "2024-08-02T17:12:32.324963Z", + "modified": "2024-08-02T17:12:32.324963Z", "name": "Drive Online Harms", "description": "Actions taken by an influence operation to harm their opponents in online spaces through harassment, suppression, releasing private information, and controlling the information space through offensive cyberspace operations.", "external_references": [ diff --git a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--fd1e7dd3-63d0-4040-808e-3e61b9ddca86.json b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--fd1e7dd3-63d0-4040-808e-3e61b9ddca86.json index c2d307a..486194b 100644 --- a/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--fd1e7dd3-63d0-4040-808e-3e61b9ddca86.json +++ b/generated_files/DISARM_STIX/x-mitre-tactic/x-mitre-tactic--fd1e7dd3-63d0-4040-808e-3e61b9ddca86.json @@ -1,14 +1,14 @@ { "type": "bundle", - "id": "bundle--1d8616ee-7364-4497-84df-ab4881152510", + "id": "bundle--7b19bab9-0254-469a-84b8-10a21bce4431", "objects": [ { "type": "x-mitre-tactic", "spec_version": "2.1", "id": "x-mitre-tactic--fd1e7dd3-63d0-4040-808e-3e61b9ddca86", "created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82", - "created": "2023-09-28T21:25:13.187521Z", - "modified": "2023-09-28T21:25:13.187521Z", + "created": "2024-08-02T17:12:32.32137Z", + "modified": "2024-08-02T17:12:32.32137Z", "name": "Develop Narratives", "description": "The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a \"\"whole of society\"\" perspective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives centre more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion constitutes an ongoing tactical struggle carried out at a whole-of-society level. Tactically, their promotion covers a broad spectrum of activities both on- and offline.", "external_references": [ diff --git a/generated_files/disarm_red_framework_clickable.html b/generated_files/disarm_red_framework_clickable.html index 51117d2..c72359b 100644 --- a/generated_files/disarm_red_framework_clickable.html +++ b/generated_files/disarm_red_framework_clickable.html @@ -73,7 +73,7 @@ function handleTechniqueClick(box) { T0072 Segment Audiences T0003 Leverage Existing Narratives T0007 Create Inauthentic Social Media Pages and Groups -T0009 Create Fake Experts +T0097 Present Persona T0039 Bait Influencer T0047 Censor Social Media as a Political Force @@ -91,7 +91,7 @@ function handleTechniqueClick(box) { T0072.001 Geographic Segmentation T0004 Develop Competing Narratives T0010 Cultivate Ignorant Agents -T0009.001 Utilise Academic/Pseudoscientific Justifications +T0097.100 Individual Persona T0049 Flood Information Space T0048 Harass @@ -109,7 +109,7 @@ function handleTechniqueClick(box) { T0072.002 Demographic Segmentation T0022 Leverage Conspiracy Theory Narratives T0013 Create Inauthentic Websites -T0097 Create Personas +T0097.101 Local Persona T0049.001 Trolls Amplify and Manipulate T0048.001 Boycott/"Cancel" Opponents @@ -127,7 +127,7 @@ function handleTechniqueClick(box) { T0072.003 Economic Segmentation T0022.001 Amplify Existing Conspiracy Theory Narratives T0014 Prepare Fundraising Campaigns -T0097.001 Produce Evidence for Persona +T0097.102 Journalist Persona T0049.002 Flood Existing Hashtag T0048.002 Harass People Based on Identities @@ -145,7 +145,7 @@ function handleTechniqueClick(box) { T0072.004 Psychographic Segmentation T0022.002 Develop Original Conspiracy Theory Narratives T0014.001 Raise Funds from Malign Actors -T0098 Establish Inauthentic News Sites +T0097.103 Activist Persona T0049.003 Bots Amplify via Automated Forwarding and Reposting T0048.003 Threaten to Dox @@ -163,7 +163,7 @@ function handleTechniqueClick(box) { T0072.005 Political Segmentation T0040 Demand Insurmountable Proof T0014.002 Raise Funds from Ignorant Agents -T0098.001 Create Inauthentic News Sites +T0097.104 Hacktivist Persona T0049.004 Utilise Spamoflauge T0048.004 Dox @@ -181,7 +181,7 @@ function handleTechniqueClick(box) { T0080 Map Target Audience Information Environment T0068 Respond to Breaking News Event or Active Crisis T0065 Prepare Physical Broadcast Capabilities -T0098.002 Leverage Existing Inauthentic News Sites +T0097.105 Military Personnel Persona T0049.005 Conduct Swarming T0123 Control Information Environment through Offensive Cyberspace Operations @@ -199,7 +199,7 @@ function handleTechniqueClick(box) { T0080.001 Monitor Social Media Analytics T0082 Develop New Narratives T0090 Create Inauthentic Accounts -T0099 Impersonate Existing Entity +T0097.106 Recruiter Persona T0049.006 Conduct Keyword Squatting T0123.001 Delete Opposing Content @@ -217,7 +217,7 @@ function handleTechniqueClick(box) { T0080.002 Evaluate Media Surveys T0083 Integrate Target Audience Vulnerabilities into Narrative T0090.001 Create Anonymous Accounts -T0099.002 Spoof/Parody Account/Site +T0097.107 Researcher Persona T0049.007 Inauthentic Sites Amplify News and Narratives T0123.002 Block Content @@ -235,7 +235,7 @@ function handleTechniqueClick(box) { T0080.003 Identify Trending Topics/Hashtags T0090.002 Create Cyborg Accounts -T0099.003 Impersonate Existing Organisation +T0097.108 Expert Persona T0049.008 Generate Information Pollution T0123.003 Destroy Information Generation Capabilities @@ -253,7 +253,7 @@ function handleTechniqueClick(box) { T0080.004 Conduct Web Traffic Analysis T0090.003 Create Bot Accounts -T0099.004 Impersonate Existing Media Outlet +T0097.109 Romantic Suitor Persona T0118 Amplify Existing Narrative T0123.004 Conduct Server Redirect @@ -271,7 +271,7 @@ function handleTechniqueClick(box) { T0080.005 Assess Degree/Type of Media Access T0090.004 Create Sockpuppet Accounts -T0099.005 Impersonate Existing Official +T0097.110 Party Official Persona T0119 Cross-Posting T0124 Suppress Opposition @@ -289,7 +289,7 @@ function handleTechniqueClick(box) { T0081 Identify Social and Technical Vulnerabilities T0091 Recruit Malign Actors -T0099.006 Impersonate Existing Influencer +T0097.111 Government Official Persona T0119.001 Post across Groups T0124.001 Report Non-Violative Opposing Content @@ -307,7 +307,7 @@ function handleTechniqueClick(box) { T0081.001 Find Echo Chambers T0091.001 Recruit Contractors -T0100 Co-Opt Trusted Sources +T0097.112 Government Employee Persona T0119.002 Post across Platform T0124.002 Goad People into Harmful Action (Stop Hitting Yourself) @@ -325,7 +325,7 @@ function handleTechniqueClick(box) { T0081.002 Identify Data Voids T0091.002 Recruit Partisans -T0100.001 Co-Opt Trusted Individuals +T0097.200 Institutional Persona T0119.003 Post across Disciplines T0124.003 Exploit Platform TOS/Content Moderation @@ -343,7 +343,7 @@ function handleTechniqueClick(box) { T0081.003 Identify Existing Prejudices T0091.003 Enlist Troll Accounts -T0100.002 Co-Opt Grassroots Groups +T0097.201 Local Institution Persona T0120 Incentivize Sharing T0125 Platform Filtering @@ -351,7 +351,7 @@ function handleTechniqueClick(box) { T0136.003 Energise Supporters -T0086 Develop Image-Based Content +T0085.008 Machine Translated Text T0105.002 Video Sharing @@ -361,7 +361,7 @@ function handleTechniqueClick(box) { T0081.004 Identify Existing Fissures T0092 Build Network -T0100.003 Co-Opt Influencers +T0097.202 News Outlet Persona T0120.001 Use Affiliate Marketing Programmes @@ -369,7 +369,7 @@ function handleTechniqueClick(box) { T0136.004 Boost Reputation -T0086.001 Develop Memes +T0086 Develop Image-Based Content T0105.003 Audio Sharing @@ -379,7 +379,7 @@ function handleTechniqueClick(box) { T0081.005 Identify Existing Conspiracy Narratives/Suspicions T0092.001 Create Organisations -T0142 Fabricate Grassroots Movement +T0097.203 Fact Checking Organisation Persona T0120.002 Use Contests and Prizes @@ -387,7 +387,7 @@ function handleTechniqueClick(box) { T0136.005 Cultvate Support for Initiative -T0086.002 Develop AI-Generated Images (Deepfakes) +T0086.001 Develop Memes T0106 Discussion Forums @@ -397,7 +397,7 @@ function handleTechniqueClick(box) { T0081.006 Identify Wedge Issues T0092.002 Use Follow Trains - +T0097.204 Think Tank Persona T0121 Manipulate Platform Algorithm @@ -405,7 +405,7 @@ function handleTechniqueClick(box) { T0136.006 Cultivate Support for Ally -T0086.003 Deceptively Edit Images (Cheap Fakes) +T0086.002 Develop AI-Generated Images (Deepfakes) T0106.001 Anonymous Message Boards @@ -415,7 +415,7 @@ function handleTechniqueClick(box) { T0081.007 Identify Target Audience Adversaries T0092.003 Create Community or Sub-Group - +T0097.205 Business Persona T0121.001 Bypass Content Blocking @@ -423,7 +423,7 @@ function handleTechniqueClick(box) { T0136.007 Recruit Members -T0086.004 Aggregate Information into Evidence Collages +T0086.003 Deceptively Edit Images (Cheap Fakes) T0107 Bookmarking and Content Curation @@ -433,7 +433,7 @@ function handleTechniqueClick(box) { T0081.008 Identify Media System Vulnerabilities T0093 Acquire/Recruit Network - +T0097.206 Government Institution Persona T0122 Direct Users to Alternative Platforms @@ -441,7 +441,7 @@ function handleTechniqueClick(box) { T0136.008 Increase Prestige -T0087 Develop Video-Based Content +T0086.004 Aggregate Information into Evidence Collages T0108 Blogging and Publishing Networks @@ -451,7 +451,7 @@ function handleTechniqueClick(box) { T0093.001 Fund Proxies - +T0097.207 NGO Persona @@ -459,7 +459,7 @@ function handleTechniqueClick(box) { T0137 Make Money -T0087.001 Develop AI-Generated Videos (Deepfakes) +T0087 Develop Video-Based Content T0109 Consumer Review Networks @@ -469,7 +469,7 @@ function handleTechniqueClick(box) { T0093.002 Acquire Botnets - +T0097.208 Social Cause Persona @@ -477,7 +477,7 @@ function handleTechniqueClick(box) { T0137.001 Generate Ad Revenue -T0087.002 Deceptively Edit Video (Cheap Fakes) +T0087.001 Develop AI-Generated Videos (Deepfakes) T0110 Formal Diplomatic Channels @@ -487,7 +487,7 @@ function handleTechniqueClick(box) { T0094 Infiltrate Existing Networks - +T0098 Establish Inauthentic News Sites @@ -495,7 +495,7 @@ function handleTechniqueClick(box) { T0137.002 Scam -T0088 Develop Audio-Based Content +T0087.002 Deceptively Edit Video (Cheap Fakes) T0111 Traditional Media @@ -505,7 +505,7 @@ function handleTechniqueClick(box) { T0094.001 Identify Susceptible Targets in Networks - +T0098.001 Create Inauthentic News Sites @@ -513,7 +513,7 @@ function handleTechniqueClick(box) { T0137.003 Raise Funds -T0088.001 Develop AI-Generated Audio (Deepfakes) +T0088 Develop Audio-Based Content T0111.001 TV @@ -523,7 +523,7 @@ function handleTechniqueClick(box) { T0094.002 Utilise Butterfly Attacks - +T0098.002 Leverage Existing Inauthentic News Sites @@ -531,7 +531,7 @@ function handleTechniqueClick(box) { T0137.004 Sell Items under False Pretences -T0088.002 Deceptively Edit Audio (Cheap Fakes) +T0088.001 Develop AI-Generated Audio (Deepfakes) T0111.002 Newspaper @@ -541,7 +541,7 @@ function handleTechniqueClick(box) { T0095 Develop Owned Media Assets - +T0100 Co-Opt Trusted Sources @@ -549,7 +549,7 @@ function handleTechniqueClick(box) { T0137.005 Extort -T0089 Obtain Private Documents +T0088.002 Deceptively Edit Audio (Cheap Fakes) T0111.003 Radio @@ -559,7 +559,7 @@ function handleTechniqueClick(box) { T0096 Leverage Content Farms - +T0100.001 Co-Opt Trusted Individuals @@ -567,7 +567,7 @@ function handleTechniqueClick(box) { T0137.006 Manipulate Stocks -T0089.001 Obtain Authentic Documents +T0089 Obtain Private Documents T0112 Email @@ -577,7 +577,7 @@ function handleTechniqueClick(box) { T0096.001 Create Content Farms - +T0100.002 Co-Opt Grassroots Groups @@ -585,6 +585,24 @@ function handleTechniqueClick(box) { T0138 Motivate to Act +T0089.001 Obtain Authentic Documents + + + + + + + + +T0096.002 Outsource Content Creation to External Organisations +T0100.003 Co-Opt Influencers + + + + + +T0138.001 Encourage + T0089.003 Alter Authentic Documents @@ -594,26 +612,8 @@ function handleTechniqueClick(box) { -T0096.002 Outsource Content Creation to External Organisations - - - - - - -T0138.001 Encourage - - - - - - - - - - T0113 Employ Commercial Analytic Firms - +T0143 Persona Legitimacy @@ -631,7 +631,7 @@ function handleTechniqueClick(box) { T0141 Acquire Compromised Asset - +T0143.001 Authentic Persona @@ -649,7 +649,7 @@ function handleTechniqueClick(box) { T0141.001 Acquire Compromised Account - +T0143.002 Fabricated Persona @@ -667,7 +667,7 @@ function handleTechniqueClick(box) { T0141.002 Acquire Compromised Website - +T0143.003 Impersonated Persona @@ -684,8 +684,8 @@ function handleTechniqueClick(box) { - - +T0145 Establish Account Imagery +T0143.004 Parody Persona @@ -702,8 +702,8 @@ function handleTechniqueClick(box) { - - +T0145.001 Copy Account Imagery +T0144 Persona Legitimacy Evidence @@ -720,8 +720,8 @@ function handleTechniqueClick(box) { - - +T0145.002 AI-Generated Account Imagery +T0144.001 Present Persona across Platforms @@ -738,8 +738,8 @@ function handleTechniqueClick(box) { - - +T0145.003 Animal Account Imagery +T0144.002 Persona Template @@ -756,7 +756,7 @@ function handleTechniqueClick(box) { - +T0145.004 Scenery Account Imagery @@ -774,7 +774,7 @@ function handleTechniqueClick(box) { - +T0145.005 Illustrated Character Account Imagery @@ -792,9 +792,27 @@ function handleTechniqueClick(box) { +T0145.006 Attractive Person Account Imagery + + + + + + + + + + + + + + +T0145.007 Stock Image Account Imagery + + @@ -815,7 +833,7 @@ function handleTechniqueClick(box) { - + @@ -831,7 +849,7 @@ function handleTechniqueClick(box) { - + @@ -847,7 +865,7 @@ function handleTechniqueClick(box) { - + @@ -863,7 +881,7 @@ function handleTechniqueClick(box) { - + @@ -879,7 +897,7 @@ function handleTechniqueClick(box) { - + @@ -894,7 +912,7 @@ function handleTechniqueClick(box) { - + @@ -908,7 +926,7 @@ function handleTechniqueClick(box) { - + @@ -921,7 +939,7 @@ function handleTechniqueClick(box) { - + @@ -934,7 +952,7 @@ function handleTechniqueClick(box) { - + @@ -946,7 +964,7 @@ function handleTechniqueClick(box) { - + @@ -957,7 +975,7 @@ function handleTechniqueClick(box) { - + @@ -968,7 +986,7 @@ function handleTechniqueClick(box) { - + @@ -978,7 +996,7 @@ function handleTechniqueClick(box) { - + @@ -987,7 +1005,7 @@ function handleTechniqueClick(box) { - + @@ -996,7 +1014,7 @@ function handleTechniqueClick(box) { - + @@ -1005,103 +1023,132 @@ function handleTechniqueClick(box) { - + - + - + - + - + - + + - + + - + + - + + - + + - + + - + + - + + - + + - + + - + + - + + + + + + + + + + + + + + + + + + + diff --git a/generated_files/red_framework_ids.csv b/generated_files/red_framework_ids.csv index a08e753..76a477f 100644 --- a/generated_files/red_framework_ids.csv +++ b/generated_files/red_framework_ids.csv @@ -1,43 +1,44 @@ P01,P01,P02,P02,P02,P03,P03,P03,P03,P04,P01,P02,P02,P02,P03,P03 TA01,TA02,TA05,TA06,TA07,TA08,TA09,TA10,TA11,TA12,TA13,TA14,TA15,TA16,TA17,TA18 -T0073,T0002,T0016,T0015,T0029,T0020,T0114,T0017,T0059,T0132,T0072,T0003,T0007,T0009,T0039,T0047 -T0074,T0066,T0018,T0023,T0043,T0042,T0114.001,T0017.001,T0060,T0132.001,T0072.001,T0004,T0010,T0009.001,T0049,T0048 -T0074.001,T0075,T0101,T0023.001,T0043.001,T0044,T0114.002,T0057,T0128,T0132.002,T0072.002,T0022,T0013,T0097,T0049.001,T0048.001 -T0074.002,T0075.001,T0102,T0023.002,T0043.002,T0045,T0115,T0057.001,T0128.001,T0132.003,T0072.003,T0022.001,T0014,T0097.001,T0049.002,T0048.002 -T0074.003,T0076,T0102.001,T0084,T0103,T0046,T0115.001,T0057.002,T0128.002,T0133,T0072.004,T0022.002,T0014.001,T0098,T0049.003,T0048.003 -T0074.004,T0077,T0102.002,T0084.001,T0103.001,,T0115.002,T0061,T0128.003,T0133.001,T0072.005,T0040,T0014.002,T0098.001,T0049.004,T0048.004 -,T0078,T0102.003,T0084.002,T0103.002,,T0115.003,T0126,T0128.004,T0133.002,T0080,T0068,T0065,T0098.002,T0049.005,T0123 -,T0079,,T0084.003,T0104,,T0116,T0126.001,T0128.005,T0133.003,T0080.001,T0082,T0090,T0099,T0049.006,T0123.001 -,T0135,,T0084.004,T0104.001,,T0116.001,T0126.002,T0129,T0133.004,T0080.002,T0083,T0090.001,T0099.002,T0049.007,T0123.002 -,T0135.001,,T0085,T0104.002,,T0117,T0127,T0129.001,T0133.005,T0080.003,,T0090.002,T0099.003,T0049.008,T0123.003 -,T0135.002,,T0085.001,T0104.003,,,T0127.001,T0129.002,T0134,T0080.004,,T0090.003,T0099.004,T0118,T0123.004 -,T0135.003,,T0085.003,T0104.004,,,T0127.002,T0129.003,T0134.001,T0080.005,,T0090.004,T0099.005,T0119,T0124 -,T0135.004,,T0085.004,T0104.005,,,,T0129.004,T0134.002,T0081,,T0091,T0099.006,T0119.001,T0124.001 -,T0136,,T0085.005,T0104.006,,,,T0129.005,,T0081.001,,T0091.001,T0100,T0119.002,T0124.002 -,T0136.001,,T0085.006,T0105,,,,T0129.006,,T0081.002,,T0091.002,T0100.001,T0119.003,T0124.003 -,T0136.002,,T0085.007,T0105.001,,,,T0129.007,,T0081.003,,T0091.003,T0100.002,T0120,T0125 -,T0136.003,,T0086,T0105.002,,,,T0129.008,,T0081.004,,T0092,T0100.003,T0120.001, -,T0136.004,,T0086.001,T0105.003,,,,T0129.009,,T0081.005,,T0092.001,T0142,T0120.002, -,T0136.005,,T0086.002,T0106,,,,T0129.010,,T0081.006,,T0092.002,,T0121, -,T0136.006,,T0086.003,T0106.001,,,,T0130,,T0081.007,,T0092.003,,T0121.001, -,T0136.007,,T0086.004,T0107,,,,T0130.001,,T0081.008,,T0093,,T0122, -,T0136.008,,T0087,T0108,,,,T0130.002,,,,T0093.001,,, -,T0137,,T0087.001,T0109,,,,T0130.003,,,,T0093.002,,, -,T0137.001,,T0087.002,T0110,,,,T0130.004,,,,T0094,,, -,T0137.002,,T0088,T0111,,,,T0130.005,,,,T0094.001,,, -,T0137.003,,T0088.001,T0111.001,,,,T0131,,,,T0094.002,,, -,T0137.004,,T0088.002,T0111.002,,,,T0131.001,,,,T0095,,, -,T0137.005,,T0089,T0111.003,,,,T0131.002,,,,T0096,,, -,T0137.006,,T0089.001,T0112,,,,,,,,T0096.001,,, -,T0138,,T0089.003,,,,,,,,,T0096.002,,, -,T0138.001,,,,,,,,,,,T0113,,, -,T0138.002,,,,,,,,,,,T0141,,, -,T0138.003,,,,,,,,,,,T0141.001,,, -,T0139,,,,,,,,,,,T0141.002,,, -,T0139.001,,,,,,,,,,,,,, -,T0139.002,,,,,,,,,,,,,, -,T0139.003,,,,,,,,,,,,,, -,T0140,,,,,,,,,,,,,, -,T0140.001,,,,,,,,,,,,,, -,T0140.002,,,,,,,,,,,,,, -,T0140.003,,,,,,,,,,,,,, +T0073,T0002,T0016,T0015,T0029,T0020,T0114,T0017,T0059,T0132,T0072,T0003,T0007,T0097,T0039,T0047 +T0074,T0066,T0018,T0023,T0043,T0042,T0114.001,T0017.001,T0060,T0132.001,T0072.001,T0004,T0010,T0097.100,T0049,T0048 +T0074.001,T0075,T0101,T0023.001,T0043.001,T0044,T0114.002,T0057,T0128,T0132.002,T0072.002,T0022,T0013,T0097.101,T0049.001,T0048.001 +T0074.002,T0075.001,T0102,T0023.002,T0043.002,T0045,T0115,T0057.001,T0128.001,T0132.003,T0072.003,T0022.001,T0014,T0097.102,T0049.002,T0048.002 +T0074.003,T0076,T0102.001,T0084,T0103,T0046,T0115.001,T0057.002,T0128.002,T0133,T0072.004,T0022.002,T0014.001,T0097.103,T0049.003,T0048.003 +T0074.004,T0077,T0102.002,T0084.001,T0103.001,,T0115.002,T0061,T0128.003,T0133.001,T0072.005,T0040,T0014.002,T0097.104,T0049.004,T0048.004 +,T0078,T0102.003,T0084.002,T0103.002,,T0115.003,T0126,T0128.004,T0133.002,T0080,T0068,T0065,T0097.105,T0049.005,T0123 +,T0079,,T0084.003,T0104,,T0116,T0126.001,T0128.005,T0133.003,T0080.001,T0082,T0090,T0097.106,T0049.006,T0123.001 +,T0135,,T0084.004,T0104.001,,T0116.001,T0126.002,T0129,T0133.004,T0080.002,T0083,T0090.001,T0097.107,T0049.007,T0123.002 +,T0135.001,,T0085,T0104.002,,T0117,T0127,T0129.001,T0133.005,T0080.003,,T0090.002,T0097.108,T0049.008,T0123.003 +,T0135.002,,T0085.001,T0104.003,,,T0127.001,T0129.002,T0134,T0080.004,,T0090.003,T0097.109,T0118,T0123.004 +,T0135.003,,T0085.003,T0104.004,,,T0127.002,T0129.003,T0134.001,T0080.005,,T0090.004,T0097.110,T0119,T0124 +,T0135.004,,T0085.004,T0104.005,,,,T0129.004,T0134.002,T0081,,T0091,T0097.111,T0119.001,T0124.001 +,T0136,,T0085.005,T0104.006,,,,T0129.005,,T0081.001,,T0091.001,T0097.112,T0119.002,T0124.002 +,T0136.001,,T0085.006,T0105,,,,T0129.006,,T0081.002,,T0091.002,T0097.200,T0119.003,T0124.003 +,T0136.002,,T0085.007,T0105.001,,,,T0129.007,,T0081.003,,T0091.003,T0097.201,T0120,T0125 +,T0136.003,,T0085.008,T0105.002,,,,T0129.008,,T0081.004,,T0092,T0097.202,T0120.001, +,T0136.004,,T0086,T0105.003,,,,T0129.009,,T0081.005,,T0092.001,T0097.203,T0120.002, +,T0136.005,,T0086.001,T0106,,,,T0129.010,,T0081.006,,T0092.002,T0097.204,T0121, +,T0136.006,,T0086.002,T0106.001,,,,T0130,,T0081.007,,T0092.003,T0097.205,T0121.001, +,T0136.007,,T0086.003,T0107,,,,T0130.001,,T0081.008,,T0093,T0097.206,T0122, +,T0136.008,,T0086.004,T0108,,,,T0130.002,,,,T0093.001,T0097.207,, +,T0137,,T0087,T0109,,,,T0130.003,,,,T0093.002,T0097.208,, +,T0137.001,,T0087.001,T0110,,,,T0130.004,,,,T0094,T0098,, +,T0137.002,,T0087.002,T0111,,,,T0130.005,,,,T0094.001,T0098.001,, +,T0137.003,,T0088,T0111.001,,,,T0131,,,,T0094.002,T0098.002,, +,T0137.004,,T0088.001,T0111.002,,,,T0131.001,,,,T0095,T0100,, +,T0137.005,,T0088.002,T0111.003,,,,T0131.002,,,,T0096,T0100.001,, +,T0137.006,,T0089,T0112,,,,,,,,T0096.001,T0100.002,, +,T0138,,T0089.001,,,,,,,,,T0096.002,T0100.003,, +,T0138.001,,T0089.003,,,,,,,,,T0113,T0143,, +,T0138.002,,,,,,,,,,,T0141,T0143.001,, +,T0138.003,,,,,,,,,,,T0141.001,T0143.002,, +,T0139,,,,,,,,,,,T0141.002,T0143.003,, +,T0139.001,,,,,,,,,,,T0145,T0143.004,, +,T0139.002,,,,,,,,,,,T0145.001,T0144,, +,T0139.003,,,,,,,,,,,T0145.002,T0144.001,, +,T0140,,,,,,,,,,,T0145.003,T0144.002,, +,T0140.001,,,,,,,,,,,T0145.004,,, +,T0140.002,,,,,,,,,,,T0145.005,,, +,T0140.003,,,,,,,,,,,T0145.006,,, +,,,,,,,,,,,,T0145.007,,, diff --git a/generated_pages/counters/C00034.md b/generated_pages/counters/C00034.md index 5486c55..63376c0 100644 --- a/generated_pages/counters/C00034.md +++ b/generated_pages/counters/C00034.md @@ -23,7 +23,6 @@ | Counters these Techniques | | ------------------------- | -| [T0009 Create Fake Experts](../../generated_pages/techniques/T0009.md) | diff --git a/generated_pages/counters/C00107.md b/generated_pages/counters/C00107.md index fb3dc56..91e097b 100644 --- a/generated_pages/counters/C00107.md +++ b/generated_pages/counters/C00107.md @@ -24,7 +24,6 @@ | Counters these Techniques | | ------------------------- | -| [T0009 Create Fake Experts](../../generated_pages/techniques/T0009.md) | diff --git a/generated_pages/counters/C00176.md b/generated_pages/counters/C00176.md index f827633..3b9c3ef 100644 --- a/generated_pages/counters/C00176.md +++ b/generated_pages/counters/C00176.md @@ -23,7 +23,6 @@ | Counters these Techniques | | ------------------------- | -| [T0009 Create Fake Experts](../../generated_pages/techniques/T0009.md) | diff --git a/generated_pages/counters/C00197.md b/generated_pages/counters/C00197.md index 894da2e..40bc0dd 100644 --- a/generated_pages/counters/C00197.md +++ b/generated_pages/counters/C00197.md @@ -25,7 +25,6 @@ | Counters these Techniques | | ------------------------- | -| [T0009 Create Fake Experts](../../generated_pages/techniques/T0009.md) | diff --git a/generated_pages/disarm_red_framework.md b/generated_pages/disarm_red_framework.md index ab64825..9c623c4 100644 --- a/generated_pages/disarm_red_framework.md +++ b/generated_pages/disarm_red_framework.md @@ -34,7 +34,7 @@ T0072 Segment Audiences T0003 Leverage Existing Narratives T0007 Create Inauthentic Social Media Pages and Groups -T0009 Create Fake Experts +T0097 Present Persona T0039 Bait Influencer T0047 Censor Social Media as a Political Force @@ -52,7 +52,7 @@ T0072.001 Geographic Segmentation T0004 Develop Competing Narratives T0010 Cultivate Ignorant Agents -T0009.001 Utilise Academic/Pseudoscientific Justifications +T0097.100 Individual Persona T0049 Flood Information Space T0048 Harass @@ -70,7 +70,7 @@ T0072.002 Demographic Segmentation T0022 Leverage Conspiracy Theory Narratives T0013 Create Inauthentic Websites -T0097 Create Personas +T0097.101 Local Persona T0049.001 Trolls Amplify and Manipulate T0048.001 Boycott/"Cancel" Opponents @@ -88,7 +88,7 @@ T0072.003 Economic Segmentation T0022.001 Amplify Existing Conspiracy Theory Narratives T0014 Prepare Fundraising Campaigns -T0097.001 Produce Evidence for Persona +T0097.102 Journalist Persona T0049.002 Flood Existing Hashtag T0048.002 Harass People Based on Identities @@ -106,7 +106,7 @@ T0072.004 Psychographic Segmentation T0022.002 Develop Original Conspiracy Theory Narratives T0014.001 Raise Funds from Malign Actors -T0098 Establish Inauthentic News Sites +T0097.103 Activist Persona T0049.003 Bots Amplify via Automated Forwarding and Reposting T0048.003 Threaten to Dox @@ -124,7 +124,7 @@ T0072.005 Political Segmentation T0040 Demand Insurmountable Proof T0014.002 Raise Funds from Ignorant Agents -T0098.001 Create Inauthentic News Sites +T0097.104 Hacktivist Persona T0049.004 Utilise Spamoflauge T0048.004 Dox @@ -142,7 +142,7 @@ T0080 Map Target Audience Information Environment T0068 Respond to Breaking News Event or Active Crisis T0065 Prepare Physical Broadcast Capabilities -T0098.002 Leverage Existing Inauthentic News Sites +T0097.105 Military Personnel Persona T0049.005 Conduct Swarming T0123 Control Information Environment through Offensive Cyberspace Operations @@ -160,7 +160,7 @@ T0080.001 Monitor Social Media Analytics T0082 Develop New Narratives T0090 Create Inauthentic Accounts -T0099 Impersonate Existing Entity +T0097.106 Recruiter Persona T0049.006 Conduct Keyword Squatting T0123.001 Delete Opposing Content @@ -178,7 +178,7 @@ T0080.002 Evaluate Media Surveys T0083 Integrate Target Audience Vulnerabilities into Narrative T0090.001 Create Anonymous Accounts -T0099.002 Spoof/Parody Account/Site +T0097.107 Researcher Persona T0049.007 Inauthentic Sites Amplify News and Narratives T0123.002 Block Content @@ -196,7 +196,7 @@ T0080.003 Identify Trending Topics/Hashtags T0090.002 Create Cyborg Accounts -T0099.003 Impersonate Existing Organisation +T0097.108 Expert Persona T0049.008 Generate Information Pollution T0123.003 Destroy Information Generation Capabilities @@ -214,7 +214,7 @@ T0080.004 Conduct Web Traffic Analysis T0090.003 Create Bot Accounts -T0099.004 Impersonate Existing Media Outlet +T0097.109 Romantic Suitor Persona T0118 Amplify Existing Narrative T0123.004 Conduct Server Redirect @@ -232,7 +232,7 @@ T0080.005 Assess Degree/Type of Media Access T0090.004 Create Sockpuppet Accounts -T0099.005 Impersonate Existing Official +T0097.110 Party Official Persona T0119 Cross-Posting T0124 Suppress Opposition @@ -250,7 +250,7 @@ T0081 Identify Social and Technical Vulnerabilities T0091 Recruit Malign Actors -T0099.006 Impersonate Existing Influencer +T0097.111 Government Official Persona T0119.001 Post across Groups T0124.001 Report Non-Violative Opposing Content @@ -268,7 +268,7 @@ T0081.001 Find Echo Chambers T0091.001 Recruit Contractors -T0100 Co-Opt Trusted Sources +T0097.112 Government Employee Persona T0119.002 Post across Platform T0124.002 Goad People into Harmful Action (Stop Hitting Yourself) @@ -286,7 +286,7 @@ T0081.002 Identify Data Voids T0091.002 Recruit Partisans -T0100.001 Co-Opt Trusted Individuals +T0097.200 Institutional Persona T0119.003 Post across Disciplines T0124.003 Exploit Platform TOS/Content Moderation @@ -304,7 +304,7 @@ T0081.003 Identify Existing Prejudices T0091.003 Enlist Troll Accounts -T0100.002 Co-Opt Grassroots Groups +T0097.201 Local Institution Persona T0120 Incentivize Sharing T0125 Platform Filtering @@ -312,7 +312,7 @@ T0136.003 Energise Supporters -T0086 Develop Image-Based Content +T0085.008 Machine Translated Text T0105.002 Video Sharing @@ -322,7 +322,7 @@ T0081.004 Identify Existing Fissures T0092 Build Network -T0100.003 Co-Opt Influencers +T0097.202 News Outlet Persona T0120.001 Use Affiliate Marketing Programmes @@ -330,7 +330,7 @@ T0136.004 Boost Reputation -T0086.001 Develop Memes +T0086 Develop Image-Based Content T0105.003 Audio Sharing @@ -340,7 +340,7 @@ T0081.005 Identify Existing Conspiracy Narratives/Suspicions T0092.001 Create Organisations -T0142 Fabricate Grassroots Movement +T0097.203 Fact Checking Organisation Persona T0120.002 Use Contests and Prizes @@ -348,7 +348,7 @@ T0136.005 Cultvate Support for Initiative -T0086.002 Develop AI-Generated Images (Deepfakes) +T0086.001 Develop Memes T0106 Discussion Forums @@ -358,7 +358,7 @@ T0081.006 Identify Wedge Issues T0092.002 Use Follow Trains - +T0097.204 Think Tank Persona T0121 Manipulate Platform Algorithm @@ -366,7 +366,7 @@ T0136.006 Cultivate Support for Ally -T0086.003 Deceptively Edit Images (Cheap Fakes) +T0086.002 Develop AI-Generated Images (Deepfakes) T0106.001 Anonymous Message Boards @@ -376,7 +376,7 @@ T0081.007 Identify Target Audience Adversaries T0092.003 Create Community or Sub-Group - +T0097.205 Business Persona T0121.001 Bypass Content Blocking @@ -384,7 +384,7 @@ T0136.007 Recruit Members -T0086.004 Aggregate Information into Evidence Collages +T0086.003 Deceptively Edit Images (Cheap Fakes) T0107 Bookmarking and Content Curation @@ -394,7 +394,7 @@ T0081.008 Identify Media System Vulnerabilities T0093 Acquire/Recruit Network - +T0097.206 Government Institution Persona T0122 Direct Users to Alternative Platforms @@ -402,7 +402,7 @@ T0136.008 Increase Prestige -T0087 Develop Video-Based Content +T0086.004 Aggregate Information into Evidence Collages T0108 Blogging and Publishing Networks @@ -412,7 +412,7 @@ T0093.001 Fund Proxies - +T0097.207 NGO Persona @@ -420,7 +420,7 @@ T0137 Make Money -T0087.001 Develop AI-Generated Videos (Deepfakes) +T0087 Develop Video-Based Content T0109 Consumer Review Networks @@ -430,7 +430,7 @@ T0093.002 Acquire Botnets - +T0097.208 Social Cause Persona @@ -438,7 +438,7 @@ T0137.001 Generate Ad Revenue -T0087.002 Deceptively Edit Video (Cheap Fakes) +T0087.001 Develop AI-Generated Videos (Deepfakes) T0110 Formal Diplomatic Channels @@ -448,7 +448,7 @@ T0094 Infiltrate Existing Networks - +T0098 Establish Inauthentic News Sites @@ -456,7 +456,7 @@ T0137.002 Scam -T0088 Develop Audio-Based Content +T0087.002 Deceptively Edit Video (Cheap Fakes) T0111 Traditional Media @@ -466,7 +466,7 @@ T0094.001 Identify Susceptible Targets in Networks - +T0098.001 Create Inauthentic News Sites @@ -474,7 +474,7 @@ T0137.003 Raise Funds -T0088.001 Develop AI-Generated Audio (Deepfakes) +T0088 Develop Audio-Based Content T0111.001 TV @@ -484,7 +484,7 @@ T0094.002 Utilise Butterfly Attacks - +T0098.002 Leverage Existing Inauthentic News Sites @@ -492,7 +492,7 @@ T0137.004 Sell Items under False Pretences -T0088.002 Deceptively Edit Audio (Cheap Fakes) +T0088.001 Develop AI-Generated Audio (Deepfakes) T0111.002 Newspaper @@ -502,7 +502,7 @@ T0095 Develop Owned Media Assets - +T0100 Co-Opt Trusted Sources @@ -510,7 +510,7 @@ T0137.005 Extort -T0089 Obtain Private Documents +T0088.002 Deceptively Edit Audio (Cheap Fakes) T0111.003 Radio @@ -520,7 +520,7 @@ T0096 Leverage Content Farms - +T0100.001 Co-Opt Trusted Individuals @@ -528,7 +528,7 @@ T0137.006 Manipulate Stocks -T0089.001 Obtain Authentic Documents +T0089 Obtain Private Documents T0112 Email @@ -538,7 +538,7 @@ T0096.001 Create Content Farms - +T0100.002 Co-Opt Grassroots Groups @@ -546,6 +546,24 @@ T0138 Motivate to Act +T0089.001 Obtain Authentic Documents + + + + + + + + +T0096.002 Outsource Content Creation to External Organisations +T0100.003 Co-Opt Influencers + + + + + +T0138.001 Encourage + T0089.003 Alter Authentic Documents @@ -555,26 +573,8 @@ -T0096.002 Outsource Content Creation to External Organisations - - - - - - -T0138.001 Encourage - - - - - - - - - - T0113 Employ Commercial Analytic Firms - +T0143 Persona Legitimacy @@ -592,7 +592,7 @@ T0141 Acquire Compromised Asset - +T0143.001 Authentic Persona @@ -610,7 +610,7 @@ T0141.001 Acquire Compromised Account - +T0143.002 Fabricated Persona @@ -628,7 +628,7 @@ T0141.002 Acquire Compromised Website - +T0143.003 Impersonated Persona @@ -645,8 +645,8 @@ - - +T0145 Establish Account Imagery +T0143.004 Parody Persona @@ -663,8 +663,8 @@ - - +T0145.001 Copy Account Imagery +T0144 Persona Legitimacy Evidence @@ -681,8 +681,8 @@ - - +T0145.002 AI-Generated Account Imagery +T0144.001 Present Persona across Platforms @@ -699,8 +699,8 @@ - - +T0145.003 Animal Account Imagery +T0144.002 Persona Template @@ -717,7 +717,7 @@ - +T0145.004 Scenery Account Imagery @@ -735,7 +735,7 @@ - +T0145.005 Illustrated Character Account Imagery @@ -753,9 +753,27 @@ +T0145.006 Attractive Person Account Imagery + + + + + + + + + + + + + + +T0145.007 Stock Image Account Imagery + + diff --git a/generated_pages/incidents/.md b/generated_pages/incidents/.md new file mode 100644 index 0000000..b3d636d --- /dev/null +++ b/generated_pages/incidents/.md @@ -0,0 +1,25 @@ +# Incident : + +* **Summary:** + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00001.md b/generated_pages/incidents/I00001.md index e6a2a76..3828db7 100644 --- a/generated_pages/incidents/I00001.md +++ b/generated_pages/incidents/I00001.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Russia , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://money.cnn.com/2017/09/28/media/blacktivist-russia-facebook-twitter/index.html](https://money.cnn.com/2017/09/28/media/blacktivist-russia-facebook-twitter/index.html) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00002.md b/generated_pages/incidents/I00002.md index 13b889d..b5e2b64 100644 --- a/generated_pages/incidents/I00002.md +++ b/generated_pages/incidents/I00002.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** Russia , World @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.washingtonpost.com/science/2018/08/23/russian-trolls-twitter-bots-exploit-vaccine-controversy/](https://www.washingtonpost.com/science/2018/08/23/russian-trolls-twitter-bots-exploit-vaccine-controversy/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | @@ -26,4 +25,4 @@ | [T0046 Use Search Engine Optimisation](../../generated_pages/techniques/T0046.md) | IT00000005 SEO optimisation/manipulation ("key words") | -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00003.md b/generated_pages/incidents/I00003.md index 441c2b7..5ad30ff 100644 --- a/generated_pages/incidents/I00003.md +++ b/generated_pages/incidents/I00003.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Russia , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.theguardian.com/us-news/2018/may/10/russia-facebook-ads-us-elections-congress](https://www.theguardian.com/us-news/2018/may/10/russia-facebook-ads-us-elections-congress) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00004.md b/generated_pages/incidents/I00004.md index d6b6a3f..535b672 100644 --- a/generated_pages/incidents/I00004.md +++ b/generated_pages/incidents/I00004.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Russia , France @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [http://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/](http://www.niemanlab.org/2018/09/how-france-beat-back-information-manipulation-and-how-other-democracies-might-do-the-same/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00005.md b/generated_pages/incidents/I00005.md index 6f788d9..89d65d6 100644 --- a/generated_pages/incidents/I00005.md +++ b/generated_pages/incidents/I00005.md @@ -13,7 +13,7 @@ The report adds that although officially the Russian government asserted its neu * **incident type**: campaign -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Russia , UK @@ -22,9 +22,8 @@ The report adds that although officially the Russian government asserted its neu * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.forbes.com/sites/emmawoollacott/2018/11/01/russian-trolls-used-islamophobia-to-whip-up-support-for-brexit/#1369afb665f2](https://www.forbes.com/sites/emmawoollacott/2018/11/01/russian-trolls-used-islamophobia-to-whip-up-support-for-brexit/#1369afb665f2) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00006.md b/generated_pages/incidents/I00006.md index 748054b..622aeb4 100644 --- a/generated_pages/incidents/I00006.md +++ b/generated_pages/incidents/I00006.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** Russia , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://en.wikipedia.org/wiki/Columbian_Chemicals_Plant_explosion_hoax](https://en.wikipedia.org/wiki/Columbian_Chemicals_Plant_explosion_hoax) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00007.md b/generated_pages/incidents/I00007.md index f250ceb..10bf62c 100644 --- a/generated_pages/incidents/I00007.md +++ b/generated_pages/incidents/I00007.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Russia , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.politifact.com/truth-o-meter/statements/2016/aug/16/paul-manafort/trump-campaign-chair-misquotes-russian-media-makes/](https://www.politifact.com/truth-o-meter/statements/2016/aug/16/paul-manafort/trump-campaign-chair-misquotes-russian-media-makes/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00008.md b/generated_pages/incidents/I00008.md index c348f2b..fcabd25 100644 --- a/generated_pages/incidents/I00008.md +++ b/generated_pages/incidents/I00008.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Russia , Serbia @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.stopfake.org/en/vencislav-the-virgin-hostile-operation-by-vencislav-bujic-seas-foundation-and-its-network-of-collaborators/](https://www.stopfake.org/en/vencislav-the-virgin-hostile-operation-by-vencislav-bujic-seas-foundation-and-its-network-of-collaborators/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00009.md b/generated_pages/incidents/I00009.md index f7e151b..a89211b 100644 --- a/generated_pages/incidents/I00009.md +++ b/generated_pages/incidents/I00009.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Russia , Philippines @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://codastory.com/disinformation/how-a-little-known-pro-kremlin-analyst-became-a-philippine-expert-overnight/](https://codastory.com/disinformation/how-a-little-known-pro-kremlin-analyst-became-a-philippine-expert-overnight/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00010.md b/generated_pages/incidents/I00010.md index 93d73b0..b2c02c6 100644 --- a/generated_pages/incidents/I00010.md +++ b/generated_pages/incidents/I00010.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Unknown , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-01 -| Reference(s) | -| --------- | -| [https://www.nytimes.com/2018/03/27/us/parkland-students-hogg-gonzalez.html](https://www.nytimes.com/2018/03/27/us/parkland-students-hogg-gonzalez.html) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00011.md b/generated_pages/incidents/I00011.md index a4d8443..8aaf413 100644 --- a/generated_pages/incidents/I00011.md +++ b/generated_pages/incidents/I00011.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2019 +* **Year started:** 2019.0 * **Countries:** Unknown , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-01 -| Reference(s) | -| --------- | -| [https://www.wcpo.com/news/national/fact-check-viral-misinformation-about-covington-catholic-nathan-phillips-infects-the-internet](https://www.wcpo.com/news/national/fact-check-viral-misinformation-about-covington-catholic-nathan-phillips-infects-the-internet) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00012.md b/generated_pages/incidents/I00012.md index cca5e53..127f0d7 100644 --- a/generated_pages/incidents/I00012.md +++ b/generated_pages/incidents/I00012.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2011 +* **Year started:** 2011.0 * **Countries:** China , China @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.cjr.org/innovations/memes-pollution-censorship-china-beijing.php](https://www.cjr.org/innovations/memes-pollution-censorship-china-beijing.php) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00013.md b/generated_pages/incidents/I00013.md index 45c2c54..b1aa67d 100644 --- a/generated_pages/incidents/I00013.md +++ b/generated_pages/incidents/I00013.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** Russia , France @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://medium.com/dfrlab/trolltracker-glimpse-into-a-french-operation-f78dcae78924](https://medium.com/dfrlab/trolltracker-glimpse-into-a-french-operation-f78dcae78924) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00014.md b/generated_pages/incidents/I00014.md index a27aab7..9e3debe 100644 --- a/generated_pages/incidents/I00014.md +++ b/generated_pages/incidents/I00014.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , France @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.wired.com/story/co-opting-french-unrest-spread-disinformation/](https://www.wired.com/story/co-opting-french-unrest-spread-disinformation/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00015.md b/generated_pages/incidents/I00015.md index 0db268c..ad6561d 100644 --- a/generated_pages/incidents/I00015.md +++ b/generated_pages/incidents/I00015.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2019 +* **Year started:** 2019.0 * **Countries:** Russia , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-01 -| Reference(s) | -| --------- | -| [https://www.theatlantic.com/politics/archive/2019/02/new-mueller-filing-shows-how-russia-misuses-us-courts/581884/](https://www.theatlantic.com/politics/archive/2019/02/new-mueller-filing-shows-how-russia-misuses-us-courts/581884/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00016.md b/generated_pages/incidents/I00016.md index e5137e2..cd18b72 100644 --- a/generated_pages/incidents/I00016.md +++ b/generated_pages/incidents/I00016.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** Russia , Lithuania @@ -13,9 +13,8 @@ * **Date added:** 2019-02-01 -| Reference(s) | -| --------- | -| [https://www.ft.com/content/b3701b12-2544-11e9-b329-c7e6ceb5ffdf](https://www.ft.com/content/b3701b12-2544-11e9-b329-c7e6ceb5ffdf) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00017.md b/generated_pages/incidents/I00017.md index 13d09cb..eae5fd1 100644 --- a/generated_pages/incidents/I00017.md +++ b/generated_pages/incidents/I00017.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Russia , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.dni.gov/files/documents/ICA_2017_01.pdf](https://www.dni.gov/files/documents/ICA_2017_01.pdf) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00018.md b/generated_pages/incidents/I00018.md index afdf427..ba2b12a 100644 --- a/generated_pages/incidents/I00018.md +++ b/generated_pages/incidents/I00018.md @@ -4,7 +4,7 @@ * **incident type**: tactic -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Russia , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| []() | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00019.md b/generated_pages/incidents/I00019.md index 67be8bb..001c2e2 100644 --- a/generated_pages/incidents/I00019.md +++ b/generated_pages/incidents/I00019.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** , France @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about](https://www.buzzfeednews.com/article/ryanhatesthis/heres-how-far-right-trolls-are-spreading-hoaxes-about) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00020.md b/generated_pages/incidents/I00020.md index e10ba4f..9312d91 100644 --- a/generated_pages/incidents/I00020.md +++ b/generated_pages/incidents/I00020.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Russia , World @@ -13,9 +13,9 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d](https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d](https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d) | 2017/01/12 | Ben Nimmo | DFRLab | [https://web.archive.org/web/20240527191455/https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d](https://web.archive.org/web/20240527191455/https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d) | diff --git a/generated_pages/incidents/I00021.md b/generated_pages/incidents/I00021.md index 5708597..1321f27 100644 --- a/generated_pages/incidents/I00021.md +++ b/generated_pages/incidents/I00021.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Russia , Armenia @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://medium.com/dfrlab/fakes-bots-and-blockings-in-armenia-44a4c87ebc46](https://medium.com/dfrlab/fakes-bots-and-blockings-in-armenia-44a4c87ebc46) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00022.md b/generated_pages/incidents/I00022.md index 5f3a140..17a5f41 100644 --- a/generated_pages/incidents/I00022.md +++ b/generated_pages/incidents/I00022.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Russia , France @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://medium.com/dfrlab/hashtag-campaign-macronleaks-4a3fb870c4e8](https://medium.com/dfrlab/hashtag-campaign-macronleaks-4a3fb870c4e8) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00023.md b/generated_pages/incidents/I00023.md index 55a96b0..da22bd2 100644 --- a/generated_pages/incidents/I00023.md +++ b/generated_pages/incidents/I00023.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Russia , France @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://medium.com/dfrlab/russian-and-french-twitter-mobs-in-election-push-bca327aa41a5](https://medium.com/dfrlab/russian-and-french-twitter-mobs-in-election-push-bca327aa41a5) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00024.md b/generated_pages/incidents/I00024.md index 15635dd..1d62aac 100644 --- a/generated_pages/incidents/I00024.md +++ b/generated_pages/incidents/I00024.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Syria , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://medium.com/dfrlab/how-the-alt-right-brought-syriahoax-to-america-47745118d1c9](https://medium.com/dfrlab/how-the-alt-right-brought-syriahoax-to-america-47745118d1c9) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00025.md b/generated_pages/incidents/I00025.md index 277bf8c..e67e334 100644 --- a/generated_pages/incidents/I00025.md +++ b/generated_pages/incidents/I00025.md @@ -6,7 +6,7 @@ Verdict: “An EU army marching out to war under Brussels’ command is a fantas * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , EU @@ -15,9 +15,8 @@ Verdict: “An EU army marching out to war under Brussels’ command is a fantas * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://medium.com/dfrlab/spread-it-on-reddit-3170a463e787](https://medium.com/dfrlab/spread-it-on-reddit-3170a463e787) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00026.md b/generated_pages/incidents/I00026.md index e227f0c..b66cfa9 100644 --- a/generated_pages/incidents/I00026.md +++ b/generated_pages/incidents/I00026.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Russia , Netherlands @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.washingtonpost.com/opinions/russias-influence-in-western-elections/2016/04/08/b427602a-fcf1-11e5-886f-a037dba38301_story.html](https://www.washingtonpost.com/opinions/russias-influence-in-western-elections/2016/04/08/b427602a-fcf1-11e5-886f-a037dba38301_story.html) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00027.md b/generated_pages/incidents/I00027.md index 592c827..37d459a 100644 --- a/generated_pages/incidents/I00027.md +++ b/generated_pages/incidents/I00027.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** Russia , Ukraine @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://helda.helsinki.fi//bitstream/handle/10138/233374/KhaldarovaPanttiFakeNews.pdf?sequence=1](https://helda.helsinki.fi//bitstream/handle/10138/233374/KhaldarovaPanttiFakeNews.pdf?sequence=1) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00028.md b/generated_pages/incidents/I00028.md index 93d60e5..5a3154d 100644 --- a/generated_pages/incidents/I00028.md +++ b/generated_pages/incidents/I00028.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** Russia , Ukraine @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.stopfake.org/en/lies-spanish-flight-operations-officer-from-kiev-informed-about-ukrainian-planes-involved-in-boeing-tragedy/%20https:/globalvoices.org/2014/07/20/the-russian-governments-7000-wikipedia-edits/%20https:/foreignpolicy.com/2016/09/29/how-mh17-gave-birth-to-the-modern-russian-spin-machine-putin-ukraine/](https://www.stopfake.org/en/lies-spanish-flight-operations-officer-from-kiev-informed-about-ukrainian-planes-involved-in-boeing-tragedy/%20https:/globalvoices.org/2014/07/20/the-russian-governments-7000-wikipedia-edits/%20https:/foreignpolicy.com/2016/09/29/how-mh17-gave-birth-to-the-modern-russian-spin-machine-putin-ukraine/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00029.md b/generated_pages/incidents/I00029.md index 04c964f..f519da6 100644 --- a/generated_pages/incidents/I00029.md +++ b/generated_pages/incidents/I00029.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Russia , Ukraine @@ -13,11 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.novayagazeta.ru/news/2015/05/07/112052-facebook-zablokiroval-sergeya-parhomenko-za-kommentariy-doklada-o-sbitom-171-boinge-187%20](https://www.novayagazeta.ru/news/2015/05/07/112052-facebook-zablokiroval-sergeya-parhomenko-za-kommentariy-doklada-o-sbitom-171-boinge-187%20) | -| [https://news.online.ua/754036/v-sotssetyah-na-paltsah-pokazali-kak-rabotayut-boty-kremlya-opublikovany-foto/](https://news.online.ua/754036/v-sotssetyah-na-paltsah-pokazali-kak-rabotayut-boty-kremlya-opublikovany-foto/) | -| [https://www.mirror.co.uk/news/world-news/ukraine-involved-mh17-downing-claims-14184413](https://www.mirror.co.uk/news/world-news/ukraine-involved-mh17-downing-claims-14184413) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00030.md b/generated_pages/incidents/I00030.md index bfb1628..795fead 100644 --- a/generated_pages/incidents/I00030.md +++ b/generated_pages/incidents/I00030.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , World @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://slate.com/culture/2018/10/last-jedi-star-wars-twitter-backlash-russia-trolls.html](https://slate.com/culture/2018/10/last-jedi-star-wars-twitter-backlash-russia-trolls.html) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00031.md b/generated_pages/incidents/I00031.md index 12d5cf0..8f99059 100644 --- a/generated_pages/incidents/I00031.md +++ b/generated_pages/incidents/I00031.md @@ -4,7 +4,7 @@ * **incident type**: apt -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , World @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://ajph.aphapublications.org/doi/pdf/10.2105/AJPH.2018.304567](https://ajph.aphapublications.org/doi/pdf/10.2105/AJPH.2018.304567) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00032.md b/generated_pages/incidents/I00032.md index b94bb8b..6e5dd96 100644 --- a/generated_pages/incidents/I00032.md +++ b/generated_pages/incidents/I00032.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://qz.com/1409102/russian-trolls-and-bots-are-flooding-twitter-with-ford-kavanaugh-disinformation/](https://qz.com/1409102/russian-trolls-and-bots-are-flooding-twitter-with-ford-kavanaugh-disinformation/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00033.md b/generated_pages/incidents/I00033.md index 87d2272..ffbfcaf 100644 --- a/generated_pages/incidents/I00033.md +++ b/generated_pages/incidents/I00033.md @@ -4,7 +4,7 @@ * **incident type**: apt -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** China , China @@ -13,10 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://gking.harvard.edu/files/gking/files/how_the_chinese_government_fabricates_social_media_posts_for_strategic_distraction_not_engaged_argument.pdf](https://gking.harvard.edu/files/gking/files/how_the_chinese_government_fabricates_social_media_posts_for_strategic_distraction_not_engaged_argument.pdf) | -| [https://www.voanews.com/a/who-is-that-chinese-troll/3540663.html](https://www.voanews.com/a/who-is-that-chinese-troll/3540663.html) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00034.md b/generated_pages/incidents/I00034.md index 5b6117b..48b10ef 100644 --- a/generated_pages/incidents/I00034.md +++ b/generated_pages/incidents/I00034.md @@ -6,7 +6,7 @@ Unique for taking place outside of the Chinese Internet system, both transgressi * **incident type**: incident -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** China , Taiwan @@ -15,10 +15,8 @@ Unique for taking place outside of the Chinese Internet system, both transgressi * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.ideals.illinois.edu/handle/2142/96746](https://www.ideals.illinois.edu/handle/2142/96746) | -| [https://qz.com/598812/an-army-of-chinese-trolls-has-jumped-the-great-firewall-to-attack-taiwanese-independence-on-facebook/](https://qz.com/598812/an-army-of-chinese-trolls-has-jumped-the-great-firewall-to-attack-taiwanese-independence-on-facebook/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00035.md b/generated_pages/incidents/I00035.md index 4a684fc..563060b 100644 --- a/generated_pages/incidents/I00035.md +++ b/generated_pages/incidents/I00035.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** Brazil , Brazil @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://blogs.oii.ox.ac.uk/politicalbots/wp-content/uploads/sites/89/2017/06/Comprop-Brazil-1.pdf](https://blogs.oii.ox.ac.uk/politicalbots/wp-content/uploads/sites/89/2017/06/Comprop-Brazil-1.pdf) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00036.md b/generated_pages/incidents/I00036.md index 61f0954..cc2fef0 100644 --- a/generated_pages/incidents/I00036.md +++ b/generated_pages/incidents/I00036.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** Brazil , Brazil @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.wilsoncenter.org/blog-post/bots-brazil-the-activity-social-media-bots-brazilian-elections](https://www.wilsoncenter.org/blog-post/bots-brazil-the-activity-social-media-bots-brazilian-elections) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00037.md b/generated_pages/incidents/I00037.md index ea2fcdd..3ee644f 100644 --- a/generated_pages/incidents/I00037.md +++ b/generated_pages/incidents/I00037.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Brazil , Brazil @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www1.folha.uol.com.br/poder/eleicoes-2016/2016/10/1823713-eleicao-no-rio-tem-tatica-antiboato-e-suspeita-de-uso-de-robos.shtml](https://www1.folha.uol.com.br/poder/eleicoes-2016/2016/10/1823713-eleicao-no-rio-tem-tatica-antiboato-e-suspeita-de-uso-de-robos.shtml) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00038.md b/generated_pages/incidents/I00038.md index 2253ab6..3555415 100644 --- a/generated_pages/incidents/I00038.md +++ b/generated_pages/incidents/I00038.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Brazil , Brazil @@ -13,10 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [http://www.labic.net/cartografia/a-rede-das-imagens-da-vaiadilma-novas-relacoes/](http://www.labic.net/cartografia/a-rede-das-imagens-da-vaiadilma-novas-relacoes/) | -| [https://www.researchgate.net/publication/300415619_The_Influence_of_Retweeting_Robots_During_Brazilian_Protests](https://www.researchgate.net/publication/300415619_The_Influence_of_Retweeting_Robots_During_Brazilian_Protests) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00039.md b/generated_pages/incidents/I00039.md index 0f7ec48..9af5982 100644 --- a/generated_pages/incidents/I00039.md +++ b/generated_pages/incidents/I00039.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Unknown , Germany @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.buzzfeed.com/albertonardelli/hyperpartisan-sites-and-facebook-pages-are-publishing-false](https://www.buzzfeed.com/albertonardelli/hyperpartisan-sites-and-facebook-pages-are-publishing-false) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00040.md b/generated_pages/incidents/I00040.md index 9969d76..d53931a 100644 --- a/generated_pages/incidents/I00040.md +++ b/generated_pages/incidents/I00040.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2015 +* **Year started:** 2015.0 * **Countries:** Unknown , Germany @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://www.nytimes.com/2017/02/06/business/syria-refugee-anas-modamani-germany-facebook.html](https://www.nytimes.com/2017/02/06/business/syria-refugee-anas-modamani-germany-facebook.html) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00041.md b/generated_pages/incidents/I00041.md index 6146ec0..742b60b 100644 --- a/generated_pages/incidents/I00041.md +++ b/generated_pages/incidents/I00041.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Unknown , Germany @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://uebermedien.de/11488/kartenlegen-mit-kriminellen-auslaendern/](https://uebermedien.de/11488/kartenlegen-mit-kriminellen-auslaendern/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00042.md b/generated_pages/incidents/I00042.md index b30d132..de4c466 100644 --- a/generated_pages/incidents/I00042.md +++ b/generated_pages/incidents/I00042.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** SaudiArabia , Qatar @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf](https://jia.sipa.columbia.edu/robot-wars-how-bots-joined-battle-gulf) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00043.md b/generated_pages/incidents/I00043.md index de6110c..5bbbbf7 100644 --- a/generated_pages/incidents/I00043.md +++ b/generated_pages/incidents/I00043.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Unknown , USA @@ -13,9 +13,8 @@ * **Date added:** 2019-02-24 -| Reference(s) | -| --------- | -| [https://gizmodo.com/how-an-investigation-of-fake-fcc-comments-snared-a-prom-1832788658](https://gizmodo.com/how-an-investigation-of-fake-fcc-comments-snared-a-prom-1832788658) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00044.md b/generated_pages/incidents/I00044.md index 912ad9b..2355ec9 100644 --- a/generated_pages/incidents/I00044.md +++ b/generated_pages/incidents/I00044.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2015 +* **Year started:** 2015.0 * **Countries:** Russia , USA @@ -13,15 +13,13 @@ * **Date added:** 2019-02-25 -| Reference(s) | -| --------- | -| [https://www.politifact.com/texas/article/2018/may/03/jade-helm-15-greg-abbott-texas-state-guard-hayden-/](https://www.politifact.com/texas/article/2018/may/03/jade-helm-15-greg-abbott-texas-state-guard-hayden-/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0009 Create Fake Experts](../../generated_pages/techniques/T0009.md) | IT00000127 Promote fake “experts” with impressive (and scary) titles | | [T0010 Cultivate Ignorant Agents](../../generated_pages/techniques/T0010.md) | IT00000126 cultivate, manipulate, exploit useful idiots (Alex Jones... drives conspiracy theories) | | [T0020 Trial Content](../../generated_pages/techniques/T0020.md) | IT00000124 4Chan/8Chan - trial content | | [T0046 Use Search Engine Optimisation](../../generated_pages/techniques/T0046.md) | IT00000125 SEO optimisation/manipulation ("key words") | diff --git a/generated_pages/incidents/I00045.md b/generated_pages/incidents/I00045.md index cf4d28f..f65587b 100644 --- a/generated_pages/incidents/I00045.md +++ b/generated_pages/incidents/I00045.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , UK @@ -13,10 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.bellingcat.com/tag/skripal/](https://www.bellingcat.com/tag/skripal/) | -| [https://euvsdisinfo.eu/conspiracy-mania-marks-one-year-anniversary-of-the-skripal-poisoning/](https://euvsdisinfo.eu/conspiracy-mania-marks-one-year-anniversary-of-the-skripal-poisoning/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00046.md b/generated_pages/incidents/I00046.md index 2cd8730..6c8dcff 100644 --- a/generated_pages/incidents/I00046.md +++ b/generated_pages/incidents/I00046.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , Macedonia @@ -13,10 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.nytimes.com/2018/09/16/world/europe/macedonia-referendum-russia-nato.html](https://www.nytimes.com/2018/09/16/world/europe/macedonia-referendum-russia-nato.html) | -| [https://www.polygraph.info/a/disinfo-analysis-macedonia-nato-russia/29770631.html](https://www.polygraph.info/a/disinfo-analysis-macedonia-nato-russia/29770631.html) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00047.md b/generated_pages/incidents/I00047.md index 19e62bc..846b75f 100644 --- a/generated_pages/incidents/I00047.md +++ b/generated_pages/incidents/I00047.md @@ -5,7 +5,7 @@ The Russian Federal Security Service (FSB), which is also responsible for border * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , World @@ -14,9 +14,8 @@ The Russian Federal Security Service (FSB), which is also responsible for border * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://euvsdisinfo.eu/wave-of-disinformation-from-the-azov-sea/](https://euvsdisinfo.eu/wave-of-disinformation-from-the-azov-sea/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00048.md b/generated_pages/incidents/I00048.md index c942bc9..7815bfb 100644 --- a/generated_pages/incidents/I00048.md +++ b/generated_pages/incidents/I00048.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2015 +* **Year started:** 2015.0 * **Countries:** Russia , World @@ -13,10 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://thesyriacampaign.org/wp-content/uploads/2017/12/KillingtheTruth.pdf](https://thesyriacampaign.org/wp-content/uploads/2017/12/KillingtheTruth.pdf) | -| [https://www.theguardian.com/world/2017/dec/18/syria-white-helmets-conspiracy-theories](https://www.theguardian.com/world/2017/dec/18/syria-white-helmets-conspiracy-theories) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00049.md b/generated_pages/incidents/I00049.md index 66d4aa0..90d0ed7 100644 --- a/generated_pages/incidents/I00049.md +++ b/generated_pages/incidents/I00049.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Russia , World @@ -13,11 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [http://www.publications.atlanticcouncil.org/breakingghouta/disinformation-2/](http://www.publications.atlanticcouncil.org/breakingghouta/disinformation-2/) | -| [https://www.bellingcat.com/news/mena/2018/12/18/chemical-weapons-and-absurdity-the-disinformation-campaign-against-the-white-helmets/](https://www.bellingcat.com/news/mena/2018/12/18/chemical-weapons-and-absurdity-the-disinformation-campaign-against-the-white-helmets/) | -| [https://www.nybooks.com/daily/2018/10/16/why-assad-and-russia-target-the-white-helmets/](https://www.nybooks.com/daily/2018/10/16/why-assad-and-russia-target-the-white-helmets/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00050.md b/generated_pages/incidents/I00050.md index 293996d..3854b69 100644 --- a/generated_pages/incidents/I00050.md +++ b/generated_pages/incidents/I00050.md @@ -7,7 +7,7 @@ Maduro has remained defiant in the face of domestic and international pressure, * **incident type**: incident -* **Year started:** 2019 +* **Year started:** 2019.0 * **Countries:** Russia , World @@ -16,9 +16,8 @@ Maduro has remained defiant in the face of domestic and international pressure, * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/](https://euvsdisinfo.eu/twitter-as-an-information-battlefield-venezuela-a-case-study/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00051.md b/generated_pages/incidents/I00051.md index 0603584..8532ac6 100644 --- a/generated_pages/incidents/I00051.md +++ b/generated_pages/incidents/I00051.md @@ -5,7 +5,7 @@ The FCO comments on the IfS were issued after a news report said the group had r * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , World @@ -14,10 +14,8 @@ The FCO comments on the IfS were issued after a news report said the group had r * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/](https://eaworldview.com/2019/01/counter-russia-disinformation-integrity-initiative/) | -| [https://www.stopfake.org/en/kremlin-watch-briefing-the-eu-has-to-start-taking-pro-kremlin-disinformation-seriously/](https://www.stopfake.org/en/kremlin-watch-briefing-the-eu-has-to-start-taking-pro-kremlin-disinformation-seriously/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00052.md b/generated_pages/incidents/I00052.md index 4a8073b..015e4be 100644 --- a/generated_pages/incidents/I00052.md +++ b/generated_pages/incidents/I00052.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2015 +* **Year started:** 2015.0 * **Countries:** China , World @@ -13,9 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.recordedfuture.com/china-social-media-operations/](https://www.recordedfuture.com/china-social-media-operations/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00053.md b/generated_pages/incidents/I00053.md index 321549b..074136f 100644 --- a/generated_pages/incidents/I00053.md +++ b/generated_pages/incidents/I00053.md @@ -5,7 +5,7 @@ Geopolitically complex issue combines US/China trade; Security concerns/issues r * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** China , World @@ -14,10 +14,8 @@ Geopolitically complex issue combines US/China trade; Security concerns/issues r * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.theatlantic.com/international/archive/2019/03/czech-zeman-babis-huawei-xi-trump/584158/](https://www.theatlantic.com/international/archive/2019/03/czech-zeman-babis-huawei-xi-trump/584158/) | -| [https://www.theglobeandmail.com/politics/article-chinas-envoy-says-white-supremacy-played-part-in-canadas-arrest-of/](https://www.theglobeandmail.com/politics/article-chinas-envoy-says-white-supremacy-played-part-in-canadas-arrest-of/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00054.md b/generated_pages/incidents/I00054.md index 7af2308..055b930 100644 --- a/generated_pages/incidents/I00054.md +++ b/generated_pages/incidents/I00054.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** China , World @@ -13,10 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.ctvnews.ca/world/china-says-foreign-concerns-over-muslim-rights-unwarranted-1.4178042](https://www.ctvnews.ca/world/china-says-foreign-concerns-over-muslim-rights-unwarranted-1.4178042) | -| [https://www.reuters.com/investigates/special-report/muslims-camps-china/](https://www.reuters.com/investigates/special-report/muslims-camps-china/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00055.md b/generated_pages/incidents/I00055.md index bf6499a..2e04544 100644 --- a/generated_pages/incidents/I00055.md +++ b/generated_pages/incidents/I00055.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2008 +* **Year started:** 2008.0 * **Countries:** China , World @@ -13,9 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.voanews.com/a/who-is-that-chinese-troll/3540663.html](https://www.voanews.com/a/who-is-that-chinese-troll/3540663.html) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00056.md b/generated_pages/incidents/I00056.md index ca7e351..78c319e 100644 --- a/generated_pages/incidents/I00056.md +++ b/generated_pages/incidents/I00056.md @@ -5,7 +5,7 @@ While there is history to Iran’s information/influence operations, starting wi * **incident type**: campaign -* **Year started:** 2012 +* **Year started:** 2012.0 * **Countries:** Iran , World @@ -14,14 +14,8 @@ While there is history to Iran’s information/influence operations, starting wi * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.fireeye.com/blog/threat-research/2018/08/suspected-iranian-influence-operation.html](https://www.fireeye.com/blog/threat-research/2018/08/suspected-iranian-influence-operation.html) | -| [https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT](https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT) | -| [https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT](https://www.reuters.com/article/us-cyber-iran-specialreport/special-report-how-iran-spreads-disinformation-around-the-world-idUSKCN1NZ1FT) | -| [https://www.rand.org/blog/2018/08/irans-disinformation-campaigns.html](https://www.rand.org/blog/2018/08/irans-disinformation-campaigns.html) | -| [https://medium.com/dfrlab/takedown-details-of-the-iranian-propaganda-network-d1fad32fdf30](https://medium.com/dfrlab/takedown-details-of-the-iranian-propaganda-network-d1fad32fdf30) | -| [https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8dhttps://comprop.oii.ox.ac.uk/wp-content/uploads/sites/93/2019/04/Iran-Memo.pdf](https://medium.com/dfrlab/trolltracker-outward-influence-operation-from-iran-cc4539684c8dhttps://comprop.oii.ox.ac.uk/wp-content/uploads/sites/93/2019/04/Iran-Memo.pdf) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00057.md b/generated_pages/incidents/I00057.md index 9c4c217..d41429c 100644 --- a/generated_pages/incidents/I00057.md +++ b/generated_pages/incidents/I00057.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia,Mexico , Mexico @@ -13,10 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.smh.com.au/world/north-america/misinformation-seeded-by-bots-and-trolls-invades-mexico-s-election-20180502-p4zctx.html](https://www.smh.com.au/world/north-america/misinformation-seeded-by-bots-and-trolls-invades-mexico-s-election-20180502-p4zctx.html) | -| [https://medium.com/dfrlab/electionwatch-russian-bots-in-mexico-46003fcab4](https://medium.com/dfrlab/electionwatch-russian-bots-in-mexico-46003fcab4) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00058.md b/generated_pages/incidents/I00058.md index 5962e3c..42872e5 100644 --- a/generated_pages/incidents/I00058.md +++ b/generated_pages/incidents/I00058.md @@ -4,7 +4,7 @@ * **incident type**: incident -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , Germany @@ -13,10 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.thebureauinvestigates.com/stories/2018-09-04/chemnitz-far-right-alternative-news](https://www.thebureauinvestigates.com/stories/2018-09-04/chemnitz-far-right-alternative-news) | -| [http://www.spiegel.de/international/germany/merkel-facing-turbulence-after-right-wing-unrest-a-1228121.html](http://www.spiegel.de/international/germany/merkel-facing-turbulence-after-right-wing-unrest-a-1228121.html) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00059.md b/generated_pages/incidents/I00059.md index ddde35f..6f943b0 100644 --- a/generated_pages/incidents/I00059.md +++ b/generated_pages/incidents/I00059.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2014 +* **Year started:** 2014.0 * **Countries:** Myanmar , Myanmar @@ -13,11 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.reuters.com/investigates/special-report/myanmar-facebook-hate/](https://www.reuters.com/investigates/special-report/myanmar-facebook-hate/) | -| [https://www.nytimes.com/2018/10/15/technology/myanmar-facebook-genocide.html?action=click&module=Top%20Stories&pgtype=Homepage](https://www.nytimes.com/2018/10/15/technology/myanmar-facebook-genocide.html?action=click&module=Top%20Stories&pgtype=Homepage) | -| [https://www.lawfareblog.com/facebooks-role-genocide-myanmar-new-reporting-complicates-narrative](https://www.lawfareblog.com/facebooks-role-genocide-myanmar-new-reporting-complicates-narrative) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00060.md b/generated_pages/incidents/I00060.md index 06b432a..4258a63 100644 --- a/generated_pages/incidents/I00060.md +++ b/generated_pages/incidents/I00060.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2018 +* **Year started:** 2018.0 * **Countries:** Russia , World @@ -13,11 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.smh.com.au/world/oceania/the-high-price-of-white-genocide-politics-for-australia-20180724-p4zt9k.html](https://www.smh.com.au/world/oceania/the-high-price-of-white-genocide-politics-for-australia-20180724-p4zt9k.html) | -| [https://www.theatlantic.com/politics/archive/2018/08/trump-white-nationalism/568393/](https://www.theatlantic.com/politics/archive/2018/08/trump-white-nationalism/568393/) | -| [https://www.iafrikan.com/2018/11/20/social-media-usa-south-africa-fake-news-disinformation/](https://www.iafrikan.com/2018/11/20/social-media-usa-south-africa-fake-news-disinformation/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00061.md b/generated_pages/incidents/I00061.md index 8d44d35..2005b69 100644 --- a/generated_pages/incidents/I00061.md +++ b/generated_pages/incidents/I00061.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** Russia , US @@ -13,12 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.stripes.com/congressmen-urge-fbi-to-investigate-bots-targeting-veterans-with-fake-news-1.573284](https://www.stripes.com/congressmen-urge-fbi-to-investigate-bots-targeting-veterans-with-fake-news-1.573284) | -| [https://www.voanews.com/a/russia-influence-operations-taking-aim-at-us-military/4640751.html](https://www.voanews.com/a/russia-influence-operations-taking-aim-at-us-military/4640751.html) | -| [https://www.washingtonpost.com/news/the-switch/wp/2017/10/09/russian-operatives-used-twitter-and-facebook-to-target-veterans-and-military-personnel-study-says/?utm_term=.d6fa34d4819c](https://www.washingtonpost.com/news/the-switch/wp/2017/10/09/russian-operatives-used-twitter-and-facebook-to-target-veterans-and-military-personnel-study-says/?utm_term=.d6fa34d4819c) | -| [https://comprop.oii.ox.ac.uk/research/working-papers/vetops/](https://comprop.oii.ox.ac.uk/research/working-papers/vetops/) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00062.md b/generated_pages/incidents/I00062.md index 3ffd262..160e1e2 100644 --- a/generated_pages/incidents/I00062.md +++ b/generated_pages/incidents/I00062.md @@ -4,7 +4,7 @@ * **incident type**: campaign -* **Year started:** 2015 +* **Year started:** 2015.0 * **Countries:** Russia,UK , UK @@ -13,10 +13,8 @@ * **Date added:** 2019-03-20 -| Reference(s) | -| --------- | -| [https://www.politico.eu/article/britain-nationalist-dark-web-populism-tommy-robinson/?](https://www.politico.eu/article/britain-nationalist-dark-web-populism-tommy-robinson/?) | -| [http://www.europarl.europa.eu/thinktank/en/document.html?reference=EPRS_STU(2019)634414](http://www.europarl.europa.eu/thinktank/en/document.html?reference=EPRS_STU(2019)634414) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00063.md b/generated_pages/incidents/I00063.md index 295b7e6..2d56fd0 100644 --- a/generated_pages/incidents/I00063.md +++ b/generated_pages/incidents/I00063.md @@ -1,12 +1,10 @@ # Incident I00063: Olympic Doping Scandal -* **Summary:** On 18 July 2016, Richard McLaren, a Canadian attorney retained by WADA to investigate Grigor Rodchenkov (the former head of Russia's national anti-doping laboratory, the Anti-Doping Center, which was suspended by the World Anti-Doping Agency (WADA) in November 2015 for facilitating Russia's elaborate state-sponsored doping program. Rodchenkov helped develop and distribute banned performance-enhancing substances for thousands of Russian Olympians from 2005 to 2015. He made headlines in 2016 as a whistleblower, helping expose the complex and extensive nature of Russia's doping program. His revelations lead to Russia's partial ban from the 2016 Summer Olympics and total ban from the 2018 Winter Olympics.). These allegations led to a 97-page report covering significant state-sponsored doping in Russia. - -The investigation found corroborating evidence after conducting witness interviews, reviewing thousands of documents, analysis of hard drives, forensic analysis of urine sample collection bottles, and laboratory analysis of individual athlete samples, with "more evidence becoming available by the day." The report concluded that it was shown "beyond a reasonable doubt" that Russia's Ministry of Sport, the Centre of Sports Preparation of the National Teams of Russia, the Federal Security Service (FSB), and the WADA-accredited laboratory in Moscow had "operated for the protection of doped Russian athletes" within a "state-directed failsafe system" using "the disappearing positive [test] methodology" (DPM) after the country's poor medal count during the 2010 Winter Olympic Games in Vancouver. McLaren stated that urine samples were opened in Sochi in order to swap them "without any evidence to the untrained eye". The official producer of BEREG-KIT security bottles used for anti-doping tests, Berlinger Group, stated, "We have no knowledge of the specifications, the methods or the procedures involved in the tests and experiments conducted by the McLaren Commission." +* **Summary:** On 18 July 2016, Richard McLaren, a Canadian attorney retained by WADA to investigate Grigor Rodchenkov (the former head of Russia's national anti-doping laboratory, the Anti-Doping Center, which was suspended by the World Anti-Doping Agency (WADA) in November 2015 for facilitating Russia's elaborate state-sponsored doping program. Rodchenkov helped develop and distribute banned performance-enhancing substances for thousands of Russian Olympians from 2005 to 2015. He made headlines in 2016 as a whistleblower, helping expose the complex and extensive nature of Russia's doping program. His revelations lead to Russia's partial ban from the 2016 Summer Olympics and total ban from the 2018 Winter Olympics.). These allegations led to a 97-page report covering significant state-sponsored doping in Russia.

The investigation found corroborating evidence after conducting witness interviews, reviewing thousands of documents, analysis of hard drives, forensic analysis of urine sample collection bottles, and laboratory analysis of individual athlete samples, with "more evidence becoming available by the day." The report concluded that it was shown "beyond a reasonable doubt" that Russia's Ministry of Sport, the Centre of Sports Preparation of the National Teams of Russia, the Federal Security Service (FSB), and the WADA-accredited laboratory in Moscow had "operated for the protection of doped Russian athletes" within a "state-directed failsafe system" using "the disappearing positive [test] methodology" (DPM) after the country's poor medal count during the 2010 Winter Olympic Games in Vancouver. McLaren stated that urine samples were opened in Sochi in order to swap them "without any evidence to the untrained eye". The official producer of BEREG-KIT security bottles used for anti-doping tests, Berlinger Group, stated, "We have no knowledge of the specifications, the methods or the procedures involved in the tests and experiments conducted by the McLaren Commission.” * **incident type**: campaign -* **Year started:** 2016 +* **Year started:** 2016.0 * **Countries:** Russia , World @@ -15,9 +13,8 @@ The investigation found corroborating evidence after conducting witness intervie * **Date added:** 2019-04-06 -| Reference(s) | -| --------- | -| [https://www.nytimes.com/2016/05/13/sports/russia-doping-sochi-olympics-2014.html?module=inline](https://www.nytimes.com/2016/05/13/sports/russia-doping-sochi-olympics-2014.html?module=inline) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | diff --git a/generated_pages/incidents/I00064.md b/generated_pages/incidents/I00064.md index 52b0496..01747d0 100644 --- a/generated_pages/incidents/I00064.md +++ b/generated_pages/incidents/I00064.md @@ -1,10 +1,10 @@ # Incident I00064: Tinder nightmares: the promise and peril of political bots -* **Summary:** > In the days leading up to the UK’s general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes. +* **Summary:** “In the days leading up to the UK’s [2019] general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes.” * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** UK , UK @@ -13,19 +13,17 @@ * **Date added:** 2024-03-12 -| Reference(s) | -| --------- | -| [https://www.wired.co.uk/article/tinder-political-bots-jeremy-corbyn-labour](https://www.wired.co.uk/article/tinder-political-bots-jeremy-corbyn-labour) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.wired.co.uk/article/tinder-political-bots-jeremy-corbyn-labour](https://www.wired.co.uk/article/tinder-political-bots-jeremy-corbyn-labour) | 2017/07/07 | Robert Gorwa, Douglas Guilbeault | Wired | [https://web.archive.org/web/20240715171942/https://www.wired.com/story/tinder-political-bots-jeremy-corbyn-labour/](https://web.archive.org/web/20240715171942/https://www.wired.com/story/tinder-political-bots-jeremy-corbyn-labour/) | | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0104.002 Dating App](../../generated_pages/techniques/T0104.002.md) | IT00000214 > In the days leading up to the UK’s [2017] general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes. - -> Tinder is a dating app where users swipe right to indicate attraction and interest in a potential partner. If both people swipe right on each other’s profile, a dialogue box becomes available for them to privately chat. After meeting their crowdfunding goal of only £500, the team built a tool which took over and operated the accounts of recruited Tinder-users. By upgrading the profiles to Tinder Premium, the team was able to place bots in any contested constituency across the UK. Once planted, the bots swiped right on all users in the attempt to get the largest number of matches and inquire into their voting intentions. - -This incident matches _T0104.002: Dating App,_ as users of Tinder were targeted in an attempt to persuade users to vote for a particular party in the upcoming election, rather than for the purpose of connecting those who were authentically interested in dating each other. | +| [T0104.002 Dating App](../../generated_pages/techniques/T0104.002.md) | IT00000214 _"In the days leading up to the UK’s [2017] general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes._

_"Tinder is a dating app where users swipe right to indicate attraction and interest in a potential partner. If both people swipe right on each other’s profile, a dialogue box becomes available for them to privately chat. After meeting their crowdfunding goal of only £500, the team built a tool which took over and operated the accounts of recruited Tinder-users. By upgrading the profiles to Tinder Premium, the team was able to place bots in any contested constituency across the UK. Once planted, the bots swiped right on all users in the attempt to get the largest number of matches and inquire into their voting intentions."_

This incident matches T0104.002: Dating App, as users of Tinder were targeted in an attempt to persuade users to vote for a particular party in the upcoming election, rather than for the purpose of connecting those who were authentically interested in dating each other. | +| [T0141.001 Acquire Compromised Account](../../generated_pages/techniques/T0141.001.md) | IT00000240 “In the days leading up to the UK’s [2019] general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes. [...]

“The activists maintain that the project was meant to foster democratic engagement. But screenshots of the bots’ activity expose a harsher reality. Images of conversations between real users and these bots, posted on i-D, Mashable, as well as on Fowler and Goodman’s public Twitter accounts, show that the bots did not identify themselves as automated accounts, instead posing as the user whose profile they had taken over. While conducting research for this story, it turned out that a number of [the reporters’ friends] living in Oxford had interacted with the bot in the lead up to the election and had no idea that it was not a real person.”

In this example people offered up their real accounts for the automation of political messaging; the actors convinced the users to give up access to their accounts to use in the operation (T0141.001: Acquire Compromised Account). The actors maintained the accounts’ existing persona, and presented themselves as potential romantic suitors for legitimate platform users (T0097:109 Romantic Suitor Persona, T0143.003: Impersonated Persona). | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000242 “In the days leading up to the UK’s [2019] general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes. [...]

“The activists maintain that the project was meant to foster democratic engagement. But screenshots of the bots’ activity expose a harsher reality. Images of conversations between real users and these bots, posted on i-D, Mashable, as well as on Fowler and Goodman’s public Twitter accounts, show that the bots did not identify themselves as automated accounts, instead posing as the user whose profile they had taken over. While conducting research for this story, it turned out that a number of [the reporters’ friends] living in Oxford had interacted with the bot in the lead up to the election and had no idea that it was not a real person.”

In this example people offered up their real accounts for the automation of political messaging; the actors convinced the users to give up access to their accounts to use in the operation (T0141.001: Acquire Compromised Account). The actors maintained the accounts’ existing persona, and presented themselves as potential romantic suitors for legitimate platform users (T0097:109 Romantic Suitor Persona, T0143.003: Impersonated Persona). | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00065.md b/generated_pages/incidents/I00065.md index a1278bb..9e67f51 100644 --- a/generated_pages/incidents/I00065.md +++ b/generated_pages/incidents/I00065.md @@ -1,10 +1,10 @@ # Incident I00065: 'Ghostwriter' Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned With Russian Security Interests -* **Summary:** > Mandiant Threat Intelligence has tied together several information operations that we assess with moderate confidence comprise part of a broader influence campaign—ongoing since at least March 2017—aligned with Russian security interests. The operations have primarily targeted audiences in Lithuania, Latvia, and Poland with narratives critical of the North Atlantic Treaty Organization’s (NATO) presence in Eastern Europe, occasionally leveraging other themes such as anti-U.S. and COVID-19-related narratives as part of this broader anti-NATO agenda. We have dubbed this campaign “Ghostwriter.” +* **Summary:** “Mandiant Threat Intelligence has tied together several information operations that we assess with moderate confidence comprise part of a broader influence campaign—ongoing since at least March 2017—aligned with Russian security interests. The operations have primarily targeted audiences in Lithuania, Latvia, and Poland with narratives critical of the North Atlantic Treaty Organization’s (NATO) presence in Eastern Europe, occasionally leveraging other themes such as anti-U.S. and COVID-19-related narratives as part of this broader anti-NATO agenda. We have dubbed this campaign “Ghostwriter.”” * **incident type**: campaign -* **Year started:** 2020 +* **Year started:** 2020.0 * **Countries:** Belarus , Lithuania, Latvia, Poland @@ -13,17 +13,15 @@ * **Date added:** 2024-03-12 -| Reference(s) | -| --------- | -| [https://www.mandiant.com/resources/blog/ghostwriter-influence-campaign](https://www.mandiant.com/resources/blog/ghostwriter-influence-campaign) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.mandiant.com/resources/blog/ghostwriter-influence-campaign](https://www.mandiant.com/resources/blog/ghostwriter-influence-campaign) | 2020/07/28 | Lee Foster, Sam Riddell, David Mainor, Gabby Roncone | Mandiant | [https://web.archive.org/web/20240621162043/https://cloud.google.com/blog/topics/threat-intelligence/ghostwriter-influence-campaign/](https://web.archive.org/web/20240621162043/https://cloud.google.com/blog/topics/threat-intelligence/ghostwriter-influence-campaign/) | | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0141.001 Acquire Compromised Account](../../generated_pages/techniques/T0141.001.md) | IT00000215 > Overall, narratives promoted in the five operations appear to represent a concerted effort to discredit the ruling political coalition, widen existing domestic political divisions and project an image of coalition disunity in Poland. In each incident, content was primarily disseminated via Twitter, Facebook, and/ or Instagram accounts belonging to Polish politicians, all of whom have publicly claimed their accounts were compromised at the times the posts were made.   - -This example demonstrates how threat actors can use _T0141.001: Acquire Compromised Account_ to distribute inauthentic content while exploiting the legitimate account holder’s persona. | +| [T0141.001 Acquire Compromised Account](../../generated_pages/techniques/T0141.001.md) | IT00000215 _”Overall, narratives promoted in the five operations appear to represent a concerted effort to discredit the ruling political coalition, widen existing domestic political divisions and project an image of coalition disunity in Poland. In each incident, content was primarily disseminated via Twitter, Facebook, and/ or Instagram accounts belonging to Polish politicians, all of whom have publicly claimed their accounts were compromised at the times the posts were made."_

This example demonstrates how threat actors can use _T0141.001: Acquire Compromised Account_ to distribute inauthentic content while exploiting the legitimate account holder’s persona. | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00066.md b/generated_pages/incidents/I00066.md index baec0e1..0ff4d4f 100644 --- a/generated_pages/incidents/I00066.md +++ b/generated_pages/incidents/I00066.md @@ -1,19 +1,10 @@ # Incident I00066: The online war between Qatar and Saudi Arabia -* **Summary:** > In the early hours of 24 May 2017, a news story appeared on the website of Qatar's official news agency, QNA, reporting that the country's emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech. - -> […] - -> Qatar claimed that the QNA had been hacked. And they said the hack was designed to deliberately spread fake news about the country's leader and its foreign policies. The Qataris specifically blamed UAE, an allegation later repeated by a Washington Post report which cited US intelligence sources. The UAE categorically denied those reports. - -> But the story of the emir's speech unleashed a media free-for-all. Within minutes, Saudi and UAE-owned TV networks - Al Arabiya and Sky News Arabia - picked up on the comments attributed to al-Thani. Both networks accused Qatar of funding extremist groups and of destabilising the region. - -This incident demonstrates how a hack of a mainstream news agency website allowed for an inauthentic narrative to be given a level of credibility which caused significant political fallout. - +* **Summary:** “In the early hours of 24 May 2017, a news story appeared on the website of Qatar's official news agency, QNA, reporting that the country's emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech.

[…]

“Qatar claimed that the QNA had been hacked. And they said the hack was designed to deliberately spread fake news about the country's leader and its foreign policies. The Qataris specifically blamed UAE, an allegation later repeated by a Washington Post report which cited US intelligence sources. The UAE categorically denied those reports.

“But the story of the emir's speech unleashed a media free-for-all. Within minutes, Saudi and UAE-owned TV networks - Al Arabiya and Sky News Arabia - picked up on the comments attributed to al-Thani. Both networks accused Qatar of funding extremist groups and of destabilising the region.”

This incident demonstrates how a hack of a mainstream news agency website allowed for an inauthentic narrative to be given a level of credibility which caused significant political fallout. * **incident type**: incident -* **Year started:** 2017 +* **Year started:** 2017.0 * **Countries:** , Qatar @@ -22,23 +13,15 @@ This incident demonstrates how a hack of a mainstream news agency website allowe * **Date added:** 2024-03-12 -| Reference(s) | -| --------- | -| [https://www.bbc.co.uk/news/blogs-trending-44294826](https://www.bbc.co.uk/news/blogs-trending-44294826) | +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.bbc.co.uk/news/blogs-trending-44294826](https://www.bbc.co.uk/news/blogs-trending-44294826) | 2018/06/03 | Owen Pinnell | BBC News | [https://web.archive.org/web/20180605001510/https://www.bbc.com/news/blogs-trending-44294826](https://web.archive.org/web/20180605001510/https://www.bbc.com/news/blogs-trending-44294826) | | Technique | Description given for this incident | | --------- | ------------------------- | -| [T0141.002 Acquire Compromised Website](../../generated_pages/techniques/T0141.002.md) | IT00000216 > In the early hours of 24 May 2017, a news story appeared on the website of Qatar's official news agency, QNA, reporting that the country's emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech. - -> […] - -> Qatar claimed that the QNA had been hacked. And they said the hack was designed to deliberately spread fake news about the country's leader and its foreign policies. The Qataris specifically blamed UAE, an allegation later repeated by a Washington Post report which cited US intelligence sources. The UAE categorically denied those reports. - -> But the story of the emir's speech unleashed a media free-for-all. Within minutes, Saudi and UAE-owned TV networks - Al Arabiya and Sky News Arabia - picked up on the comments attributed to al-Thani. Both networks accused Qatar of funding extremist groups and of destabilising the region. - -This incident demonstrates how threat actors used _T0141.002: Acquire Compromised Website_ to allow for an inauthentic narrative to be given a level of credibility which caused significant political fallout. | +| [T0141.002 Acquire Compromised Website](../../generated_pages/techniques/T0141.002.md) | IT00000216 _"In the early hours of 24 May 2017, a news story appeared on the website of Qatar's official news agency, QNA, reporting that the country's emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech."_

_"[…]_

_"Qatar claimed that the QNA had been hacked. And they said the hack was designed to deliberately spread fake news about the country's leader and its foreign policies. The Qataris specifically blamed UAE, an allegation later repeated by a Washington Post report which cited US intelligence sources. The UAE categorically denied those reports._

_"But the story of the emir's speech unleashed a media free-for-all. Within minutes, Saudi and UAE-owned TV networks - Al Arabiya and Sky News Arabia - picked up on the comments attributed to al-Thani. Both networks accused Qatar of funding extremist groups and of destabilising the region."_

This incident demonstrates how threat actors used _T0141.002: Acquire Compromised Website_ to allow for an inauthentic narrative to be given a level of credibility which caused significant political fallout. | DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00067.md b/generated_pages/incidents/I00067.md new file mode 100644 index 0000000..8dda6e1 --- /dev/null +++ b/generated_pages/incidents/I00067.md @@ -0,0 +1,27 @@ +# Incident I00067: Understanding Information disorder + +* **Summary:** In this report Claire Wardle describes seven types of mis- and disinformation. + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://firstdraftnews.org/long-form-article/understanding-information-disorder/](https://firstdraftnews.org/long-form-article/understanding-information-disorder/) | 2020/09/22 | Claire Wardle | First Draft | [https://web.archive.org/web/20210330030913/https://firstdraftnews.org/long-form-article/understanding-information-disorder/](https://web.archive.org/web/20210330030913/https://firstdraftnews.org/long-form-article/understanding-information-disorder/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0143.004 Parody Persona](../../generated_pages/techniques/T0143.004.md) | IT00000218 “A 2019 case in the US involved a Republican political operative who created a parody site designed to look like Joe Biden’s official website as the former vice president was campaigning to be the Democratic nominee for the 2020 presidential election. With a URL of joebiden[.]info, the parody site was indexed by Google higher than Biden’s official site, joebiden[.]com, when he launched his campaign in April 2019. The operative, who previously had created content for Donald Trump, said he did not create the site for the Trump campaign directly.

“The opening line on the parody site reads: “Uncle Joe is back and ready to take a hands-on approach to America’s problems!” It is full of images of Biden kissing and hugging young girls and women. At the bottom of the page a statement reads: “This site is political commentary and parody of Joe Biden’s Presidential campaign website. This is not Joe Biden’s actual website. It is intended for entertainment and political commentary only.””

In this example a website was created which claimed to be a parody of Joe Biden’s official website (T0143.004: Parody Persona).

Although the website was a parody, it ranked higher than Joe Biden’s real website on Google search. | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00068.md b/generated_pages/incidents/I00068.md new file mode 100644 index 0000000..632a089 --- /dev/null +++ b/generated_pages/incidents/I00068.md @@ -0,0 +1,30 @@ +# Incident I00068: Attempted Audio Deepfake Call Targets LastPass Employee + +* **Summary:** “In a new blog post from LastPass, the password management firm used by countless personal and corporate clients to help protect their login information, the company explains that someone used AI voice-cloning tech to spoof the voice of its CEO in an attempt to trick one of its employees.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://blog.lastpass.com/posts/2024/04/attempted-audio-deepfake-call-targets-lastpass-employee](https://blog.lastpass.com/posts/2024/04/attempted-audio-deepfake-call-targets-lastpass-employee) | 2024/04/10 | Mike Kosak | LastPass | [https://web.archive.org/web/20240619143325/https://blog.lastpass.com/posts/2024/04/attempted-audio-deepfake-call-targets-lastpass-employee](https://web.archive.org/web/20240619143325/https://blog.lastpass.com/posts/2024/04/attempted-audio-deepfake-call-targets-lastpass-employee) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0043.001 Use Encrypted Chat Apps](../../generated_pages/techniques/T0043.001.md) | IT00000219 “While reports of [...] deepfake calls targeting private companies are luckily still rare, LastPass itself experienced a deepfake attempt earlier today that we are sharing with the larger community to help raise awareness that this tactic is spreading and all companies should be on the alert. In our case, an employee received a series of calls, texts, and at least one voicemail featuring an audio deepfake from a threat actor impersonating our CEO via WhatsApp. As the attempted communication was outside of normal business communication channels and due to the employee’s suspicion regarding the presence of many of the hallmarks of a social engineering attempt (such as forced urgency), our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness of the tactic both internally and externally.”

In this example attackers impersonated the CEO of LastPass (T0097.100: Individual Persona, T0143.003: Impersonated Persona), targeting one of its employees over WhatsApp (T0043.001: Use Encrypted Chat Apps) using deepfaked audio (T0088.001: Develop AI-Generated Audio (Deepfakes)). | +| [T0088.001 Develop AI-Generated Audio (Deepfakes)](../../generated_pages/techniques/T0088.001.md) | IT00000220 “While reports of [...] deepfake calls targeting private companies are luckily still rare, LastPass itself experienced a deepfake attempt earlier today that we are sharing with the larger community to help raise awareness that this tactic is spreading and all companies should be on the alert. In our case, an employee received a series of calls, texts, and at least one voicemail featuring an audio deepfake from a threat actor impersonating our CEO via WhatsApp. As the attempted communication was outside of normal business communication channels and due to the employee’s suspicion regarding the presence of many of the hallmarks of a social engineering attempt (such as forced urgency), our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness of the tactic both internally and externally.”

In this example attackers impersonated the CEO of LastPass (T0097.100: Individual Persona, T0143.003: Impersonated Persona), targeting one of its employees over WhatsApp (T0043.001: Use Encrypted Chat Apps) using deepfaked audio (T0088.001: Develop AI-Generated Audio (Deepfakes)). | +| [T0097.100 Individual Persona](../../generated_pages/techniques/T0097.100.md) | IT00000221 “While reports of [...] deepfake calls targeting private companies are luckily still rare, LastPass itself experienced a deepfake attempt earlier today that we are sharing with the larger community to help raise awareness that this tactic is spreading and all companies should be on the alert. In our case, an employee received a series of calls, texts, and at least one voicemail featuring an audio deepfake from a threat actor impersonating our CEO via WhatsApp. As the attempted communication was outside of normal business communication channels and due to the employee’s suspicion regarding the presence of many of the hallmarks of a social engineering attempt (such as forced urgency), our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness of the tactic both internally and externally.”

In this example attackers impersonated the CEO of LastPass (T0097.100: Individual Persona, T0143.003: Impersonated Persona), targeting one of its employees over WhatsApp (T0043.001: Use Encrypted Chat Apps) using deepfaked audio (T0088.001: Develop AI-Generated Audio (Deepfakes)). | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000222 “While reports of [...] deepfake calls targeting private companies are luckily still rare, LastPass itself experienced a deepfake attempt earlier today that we are sharing with the larger community to help raise awareness that this tactic is spreading and all companies should be on the alert. In our case, an employee received a series of calls, texts, and at least one voicemail featuring an audio deepfake from a threat actor impersonating our CEO via WhatsApp. As the attempted communication was outside of normal business communication channels and due to the employee’s suspicion regarding the presence of many of the hallmarks of a social engineering attempt (such as forced urgency), our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness of the tactic both internally and externally.”

In this example attackers impersonated the CEO of LastPass (T0097.100: Individual Persona, T0143.003: Impersonated Persona), targeting one of its employees over WhatsApp (T0043.001: Use Encrypted Chat Apps) using deepfaked audio (T0088.001: Develop AI-Generated Audio (Deepfakes)). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00069.md b/generated_pages/incidents/I00069.md new file mode 100644 index 0000000..ebf8213 --- /dev/null +++ b/generated_pages/incidents/I00069.md @@ -0,0 +1,34 @@ +# Incident I00069: Uncharmed: Untangling Iran's APT42 Operations + +* **Summary:** “APT42, an Iranian state-sponsored cyber espionage actor, is using enhanced social engineering schemes to gain access to victim networks, including cloud environments. The actor is targeting Western and Middle Eastern NGOs, media organizations, academia, legal services and activists. Mandiant assesses APT42 operates on behalf of the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO).

“APT42 was observed posing as journalists and event organizers to build trust with their victims through ongoing correspondence, and to deliver invitations to conferences or legitimate documents. These social engineering schemes enabled APT42 to harvest credentials and use them to gain initial access to cloud environments. Subsequently, the threat actor covertly exfiltrated data of strategic interest to Iran, while relying on built-in features and open-source tools to avoid detection.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations](https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations) | 2024/05/01 | Ofir Rozmann, Asli Koksal, Adrian Hernandez, Sarah Bock, Jonathan Leathery | Mandiant | [https://web.archive.org/web/20240619195456/https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations/](https://web.archive.org/web/20240619195456/https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.100 Individual Persona](../../generated_pages/techniques/T0097.100.md) | IT00000231 “[Iranian state-sponsored cyber espionage actor] APT42 cloud operations attack lifecycle can be described in details as follows:

- “Social engineering schemes involving decoys and trust building, which includes masquerading as legitimate NGOs and conducting ongoing correspondence with the target, sometimes lasting several weeks.
- The threat actor masqueraded as well-known international organizations in the legal and NGO fields and sent emails from domains typosquatting the original NGO domains, for example aspenlnstitute[.]org.
- The Aspen Institute became aware of this spoofed domain and collaborated with industry partners, including blocking it in SafeBrowsing, thus protecting users of Google Chrome and additional browsers.
- To increase their credibility, APT42 impersonated high-ranking personnel working at the aforementioned organizations when creating the email personas.
- APT42 enhanced their campaign credibility by using decoy material inviting targets to legitimate and relevant events and conferences. In one instance, the decoy material was hosted on an attacker-controlled SharePoint folder, accessible only after the victim entered their credentials. Mandiant did not identify malicious elements in the files, suggesting they were used solely to gain the victim’s trust.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created a domain impersonating the existing NGO The Aspen Institute (T0143.003: Impersonated Persona, T0097.207: NGO Persona). They increased the perceived legitimacy of the impersonation by also impersonating high-ranking employees of the NGO (T0097.100: Individual Persona, T0143.003: Impersonated Persona). | +| [T0097.103 Activist Persona](../../generated_pages/techniques/T0097.103.md) | IT00000227 “In March 2023, [Iranian state-sponsored cyber espionage actor] APT42 sent a spear-phishing email with a fake Google Meet invitation, allegedly sent on behalf of Mona Louri, a likely fake persona leveraged by APT42, claiming to be a human rights activist and researcher. Upon entry, the user was presented with a fake Google Meet page and asked to enter their credentials, which were subsequently sent to the attackers.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created an account which presented as a human rights activist (T0097.103: Activist Persona) and researcher (T0097.107: Researcher Persona). The analysts assert that it was likely the persona was fabricated (T0143.002: Fabricated Persona) | +| [T0097.107 Researcher Persona](../../generated_pages/techniques/T0097.107.md) | IT00000228 “In March 2023, [Iranian state-sponsored cyber espionage actor] APT42 sent a spear-phishing email with a fake Google Meet invitation, allegedly sent on behalf of Mona Louri, a likely fake persona leveraged by APT42, claiming to be a human rights activist and researcher. Upon entry, the user was presented with a fake Google Meet page and asked to enter their credentials, which were subsequently sent to the attackers.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created an account which presented as a human rights activist (T0097.103: Activist Persona) and researcher (T0097.107: Researcher Persona). The analysts assert that it was likely the persona was fabricated (T0143.002: Fabricated Persona) | +| [T0097.202 News Outlet Persona](../../generated_pages/techniques/T0097.202.md) | IT00000223 “Mandiant identified at least three clusters of infrastructure used by [Iranian state-sponsored cyber espionage actor] APT42 to harvest credentials from targets in the policy and government sectors, media organizations and journalists, and NGOs and activists. The three clusters employ similar tactics, techniques and procedures (TTPs) to target victim credentials (spear-phishing emails), but use slightly varied domains, masquerading patterns, decoys, and themes.

Cluster A: Posing as News Outlets and NGOs:
- Suspected Targeting: credentials of journalists, researchers, and geopolitical entities in regions of interest to Iran.
- Masquerading as: The Washington Post (U.S.), The Economist (UK), The Jerusalem Post (IL), Khaleej Times (UAE), Azadliq (Azerbaijan), and more news outlets and NGOs. This often involves the use of typosquatted domains like washinqtonpost[.]press.

“Mandiant did not observe APT42 target or compromise these organizations, but rather impersonate them.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, impersonated existing news organisations and NGOs (T0097.202 News Outlet Persona, T0097.207: NGO Persona, T0143.003: Impersonated Persona) in attempts to steal credentials from targets (T0141.001: Acquire Compromised Account), using elements of influence operations to facilitate their cyber attacks. | +| [T0097.207 NGO Persona](../../generated_pages/techniques/T0097.207.md) | IT00000232 “[Iranian state-sponsored cyber espionage actor] APT42 cloud operations attack lifecycle can be described in details as follows:

- “Social engineering schemes involving decoys and trust building, which includes masquerading as legitimate NGOs and conducting ongoing correspondence with the target, sometimes lasting several weeks.
- The threat actor masqueraded as well-known international organizations in the legal and NGO fields and sent emails from domains typosquatting the original NGO domains, for example aspenlnstitute[.]org.
- The Aspen Institute became aware of this spoofed domain and collaborated with industry partners, including blocking it in SafeBrowsing, thus protecting users of Google Chrome and additional browsers.
- To increase their credibility, APT42 impersonated high-ranking personnel working at the aforementioned organizations when creating the email personas.
- APT42 enhanced their campaign credibility by using decoy material inviting targets to legitimate and relevant events and conferences. In one instance, the decoy material was hosted on an attacker-controlled SharePoint folder, accessible only after the victim entered their credentials. Mandiant did not identify malicious elements in the files, suggesting they were used solely to gain the victim’s trust.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created a domain impersonating the existing NGO The Aspen Institute (T0143.003: Impersonated Persona, T0097.207: NGO Persona). They increased the perceived legitimacy of the impersonation by also impersonating high-ranking employees of the NGO (T0097.100: Individual Persona, T0143.003: Impersonated Persona). | +| [T0141.001 Acquire Compromised Account](../../generated_pages/techniques/T0141.001.md) | IT00000226 “Mandiant identified at least three clusters of infrastructure used by [Iranian state-sponsored cyber espionage actor] APT42 to harvest credentials from targets in the policy and government sectors, media organizations and journalists, and NGOs and activists. The three clusters employ similar tactics, techniques and procedures (TTPs) to target victim credentials (spear-phishing emails), but use slightly varied domains, masquerading patterns, decoys, and themes.

Cluster A: Posing as News Outlets and NGOs:
- Suspected Targeting: credentials of journalists, researchers, and geopolitical entities in regions of interest to Iran.
- Masquerading as: The Washington Post (U.S.), The Economist (UK), The Jerusalem Post (IL), Khaleej Times (UAE), Azadliq (Azerbaijan), and more news outlets and NGOs. This often involves the use of typosquatted domains like washinqtonpost[.]press.

“Mandiant did not observe APT42 target or compromise these organizations, but rather impersonate them.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, impersonated existing news organisations and NGOs (T0097.202 News Outlet Persona, T0097.207: NGO Persona, T0143.003: Impersonated Persona) in attempts to steal credentials from targets (T0141.001: Acquire Compromised Account), using elements of influence operations to facilitate their cyber attacks. | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000229 “In March 2023, [Iranian state-sponsored cyber espionage actor] APT42 sent a spear-phishing email with a fake Google Meet invitation, allegedly sent on behalf of Mona Louri, a likely fake persona leveraged by APT42, claiming to be a human rights activist and researcher. Upon entry, the user was presented with a fake Google Meet page and asked to enter their credentials, which were subsequently sent to the attackers.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created an account which presented as a human rights activist (T0097.103: Activist Persona) and researcher (T0097.107: Researcher Persona). The analysts assert that it was likely the persona was fabricated (T0143.002: Fabricated Persona) | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000230 “[Iranian state-sponsored cyber espionage actor] APT42 cloud operations attack lifecycle can be described in details as follows:

- “Social engineering schemes involving decoys and trust building, which includes masquerading as legitimate NGOs and conducting ongoing correspondence with the target, sometimes lasting several weeks.
- The threat actor masqueraded as well-known international organizations in the legal and NGO fields and sent emails from domains typosquatting the original NGO domains, for example aspenlnstitute[.]org.
- The Aspen Institute became aware of this spoofed domain and collaborated with industry partners, including blocking it in SafeBrowsing, thus protecting users of Google Chrome and additional browsers.
- To increase their credibility, APT42 impersonated high-ranking personnel working at the aforementioned organizations when creating the email personas.
- APT42 enhanced their campaign credibility by using decoy material inviting targets to legitimate and relevant events and conferences. In one instance, the decoy material was hosted on an attacker-controlled SharePoint folder, accessible only after the victim entered their credentials. Mandiant did not identify malicious elements in the files, suggesting they were used solely to gain the victim’s trust.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created a domain impersonating the existing NGO The Aspen Institute (T0143.003: Impersonated Persona, T0097.207: NGO Persona). They increased the perceived legitimacy of the impersonation by also impersonating high-ranking employees of the NGO (T0097.100: Individual Persona, T0143.003: Impersonated Persona). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00070.md b/generated_pages/incidents/I00070.md new file mode 100644 index 0000000..0db0fa4 --- /dev/null +++ b/generated_pages/incidents/I00070.md @@ -0,0 +1,29 @@ +# Incident I00070: Eli Lilly Clarifies It’s Not Offering Free Insulin After Tweet From Fake Verified Account—As Chaos Unfolds On Twitter + +* **Summary:** “Pharmaceutical company Eli Lilly clarified [in November 2022] it is not offering free insulin, after a fake Twitter account—which was verified through Twitter Blue, a new subscription service implemented by Elon Musk— impersonating the brand said it was” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.forbes.com/sites/marisadellatto/2022/11/10/eli-lilly-clarifies-its-not-offering-free-insulin-after-tweet-from-fake-verified-account-as-chaos-unfolds-on-twitter/](https://www.forbes.com/sites/marisadellatto/2022/11/10/eli-lilly-clarifies-its-not-offering-free-insulin-after-tweet-from-fake-verified-account-as-chaos-unfolds-on-twitter/) | 2022/11/10 | Marisa Dellatto | Forbes | [https://web.archive.org/web/20221127024348/https://www.forbes.com/sites/marisadellatto/2022/11/10/eli-lilly-clarifies-its-not-offering-free-insulin-after-tweet-from-fake-verified-account-as-chaos-unfolds-on-twitter/](https://web.archive.org/web/20221127024348/https://www.forbes.com/sites/marisadellatto/2022/11/10/eli-lilly-clarifies-its-not-offering-free-insulin-after-tweet-from-fake-verified-account-as-chaos-unfolds-on-twitter/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.205 Business Persona](../../generated_pages/techniques/T0097.205.md) | IT00000234 “Twitter Blue launched [November 2022], giving any users who pay $8 a month the ability to be verified on the site, a feature previously only available to public figures, government officials and journalists as a way to show they are who they claim to be.

“[A day after the launch], an account with the handle @EliLillyandCo labeled itself with the name “Eli Lilly and Company,” and by using the same logo as the company in its profile picture and with the verification checkmark, was indistinguishable from the real company (the picture has since been removed and the account has labeled itself as a parody profile).

The parody account tweeted “we are excited to announce insulin is free now.””

In this example an account impersonated the pharmaceutical company Eli Lilly (T0097.205: Business Persona, T0143.003: Impersonated Persona) by copying its name, profile picture (T0145.001: Copy Account Imagery), and paying for verification. | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000235 “Twitter Blue launched [November 2022], giving any users who pay $8 a month the ability to be verified on the site, a feature previously only available to public figures, government officials and journalists as a way to show they are who they claim to be.

“[A day after the launch], an account with the handle @EliLillyandCo labeled itself with the name “Eli Lilly and Company,” and by using the same logo as the company in its profile picture and with the verification checkmark, was indistinguishable from the real company (the picture has since been removed and the account has labeled itself as a parody profile).

The parody account tweeted “we are excited to announce insulin is free now.””

In this example an account impersonated the pharmaceutical company Eli Lilly (T0097.205: Business Persona, T0143.003: Impersonated Persona) by copying its name, profile picture (T0145.001: Copy Account Imagery), and paying for verification. | +| [T0145.001 Copy Account Imagery](../../generated_pages/techniques/T0145.001.md) | IT00000233 “Twitter Blue launched [November 2022], giving any users who pay $8 a month the ability to be verified on the site, a feature previously only available to public figures, government officials and journalists as a way to show they are who they claim to be.

“[A day after the launch], an account with the handle @EliLillyandCo labeled itself with the name “Eli Lilly and Company,” and by using the same logo as the company in its profile picture and with the verification checkmark, was indistinguishable from the real company (the picture has since been removed and the account has labeled itself as a parody profile).

The parody account tweeted “we are excited to announce insulin is free now.””

In this example an account impersonated the pharmaceutical company Eli Lilly (T0097.205: Business Persona, T0143.003: Impersonated Persona) by copying its name, profile picture (T0145.001: Copy Account Imagery), and paying for verification. | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00071.md b/generated_pages/incidents/I00071.md new file mode 100644 index 0000000..5960cbe --- /dev/null +++ b/generated_pages/incidents/I00071.md @@ -0,0 +1,33 @@ +# Incident I00071: Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland + +* **Summary:** “Russian Telegram channels possibly linked to Ghostwriter [a hacking group attributed to Belarus] amplified forged letters published by hacktivist assets” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://medium.com/dfrlab/russia-aligned-hacktivists-stir-up-anti-ukrainian-sentiments-in-poland-f2d6660cf09a](https://medium.com/dfrlab/russia-aligned-hacktivists-stir-up-anti-ukrainian-sentiments-in-poland-f2d6660cf09a) | 2022/09/09 | Givi Gigitashvili | DFRLab | [https://web.archive.org/web/20240111203524/https://medium.com/dfrlab/russia-aligned-hacktivists-stir-up-anti-ukrainian-sentiments-in-poland-f2d6660cf09a](https://web.archive.org/web/20240111203524/https://medium.com/dfrlab/russia-aligned-hacktivists-stir-up-anti-ukrainian-sentiments-in-poland-f2d6660cf09a) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0085.004 Develop Document](../../generated_pages/techniques/T0085.004.md) | IT00000324 “On August 16, 2022, pro-Kremlin Telegram channel Joker DPR (Джокер ДНР) published a forged letter allegedly written by Ukrainian Foreign Minister Dmytro Kuleba. In the letter, Kuleba supposedly asked relevant Polish authorities to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII.

[...]

The letter is not dated, and Dmytro Kuleba’s signature seems to be copied from a publicly available letter signed by him in 2021.”

In this example the Telegram channel Joker DPR published a forged letter (T0085.004: Develop Document) in which they impersonated the Ukrainian Minister of Foreign Affairs (T0097.111: Government Official Persona, T0143.003: Impersonated Persona), using Ministry letterhead (T0097.206: Government Institution Persona, T0143.003: Impersonated Persona). | +| [T0097.101 Local Persona](../../generated_pages/techniques/T0097.101.md) | IT00000238 “The August 17 [2022] Telegram post [which contained a falsified letter from the Ukrainian Minister of Foreign Affairs asking Poland to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII] also contained screenshots of Facebook posts that appeared on two Facebook accounts belonging to Polish nationals Piotr Górka, an expert in the history of the Polish Air Force, and Dariusz Walusiak, a Polish historian and documentary maker. The Górka post suggested that he fully supported the Polish government’s decision to change Belwederska Street to Stepan Bandera Street.

“In a statement to the DFRLab, Górka said his account was accessed without his consent. “This is not my post loaded to my Facebook page,” he explained. “My site was hacked, some days ago.” At the time of publishing, Piotr Górka’s post and his Facebook account were no longer accessible.

“The post on Górka’s Facebook page was shared by Dariusz Walusiak’s Facebook account; the account also reposted it on the Facebook walls of more than twenty other Facebook users, including Adam Kalita, currently working at Krakow branch of the Institute of National Remembrance; Jan Kasprzyk, head of the Office for War Veterans and Victims of Oppression; and Alicja Kondraciuk, a Polish public figure living in Krakow.

“Walusiak’s Facebook account is also no longer accessible. Given his work on Polish history and identity, it seems highly unlikely he would support the Bandera measure; the DFRLab has also reached out to him for comment.

“The fact that Joker DPR’s Telegram post included screenshots of their Facebook posts raises the strong possibility that both Facebook accounts were compromised, and that hackers planted false statements on their pages that would seem out of character for them in order to gain further attention to the forged documents.”

In this example, threat actors used compromised accounts (T0141.001: Acquire Compromised Account) of Polish historians who have enough relevant knowledge to plausibly weigh in on the forged letter’s narrative (T0143.003: Impersonated Persona, T0097.101: Local Persona, T0097.108: Expert Persona). 

This matches T0097.108: Expert Persona because the impersonation exploited Górka and Walusiak’s existing personas as experts in Polish history. | +| [T0097.108 Expert Persona](../../generated_pages/techniques/T0097.108.md) | IT00000239 “The August 17 [2022] Telegram post [which contained a falsified letter from the Ukrainian Minister of Foreign Affairs asking Poland to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII] also contained screenshots of Facebook posts that appeared on two Facebook accounts belonging to Polish nationals Piotr Górka, an expert in the history of the Polish Air Force, and Dariusz Walusiak, a Polish historian and documentary maker. The Górka post suggested that he fully supported the Polish government’s decision to change Belwederska Street to Stepan Bandera Street.

“In a statement to the DFRLab, Górka said his account was accessed without his consent. “This is not my post loaded to my Facebook page,” he explained. “My site was hacked, some days ago.” At the time of publishing, Piotr Górka’s post and his Facebook account were no longer accessible.

“The post on Górka’s Facebook page was shared by Dariusz Walusiak’s Facebook account; the account also reposted it on the Facebook walls of more than twenty other Facebook users, including Adam Kalita, currently working at Krakow branch of the Institute of National Remembrance; Jan Kasprzyk, head of the Office for War Veterans and Victims of Oppression; and Alicja Kondraciuk, a Polish public figure living in Krakow.

“Walusiak’s Facebook account is also no longer accessible. Given his work on Polish history and identity, it seems highly unlikely he would support the Bandera measure; the DFRLab has also reached out to him for comment.

“The fact that Joker DPR’s Telegram post included screenshots of their Facebook posts raises the strong possibility that both Facebook accounts were compromised, and that hackers planted false statements on their pages that would seem out of character for them in order to gain further attention to the forged documents.”

In this example, threat actors used compromised accounts (T0141.001: Acquire Compromised Account) of Polish historians who have enough relevant knowledge to plausibly weigh in on the forged letter’s narrative (T0143.003: Impersonated Persona, T0097.101: Local Persona, T0097.108: Expert Persona). 

This matches T0097.108: Expert Persona because the impersonation exploited Górka and Walusiak’s existing personas as experts in Polish history. | +| [T0097.111 Government Official Persona](../../generated_pages/techniques/T0097.111.md) | IT00000327 “On August 16, 2022, pro-Kremlin Telegram channel Joker DPR (Джокер ДНР) published a forged letter allegedly written by Ukrainian Foreign Minister Dmytro Kuleba. In the letter, Kuleba supposedly asked relevant Polish authorities to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII.

[...]

The letter is not dated, and Dmytro Kuleba’s signature seems to be copied from a publicly available letter signed by him in 2021.”

In this example the Telegram channel Joker DPR published a forged letter (T0085.004: Develop Document) in which they impersonated the Ukrainian Minister of Foreign Affairs (T0097.111: Government Official Persona, T0143.003: Impersonated Persona), using Ministry letterhead (T0097.206: Government Institution Persona, T0143.003: Impersonated Persona). | +| [T0097.206 Government Institution Persona](../../generated_pages/techniques/T0097.206.md) | IT00000326 “On August 16, 2022, pro-Kremlin Telegram channel Joker DPR (Джокер ДНР) published a forged letter allegedly written by Ukrainian Foreign Minister Dmytro Kuleba. In the letter, Kuleba supposedly asked relevant Polish authorities to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII.

[...]

The letter is not dated, and Dmytro Kuleba’s signature seems to be copied from a publicly available letter signed by him in 2021.”

In this example the Telegram channel Joker DPR published a forged letter (T0085.004: Develop Document) in which they impersonated the Ukrainian Minister of Foreign Affairs (T0097.111: Government Official Persona, T0143.003: Impersonated Persona), using Ministry letterhead (T0097.206: Government Institution Persona, T0143.003: Impersonated Persona). | +| [T0141.001 Acquire Compromised Account](../../generated_pages/techniques/T0141.001.md) | IT00000236 “The August 17 [2022] Telegram post [which contained a falsified letter from the Ukrainian Minister of Foreign Affairs asking Poland to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII] also contained screenshots of Facebook posts that appeared on two Facebook accounts belonging to Polish nationals Piotr Górka, an expert in the history of the Polish Air Force, and Dariusz Walusiak, a Polish historian and documentary maker. The Górka post suggested that he fully supported the Polish government’s decision to change Belwederska Street to Stepan Bandera Street.

“In a statement to the DFRLab, Górka said his account was accessed without his consent. “This is not my post loaded to my Facebook page,” he explained. “My site was hacked, some days ago.” At the time of publishing, Piotr Górka’s post and his Facebook account were no longer accessible.

“The post on Górka’s Facebook page was shared by Dariusz Walusiak’s Facebook account; the account also reposted it on the Facebook walls of more than twenty other Facebook users, including Adam Kalita, currently working at Krakow branch of the Institute of National Remembrance; Jan Kasprzyk, head of the Office for War Veterans and Victims of Oppression; and Alicja Kondraciuk, a Polish public figure living in Krakow.

“Walusiak’s Facebook account is also no longer accessible. Given his work on Polish history and identity, it seems highly unlikely he would support the Bandera measure; the DFRLab has also reached out to him for comment.

“The fact that Joker DPR’s Telegram post included screenshots of their Facebook posts raises the strong possibility that both Facebook accounts were compromised, and that hackers planted false statements on their pages that would seem out of character for them in order to gain further attention to the forged documents.”

In this example, threat actors used compromised accounts (T0141.001: Acquire Compromised Account) of Polish historians who have enough relevant knowledge to plausibly weigh in on the forged letter’s narrative (T0143.003: Impersonated Persona, T0097.101: Local Persona, T0097.108: Expert Persona). 

This matches T0097.108: Expert Persona because the impersonation exploited Górka and Walusiak’s existing personas as experts in Polish history. | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000237 “The August 17 [2022] Telegram post [which contained a falsified letter from the Ukrainian Minister of Foreign Affairs asking Poland to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII] also contained screenshots of Facebook posts that appeared on two Facebook accounts belonging to Polish nationals Piotr Górka, an expert in the history of the Polish Air Force, and Dariusz Walusiak, a Polish historian and documentary maker. The Górka post suggested that he fully supported the Polish government’s decision to change Belwederska Street to Stepan Bandera Street.

“In a statement to the DFRLab, Górka said his account was accessed without his consent. “This is not my post loaded to my Facebook page,” he explained. “My site was hacked, some days ago.” At the time of publishing, Piotr Górka’s post and his Facebook account were no longer accessible.

“The post on Górka’s Facebook page was shared by Dariusz Walusiak’s Facebook account; the account also reposted it on the Facebook walls of more than twenty other Facebook users, including Adam Kalita, currently working at Krakow branch of the Institute of National Remembrance; Jan Kasprzyk, head of the Office for War Veterans and Victims of Oppression; and Alicja Kondraciuk, a Polish public figure living in Krakow.

“Walusiak’s Facebook account is also no longer accessible. Given his work on Polish history and identity, it seems highly unlikely he would support the Bandera measure; the DFRLab has also reached out to him for comment.

“The fact that Joker DPR’s Telegram post included screenshots of their Facebook posts raises the strong possibility that both Facebook accounts were compromised, and that hackers planted false statements on their pages that would seem out of character for them in order to gain further attention to the forged documents.”

In this example, threat actors used compromised accounts (T0141.001: Acquire Compromised Account) of Polish historians who have enough relevant knowledge to plausibly weigh in on the forged letter’s narrative (T0143.003: Impersonated Persona, T0097.101: Local Persona, T0097.108: Expert Persona). 

This matches T0097.108: Expert Persona because the impersonation exploited Górka and Walusiak’s existing personas as experts in Polish history. | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00072.md b/generated_pages/incidents/I00072.md new file mode 100644 index 0000000..c6d211a --- /dev/null +++ b/generated_pages/incidents/I00072.md @@ -0,0 +1,28 @@ +# Incident I00072: Behind the Dutch Terror Threat Video: The St. Petersburg "Troll Factory" Connection + +* **Summary:** Bellingcat analyses the publication and propagation of a fabricated video:

“At 13:30:09 GMT on 18 January 2016, a new YouTube channel called ПАТРИОТ (“Patriot”) uploaded its first video, titled (in Ukrainian) “Appeal of AZOV fighters to the Netherlands on a referendum about EU – Ukraine.” The video depicts six soldiers holding guns, supposedly from the notorious far-right, ultra-nationalist Azov Battalion, speaking in Ukrainian before burning a Dutch flag. In the video, the supposed Azov fighters threaten to conduct terrorist attacks in the Netherlands if the April 6 referendum is rejected. There are numerous examples of genuine Azov Battalion soldiers saying or doing reprehensible things, such as making severely anti-Semitic comments and having Nazi tattoos. However, most of these verified examples come from individual fighters, while the video with the Dutch flag being burned and terror threats supposedly comes as an official statement of the battalion.

The video has been proven as a fake, and is just one of many fake videos surrounding the Azov Battalion. This post [examines] the way in which the video originated and was spread. After open source analysis, it becomes clear that this video was initially spread and likely created by the same network of accounts and news sites that are operated by the infamous “St. Petersburg Troll Factories” of the Internet Research Agency and its sister organization, the Federal News Agency (FAN).  The same tactics can be seen in a recent report from Andrey Soshnikov of the BBC, in which he revealed that a fake video showing what was supposedly a U.S. soldier shooting a Quran was created and spread by this “troll factory.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.bellingcat.com/news/uk-and-europe/2016/04/03/azov-video/](https://www.bellingcat.com/news/uk-and-europe/2016/04/03/azov-video/) | 2016/04/03 | - | bellingcat | [https://web.archive.org/web/20240527150851/https://www.bellingcat.com/news/uk-and-europe/2016/04/03/azov-video/](https://web.archive.org/web/20240527150851/https://www.bellingcat.com/news/uk-and-europe/2016/04/03/azov-video/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.204 Think Tank Persona](../../generated_pages/techniques/T0097.204.md) | IT00000244 “The creator of Geopolitika[.]ru is Aleksandr Dugin, who was sanctioned by the United States Department of Treasury in 2015 for his role in the Eurasian Youth Union “for being responsible for or complicit in actions or policies that threaten the peace, security, stability, or sovereignty or territorial integrity of Ukraine.”

[...]

“Currently, the website geopolika[.]ru redirects directly to another partner website, Katehon.

“Katehon poses itself as a think tank focused on geopolitics in an English edition of its website. In contrast, in Russian, it states its aim to develop “ideological, political, diplomatic, economic and military strategy for Russia of the future” with a special role of religion. The president of Katehon’s supervisory board is Konstantin Malofeev, a Russian millionaire with connections to the Russian orthodox church and presidential administration, who founded Tsargrad TV, a known source of disinformation. Malofeev was sanctioned by the U.S. Department of Treasury and the European Union in 2014 for material support and financial backing of Russian-backed separatists in eastern Ukraine. Another known figure from the board is Sergei Glaziev, former advisor to Putin in 2012–2019. Dugin is also on the board in the Russian edition of the website, whereas he is omitted in English.”

In this example a website managed by an actor previously sanctioned by the US department of treasury has been configured to redirect to another website; Katehon (T0129.008: Redirect URLs).

Katehon presents itself as a geopolitical think tank in English (T0097.204: Think Tank Persona), but does not maintain this persona when presenting itself to a Russian speaking audience. | +| [T0129.008 Redirect URLs](../../generated_pages/techniques/T0129.008.md) | IT00000243 “The creator of Geopolitika[.]ru is Aleksandr Dugin, who was sanctioned by the United States Department of Treasury in 2015 for his role in the Eurasian Youth Union “for being responsible for or complicit in actions or policies that threaten the peace, security, stability, or sovereignty or territorial integrity of Ukraine.”

[...]

“Currently, the website geopolika[.]ru redirects directly to another partner website, Katehon.

“Katehon poses itself as a think tank focused on geopolitics in an English edition of its website. In contrast, in Russian, it states its aim to develop “ideological, political, diplomatic, economic and military strategy for Russia of the future” with a special role of religion. The president of Katehon’s supervisory board is Konstantin Malofeev, a Russian millionaire with connections to the Russian orthodox church and presidential administration, who founded Tsargrad TV, a known source of disinformation. Malofeev was sanctioned by the U.S. Department of Treasury and the European Union in 2014 for material support and financial backing of Russian-backed separatists in eastern Ukraine. Another known figure from the board is Sergei Glaziev, former advisor to Putin in 2012–2019. Dugin is also on the board in the Russian edition of the website, whereas he is omitted in English.”

In this example a website managed by an actor previously sanctioned by the US department of treasury has been configured to redirect to another website; Katehon (T0129.008: Redirect URLs).

Katehon presents itself as a geopolitical think tank in English (T0097.204: Think Tank Persona), but does not maintain this persona when presenting itself to a Russian speaking audience. | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00073.md b/generated_pages/incidents/I00073.md new file mode 100644 index 0000000..d063cd0 --- /dev/null +++ b/generated_pages/incidents/I00073.md @@ -0,0 +1,26 @@ +# Incident I00073: Disinformation campaign removed by Facebook linked to Russia’s Internet Research Agency + +* **Summary:** “On September 24, 2020, Facebook took down a small network of assets — a single Facebook page, five user profiles, and three Instagram accounts — linked to United World International, a fringe blogging outlet that spread anti-Western geopolitical narratives in English as well as Turkish. The outlet appeared to be managed by several people connected to the Russian Internet Research Agency (IRA), the notorious Kremlin-linked troll farm known for its interference in the 2016 U.S. presidential elections.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://medium.com/dfrlab/disinformation-campaign-removed-by-facebook-linked-to-russias-internet-research-agency-3cbd88d0dad](https://medium.com/dfrlab/disinformation-campaign-removed-by-facebook-linked-to-russias-internet-research-agency-3cbd88d0dad) | 2020/09/24 | Nika Aleksejev, Roman Osadchuk | DFRLab | [https://web.archive.org/web/20240628122121/https://medium.com/dfrlab/disinformation-campaign-removed-by-facebook-linked-to-russias-internet-research-agency-3cbd88d0dad](https://web.archive.org/web/20240628122121/https://medium.com/dfrlab/disinformation-campaign-removed-by-facebook-linked-to-russias-internet-research-agency-3cbd88d0dad) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00074.md b/generated_pages/incidents/I00074.md new file mode 100644 index 0000000..168031b --- /dev/null +++ b/generated_pages/incidents/I00074.md @@ -0,0 +1,32 @@ +# Incident I00074: The Tactics & Tropes of the Internet Research Agency + +* **Summary:** “Upon request by the United States Senate Select Committee on Intelligence (SSCI), New Knowledge reviewed an expansive data set of social media posts and metadata provided to SSCI by Facebook, Twitter, and Alphabet, plus a set of related data from additional platforms. The data sets were provided by the three primary platforms to serve as evidence for an investigation into the Internet Research Agency (IRA) influence operations. 

“The organic post content in this data set has never previously been seen by the public. TheOur report quantifies and contextualizes Internet Research Agency (IRA) influence operations targeting American citizens from 2014 through 2017, and articulates the significance of this long-running and broad influence operation. It includes an overview of Russian influence operations, a collection of summary statistics, and a set of key takeaways that are then discussed in detail later in the document. The document includes links to full data visualizations, hosted online, that permit the reader to explore facets of the IRA-created manipulation ecosystem.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://digitalcommons.unl.edu/cgi/viewcontent.cgi?article=1003&context=senatedocs](https://digitalcommons.unl.edu/cgi/viewcontent.cgi?article=1003&context=senatedocs) | 2019/10/01 | Renee DiResta, Kris Shaffer, Becky Ruppel, David Sullivan, Robert Matney, Ryan Fox, Jonathan Albright, Ben Johnson | New Knowledge | [https://web.archive.org/web/20240529025902/https://digitalcommons.unl.edu/cgi/viewcontent.cgi?article=1003&context=senatedocs](https://web.archive.org/web/20240529025902/https://digitalcommons.unl.edu/cgi/viewcontent.cgi?article=1003&context=senatedocs) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.106 Recruiter Persona](../../generated_pages/techniques/T0097.106.md) | IT00000248 “A few press investigations have alluded to the [Russia’s Internet Research Agency]’s job ads. The extent of the human asset recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a priority. Posts encouraging Americans to perform various types of tasks for IRA handlers appeared in Black, Left, and Right-targeted groups, though they were most numerous in the Black community. They included:

- Requests for contact with preachers from Black churches (Black_Baptist_Church)
- Offers of free counsellingcounseling to people with sexual addiction (Army of Jesus)
- Soliciting volunteers to hand out fliers
- Soliciting volunteers to teach self-defense classes
- Offering free self-defense classes (Black Fist/Fit Black)
- Requests for followers to attend political rallies
- Requests for photographers to document protests
- Requests for speakers at protests
- Requests to protest the Westborough Baptist Church (LGBT United)
- Job offers for designers to help design fliers, sites, Facebook sticker packs
- Requests for female followers to send photos for a calendar
- Requests for followers to send photos to be shared to the Page (Back the Badge)
- Soliciting videos for a YouTube contest called “Pee on Hillary”
- Encouraging people to apply to be part of a Black reality TV show
- Posting a wide variety of job ads (write for BlackMattersUS and others)
- Requests for lawyers to volunteer to assist with immigration cases”

This behaviour matches T0097.106: Recruiter Persona because the threat actors are presenting tasks for their target audience to complete in the style of a job posting (even though some of the tasks were presented as voluntary / unpaid efforts), including calls for people to attend political rallies (T0126.001: Call to Action to Attend). | +| [T0097.202 News Outlet Persona](../../generated_pages/techniques/T0097.202.md) | IT00000250 “The Black Matters Facebook Page [operated by Russia’s Internet Research Agency] explored several visual brand identities, moving from a plain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran the Facebook Page announced the launch of the website, blackmattersus[.]com, emphasizing media distrust and a desire to build Black independent media; [“I DIDN’T BELIEVE THE MEDIA / SO I BECAME ONE”]”

In this example an asset controlled by Russia’s Internet Research Agency began to present itself as a source of “Black independent media”, claiming that the media could not be trusted (T0097.208: Social Cause Persona, T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | +| [T0097.204 Think Tank Persona](../../generated_pages/techniques/T0097.204.md) | IT00000245 “[Russia’s Internet Research Agency, the IRA] pushed narratives with longform blog content. They created media properties, websites designed to produce stories that would resonate with those targeted. It appears, based on the data set provided by Alphabet, that the IRA may have also expanded into think tank-style communiques. One such page, previously unattributed to the IRA but included in the Alphabet data, was GI Analytics, a geopolitics blog with an international masthead that included American authors. This page was promoted via AdWords and YouTube videos; it has strong ties to more traditional Russian propaganda networks, which will be discussed later in this analysis. GI Analytics wrote articles articulating nuanced academic positions on a variety of sophisticated topics. From the site’s About page:

““Our purpose and mission are to provide high-quality analysis at a time when we are faced with a multitude of crises, a collapsing global economy, imperialist wars, environmental disasters, corporate greed, terrorism, deceit, GMO food, a migration crisis and a crackdown on small farmers and ranchers.””

In this example Alphabet’s technical indicators allowed them to assert that GI Analytics, which presented itself as a think tank, was a fabricated institution associated with Russia’s Internet Research Agency (T0097.204: Think Tank Persona, T0143.002: Fabricated Persona). | +| [T0097.208 Social Cause Persona](../../generated_pages/techniques/T0097.208.md) | IT00000251 “The Black Matters Facebook Page [operated by Russia’s Internet Research Agency] explored several visual brand identities, moving from a plain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran the Facebook Page announced the launch of the website, blackmattersus[.]com, emphasizing media distrust and a desire to build Black independent media; [“I DIDN’T BELIEVE THE MEDIA / SO I BECAME ONE”]”

In this example an asset controlled by Russia’s Internet Research Agency began to present itself as a source of “Black independent media”, claiming that the media could not be trusted (T0097.208: Social Cause Persona, T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | +| [T0126.001 Call to Action to Attend](../../generated_pages/techniques/T0126.001.md) | IT00000247 “A few press investigations have alluded to the [Russia’s Internet Research Agency]’s job ads. The extent of the human asset recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a priority. Posts encouraging Americans to perform various types of tasks for IRA handlers appeared in Black, Left, and Right-targeted groups, though they were most numerous in the Black community. They included:

- Requests for contact with preachers from Black churches (Black_Baptist_Church)
- Offers of free counsellingcounseling to people with sexual addiction (Army of Jesus)
- Soliciting volunteers to hand out fliers
- Soliciting volunteers to teach self-defense classes
- Offering free self-defense classes (Black Fist/Fit Black)
- Requests for followers to attend political rallies
- Requests for photographers to document protests
- Requests for speakers at protests
- Requests to protest the Westborough Baptist Church (LGBT United)
- Job offers for designers to help design fliers, sites, Facebook sticker packs
- Requests for female followers to send photos for a calendar
- Requests for followers to send photos to be shared to the Page (Back the Badge)
- Soliciting videos for a YouTube contest called “Pee on Hillary”
- Encouraging people to apply to be part of a Black reality TV show
- Posting a wide variety of job ads (write for BlackMattersUS and others)
- Requests for lawyers to volunteer to assist with immigration cases”

This behaviour matches T0097.106: Recruiter Persona because the threat actors are presenting tasks for their target audience to complete in the style of a job posting (even though some of the tasks were presented as voluntary / unpaid efforts), including calls for people to attend political rallies (T0126.001: Call to Action to Attend). | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000249 “The Black Matters Facebook Page [operated by Russia’s Internet Research Agency] explored several visual brand identities, moving from a plain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran the Facebook Page announced the launch of the website, blackmattersus[.]com, emphasizing media distrust and a desire to build Black independent media; [“I DIDN’T BELIEVE THE MEDIA / SO I BECAME ONE”]”

In this example an asset controlled by Russia’s Internet Research Agency began to present itself as a source of “Black independent media”, claiming that the media could not be trusted (T0097.208: Social Cause Persona, T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00075.md b/generated_pages/incidents/I00075.md new file mode 100644 index 0000000..2e1042e --- /dev/null +++ b/generated_pages/incidents/I00075.md @@ -0,0 +1,30 @@ +# Incident I00075: How Russia Meddles Abroad for Profit: Cash, Trolls and a Cult Leader + +* **Summary:** “It was one of Russia’s most overt attempts at election interference to date. Working from their headquarters in a resort hotel, the Russians published their own newspaper in the local language and hired students to write fawning articles about the president to help him win another term. Skirting electoral laws, they bought airtime on television stations and blanketed the country with billboards.

“They paid young people to attend rallies and journalists to cover them. They showed up with armed bodyguards at campaign offices to bribe challengers to drop out of the race to clear their candidate’s path.

“At Madagascar’s election commission, officials were alarmed.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.nytimes.com/2019/11/11/world/africa/russia-madagascar-election.html](https://www.nytimes.com/2019/11/11/world/africa/russia-madagascar-election.html) | 2019/11/11 | Michael Schwirtz, Gaelle Borgia | New York Times | [https://web.archive.org/web/20240625161319/https://www.nytimes.com/2019/11/11/world/africa/russia-madagascar-election.html](https://web.archive.org/web/20240625161319/https://www.nytimes.com/2019/11/11/world/africa/russia-madagascar-election.html) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.110 Party Official Persona](../../generated_pages/techniques/T0097.110.md) | IT00000328 “In the campaign’s final weeks, Pastor Mailhol said, the team of Russians made a request: Drop out of the race and support Mr. Rajoelina. He refused.

“The Russians made the same proposal to the history professor running for president, saying, “If you accept this deal you will have money” according to Ms. Rasamimanana, the professor’s campaign manager.

When the professor refused, she said, the Russians created a fake Facebook page that mimicked his official page and posted an announcement on it that he was supporting Mr. Rajoelina.”

In this example actors created online accounts styled to look like official pages to trick targets into thinking that the presidential candidate announced that they had dropped out of the election (T0097.110: Party Official Persona, T0143.003: Impersonated Persona) | +| [T0129.006 Deny Involvement](../../generated_pages/techniques/T0129.006.md) | IT00000331 “Only three of the Russian operatives identified by local hires of the campaign responded to requests for comment. All acknowledged visiting Madagascar last year, but only one admitted working as a pollster on behalf of the president.

“The others said they were simply tourists. Pyotr Korolyov, described as a sociologist on one spreadsheet, spent much of the summer of 2018 and fall hunched over a computer, deep in polling data at La Résidence Ankerana, a hotel the Russians used as their headquarters, until he was hospitalized with the measles, according to one person who worked with him.

“In an email exchange, Mr. Korolyov confirmed that he had come down with the measles, but rejected playing a role in a Russian operation. He did defend the idea of one, though.

““Russia should influence elections around the world, the same way the United States influences elections,” he wrote. “Sooner or later Russia will return to global politics as a global player,” he added. “And the American establishment will just have to accept that.””

This behaviour matches T0129.006: Deny Involvement because the actors contacted by journalists denied that they had participated in election interference (in spite of the evidence to the contrary). | +| [T0137 Make Money](../../generated_pages/techniques/T0137.md) | IT00000330 “But while Russia’s efforts [at election interference] in the United States fit Moscow’s campaign to upend Western democracy and rattle Mr. Putin’s geopolitical rivals, the undertaking in Madagascar often seemed to have a much simpler objective: profit.

“Before the election, a Russian company that local officials and foreign diplomats say is controlled by Mr. Prigozhin acquired a major stake in a government-run company that mines chromium, a mineral valued for its use in stainless steel. The acquisition set off protests by workers complaining of unpaid wages, cancelledcanceled benefits and foreign intrusion into a sector that had been a source of national pride for Madagascar.

“It repeated a pattern in which Russia has swooped into African nations, hoping to reshape their politics for material gain. In the Central African Republic, a former Russian intelligence officer is the top security adviser to the country’s president, while companies linked to Mr. Prigozhin have spread across the nation, snapping up diamonds in both legal and illegal ways, according to government officials, warlords in the diamond trade and registration documents showing Mr. Prigozhin’s growing military and commercial footprint.

[...] “The [operation switched from supporting the incumbent candidate on realising he would lose the election]. After the Russians pirouetted to help Mr. Rajoelina — their former opponent — win the election, Mr. Prigozhin’s company was able to negotiate with the new government to keep control of the chromium mining operation, despite the worker protests, and Mr. Prigozhin’s political operatives remain stationed in the capital to this day.”

This behaviour matches T0137: Make Money because analysts have asserted that the identified influence operation was in part motivated by a goal to generate profit | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000329 “In the campaign’s final weeks, Pastor Mailhol said, the team of Russians made a request: Drop out of the race and support Mr. Rajoelina. He refused.

“The Russians made the same proposal to the history professor running for president, saying, “If you accept this deal you will have money” according to Ms. Rasamimanana, the professor’s campaign manager.

When the professor refused, she said, the Russians created a fake Facebook page that mimicked his official page and posted an announcement on it that he was supporting Mr. Rajoelina.”

In this example actors created online accounts styled to look like official pages to trick targets into thinking that the presidential candidate announced that they had dropped out of the election (T0097.110: Party Official Persona, T0143.003: Impersonated Persona) | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00076.md b/generated_pages/incidents/I00076.md new file mode 100644 index 0000000..13bdf98 --- /dev/null +++ b/generated_pages/incidents/I00076.md @@ -0,0 +1,34 @@ +# Incident I00076: Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests + +* **Summary:** “In August 2018, FireEye Threat Intelligence released a report exposing what we assessed to be an Iranian influence operation leveraging networks of inauthentic news sites and social media accounts aimed at audiences around the world.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://web.archive.org/web/20190529020105/https://www.fireeye.com/blog/threat-research/2019/05/social-media-network-impersonates-us-political-candidates-supports-iranian-interests.html](https://web.archive.org/web/20190529020105/https://www.fireeye.com/blog/threat-research/2019/05/social-media-network-impersonates-us-political-candidates-supports-iranian-interests.html) | 2019/05/28 | Alice Revelli, Lee Foster | FireEye | [https://web.archive.org/web/20190529020105/https://www.fireeye.com/blog/threat-research/2019/05/social-media-network-impersonates-us-political-candidates-supports-iranian-interests.html](https://web.archive.org/web/20190529020105/https://www.fireeye.com/blog/threat-research/2019/05/social-media-network-impersonates-us-political-candidates-supports-iranian-interests.html) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0084.002 Plagiarise Content](../../generated_pages/techniques/T0084.002.md) | IT00000335 “Some Twitter accounts in the network [of inauthentic accounts attributed to Iran] impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

“For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month”

[...]

“In another example, the account @ButlerJineea impersonated Jineea Butler, a 2018 candidate for New York’s 13th Congressional District, using a photograph of Butler for its profile picture and incorporating her campaign slogans into its background picture, as well as claiming in its Twitter bio to be a “US House candidate, NY-13” and linking to Butler’s website, jineeabutlerforcongress[.]com.”

In this example actors impersonated existing political candidates (T0097.110: Member of Political Party Persona, T0143.003: Impersonated Persona), strengthening the impersonation by copying legitimate accounts’ imagery (T0145.001: Copy Account Imagery), and copying its previous posts (T0084.002: Plagiarise Content). | +| [T0097.101 Local Persona](../../generated_pages/techniques/T0097.101.md) | IT00000252 “In addition to directly posting material on social media, we observed some personas in the network [of inauthentic accounts attributed to Iran] leverage legitimate print and online media outlets in the U.S. and Israel to promote Iranian interests via the submission of letters, guest columns, and blog posts that were then published. We also identified personas that we suspect were fabricated for the sole purpose of submitting such letters, but that do not appear to maintain accounts on social media. The personas claimed to be based in varying locations depending on the news outlets they were targeting for submission; for example, a persona that listed their location as Seattle, WA in a letter submitted to the Seattle Times subsequently claimed to be located in Baytown, TX in a letter submitted to The Baytown Sun. Other accounts in the network then posted links to some of these letters on social media.”

In this example actors fabricated individuals who lived in areas which were being targeted for influence through the use of letters to local papers (T0097.101: Local Persona, T0143.002: Fabricated Persona). | +| [T0097.102 Journalist Persona](../../generated_pages/techniques/T0097.102.md) | IT00000257 “Accounts in the network [of inauthentic accounts attributed to Iran], under the guise of journalist personas, also solicited various individuals over Twitter for interviews and chats, including real journalists and politicians. The personas appear to have successfully conducted remote video and audio interviews with U.S. and UK-based individuals, including a prominent activist, a radio talk show host, and a former U.S. Government official, and subsequently posted the interviews on social media, showing only the individual being interviewed and not the interviewer. The interviewees expressed views that Iran would likely find favorable, discussing topics such as the February 2019 Warsaw summit, an attack on a military parade in the Iranian city of Ahvaz, and the killing of Jamal Khashoggi.

“The provenance of these interviews appear to have been misrepresented on at least one occasion, with one persona appearing to have falsely claimed to be operating on behalf of a mainstream news outlet; a remote video interview with a US-based activist about the Jamal Khashoggi killing was posted by an account adopting the persona of a journalist from the outlet Newsday, with the Newsday logo also appearing in the video. We did not identify any Newsday interview with the activist in question on this topic. In another instance, a persona posing as a journalist directed tweets containing audio of an interview conducted with a former U.S. Government official at real media personalities, calling on them to post about the interview.”

In this example actors fabricated journalists (T0097.102: Journalist Persona, T0143.002: Fabricated Persona) who worked at existing news outlets (T0097.202: News Outlet Persona, T0143.003: Impersonated Persona) in order to conduct interviews with targeted individuals. | +| [T0097.110 Party Official Persona](../../generated_pages/techniques/T0097.110.md) | IT00000334 “Some Twitter accounts in the network [of inauthentic accounts attributed to Iran] impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

“For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month”

[...]

“In another example, the account @ButlerJineea impersonated Jineea Butler, a 2018 candidate for New York’s 13th Congressional District, using a photograph of Butler for its profile picture and incorporating her campaign slogans into its background picture, as well as claiming in its Twitter bio to be a “US House candidate, NY-13” and linking to Butler’s website, jineeabutlerforcongress[.]com.”

In this example actors impersonated existing political candidates (T0097.110: Member of Political Party Persona, T0143.003: Impersonated Persona), strengthening the impersonation by copying legitimate accounts’ imagery (T0145.001: Copy Account Imagery), and copying its previous posts (T0084.002: Plagiarise Content). | +| [T0097.202 News Outlet Persona](../../generated_pages/techniques/T0097.202.md) | IT00000255 “Accounts in the network [of inauthentic accounts attributed to Iran], under the guise of journalist personas, also solicited various individuals over Twitter for interviews and chats, including real journalists and politicians. The personas appear to have successfully conducted remote video and audio interviews with U.S. and UK-based individuals, including a prominent activist, a radio talk show host, and a former U.S. Government official, and subsequently posted the interviews on social media, showing only the individual being interviewed and not the interviewer. The interviewees expressed views that Iran would likely find favorable, discussing topics such as the February 2019 Warsaw summit, an attack on a military parade in the Iranian city of Ahvaz, and the killing of Jamal Khashoggi.

“The provenance of these interviews appear to have been misrepresented on at least one occasion, with one persona appearing to have falsely claimed to be operating on behalf of a mainstream news outlet; a remote video interview with a US-based activist about the Jamal Khashoggi killing was posted by an account adopting the persona of a journalist from the outlet Newsday, with the Newsday logo also appearing in the video. We did not identify any Newsday interview with the activist in question on this topic. In another instance, a persona posing as a journalist directed tweets containing audio of an interview conducted with a former U.S. Government official at real media personalities, calling on them to post about the interview.”

In this example actors fabricated journalists (T0097.102: Journalist Persona, T0143.002: Fabricated Persona) who worked at existing news outlets (T0097.202: News Outlet Persona, T0143.003: Impersonated Persona) in order to conduct interviews with targeted individuals. | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000253 “In addition to directly posting material on social media, we observed some personas in the network [of inauthentic accounts attributed to Iran] leverage legitimate print and online media outlets in the U.S. and Israel to promote Iranian interests via the submission of letters, guest columns, and blog posts that were then published. We also identified personas that we suspect were fabricated for the sole purpose of submitting such letters, but that do not appear to maintain accounts on social media. The personas claimed to be based in varying locations depending on the news outlets they were targeting for submission; for example, a persona that listed their location as Seattle, WA in a letter submitted to the Seattle Times subsequently claimed to be located in Baytown, TX in a letter submitted to The Baytown Sun. Other accounts in the network then posted links to some of these letters on social media.”

In this example actors fabricated individuals who lived in areas which were being targeted for influence through the use of letters to local papers (T0097.101: Local Persona, T0143.002: Fabricated Persona). | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000333 “Some Twitter accounts in the network [of inauthentic accounts attributed to Iran] impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

“For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month”

[...]

“In another example, the account @ButlerJineea impersonated Jineea Butler, a 2018 candidate for New York’s 13th Congressional District, using a photograph of Butler for its profile picture and incorporating her campaign slogans into its background picture, as well as claiming in its Twitter bio to be a “US House candidate, NY-13” and linking to Butler’s website, jineeabutlerforcongress[.]com.”

In this example actors impersonated existing political candidates (T0097.110: Member of Political Party Persona, T0143.003: Impersonated Persona), strengthening the impersonation by copying legitimate accounts’ imagery (T0145.001: Copy Account Imagery), and copying its previous posts (T0084.002: Plagiarise Content). | +| [T0145.001 Copy Account Imagery](../../generated_pages/techniques/T0145.001.md) | IT00000332 “Some Twitter accounts in the network [of inauthentic accounts attributed to Iran] impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

“For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month”

[...]

“In another example, the account @ButlerJineea impersonated Jineea Butler, a 2018 candidate for New York’s 13th Congressional District, using a photograph of Butler for its profile picture and incorporating her campaign slogans into its background picture, as well as claiming in its Twitter bio to be a “US House candidate, NY-13” and linking to Butler’s website, jineeabutlerforcongress[.]com.”

In this example actors impersonated existing political candidates (T0097.110: Member of Political Party Persona, T0143.003: Impersonated Persona), strengthening the impersonation by copying legitimate accounts’ imagery (T0145.001: Copy Account Imagery), and copying its previous posts (T0084.002: Plagiarise Content). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00077.md b/generated_pages/incidents/I00077.md new file mode 100644 index 0000000..d50c45a --- /dev/null +++ b/generated_pages/incidents/I00077.md @@ -0,0 +1,31 @@ +# Incident I00077: Fronts & Friends: An Investigation into Two Twitter Networks Linked to Russian Actors + +* **Summary:** “On February 23, 2021 Twitter announced the removal of two networks linked to Russian actors, which it had shared with the Stanford Internet Observatory on February 12. The first network, which we will call Network 1, “can be reliably tied to Russian state actors,” according to Twitter. It consisted of two types of accounts: accounts that claimed to be located in Syria and accounts that spread anti-NATO messaging. Many of these accounts were sockpuppets, claiming to be individuals that did not exist, or fake media fronts.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://stacks.stanford.edu/file/druid:jv674ss6714/russia_twitter_takedown_feb_23_2021.pdf](https://stacks.stanford.edu/file/druid:jv674ss6714/russia_twitter_takedown_feb_23_2021.pdf) | 2021/02/23 | Renée DiResta, Shelby Grossman | Stanford Internet Observatory | [https://web.archive.org/web/20231227044952/https://stacks.stanford.edu/file/druid:jv674ss6714/russia_twitter_takedown_feb_23_2021.pdf](https://web.archive.org/web/20231227044952/https://stacks.stanford.edu/file/druid:jv674ss6714/russia_twitter_takedown_feb_23_2021.pdf) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.103 Activist Persona](../../generated_pages/techniques/T0097.103.md) | IT00000262 “The Syria portion of the network [of inauthentic accounts attributed to Russia] included additional sockpuppet accounts. One of these claimed to be a gay rights defender in Syria. Several said they were Syrian journalists. Another account, @SophiaHammer3, said she was born in Syria but currently lives in London. “I’m fond of history and politics. I struggle for justice.” Twitter users had previously observed that Sophia was likely a sockpuppet.”

This behaviour matches T0097.103: Activist Persona because the account presents itself as defending a political cause - in this case gay rights.

Twitter’s technical indicators allowed their analysts to assert that these accounts were “reliably tied to Russian state actors”, meaning the presented personas were entirely fabricated (T0143.002: Fabricated Persona); these accounts are not legitimate gay rights defenders or journalists, they’re assets controlled by Russia publishing narratives beneficial to their agenda. | +| [T0097.202 News Outlet Persona](../../generated_pages/techniques/T0097.202.md) | IT00000265 “Two accounts [in the second network of accounts taken down by Twitter] appear to have been operated by Oriental Review and the Strategic Culture Foundation, respectively. Oriental Review bills itself as an “open source site for free thinking”, though it trades in outlandish conspiracy theories and posts content bylined by fake people. Stanford Internet Observatory researchers and investigative journalists have previously noted the presence of content bylined by fake “reporter” personas tied to the GRU-linked front Inside Syria Media Center, posted on Oriental Review.”

In an effort to make the Oriental Review’s stories appear more credible, the threat actors created fake journalists and pretended they wrote the articles on their website (aka “bylined” them).

In DISARM terms, they fabricated journalists (T0143.002: Fabricated Persona, T0097.003: Journalist Persona), and then used these fabricated journalists to increase perceived legitimacy (T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | +| [T0143.001 Authentic Persona](../../generated_pages/techniques/T0143.001.md) | IT00000258 “The largest account [in the network of inauthentic accounts attributed to Russia] had 11,542 followers but only 8 had over 1,000 followers, and 11 had under ten. The accounts in aggregate had only 79,807 engagements across the entire tweet corpus, and appear to have been linked to the operations primarily via technical indicators rather than amplification or conversation between them. A few of the bios from accounts in the set claim to be journalists. Two profiles, belonging to an American activist and a Russian academic, were definitively real people; we do not have sufficient visibility into the technical indicators that led to their inclusion in the network and thus do not include them in our discussion.”

In this example the Stanford Internet Observatory has been provided data on two networks which, according to Twitter, showed signs of being affiliated with Russia’s Internet Research Agency (IRA). Two accounts investigated by Stanford were real people presenting their authentic personas, matching T0143.001: Authentic Persona.

Stanford didn’t have access to the technical indicators associating these accounts with the IRA, so they did not include data associated with these accounts for assessment. Analysts with access to platform logs may be able to uncover indicators of suspicious behaviour in accounts presenting authentic personas, using attribution methods unavailable to analysts working with open source data. | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000264 “Two accounts [in the second network of accounts taken down by Twitter] appear to have been operated by Oriental Review and the Strategic Culture Foundation, respectively. Oriental Review bills itself as an “open source site for free thinking”, though it trades in outlandish conspiracy theories and posts content bylined by fake people. Stanford Internet Observatory researchers and investigative journalists have previously noted the presence of content bylined by fake “reporter” personas tied to the GRU-linked front Inside Syria Media Center, posted on Oriental Review.”

In an effort to make the Oriental Review’s stories appear more credible, the threat actors created fake journalists and pretended they wrote the articles on their website (aka “bylined” them).

In DISARM terms, they fabricated journalists (T0143.002: Fabricated Persona, T0097.003: Journalist Persona), and then used these fabricated journalists to increase perceived legitimacy (T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | +| [T0144.001 Present Persona across Platforms](../../generated_pages/techniques/T0144.001.md) | IT00000260 “Approximately one-third of the suspended accounts [in the network of inauthentic accounts attributed to Russia] tweeted primarily about Syria, in English, Russian, and Arabic; many accounts tweeted in all three languages. The themes these accounts pushed will be familiar to anyone who has studied Russian overt or covert information operations about Syria: 

- Praising Russia’s role in Syria; claiming Russia was killing terrorists in Syria and highlighting Russia’s humanitarian aid
- Criticizing the role of the Turkey and the US in Syria; claiming the US killed civilians in Syria
- Criticizing the White Helmets, and claiming that they worked with Westerners to created scenes to make it look like the Syrian government used chemical weapons

“The two most prominent Syria accounts were @Syria_FreeNews and @PamSpenser. 

“@Syria_FreeNews had 20,505 followers and was created on April 6, 2017. The account’s bio said “Exclusive information about Middle East and Northern Africa countries events. BreaKing news from the scene.””

This behaviour matches T0097.202: News Outlet Persona because the account @Syrira_FreeNews presented itself as a news outlet in its name, bio, and branding, across all websites on which the persona had been established (T0144.001: Persona Presented across Platforms). Twitter’s technical indicators allowed them to attribute the account “can be reliably tied to Russian state actors”. Because of this we can assert that the persona is entirely fabricated (T0143.002: Fabricated Persona); this is not a legitimate news outlet providing information about Syria, it’s an asset controlled by Russia publishing narratives beneficial to their agenda. | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00078.md b/generated_pages/incidents/I00078.md new file mode 100644 index 0000000..c282e96 --- /dev/null +++ b/generated_pages/incidents/I00078.md @@ -0,0 +1,31 @@ +# Incident I00078: Meta’s September 2020 Removal of Coordinated Inauthentic Behavior + +* **Summary:** “[Meta] removed three separate networks for violating [Meta’s] policy against foreign or government interference which is coordinated inauthentic behavior (CIB) on behalf of a foreign or government entity. These networks originated in Russia.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://about.fb.com/news/2020/09/removing-coordinated-inauthentic-behavior-russia/](https://about.fb.com/news/2020/09/removing-coordinated-inauthentic-behavior-russia/) | 2020/09/24 | Nathaniel Gleicher | Meta | [https://web.archive.org/web/20240604043118/https://about.fb.com/news/2020/09/removing-coordinated-inauthentic-behavior-russia/](https://web.archive.org/web/20240604043118/https://about.fb.com/news/2020/09/removing-coordinated-inauthentic-behavior-russia/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.101 Local Persona](../../generated_pages/techniques/T0097.101.md) | IT00000271 “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [T0097.106 Recruiter Persona](../../generated_pages/techniques/T0097.106.md) | IT00000270 “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [T0097.204 Think Tank Persona](../../generated_pages/techniques/T0097.204.md) | IT00000267 “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [T0143.001 Authentic Persona](../../generated_pages/techniques/T0143.001.md) | IT00000269 “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000268 “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00079.md b/generated_pages/incidents/I00079.md new file mode 100644 index 0000000..7e3cb70 --- /dev/null +++ b/generated_pages/incidents/I00079.md @@ -0,0 +1,34 @@ +# Incident I00079: Three thousand fake tanks + +* **Summary:** “How a network of conspiracy sites spread a fake story about US reinforcements in Europe” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d](https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d) | 2017/01/12 | Ben Nimmo | DFRLab | [https://web.archive.org/web/20240527191455/https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d](https://web.archive.org/web/20240527191455/https://medium.com/@DFRLab/three-thousand-fake-tanks-575410c4f64d) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0016 Create Clickbait](../../generated_pages/techniques/T0016.md) | IT00000275 “On January 4 [2017], however, the Donbas News International (DNI) agency, based in Donetsk, Ukraine, and (since September 2016) an official state media outlet of the unrecognized separatist Donetsk People’s Republic, ran an article under the sensational headline, “US sends 3,600 tanks against Russia — massive NATO deployment under way.” DNI is run by Finnish exile Janus Putkonen, described by the Finnish national broadcaster, YLE, as a “Finnish info warrior”, and the first foreigner to be granted a Donetsk passport.

“The equally sensational opening paragraph ran, “The NATO war preparation against Russia, ‘Operation Atlantic Resolve’, is in full swing. 2,000 US tanks will be sent in coming days from Germany to Eastern Europe, and 1,600 US tanks is deployed to storage facilities in the Netherlands. At the same time, NATO countries are sending thousands of soldiers in to Russian borders.”

“The report is based around an obvious factual error, conflating the total number of vehicles with the actual number of tanks, and therefore multiplying the actual tank force 20 times over. For context, military website globalfirepower.com puts the total US tank force at 8,848. If the DNI story had been true, it would have meant sending 40% of all the US’ main battle tanks to Europe in one go.

“Could this have been an innocent mistake? The simple answer is “no”. The journalist who penned the story had a sufficient command of the details to be able to write, later in the same article, “In January, 26 tanks, 100 other vehicles and 120 containers will be transported by train to Lithuania. Germany will send the 122nd Infantry Battalion.” Yet the same author apparently believed, in the headline and first paragraph, that every single vehicle in Atlantic Resolve is a tank. To call this an innocent mistake is simply not plausible.

“The DNI story can only realistically be considered a deliberate fake designed to caricaturize and demonize NATO, the United States and Germany (tactfully referred to in the report as having “rolled over Eastern Europe in its war of extermination 75 years ago”) by grossly overstating the number of MBTs involved.”

This behaviour matches T0016: Create Clickbait because the person who wrote the story is shown to be aware of the fact that there were non-tank vehicles later in their story, but still chose to give the article a sensationalist headline claiming that all vehicles being sent were tanks. | +| [T0023 Distort Facts](../../generated_pages/techniques/T0023.md) | IT00000272 “On January 4 [2017], a little-known news site based in Donetsk, Ukraine published an article claiming that the United States was sending 3,600 tanks to Europe as part of “the NATO war preparation against Russia”.

“Like much fake news, this story started with a grain of truth: the US was about to reinforce its armored units in Europe. However, the article converted literally thousands of other vehicles — including hundreds of Humvees and trailers — into tanks, building the US force into something 20 times more powerful than it actually was.

“The story caught on online. Within three days it had been repeated by a dozen websites in the United States, Canada and Europe, and shared some 40,000 times. It was translated into Norwegian; quoted, unchallenged, by Russian state news agency RIA Novosti; and spread among Russian-language websites.

“It was also an obvious fake, as any Google news search would have revealed. Yet despite its evident falsehood, it spread widely, and not just in directly Kremlin-run media. Tracking the spread of this fake therefore shines a light on the wider question of how fake stories are dispersed.”

Russian state news agency RIA Novosti presents themselves as a news outlet (T0097.202: News Outlet Persona). RIO Novosti is a real news outlet (T0143.001: Authentic Persona), but it did not carry out a basic investigation into the veracity of the narrative they published implicitly expected of institutions presenting themselves as news outlets.

We can’t know how or why this narrative ended up being published by RIA Novosti, but we know that it presented a distorted reality as authentic information (T0023: Distort Facts), claiming that the US was sending 3,600 tanks, instead of 3,600 vehicles which included ~180 tanks. | +| [T0084.002 Plagiarise Content](../../generated_pages/techniques/T0084.002.md) | IT00000278 “The sixth [website to repost a confirmed false narrative investigated in this report] is an apparent think tank, the Center for Global Strategic Monitoring. This website describes itself, in English apparently written by a non-native speaker, as a “nonprofit and nonpartisan research and analysis institution dedicated to providing insights of the think tank community publications”. It does, indeed, publish think-tank reports on issues such as Turkey and US-China relations; however, the reports are the work of other think tanks, often unattributed (the two mentioned in this sentence were actually produced by the Brookings Institution, although the website makes no mention of the fact). It also fails to provide an address, or any other contact details other than an email, and its (long) list of experts includes entries apparently copied and pasted from other institutions. Thus, the “think tank” website which shared the fake story appears to be a fake itself.” In this example a website which amplified a false narrative presented itself as a think tank (T0097.204: Think Tank Persona).

This is an entirely fabricated persona (T0143.002: Fabricated Persona); it republished content from other think tanks without attribution (T0084.002: Plagiarise Content) and fabricated experts (T0097.108: Expert Persona, T0143.002: Fabricated Persona) to make it more believable that they were a real think tank. | +| [T0097.108 Expert Persona](../../generated_pages/techniques/T0097.108.md) | IT00000277 “The sixth [website to repost a confirmed false narrative investigated in this report] is an apparent think tank, the Center for Global Strategic Monitoring. This website describes itself, in English apparently written by a non-native speaker, as a “nonprofit and nonpartisan research and analysis institution dedicated to providing insights of the think tank community publications”. It does, indeed, publish think-tank reports on issues such as Turkey and US-China relations; however, the reports are the work of other think tanks, often unattributed (the two mentioned in this sentence were actually produced by the Brookings Institution, although the website makes no mention of the fact). It also fails to provide an address, or any other contact details other than an email, and its (long) list of experts includes entries apparently copied and pasted from other institutions. Thus, the “think tank” website which shared the fake story appears to be a fake itself.” In this example a website which amplified a false narrative presented itself as a think tank (T0097.204: Think Tank Persona).

This is an entirely fabricated persona (T0143.002: Fabricated Persona); it republished content from other think tanks without attribution (T0084.002: Plagiarise Content) and fabricated experts (T0097.108: Expert Persona, T0143.002: Fabricated Persona) to make it more believable that they were a real think tank. | +| [T0097.202 News Outlet Persona](../../generated_pages/techniques/T0097.202.md) | IT00000274 “On January 4 [2017], a little-known news site based in Donetsk, Ukraine published an article claiming that the United States was sending 3,600 tanks to Europe as part of “the NATO war preparation against Russia”.

“Like much fake news, this story started with a grain of truth: the US was about to reinforce its armored units in Europe. However, the article converted literally thousands of other vehicles — including hundreds of Humvees and trailers — into tanks, building the US force into something 20 times more powerful than it actually was.

“The story caught on online. Within three days it had been repeated by a dozen websites in the United States, Canada and Europe, and shared some 40,000 times. It was translated into Norwegian; quoted, unchallenged, by Russian state news agency RIA Novosti; and spread among Russian-language websites.

“It was also an obvious fake, as any Google news search would have revealed. Yet despite its evident falsehood, it spread widely, and not just in directly Kremlin-run media. Tracking the spread of this fake therefore shines a light on the wider question of how fake stories are dispersed.”

Russian state news agency RIA Novosti presents themselves as a news outlet (T0097.202: News Outlet Persona). RIO Novosti is a real news outlet (T0143.001: Authentic Persona), but it did not carry out a basic investigation into the veracity of the narrative they published implicitly expected of institutions presenting themselves as news outlets.

We can’t know how or why this narrative ended up being published by RIA Novosti, but we know that it presented a distorted reality as authentic information (T0023: Distort Facts), claiming that the US was sending 3,600 tanks, instead of 3,600 vehicles which included ~180 tanks. | +| [T0097.204 Think Tank Persona](../../generated_pages/techniques/T0097.204.md) | IT00000276 “The sixth [website to repost a confirmed false narrative investigated in this report] is an apparent think tank, the Center for Global Strategic Monitoring. This website describes itself, in English apparently written by a non-native speaker, as a “nonprofit and nonpartisan research and analysis institution dedicated to providing insights of the think tank community publications”. It does, indeed, publish think-tank reports on issues such as Turkey and US-China relations; however, the reports are the work of other think tanks, often unattributed (the two mentioned in this sentence were actually produced by the Brookings Institution, although the website makes no mention of the fact). It also fails to provide an address, or any other contact details other than an email, and its (long) list of experts includes entries apparently copied and pasted from other institutions. Thus, the “think tank” website which shared the fake story appears to be a fake itself.” In this example a website which amplified a false narrative presented itself as a think tank (T0097.204: Think Tank Persona).

This is an entirely fabricated persona (T0143.002: Fabricated Persona); it republished content from other think tanks without attribution (T0084.002: Plagiarise Content) and fabricated experts (T0097.108: Expert Persona, T0143.002: Fabricated Persona) to make it more believable that they were a real think tank. | +| [T0143.001 Authentic Persona](../../generated_pages/techniques/T0143.001.md) | IT00000273 “On January 4 [2017], a little-known news site based in Donetsk, Ukraine published an article claiming that the United States was sending 3,600 tanks to Europe as part of “the NATO war preparation against Russia”.

“Like much fake news, this story started with a grain of truth: the US was about to reinforce its armored units in Europe. However, the article converted literally thousands of other vehicles — including hundreds of Humvees and trailers — into tanks, building the US force into something 20 times more powerful than it actually was.

“The story caught on online. Within three days it had been repeated by a dozen websites in the United States, Canada and Europe, and shared some 40,000 times. It was translated into Norwegian; quoted, unchallenged, by Russian state news agency RIA Novosti; and spread among Russian-language websites.

“It was also an obvious fake, as any Google news search would have revealed. Yet despite its evident falsehood, it spread widely, and not just in directly Kremlin-run media. Tracking the spread of this fake therefore shines a light on the wider question of how fake stories are dispersed.”

Russian state news agency RIA Novosti presents themselves as a news outlet (T0097.202: News Outlet Persona). RIO Novosti is a real news outlet (T0143.001: Authentic Persona), but it did not carry out a basic investigation into the veracity of the narrative they published implicitly expected of institutions presenting themselves as news outlets.

We can’t know how or why this narrative ended up being published by RIA Novosti, but we know that it presented a distorted reality as authentic information (T0023: Distort Facts), claiming that the US was sending 3,600 tanks, instead of 3,600 vehicles which included ~180 tanks. | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000279 “The sixth [website to repost a confirmed false narrative investigated in this report] is an apparent think tank, the Center for Global Strategic Monitoring. This website describes itself, in English apparently written by a non-native speaker, as a “nonprofit and nonpartisan research and analysis institution dedicated to providing insights of the think tank community publications”. It does, indeed, publish think-tank reports on issues such as Turkey and US-China relations; however, the reports are the work of other think tanks, often unattributed (the two mentioned in this sentence were actually produced by the Brookings Institution, although the website makes no mention of the fact). It also fails to provide an address, or any other contact details other than an email, and its (long) list of experts includes entries apparently copied and pasted from other institutions. Thus, the “think tank” website which shared the fake story appears to be a fake itself.” In this example a website which amplified a false narrative presented itself as a think tank (T0097.204: Think Tank Persona).

This is an entirely fabricated persona (T0143.002: Fabricated Persona); it republished content from other think tanks without attribution (T0084.002: Plagiarise Content) and fabricated experts (T0097.108: Expert Persona, T0143.002: Fabricated Persona) to make it more believable that they were a real think tank. | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00080.md b/generated_pages/incidents/I00080.md new file mode 100644 index 0000000..dac7178 --- /dev/null +++ b/generated_pages/incidents/I00080.md @@ -0,0 +1,31 @@ +# Incident I00080: Hundreds Of Propaganda Accounts Targeting Iran And Qatar Have Been Removed From Facebook + +* **Summary:** “A BuzzFeed News investigation uncovered a network of websites and accounts using Facebook, Twitter, YouTube, and other social platforms to sow propaganda targeting Iran and Qatar. The accounts, which have now been taken down, appear to have been professionally run by PR firms based in the Middle East and Africa.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.buzzfeednews.com/article/janelytvynenko/uae-propaganda](https://www.buzzfeednews.com/article/janelytvynenko/uae-propaganda) | 2019/10/04 | Jane Lytvynenko, Logan McDonald | BuzzFeed News | [https://web.archive.org/web/20240221110457/https://www.buzzfeednews.com/article/janelytvynenko/uae-propaganda](https://web.archive.org/web/20240221110457/https://www.buzzfeednews.com/article/janelytvynenko/uae-propaganda) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.102 Journalist Persona](../../generated_pages/techniques/T0097.102.md) | IT00000281 “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler (noun) (linking verb) (noun/verb/adjective),” which appears to reveal the formula used to write Twitter bios for the accounts.”

The Jenny Powel account used in this influence operation presents as both a journalist and an activist (T0097.102: Journalist Persona, T0097.103: Activist Persona, T0143.002: Fabricated Persona). This example shows how threat actors can easily follow a template to present a fabricated persona to their target audience (T0144.002: Persona Template). | +| [T0097.103 Activist Persona](../../generated_pages/techniques/T0097.103.md) | IT00000282 “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler (noun) (linking verb) (noun/verb/adjective),” which appears to reveal the formula used to write Twitter bios for the accounts.”

The Jenny Powel account used in this influence operation presents as both a journalist and an activist (T0097.102: Journalist Persona, T0097.103: Activist Persona, T0143.002: Fabricated Persona). This example shows how threat actors can easily follow a template to present a fabricated persona to their target audience (T0144.002: Persona Template). | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000283 “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler (noun) (linking verb) (noun/verb/adjective),” which appears to reveal the formula used to write Twitter bios for the accounts.”

The Jenny Powel account used in this influence operation presents as both a journalist and an activist (T0097.102: Journalist Persona, T0097.103: Activist Persona, T0143.002: Fabricated Persona). This example shows how threat actors can easily follow a template to present a fabricated persona to their target audience (T0144.002: Persona Template). | +| [T0144.002 Persona Template](../../generated_pages/techniques/T0144.002.md) | IT00000284 “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler (noun) (linking verb) (noun/verb/adjective),” which appears to reveal the formula used to write Twitter bios for the accounts.”

The Jenny Powel account used in this influence operation presents as both a journalist and an activist (T0097.102: Journalist Persona, T0097.103: Activist Persona, T0143.002: Fabricated Persona). This example shows how threat actors can easily follow a template to present a fabricated persona to their target audience (T0144.002: Persona Template). | +| [T0145.007 Stock Image Account Imagery](../../generated_pages/techniques/T0145.007.md) | IT00000280 “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler noun|linking verb|noun/verb/adjective|,” which appears to reveal the formula used to write Twitter bios for the accounts.”

This behaviour matches T0145.007: Stock Image Account Imagery because the account was identified as using a stock image as its profile picture. | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00081.md b/generated_pages/incidents/I00081.md new file mode 100644 index 0000000..b88aa9f --- /dev/null +++ b/generated_pages/incidents/I00081.md @@ -0,0 +1,28 @@ +# Incident I00081: Belarus KGB created fake accounts to criticize Poland during border crisis, Facebook parent company says + +* **Summary:** “Meta, the parent company of Facebook, said it has linked Belarus’s main security service, the KGB, to fake accounts on its social media platforms that criticized Poland during the countries’ recent border standoff.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.washingtonpost.com/world/europe/meta-belarus-kgb-poland-facebook/2021/12/02/ffaa73f8-534d-11ec-83d2-d9dab0e23b7e_story.html](https://www.washingtonpost.com/world/europe/meta-belarus-kgb-poland-facebook/2021/12/02/ffaa73f8-534d-11ec-83d2-d9dab0e23b7e_story.html) | 2021/12/02 | Isabelle Khurshudyan | The Washington Post | [https://web.archive.org/web/20211202114247/https://www.washingtonpost.com/world/europe/meta-belarus-kgb-poland-facebook/2021/12/02/ffaa73f8-534d-11ec-83d2-d9dab0e23b7e_story.html](https://web.archive.org/web/20211202114247/https://www.washingtonpost.com/world/europe/meta-belarus-kgb-poland-facebook/2021/12/02/ffaa73f8-534d-11ec-83d2-d9dab0e23b7e_story.html) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.101 Local Persona](../../generated_pages/techniques/T0097.101.md) | IT00000285 “Meta said it also removed 31 Facebook accounts, four groups, two events and four Instagram accounts that it believes originated in Poland and targeted Belarus and Iraq. Those allegedly fake accounts posed as Middle Eastern migrants posting about the border crisis. Meta did not link the accounts to a specific group.

““These fake personas claimed to be sharing their own negative experiences of trying to get from Belarus to Poland and posted about migrants’ difficult lives in Europe,” Meta said. “They also posted about Poland’s strict anti-migrant policies and anti-migrant neo-Nazi activity in Poland. They also shared links to news articles criticizing the Belarusian government’s handling of the border crisis and off-platform videos alleging migrant abuse in Europe.””

In this example accounts falsely presented themselves as having local insight into the border crisis narrative (T0097.101: Local Persona, T0143.002: Fabricated Persona). | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000286 “Meta said it also removed 31 Facebook accounts, four groups, two events and four Instagram accounts that it believes originated in Poland and targeted Belarus and Iraq. Those allegedly fake accounts posed as Middle Eastern migrants posting about the border crisis. Meta did not link the accounts to a specific group.

““These fake personas claimed to be sharing their own negative experiences of trying to get from Belarus to Poland and posted about migrants’ difficult lives in Europe,” Meta said. “They also posted about Poland’s strict anti-migrant policies and anti-migrant neo-Nazi activity in Poland. They also shared links to news articles criticizing the Belarusian government’s handling of the border crisis and off-platform videos alleging migrant abuse in Europe.””

In this example accounts falsely presented themselves as having local insight into the border crisis narrative (T0097.101: Local Persona, T0143.002: Fabricated Persona). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00082.md b/generated_pages/incidents/I00082.md new file mode 100644 index 0000000..7600161 --- /dev/null +++ b/generated_pages/incidents/I00082.md @@ -0,0 +1,31 @@ +# Incident I00082: Meta’s November 2021 Adversarial Threat Report + +* **Summary:** “Over the past four years, [Meta has] shared our findings about coordinated inauthentic behavior we detect and remove from our platforms. As part of our regular CIB reports, we’re sharing information about all networks we take down over the course of a month to make it easier for people to see the progress we’re making in one place.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://about.fb.com/wp-content/uploads/2021/12/Metas-Adversarial-Threat-Report.pdf](https://about.fb.com/wp-content/uploads/2021/12/Metas-Adversarial-Threat-Report.pdf) | 2021/12/01 | Nathaniel Gleicher, Ben Nimmo, David Agranovich, Mike Dvilyanski | Meta | [https://web.archive.org/web/20240521154735/https://about.fb.com/wp-content/uploads/2021/12/Metas-Adversarial-Threat-Report.pdf](https://web.archive.org/web/20240521154735/https://about.fb.com/wp-content/uploads/2021/12/Metas-Adversarial-Threat-Report.pdf) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.102 Journalist Persona](../../generated_pages/techniques/T0097.102.md) | IT00000287 “[Meta] removed 41 Facebook accounts, five Groups, and four Instagram accounts for violating our policy against coordinated inauthentic behavior. This activity originated in Belarus and primarily targeted audiences in the Middle East and Europe.

“The core of this activity began in October 2021, with some accounts created as recently as mid-November. The people behind it used newly-created fake accounts — many of which were detected and disabled by our automated systems soon after creation — to pose as journalists and activists from the European Union, particularly Poland and Lithuania. Some of the accounts used profile photos likely generated using artificial intelligence techniques like generative adversarial networks (GAN). These fictitious personas posted criticism of Poland in English, Polish, and Kurdish, including pictures and videos about Polish border guards allegedly violating migrants’ rights, and compared Poland’s treatment of migrants against other countries’. They also posted to Groups focused on the welfare of migrants in Europe. A few accounts posted in Russian about relations between Belarus and the Baltic States.”

This example shows how accounts identified as participating in coordinated inauthentic behaviour were presenting themselves as journalists and activists while spreading operation narratives (T0097.102: Journalist Persona, T0097.103: Activist Persona).

Additionally, analysts at Meta identified accounts which were participating in coordinated inauthentic behaviour that had likely used AI-Generated images as their profile pictures (T0145.002: AI-Generated Account Imagery). | +| [T0097.103 Activist Persona](../../generated_pages/techniques/T0097.103.md) | IT00000290 “[Meta] removed a network of accounts in Vietnam for violating our Inauthentic Behavior policy against mass reporting. They coordinated the targeting of activists and other people who publicly criticized the Vietnamese government and used false reports of various violations in an attempt to have these users removed from our platform. The people behind this activity relied primarily on authentic and duplicate accounts to submit hundreds — in some cases, thousands — of complaints against their targets through our abuse reporting flows.

“Many operators also maintained fake accounts — some of which were detected and disabled by our automated systems — to pose as their targets so they could then report the legitimate accounts as fake. They would frequently change the gender and name of their fake accounts to resemble the target individual. Among the most common claims in this misleading reporting activity were complaints of impersonation, and to a much lesser extent inauthenticity. The network also advertised abusive services in their bios and constantly evolved their tactics in an attempt to evade detection.“

In this example actors repurposed their accounts to impersonate targeted activists (T0097.103: Activist Persona, T0143.003: Impersonated Persona) in order to falsely report the activists’ legitimate accounts as impersonations (T0124.001: Report Non-Violative Opposing Content). | +| [T0124.001 Report Non-Violative Opposing Content](../../generated_pages/techniques/T0124.001.md) | IT00000291 “[Meta] removed a network of accounts in Vietnam for violating our Inauthentic Behavior policy against mass reporting. They coordinated the targeting of activists and other people who publicly criticized the Vietnamese government and used false reports of various violations in an attempt to have these users removed from our platform. The people behind this activity relied primarily on authentic and duplicate accounts to submit hundreds — in some cases, thousands — of complaints against their targets through our abuse reporting flows.

“Many operators also maintained fake accounts — some of which were detected and disabled by our automated systems — to pose as their targets so they could then report the legitimate accounts as fake. They would frequently change the gender and name of their fake accounts to resemble the target individual. Among the most common claims in this misleading reporting activity were complaints of impersonation, and to a much lesser extent inauthenticity. The network also advertised abusive services in their bios and constantly evolved their tactics in an attempt to evade detection.“

In this example actors repurposed their accounts to impersonate targeted activists (T0097.103: Activist Persona, T0143.003: Impersonated Persona) in order to falsely report the activists’ legitimate accounts as impersonations (T0124.001: Report Non-Violative Opposing Content). | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000292 “[Meta] removed a network of accounts in Vietnam for violating our Inauthentic Behavior policy against mass reporting. They coordinated the targeting of activists and other people who publicly criticized the Vietnamese government and used false reports of various violations in an attempt to have these users removed from our platform. The people behind this activity relied primarily on authentic and duplicate accounts to submit hundreds — in some cases, thousands — of complaints against their targets through our abuse reporting flows.

“Many operators also maintained fake accounts — some of which were detected and disabled by our automated systems — to pose as their targets so they could then report the legitimate accounts as fake. They would frequently change the gender and name of their fake accounts to resemble the target individual. Among the most common claims in this misleading reporting activity were complaints of impersonation, and to a much lesser extent inauthenticity. The network also advertised abusive services in their bios and constantly evolved their tactics in an attempt to evade detection.“

In this example actors repurposed their accounts to impersonate targeted activists (T0097.103: Activist Persona, T0143.003: Impersonated Persona) in order to falsely report the activists’ legitimate accounts as impersonations (T0124.001: Report Non-Violative Opposing Content). | +| [T0145.002 AI-Generated Account Imagery](../../generated_pages/techniques/T0145.002.md) | IT00000289 “[Meta] removed 41 Facebook accounts, five Groups, and four Instagram accounts for violating our policy against coordinated inauthentic behavior. This activity originated in Belarus and primarily targeted audiences in the Middle East and Europe.

“The core of this activity began in October 2021, with some accounts created as recently as mid-November. The people behind it used newly-created fake accounts — many of which were detected and disabled by our automated systems soon after creation — to pose as journalists and activists from the European Union, particularly Poland and Lithuania. Some of the accounts used profile photos likely generated using artificial intelligence techniques like generative adversarial networks (GAN). These fictitious personas posted criticism of Poland in English, Polish, and Kurdish, including pictures and videos about Polish border guards allegedly violating migrants’ rights, and compared Poland’s treatment of migrants against other countries’. They also posted to Groups focused on the welfare of migrants in Europe. A few accounts posted in Russian about relations between Belarus and the Baltic States.”

This example shows how accounts identified as participating in coordinated inauthentic behaviour were presenting themselves as journalists and activists while spreading operation narratives (T0097.102: Journalist Persona, T0097.103: Activist Persona).

Additionally, analysts at Meta identified accounts which were participating in coordinated inauthentic behaviour that had likely used AI-Generated images as their profile pictures (T0145.002: AI-Generated Account Imagery). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00083.md b/generated_pages/incidents/I00083.md new file mode 100644 index 0000000..5f12166 --- /dev/null +++ b/generated_pages/incidents/I00083.md @@ -0,0 +1,27 @@ +# Incident I00083: Fake Think Tanks Fuel Fake News—And the President's Tweets + +* **Summary:** ““FAKE NEWS ISN'T just Macedonian teenagers or internet trolls. A longstanding network of bogus "think tanks" raise disinformation to a pseudoscience, and their studies' pull quotes and flashy stats become the "evidence" driving viral, fact-free stories. Not to mention President Trump's tweets.

“These organizations have always existed: They're old-school propagandists with new-school, tech-savvy reach. They've been ginning up so-called research for everyone from shady corporations to anti-LGBTQ groups to white supremacists for decades---they're practiced, and their faux-academic veneer is thick and glossy. Which makes them harder to brush off than your garden-variety liar. "Fake think tanks use a mix of selected truths, half-truths, and downright fabricated stuff in order to manipulate people," says Massimo Pigliucci, a philosopher at the City College of New York and author of Nonsense on Stilts: How To Tell Science from Bunk. "We don't live in the age of post-truth. We live in the age of internet-enabled bullshit.”

“So phony think tanks are hard to spot, let alone discredit and combat. Their mix of pseudoscientific camouflage, long-held political connections, and social media gets them influence—and a whole lot of clicks.”” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.wired.com/2017/01/fake-think-tanks-fuel-fake-news-presidents-tweets/](https://www.wired.com/2017/01/fake-think-tanks-fuel-fake-news-presidents-tweets/) | 2017/01/24 | Emma Grey Ellis | Wired | [https://web.archive.org/web/20240705093231/https://www.wired.com/2017/01/fake-think-tanks-fuel-fake-news-presidents-tweets/](https://web.archive.org/web/20240705093231/https://www.wired.com/2017/01/fake-think-tanks-fuel-fake-news-presidents-tweets/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.204 Think Tank Persona](../../generated_pages/techniques/T0097.204.md) | IT00000293 “[This article discusses a] longstanding network of bogus "think tanks" raise disinformation to a pseudoscience, and their studies' pull quotes and flashy stats become the "evidence" driving viral, fact-free stories

[...]

“[These inauthentic Think Tanks] tend toward hate: There's the white supremacist National Policy Institute and Jared Taylor's New Century Foundation; the anti-LGBTQ work of the Family Research Council and American College of Pediatricians; and a whole slew of groups fixated on immigration. Three of the biggest---Federation for American Immigration Reform, the Center for Immigration Studies, and NumbersUSA---are intertwined, all connected in their origins to white nationalist John Tanton.

“The Southern Poverty Law Center designates most of these organizations as bona fide hate groups. And yet most---FRC, CIS and FAIR in particular---enjoy relationships with some powerful politicians. Trump himself has met with leaders of the anti-immigration groups, hired people from FAIR and the Family Research Council, and cited the anti-immigration groups' erroneous figures.

“That's because phony think tanks are professional mimics, from the innocuous-sounding names---the Employment Policies Institute practically steals its name from the Economic Policy Institute---to their online presences. "It used to be you could trust a dot-edu or a dot-org," says Heidi Beirich, director of the Southern Poverty Law Center's Intelligence Project. "Now some of the main hate sites are dot-orgs.””

In this example an organisation designated as a hate group is presenting itself as a think tank (T0097.204: Think Tank Persona) in order to boost the perceived legitimacy of narratives. | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00084.md b/generated_pages/incidents/I00084.md new file mode 100644 index 0000000..9849a02 --- /dev/null +++ b/generated_pages/incidents/I00084.md @@ -0,0 +1,31 @@ +# Incident I00084: Russia turns its diplomats into disinformation warriors + +* **Summary:** “After its state media outlets were banned in Europe and demoted from social media, the Kremlin is relying on officials to aggressively peddle falsehoods about the war in Ukraine.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.politico.eu/article/russia-diplomats-disinformation-war-ukraine/](https://www.politico.eu/article/russia-diplomats-disinformation-war-ukraine/) | 2022/04/07 | Mark Scott | Politico | [https://web.archive.org/web/20240528043057/https://www.politico.eu/article/russia-diplomats-disinformation-war-ukraine/](https://web.archive.org/web/20240528043057/https://www.politico.eu/article/russia-diplomats-disinformation-war-ukraine/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0043.001 Use Encrypted Chat Apps](../../generated_pages/techniques/T0043.001.md) | IT00000294 “[Russia’s social media] reach isn't the same as Russian state media, but they are trying to recreate what RT and Sputnik had done," said one EU official involved in tracking Russian disinformation. "It's a coordinated effort that goes beyond social media and involves specific websites."

“Central to that wider online playbook is a Telegram channel called Warfakes and an affiliated website. Since the beginning of the conflict, that social media channel has garnered more than 725,000 members and repeatedly shares alleged fact-checks aimed at debunking Ukrainian narratives, using language similar to Western-style fact-checking outlets.”

In this example a Telegram channel (T0043.001: Use Encrypted Chat Apps) was established which presented itself as a source of fact checks (T0097.203: Fact Checking Organisation Persona). | +| [T0097.111 Government Official Persona](../../generated_pages/techniques/T0097.111.md) | IT00000337 “After the European Union banned Kremlin-backed media outlets and social media giants demoted their posts for peddling falsehoods about the war in Ukraine, Moscow has turned to its cadre of diplomats, government spokespeople and ministers — many of whom have extensive followings on social media — to promote disinformation about the conflict in Eastern Europe, according to four EU and United States officials.”

In this example authentic Russian government officials used their own accounts to promote false narratives (T0143.001: Authentic Persona, T0097.111: Government Official Persona).

The use of accounts managed by authentic Government / Diplomats to spread false narratives makes it harder for platforms to enforce content moderation, because of the political ramifications they may face for censoring elected officials (T0131: Exploit TOS/Content Moderation). For example, Twitter previously argued that official channels of world leaders are not removed due to the high public interest associated with their activities. | +| [T0097.203 Fact Checking Organisation Persona](../../generated_pages/techniques/T0097.203.md) | IT00000295 “[Russia’s social media] reach isn't the same as Russian state media, but they are trying to recreate what RT and Sputnik had done," said one EU official involved in tracking Russian disinformation. "It's a coordinated effort that goes beyond social media and involves specific websites."

“Central to that wider online playbook is a Telegram channel called Warfakes and an affiliated website. Since the beginning of the conflict, that social media channel has garnered more than 725,000 members and repeatedly shares alleged fact-checks aimed at debunking Ukrainian narratives, using language similar to Western-style fact-checking outlets.”

In this example a Telegram channel (T0043.001: Use Encrypted Chat Apps) was established which presented itself as a source of fact checks (T0097.203: Fact Checking Organisation Persona). | +| [T0131 Exploit TOS/Content Moderation](../../generated_pages/techniques/T0131.md) | IT00000338 “After the European Union banned Kremlin-backed media outlets and social media giants demoted their posts for peddling falsehoods about the war in Ukraine, Moscow has turned to its cadre of diplomats, government spokespeople and ministers — many of whom have extensive followings on social media — to promote disinformation about the conflict in Eastern Europe, according to four EU and United States officials.”

In this example authentic Russian government officials used their own accounts to promote false narratives (T0143.001: Authentic Persona, T0097.111: Government Official Persona).

The use of accounts managed by authentic Government / Diplomats to spread false narratives makes it harder for platforms to enforce content moderation, because of the political ramifications they may face for censoring elected officials (T0131: Exploit TOS/Content Moderation). For example, Twitter previously argued that official channels of world leaders are not removed due to the high public interest associated with their activities. | +| [T0143.001 Authentic Persona](../../generated_pages/techniques/T0143.001.md) | IT00000336 “After the European Union banned Kremlin-backed media outlets and social media giants demoted their posts for peddling falsehoods about the war in Ukraine, Moscow has turned to its cadre of diplomats, government spokespeople and ministers — many of whom have extensive followings on social media — to promote disinformation about the conflict in Eastern Europe, according to four EU and United States officials.”

In this example authentic Russian government officials used their own accounts to promote false narratives (T0143.001: Authentic Persona, T0097.111: Government Official Persona).

The use of accounts managed by authentic Government / Diplomats to spread false narratives makes it harder for platforms to enforce content moderation, because of the political ramifications they may face for censoring elected officials (T0131: Exploit TOS/Content Moderation). For example, Twitter previously argued that official channels of world leaders are not removed due to the high public interest associated with their activities. | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00085.md b/generated_pages/incidents/I00085.md new file mode 100644 index 0000000..0b37ecc --- /dev/null +++ b/generated_pages/incidents/I00085.md @@ -0,0 +1,29 @@ +# Incident I00085: China’s large-scale media push: Attempts to influence Swedish media + +* **Summary:** “Through the Chinese ambassador in Sweden, the Chinese government has been in contact with media companies in Sweden on several occasions, in an attempt to influence publications, according to a survey made by SVT Nyheter (Swedish national television).” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.svt.se/nyheter/inrikes/china-s-large-scale-media-push-attempts-to-influence-swedish-media](https://www.svt.se/nyheter/inrikes/china-s-large-scale-media-push-attempts-to-influence-swedish-media) | 2020/01/20 | Knut Kainz Rognerud, Karin Moberg, Jon Åhlén | SÅ ARBETAR VI | [https://web.archive.org/web/20240408034525/https://www.svt.se/nyheter/inrikes/china-s-large-scale-media-push-attempts-to-influence-swedish-media](https://web.archive.org/web/20240408034525/https://www.svt.se/nyheter/inrikes/china-s-large-scale-media-push-attempts-to-influence-swedish-media) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.111 Government Official Persona](../../generated_pages/techniques/T0097.111.md) | IT00000340 “Four media companies – Svenska Dagbladet, Expressen, Sveriges Radio, and Sveriges Television – stated that they had been contacted by the Chinese embassy on several occasions, and that they, for instance, had been criticized on their publications, both by letters and e-mails.

The media company Svenska Dagbladet, had been contacted on several occasions in the past two years, including via e-mails directly from the Chinese ambassador to Sweden. Several times, China and the Chinese ambassador had criticized the media company’s publications regarding the conditions in China. Individual reporters also reported having been subjected to criticism.

The tabloid Expressen had received several letters and e-mails from the embassy, e-mails containing criticism and threatening formulations regarding the coverage of the Swedish book publisher Gui Minhai, who has been imprisoned in China since 2015. Formulations such as “media tyranny” could be found in the e-mails.”

In this case, the Chinese ambassador is using their official role (T0143.001: Authentic Persona, T0097.111: Government Official Persona) to try to influence Swedish press. A government official trying to interfere in other countries' media activities could be a violation of press freedom. In this specific case, the Chinese diplomats are trying to silence criticism against China (T0139.002: Silence).” | +| [T0139.002 Silence](../../generated_pages/techniques/T0139.002.md) | IT00000341 “Four media companies – Svenska Dagbladet, Expressen, Sveriges Radio, and Sveriges Television – stated that they had been contacted by the Chinese embassy on several occasions, and that they, for instance, had been criticized on their publications, both by letters and e-mails.

The media company Svenska Dagbladet, had been contacted on several occasions in the past two years, including via e-mails directly from the Chinese ambassador to Sweden. Several times, China and the Chinese ambassador had criticized the media company’s publications regarding the conditions in China. Individual reporters also reported having been subjected to criticism.

The tabloid Expressen had received several letters and e-mails from the embassy, e-mails containing criticism and threatening formulations regarding the coverage of the Swedish book publisher Gui Minhai, who has been imprisoned in China since 2015. Formulations such as “media tyranny” could be found in the e-mails.”

In this case, the Chinese ambassador is using their official role (T0143.001: Authentic Persona, T0097.111: Government Official Persona) to try to influence Swedish press. A government official trying to interfere in other countries' media activities could be a violation of press freedom. In this specific case, the Chinese diplomats are trying to silence criticism against China (T0139.002: Silence).” | +| [T0143.001 Authentic Persona](../../generated_pages/techniques/T0143.001.md) | IT00000339 “Four media companies – Svenska Dagbladet, Expressen, Sveriges Radio, and Sveriges Television – stated that they had been contacted by the Chinese embassy on several occasions, and that they, for instance, had been criticized on their publications, both by letters and e-mails.

The media company Svenska Dagbladet, had been contacted on several occasions in the past two years, including via e-mails directly from the Chinese ambassador to Sweden. Several times, China and the Chinese ambassador had criticized the media company’s publications regarding the conditions in China. Individual reporters also reported having been subjected to criticism.

The tabloid Expressen had received several letters and e-mails from the embassy, e-mails containing criticism and threatening formulations regarding the coverage of the Swedish book publisher Gui Minhai, who has been imprisoned in China since 2015. Formulations such as “media tyranny” could be found in the e-mails.”

In this case, the Chinese ambassador is using their official role (T0143.001: Authentic Persona, T0097.111: Government Official Persona) to try to influence Swedish press. A government official trying to interfere in other countries' media activities could be a violation of press freedom. In this specific case, the Chinese diplomats are trying to silence criticism against China (T0139.002: Silence).” | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00086.md b/generated_pages/incidents/I00086.md new file mode 100644 index 0000000..855a932 --- /dev/null +++ b/generated_pages/incidents/I00086.md @@ -0,0 +1,33 @@ +# Incident I00086: #WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media + +* **Summary:** “This report investigates a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023. By using digital forensic strategies and network analysis, this research unearths the magnitude of knowledge, organization, and resource expenditure of the campaign. Network analysis indicates the campaign includes thousands of accounts. Though unable to trace the exact origins, phone numbers belonging to accounts have been linked to Jordan and Egypt, and it is alleged that many of the tactics are likely inspired by previous Iranian campaigns. Advanced and novel tactics are unearthed in this report, including evading reverse image search, strategic hashtag use, and meticulous crafting of fake accounts and engagements. These tactics signify a nuanced approach to creating a disinformation network aimed at manipulating public opinion in Israel. This report also examines Meta’s responsibilities, highlighting concern over its inaction and staggered transparency. This report contributes crucial insights regarding influence campaigns in Israeli digital spaces and provides valuable learnings for social media platforms in combating disinformation campaign strategies and efforts.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://ict.org.il/post-0ctober-7th-disinformation-network-operates-on-israeli-social-media/](https://ict.org.il/post-0ctober-7th-disinformation-network-operates-on-israeli-social-media/) | 2024/02/21 | Uri Klempner | Reichman University | [https://web.archive.org/web/20240528220853/https://ict.org.il/post-0ctober-7th-disinformation-network-operates-on-israeli-social-media/](https://web.archive.org/web/20240528220853/https://ict.org.il/post-0ctober-7th-disinformation-network-operates-on-israeli-social-media/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0015 Create Hashtags and Search Artefacts](../../generated_pages/techniques/T0015.md) | IT00000302 In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”, which posted hashtags alongside campaign content (T0015: Create Hashtags and Search Artefacts):

“The accounts post generic images to fill their account feed to make the account seem real. They then employ a hidden hashtag in their posts, consisting of a seemingly random string of numbers and letters.

“The hypothesis regarding this tactic is that the group orchestrating these accounts utilizes these hashtags as a means of indexing them. This system likely serves a dual purpose: firstly, to keep track of the network’s expansive network of accounts and unique posts, and secondly, to streamline the process of boosting engagement among these accounts. By searching for these specific, unique hashtags, the group can quickly locate posts from their network and engage with them using other fake accounts, thereby artificially inflating the visibility and perceived authenticity of the fake account.” | +| [T0085.008 Machine Translated Text](../../generated_pages/techniques/T0085.008.md) | IT00000301 In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”.

“A conspicuous aspect of these accounts is the likely usage of machine-translated Hebrew. The disjointed and linguistically strange comments imply that the CIB’s architects are not Hebrew-speaking and likely translate to Hebrew using online tools. There’s no official way to confirm that a text is translated, but it is evident when the gender for nouns is incorrect, very unusual words or illogical grammar being used usually lead to the conclusion that the comment was not written by a native speaker that is aware of the nuances of the language.”

In this example analysts asserted that accounts were posting content which had been translated via machine (T0085.008: Machine Translated Text), based on indicators such as issues with grammar and gender. | +| [T0097.101 Local Persona](../../generated_pages/techniques/T0097.101.md) | IT00000296 Accounts which were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023” were presenting themselves as locals to Israel (T0097.101: Local Persona):

“Unlike usual low-effort fake accounts, these accounts meticulously mimic young Israelis. They stand out due to the extraordinary lengths taken to ensure their authenticity, from unique narratives to the content they produce to their seemingly authentic interactions.” | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000297 In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”.

“A core component of the detection methodology was applying qualitative linguistic analysis. This involved checking the fingerprint of language, syntax, and style used in the comments and profile of the suspected account. Each account bio consistently incorporated a combination of specific elements: emojis, nationality, location, educational institution or occupation, age, and a personal quote, sports team or band. The recurrence of this specific formula across multiple accounts hinted at a standardized template for bio construction.”

This example shows how actors can follow a templated formula to present a persona on social media platforms (T0143.002: Fabricated Persona, T0144.002: Persona Template). | +| [T0144.002 Persona Template](../../generated_pages/techniques/T0144.002.md) | IT00000298 In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”.

“A core component of the detection methodology was applying qualitative linguistic analysis. This involved checking the fingerprint of language, syntax, and style used in the comments and profile of the suspected account. Each account bio consistently incorporated a combination of specific elements: emojis, nationality, location, educational institution or occupation, age, and a personal quote, sports team or band. The recurrence of this specific formula across multiple accounts hinted at a standardized template for bio construction.”

This example shows how actors can follow a templated formula to present a persona on social media platforms (T0143.002: Fabricated Persona, T0144.002: Persona Template). | +| [T0145.001 Copy Account Imagery](../../generated_pages/techniques/T0145.001.md) | IT00000300 “In the wake of the Hamas attack on October 7th, the Israel Defense Forces (IDF) Information Security Department revealed a campaign of Instagram accounts impersonating young, attractive Israeli women who were actively engaging Israeli soldiers, attempting to extract information through direct messages.

[...]

“Some profiles underwent a reverse-image search of their photos to ascertain their authenticity. Many of the images searched were found to be appropriated from genuine social media profiles or sites such as Pinterest. When this was the case, the account was marked as confirmed to be inauthentic. One innovative method involves using photos that are initially frames from videos, which allows for evading reverse searches in most cases . This is seen in Figure 4, where an image uploaded by an inauthentic account was a screenshot taken from a TikTok video.”

In this example accounts associated with an influence operation used account imagery showing “young, attractive Israeli women” (T0145.006: Attractive Person Account Imagery), with some of these assets taken from existing accounts not associated with the operation (T0145.001: Copy Account Imagery). | +| [T0145.006 Attractive Person Account Imagery](../../generated_pages/techniques/T0145.006.md) | IT00000299 “In the wake of the Hamas attack on October 7th, the Israel Defense Forces (IDF) Information Security Department revealed a campaign of Instagram accounts impersonating young, attractive Israeli women who were actively engaging Israeli soldiers, attempting to extract information through direct messages.

[...]

“Some profiles underwent a reverse-image search of their photos to ascertain their authenticity. Many of the images searched were found to be appropriated from genuine social media profiles or sites such as Pinterest. When this was the case, the account was marked as confirmed to be inauthentic. One innovative method involves using photos that are initially frames from videos, which allows for evading reverse searches in most cases . This is seen in Figure 4, where an image uploaded by an inauthentic account was a screenshot taken from a TikTok video.”

In this example accounts associated with an influence operation used account imagery showing “young, attractive Israeli women” (T0145.006: Attractive Person Account Imagery), with some of these assets taken from existing accounts not associated with the operation (T0145.001: Copy Account Imagery). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00087.md b/generated_pages/incidents/I00087.md new file mode 100644 index 0000000..31443cf --- /dev/null +++ b/generated_pages/incidents/I00087.md @@ -0,0 +1,30 @@ +# Incident I00087: Challenging Truth and Trust: A Global Inventory of Organized Social Media Manipulation + +* **Summary:** “The manipulation of public opinion over social media platforms has emerged as a critical threat to public life. Around the world, a range of government agencies and political parties are exploiting social media platforms to spread junk news and disinformation, exercise censorship and control, and undermine trust in the media, public institutions, and science.

“At a time when news consumption is increasingly digital, artificial intelligence, big data analytics, and “blackbox” algorithms are being leveraged to challenge truth and trust: the cornerstones of our democratic society.

“In 2017, the first Global Cyber Troops inventory shed light on the global organization of social media manipulation by government and political party actors.

“This 2018 report analyses the new trends of organized media manipulation, and the growing capacities, strategies and resources that support this phenomenon.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://demtech.oii.ox.ac.uk/wp-content/uploads/sites/12/2018/07/ct_appendix.pdf](https://demtech.oii.ox.ac.uk/wp-content/uploads/sites/12/2018/07/ct_appendix.pdf) | 2018/08/08 | Samantha Bradshaw, Philip N. Howard | Computational Propaganda Research Project | [https://web.archive.org/web/20240621104749/https://demtech.oii.ox.ac.uk/wp-content/uploads/sites/12/2018/07/ct_appendix.pdf](https://web.archive.org/web/20240621104749/https://demtech.oii.ox.ac.uk/wp-content/uploads/sites/12/2018/07/ct_appendix.pdf) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.101 Local Persona](../../generated_pages/techniques/T0097.101.md) | IT00000307 “Another actor operating in China is the American-based company Devumi. Most of the Twitter accounts managed by Devumi resemble real people, and some are even associated with a kind of large-scale social identity theft. At least 55,000 of the accounts use the names, profile pictures, hometowns and other personal details of real Twitter users, including minors, according to The New York Times (Confessore et al., 2018)).”

In this example accounts impersonated real locals while spreading operation narratives (T0143.003: Impersonated Persona, T0097.101: Local Persona). The impersonation included stealing the legitimate accounts’ profile pictures (T0145.001: Copy Account Imagery). | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000306 “Another actor operating in China is the American-based company Devumi. Most of the Twitter accounts managed by Devumi resemble real people, and some are even associated with a kind of large-scale social identity theft. At least 55,000 of the accounts use the names, profile pictures, hometowns and other personal details of real Twitter users, including minors, according to The New York Times (Confessore et al., 2018)).”

In this example accounts impersonated real locals while spreading operation narratives (T0143.003: Impersonated Persona, T0097.101: Local Persona). The impersonation included stealing the legitimate accounts’ profile pictures (T0145.001: Copy Account Imagery). | +| [T0145.001 Copy Account Imagery](../../generated_pages/techniques/T0145.001.md) | IT00000303 “In 2017, Tanya O'Carroll, a technology and human rights adviser for Amnesty International, published an investigation of the political impact of bots and trolls in Mexico (O’Carroll, 2017). An article by the BBC describes a video showing the operation of a "troll farm" in Mexico, where people were tweeting in support of Enrique Peña Nieto of the PRI in 2012 (Martinez, 2018).

“According to a report published by El País, the main target of parties’ online strategies are young people, including 14 million new voters who are expected to play a decisive role in the outcome of the July 2018 election (Peinado et al., 2018). Thus, one of the strategies employed by these bots was the use of profile photos of attractive people from other countries (Soloff, 2017).”

In this example accounts copied the profile pictures of attractive people from other countries (T0145.001: Copy Account Imagery, T0145.006: Attractive Person Account Imagery). | +| [T0145.006 Attractive Person Account Imagery](../../generated_pages/techniques/T0145.006.md) | IT00000304 “In 2017, Tanya O'Carroll, a technology and human rights adviser for Amnesty International, published an investigation of the political impact of bots and trolls in Mexico (O’Carroll, 2017). An article by the BBC describes a video showing the operation of a "troll farm" in Mexico, where people were tweeting in support of Enrique Peña Nieto of the PRI in 2012 (Martinez, 2018).

“According to a report published by El País, the main target of parties’ online strategies are young people, including 14 million new voters who are expected to play a decisive role in the outcome of the July 2018 election (Peinado et al., 2018). Thus, one of the strategies employed by these bots was the use of profile photos of attractive people from other countries (Soloff, 2017).”

In this example accounts copied the profile pictures of attractive people from other countries (T0145.001: Copy Account Imagery, T0145.006: Attractive Person Account Imagery). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00088.md b/generated_pages/incidents/I00088.md new file mode 100644 index 0000000..545d25c --- /dev/null +++ b/generated_pages/incidents/I00088.md @@ -0,0 +1,30 @@ +# Incident I00088: Much Ado About ‘Somethings’ - China-Linked Influence Operation Endures Despite Takedown + +* **Summary:** “Beneath a video on Facebook about the war between Israel and Hamas, Lamonica Trout commented, “America is the war monger, the Jew’s own son!” She left identical comments beneath the same video on two other Facebook pages. Trout’s profile provides no information besides her name. It lists no friends, and there is not a single post or photograph in her feed. Trout’s profile photo shows an alligator.

“Lamonica Trout is likely an invention of the group behind Spamouflage, an ongoing, multi-year influence operation that promotes Beijing’s interests. Last year, Facebook’s parent company, Meta, took down 7,704 accounts and 954 pages it identified as part of the Spamouflage operation, which it described as the “largest known cross-platform influence operation [Meta had] disrupted to date.” Facebook’s terms of service prohibit a range of deceptive and inauthentic behaviors, including efforts to conceal the purpose of social media activity or the identity of those behind it.

“This research report documents a previously unrecognized component on Facebook of Spamouflage, which operates over 450 pages and user profiles, including Lamonica Trout, as part of a coordinated effort to promote anti-American and anti-Western narratives. One hub of this activity is the community page known as “The War of Somethings,” which has around 2,000 likes and 3,000 followers — although many of those are likely to be no more real than Lamonica Trout.

“The broader War of Somethings (WoS) network, so dubbed because all the Facebook pages and user accounts in the network are connected to “The War of Somethings” behaves very similarly to previous Spamouflage campaigns. The WoS network has targeted Guo Wengui, a wealthy Chinese businessman in exile, who is also a frequent target of Spamouflage. Previous analyses named the group Spamouflage because it posts apolitical content to camouflage its political agenda, a tactic that the WoS network also employs. Like Spamouflage, the WoS network is active during the workday in China and uses inauthentic accounts, including invented personas and hijacked accounts, to promote its content. For these reasons and others, the WoS network is very likely a part of Spamouflage.

“To date, the WoS network appears to have had almost no reach outside of its own echo chambers. Yet previous Spamouflage campaigns have broken out to wider audiences. Prominent individuals with a record of hostility toward the United States, such as Venezuelan Foreign Minister Jorge Arreaza and British parliamentarian George Galloway, have shared Spamouflage content with their numerous followers.

“As of July 2023, and possibly earlier, the WoS network has posted content explicitly related to the upcoming U.S. elections, a sign that Spamouflage may be preparing to interfere in the elections. To help prevent such manipulation, the authors have shared the data from this paper with Meta to facilitate enforcement of Facebook’s terms of service.

“Though Spamouflage operates on other platforms, this report focuses on its Facebook activity. Its Facebook network may actually be larger than what is documented. Leveraging the information below, social media companies with access to internal data can better assess the full scale and scope.

“Spamouflage and other enduring influence operations demonstrate that social media takedowns are necessary, but not sufficient, to combat foreign malign influence operations. The federal government also has a role to play: It should send clear and consistent messages to China and other state sponsors of such operations that there will be a price to pay for attempts at manipulating U.S. public opinion.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.fdd.org/analysis/2024/03/27/much-ado-about-somethings/](https://www.fdd.org/analysis/2024/03/27/much-ado-about-somethings/) | 2024/03/27 | Max Lesser, Ari Ben Am, Margot Fulde-Hardy, Saman Nazari, Paul J. Malcomb | Foundation for Defence of Democracies | [https://web.archive.org/web/20240711220741/https://www.fdd.org/analysis/2024/03/27/much-ado-about-somethings/](https://web.archive.org/web/20240711220741/https://www.fdd.org/analysis/2024/03/27/much-ado-about-somethings/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0085.008 Machine Translated Text](../../generated_pages/techniques/T0085.008.md) | IT00000310 “The broader War of Somethings (WoS) network, so dubbed because all the Facebook pages and user accounts in the network are connected to “The War of Somethings” page,  behaves very similarly to previous Spamouflage campaigns. [Spamouflage is a coordinated inauthentic behaviour network attributed to the Chinese state.]

“Like other components of Spamouflage, the WoS network sometimes intersperses apolitical content with its more agenda-driven material. Many members post nearly identical comments at almost the same time. The text includes markers of automatic translation while error messages included as profile photos indicate the automated pulling of stock images.”

In this example analysts found an indicator of automated use of stock images in Facebook accounts; some of the accounts in the network appeared to have mistakenly uploaded error messages as profile pictures (T0145.007: Stock Image Account Imagery). The text posted by the accounts also appeared to have been translated using automation (T0085.008: Machine Translated Text). | +| [T0145.002 AI-Generated Account Imagery](../../generated_pages/techniques/T0145.002.md) | IT00000309 “The broader War of Somethings (WoS) network, so dubbed because all the Facebook pages and user accounts in the network are connected to “The War of Somethings” page,  behaves very similarly to previous Spamouflage campaigns.

“Spamouflage is a coordinated inatuhentic behaviour network attributed to the Chinese state.

“Despite the WoS network’s relative sophistication, there are tell-tale signs that it is an influence operation. Several user profile photos display signs of AI generation or do not match the profile’s listed gender.”

A network of accounts connected to the facebook page “The War of Somethings” used AI-generated images of people as their profile picture (T0145.002: AI-Generated Account Imagery). | +| [T0145.003 Animal Account Imagery](../../generated_pages/techniques/T0145.003.md) | IT00000308 “Beneath a video on Facebook about the war between Israel and Hamas, Lamonica Trout commented, “America is the war monger, the Jew’s own son!” She left identical comments beneath the same video on two other Facebook pages. Trout’s profile provides no information besides her name. It lists no friends, and there is not a single post or photograph in her feed. Trout’s profile photo shows an alligator.

“Lamonica Trout is likely an invention of the group behind Spamouflage, an ongoing, multi-year influence operation that promotes Beijing’s interests. Last year, Facebook’s parent company, Meta, took down 7,704 accounts and 954 pages it identified as part of the Spamouflage operation, which it described as the “largest known cross-platform influence operation [Meta had] disrupted to date.”2 Facebook’s terms of service prohibit a range of deceptive and inauthentic behaviors, including efforts to conceal the purpose of social media activity or the identity of those behind it.”

In this example an account attributed to a multi-year influence operation created the persona of Lamonica Trout in a Facebook account, which used an image of an animal in its profile picture (T0145.003: Animal Account Imagery). | +| [T0145.007 Stock Image Account Imagery](../../generated_pages/techniques/T0145.007.md) | IT00000311 “The broader War of Somethings (WoS) network, so dubbed because all the Facebook pages and user accounts in the network are connected to “The War of Somethings” page,  behaves very similarly to previous Spamouflage campaigns. [Spamouflage is a coordinated inauthentic behaviour network attributed to the Chinese state.]

“Like other components of Spamouflage, the WoS network sometimes intersperses apolitical content with its more agenda-driven material. Many members post nearly identical comments at almost the same time. The text includes markers of automatic translation while error messages included as profile photos indicate the automated pulling of stock images.”

In this example analysts found an indicator of automated use of stock images in Facebook accounts; some of the accounts in the network appeared to have mistakenly uploaded error messages as profile pictures (T0145.007: Stock Image Account Imagery). The text posted by the accounts also appeared to have been translated using automation (T0085.008: Machine Translated Text). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00089.md b/generated_pages/incidents/I00089.md new file mode 100644 index 0000000..40772df --- /dev/null +++ b/generated_pages/incidents/I00089.md @@ -0,0 +1,28 @@ +# Incident I00089: Hackers Use Fake Facebook Profiles of Attractive Women to Spread Viruses, Steal Passwords + +* **Summary:** “On Facebook, Rita, Alona and Christina appeared to be just like the millions of other U.S citizens sharing their lives with the world. They discussed family outings, shared emojis and commented on each other's photographs.

“In reality, the three accounts were part of a highly-targeted cybercrime operation, used to spread malware that was able to steal passwords and spy on victims.

“Hackers with links to Lebanon likely ran the covert scheme using a strain of malware dubbed "Tempting Cedar Spyware," according to researchers from Prague-based anti-virus company Avast, which detailed its findings in a report released on Wednesday.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.newsweek.com/hackers-use-fake-profiles-attractive-women-facebook-spread-viruses-814293](https://www.newsweek.com/hackers-use-fake-profiles-attractive-women-facebook-spread-viruses-814293) | 2018/02/21 | Jason Murdock | Newsweek | [https://web.archive.org/web/20240116034006/https://www.newsweek.com/hackers-use-fake-profiles-attractive-women-facebook-spread-viruses-814293](https://web.archive.org/web/20240116034006/https://www.newsweek.com/hackers-use-fake-profiles-attractive-women-facebook-spread-viruses-814293) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000314 “On Facebook, Rita, Alona and Christina appeared to be just like the millions of other U.S citizens sharing their lives with the world. They discussed family outings, shared emojis and commented on each other's photographs.

“In reality, the three accounts were part of a highly-targeted cybercrime operation, used to spread malware that was able to steal passwords and spy on victims.

“Hackers with links to Lebanon likely ran the covert scheme using a strain of malware dubbed "Tempting Cedar Spyware," according to researchers from Prague-based anti-virus company Avast, which detailed its findings in a report released on Wednesday.

“In a honey trap tactic as old as time, the culprits' targets were mostly male, and lured by fake attractive women. 

“In the attack, hackers would send flirtatious messages using Facebook to the chosen victims, encouraging them to download a second , booby-trapped, chat application known as Kik Messenger to have "more secure" conversations. Upon analysis, Avast experts found that "many fell for the trap.””

In this example threat actors took on the persona of a romantic suitor on Facebook, directing their targets to another platform (T0097:109 Romantic Suitor Persona, T0145.006: Attractive Person Account Imagery, T0143.002: Fabricated Persona). | +| [T0145.006 Attractive Person Account Imagery](../../generated_pages/techniques/T0145.006.md) | IT00000312 “On Facebook, Rita, Alona and Christina appeared to be just like the millions of other U.S citizens sharing their lives with the world. They discussed family outings, shared emojis and commented on each other's photographs.

“In reality, the three accounts were part of a highly-targeted cybercrime operation, used to spread malware that was able to steal passwords and spy on victims.

“Hackers with links to Lebanon likely ran the covert scheme using a strain of malware dubbed "Tempting Cedar Spyware," according to researchers from Prague-based anti-virus company Avast, which detailed its findings in a report released on Wednesday.

“In a honey trap tactic as old as time, the culprits' targets were mostly male, and lured by fake attractive women. 

“In the attack, hackers would send flirtatious messages using Facebook to the chosen victims, encouraging them to download a second , booby-trapped, chat application known as Kik Messenger to have "more secure" conversations. Upon analysis, Avast experts found that "many fell for the trap.””

In this example threat actors took on the persona of a romantic suitor on Facebook, directing their targets to another platform (T0097:109 Romantic Suitor Persona, T0145.006: Attractive Person Account Imagery, T0143.002: Fabricated Persona). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00090.md b/generated_pages/incidents/I00090.md new file mode 100644 index 0000000..2fddfc4 --- /dev/null +++ b/generated_pages/incidents/I00090.md @@ -0,0 +1,26 @@ +# Incident I00090: Fake: US Intelligence Officer Says Poland Contributes to Ukraine’s Armed Forces Destruction + +* **Summary:** “Russian media and social media channels have been promoting Scott Ritter as an American intelligence officer to promote their narratives about Ukraine. Ritter is a former U.S. intelligence officer and UN weapons inspector in Iraq, He was jailed for 3 years in the United States and has not been an intelligence officer.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.stopfake.org/en/fake-us-intelligence-officer-says-poland-contributes-to-ukraine-s-armed-forces-destruction/](https://www.stopfake.org/en/fake-us-intelligence-officer-says-poland-contributes-to-ukraine-s-armed-forces-destruction/) | 2023/03/20 | - | StopFake | [https://web.archive.org/web/20230531103430/https://www.stopfake.org/en/fake-us-intelligence-officer-says-poland-contributes-to-ukraine-s-armed-forces-destruction/](https://web.archive.org/web/20230531103430/https://www.stopfake.org/en/fake-us-intelligence-officer-says-poland-contributes-to-ukraine-s-armed-forces-destruction/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00091.md b/generated_pages/incidents/I00091.md new file mode 100644 index 0000000..6421b7e --- /dev/null +++ b/generated_pages/incidents/I00091.md @@ -0,0 +1,29 @@ +# Incident I00091: Facebook uncovers Chinese network behind fake expert + +* **Summary:** “Facebook owner Meta Platforms has removed more than 500 accounts linked to an online disinformation network primarily based in China.

“The accounts had promoted the claims of a fake Swiss biologist called "Wilson Edwards", who alleged the US was meddling in efforts to find the origins of Covid-19.

“Edwards' comments had been widely carried by Chinese state media outlets.

“However, the Swiss embassy said that it was unlikely this person existed.

“Meta said in its report the social media campaign was "largely unsuccessful," and targeted English-speaking audiences in the United States and Britain and Chinese-speaking audiences in Taiwan, Hong Kong and Tibet.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.bbc.com/news/world-asia-china-59456548](https://www.bbc.com/news/world-asia-china-59456548) | 2021/12/02 | - | BBC News | [https://web.archive.org/web/20240709132111/https://www.bbc.com/news/world-asia-china-59456548](https://web.archive.org/web/20240709132111/https://www.bbc.com/news/world-asia-china-59456548) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.106 Recruiter Persona](../../generated_pages/techniques/T0097.106.md) | IT00000316 “Earlier in July [2021], an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China.

“State media outlets, including CGTN, Shanghai Daily and Global Times, had cited the so-called biologist based on his Facebook profile.

“However, the Swiss embassy said in August that the person likely did not exist, as the Facebook account was opened only two weeks prior to its first post and only had three friends.

“It added "there was no registry of a Swiss citizen with the name "Wilson Edwards" and no academic articles under the name", and urged Chinese media outlets to take down any mention of him.

[...]

“It also said that his profile photo also appeared to have been generated using machine-learning capabilities.”

In this example an account created on Facebook presented itself as a Swiss biologist to present a narrative related to COVID-19 (T0143.002: Fabricated Persona, T0097.106: Researcher Persona). It used an AI-Generated profile picture to disguise itself (T0145.002: AI-Generated Account Imagery). | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000315 “Earlier in July [2021], an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China.

“State media outlets, including CGTN, Shanghai Daily and Global Times, had cited the so-called biologist based on his Facebook profile.

“However, the Swiss embassy said in August that the person likely did not exist, as the Facebook account was opened only two weeks prior to its first post and only had three friends.

“It added "there was no registry of a Swiss citizen with the name "Wilson Edwards" and no academic articles under the name", and urged Chinese media outlets to take down any mention of him.

[...]

“It also said that his profile photo also appeared to have been generated using machine-learning capabilities.”

In this example an account created on Facebook presented itself as a Swiss biologist to present a narrative related to COVID-19 (T0143.002: Fabricated Persona, T0097.106: Researcher Persona). It used an AI-Generated profile picture to disguise itself (T0145.002: AI-Generated Account Imagery). | +| [T0145.002 AI-Generated Account Imagery](../../generated_pages/techniques/T0145.002.md) | IT00000317 “Earlier in July [2021], an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China.

“State media outlets, including CGTN, Shanghai Daily and Global Times, had cited the so-called biologist based on his Facebook profile.

“However, the Swiss embassy said in August that the person likely did not exist, as the Facebook account was opened only two weeks prior to its first post and only had three friends.

“It added "there was no registry of a Swiss citizen with the name "Wilson Edwards" and no academic articles under the name", and urged Chinese media outlets to take down any mention of him.

[...]

“It also said that his profile photo also appeared to have been generated using machine-learning capabilities.”

In this example an account created on Facebook presented itself as a Swiss biologist to present a narrative related to COVID-19 (T0143.002: Fabricated Persona, T0097.106: Researcher Persona). It used an AI-Generated profile picture to disguise itself (T0145.002: AI-Generated Account Imagery). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00092.md b/generated_pages/incidents/I00092.md new file mode 100644 index 0000000..b5da15f --- /dev/null +++ b/generated_pages/incidents/I00092.md @@ -0,0 +1,26 @@ +# Incident I00092: The Most Influential Spreader of Coronavirus Misinformation Online + +* **Summary:** “Researchers and regulators say Joseph Mercola, an osteopathic physician, creates and profits from misleading claims about Covid-19 vaccines.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.nytimes.com/2021/07/24/technology/joseph-mercola-coronavirus-misinformation-online.html](https://www.nytimes.com/2021/07/24/technology/joseph-mercola-coronavirus-misinformation-online.html) | 2021/07/24 | Sheera Frenkel | New York Times | [https://web.archive.org/web/20240710141105/https://www.nytimes.com/2021/07/24/technology/joseph-mercola-coronavirus-misinformation-online.html](https://web.archive.org/web/20240710141105/https://www.nytimes.com/2021/07/24/technology/joseph-mercola-coronavirus-misinformation-online.html) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00093.md b/generated_pages/incidents/I00093.md new file mode 100644 index 0000000..4d50c44 --- /dev/null +++ b/generated_pages/incidents/I00093.md @@ -0,0 +1,29 @@ +# Incident I00093: China Falsely Denies Disinformation Campaign Targeting Canada’s Prime Minister + +* **Summary:** “On October 23, Canada’s Foreign Ministry said it had discovered a disinformation campaign, likely tied to China, aimed at discrediting dozens of Canadian politicians, including Prime Minister Justin Trudeau.

“The ministry said the campaign took place in August and September. It used new and hijacked social media accounts to bulk-post messages targeting Canadian politicians.

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

““Canada was a downright liar and disseminator of false information… Beijing has never meddled in another nation’s domestic affairs.”

“That is false.

“The Canadian government's report is based on an investigation conducted by its Rapid Response Mechanism cyber intelligence unit in cooperation with the social media platforms.

“The investigation exposed China’s disinformation campaign dubbed “Spamouflage” -- for its tactic of using “a network of new or hijacked social media accounts that posts and increases the number of propaganda messages across multiple social media platforms – including Facebook, X/Twitter, Instagram, YouTube, Medium, Reddit, TikTok, and LinkedIn.”” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://www.polygraph.info/a/fact-check-china-falsely-denies-disinformation-campaign-targeting-canada-s-prime-minister/7326349.html](https://www.polygraph.info/a/fact-check-china-falsely-denies-disinformation-campaign-targeting-canada-s-prime-minister/7326349.html) | 2023/10/25 | Lin Yang | POLYGRAPH.info | [https://web.archive.org/web/20231027191359/https://www.polygraph.info/a/fact-check-china-falsely-denies-disinformation-campaign-targeting-canada-s-prime-minister/7326349.html](https://web.archive.org/web/20231027191359/https://www.polygraph.info/a/fact-check-china-falsely-denies-disinformation-campaign-targeting-canada-s-prime-minister/7326349.html) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.111 Government Official Persona](../../generated_pages/techniques/T0097.111.md) | IT00000343 “On October 23, Canada’s Foreign Ministry said it had discovered a disinformation campaign, likely tied to China, aimed at discrediting dozens of Canadian politicians, including Prime Minister Justin Trudeau.

“The ministry said the campaign took place in August and September. It used new and hijacked social media accounts to bulk-post messages targeting Canadian politicians (T0141.001: Acquire Compromised Account).

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

““Canada was a downright liar and disseminator of false information… Beijing has never meddled in another nation’s domestic affairs.”

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

“That is false.

“The Canadian government's report is based on an investigation conducted by its Rapid Response Mechanism cyber intelligence unit in cooperation with the social media platforms.

“The investigation exposed China’s disinformation campaign dubbed “Spamouflage” -- for its tactic of using “a network of new or hijacked social media accounts that posts and increases the number of propaganda messages across multiple social media platforms – including Facebook, X/Twitter, Instagram, YouTube, Medium, Reddit, TikTok, and LinkedIn.””

In this case a network of accounts attributed to China were identified operating on multiple platforms. The report was dismissed as false information by an official in the Chinese Embassy in Canada (T0143.001: Authentic Persona, T0097.111: Government Official Persona, T0129.006: Deny Involvement). | +| [T0129.006 Deny Involvement](../../generated_pages/techniques/T0129.006.md) | IT00000344 “On October 23, Canada’s Foreign Ministry said it had discovered a disinformation campaign, likely tied to China, aimed at discrediting dozens of Canadian politicians, including Prime Minister Justin Trudeau.

“The ministry said the campaign took place in August and September. It used new and hijacked social media accounts to bulk-post messages targeting Canadian politicians (T0141.001: Acquire Compromised Account).

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

““Canada was a downright liar and disseminator of false information… Beijing has never meddled in another nation’s domestic affairs.”

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

“That is false.

“The Canadian government's report is based on an investigation conducted by its Rapid Response Mechanism cyber intelligence unit in cooperation with the social media platforms.

“The investigation exposed China’s disinformation campaign dubbed “Spamouflage” -- for its tactic of using “a network of new or hijacked social media accounts that posts and increases the number of propaganda messages across multiple social media platforms – including Facebook, X/Twitter, Instagram, YouTube, Medium, Reddit, TikTok, and LinkedIn.””

In this case a network of accounts attributed to China were identified operating on multiple platforms. The report was dismissed as false information by an official in the Chinese Embassy in Canada (T0143.001: Authentic Persona, T0097.111: Government Official Persona, T0129.006: Deny Involvement). | +| [T0143.001 Authentic Persona](../../generated_pages/techniques/T0143.001.md) | IT00000342 “On October 23, Canada’s Foreign Ministry said it had discovered a disinformation campaign, likely tied to China, aimed at discrediting dozens of Canadian politicians, including Prime Minister Justin Trudeau.

“The ministry said the campaign took place in August and September. It used new and hijacked social media accounts to bulk-post messages targeting Canadian politicians (T0141.001: Acquire Compromised Account).

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

““Canada was a downright liar and disseminator of false information… Beijing has never meddled in another nation’s domestic affairs.”

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

“That is false.

“The Canadian government's report is based on an investigation conducted by its Rapid Response Mechanism cyber intelligence unit in cooperation with the social media platforms.

“The investigation exposed China’s disinformation campaign dubbed “Spamouflage” -- for its tactic of using “a network of new or hijacked social media accounts that posts and increases the number of propaganda messages across multiple social media platforms – including Facebook, X/Twitter, Instagram, YouTube, Medium, Reddit, TikTok, and LinkedIn.””

In this case a network of accounts attributed to China were identified operating on multiple platforms. The report was dismissed as false information by an official in the Chinese Embassy in Canada (T0143.001: Authentic Persona, T0097.111: Government Official Persona, T0129.006: Deny Involvement). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00094.md b/generated_pages/incidents/I00094.md new file mode 100644 index 0000000..059921d --- /dev/null +++ b/generated_pages/incidents/I00094.md @@ -0,0 +1,29 @@ +# Incident I00094: A glimpse inside a Chinese influence campaign: How bogus news websites blur the line between true and false + +* **Summary:** “In November of 2023, a joint team comprised of the South Korean intelligence agency and four cybersecurity firms revealed a dark corner of the web that few would have believed existed: an alleged Chinese influence campaign involving more than three dozen fake websites disguised to resemble South Korean news publications.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://thereadable.co/a-glimpse-inside-a-chinese-influence-campaign-how-bogus-news-websites-blur-the-line-between-true-and-false/](https://thereadable.co/a-glimpse-inside-a-chinese-influence-campaign-how-bogus-news-websites-blur-the-line-between-true-and-false/) | 2024/01/12 | Kuksung Nam | TheReadable | [https://web.archive.org/web/20240221225110/https://thereadable.co/a-glimpse-inside-a-chinese-influence-campaign-how-bogus-news-websites-blur-the-line-between-true-and-false/](https://web.archive.org/web/20240221225110/https://thereadable.co/a-glimpse-inside-a-chinese-influence-campaign-how-bogus-news-websites-blur-the-line-between-true-and-false/) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.201 Local Institution Persona](../../generated_pages/techniques/T0097.201.md) | IT00000318 Researchers identified websites managed by a Chinese marketing firm which presented themselves as news organisations.

“On its official website, the Chinese marketing firm boasted that they were in contact with news organizations across the globe, including one in South Korea called the “Chungcheng Times.” According to the joint team, this outlet is a fictional news organization created by the offending company. The Chinese company sought to disguise the site’s true identity and purpose by altering the name attached to it by one character—making it very closely resemble the name of a legitimate outlet operating out of Chungchengbuk-do.

“The marketing firm also established a news organization under the Korean name “Gyeonggido Daily,” which closely resembles legitimate news outlets operating out of Gyeonggi province such as “Gyeonggi Daily,” “Daily Gyeonggi Newspaper,” and “Gyeonggi N Daily.” One of the fake news sites was named “Incheon Focus,” a title that could be easily mistaken for the legitimate local news outlet, “Focus Incheon.” Furthermore, the Chinese marketing company operated two fake news sites with names identical to two separate local news organizations, one of which ceased operations in December 2022.

“In total, fifteen out of eighteen Chinese fake news sites incorporated the correct names of real regions in their fake company names. “If the operators had created fake news sites similar to major news organizations based in Seoul, however, the intended deception would have easily been uncovered,” explained Song Tae-eun, an assistant professor in the Department of National Security & Unification Studies at the Korea National Diplomatic Academy, to The Readable. “There is also the possibility that they are using the regional areas as an attempt to form ties with the local community; that being the government, the private sector, and religious communities.””

The firm styled their news site to resemble existing local news outlets in their target region (T0097.201: Local Institution Persona, T0097.202: News Outlet Persona, T0143.003: Impersonated Persona). | +| [T0097.202 News Outlet Persona](../../generated_pages/techniques/T0097.202.md) | IT00000319 Researchers identified websites managed by a Chinese marketing firm which presented themselves as news organisations.

“On its official website, the Chinese marketing firm boasted that they were in contact with news organizations across the globe, including one in South Korea called the “Chungcheng Times.” According to the joint team, this outlet is a fictional news organization created by the offending company. The Chinese company sought to disguise the site’s true identity and purpose by altering the name attached to it by one character—making it very closely resemble the name of a legitimate outlet operating out of Chungchengbuk-do.

“The marketing firm also established a news organization under the Korean name “Gyeonggido Daily,” which closely resembles legitimate news outlets operating out of Gyeonggi province such as “Gyeonggi Daily,” “Daily Gyeonggi Newspaper,” and “Gyeonggi N Daily.” One of the fake news sites was named “Incheon Focus,” a title that could be easily mistaken for the legitimate local news outlet, “Focus Incheon.” Furthermore, the Chinese marketing company operated two fake news sites with names identical to two separate local news organizations, one of which ceased operations in December 2022.

“In total, fifteen out of eighteen Chinese fake news sites incorporated the correct names of real regions in their fake company names. “If the operators had created fake news sites similar to major news organizations based in Seoul, however, the intended deception would have easily been uncovered,” explained Song Tae-eun, an assistant professor in the Department of National Security & Unification Studies at the Korea National Diplomatic Academy, to The Readable. “There is also the possibility that they are using the regional areas as an attempt to form ties with the local community; that being the government, the private sector, and religious communities.””

The firm styled their news site to resemble existing local news outlets in their target region (T0097.201: Local Institution Persona, T0097.202: News Outlet Persona, T0143.003: Impersonated Persona). | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | IT00000320 Researchers identified websites managed by a Chinese marketing firm which presented themselves as news organisations.

“On its official website, the Chinese marketing firm boasted that they were in contact with news organizations across the globe, including one in South Korea called the “Chungcheng Times.” According to the joint team, this outlet is a fictional news organization created by the offending company. The Chinese company sought to disguise the site’s true identity and purpose by altering the name attached to it by one character—making it very closely resemble the name of a legitimate outlet operating out of Chungchengbuk-do.

“The marketing firm also established a news organization under the Korean name “Gyeonggido Daily,” which closely resembles legitimate news outlets operating out of Gyeonggi province such as “Gyeonggi Daily,” “Daily Gyeonggi Newspaper,” and “Gyeonggi N Daily.” One of the fake news sites was named “Incheon Focus,” a title that could be easily mistaken for the legitimate local news outlet, “Focus Incheon.” Furthermore, the Chinese marketing company operated two fake news sites with names identical to two separate local news organizations, one of which ceased operations in December 2022.

“In total, fifteen out of eighteen Chinese fake news sites incorporated the correct names of real regions in their fake company names. “If the operators had created fake news sites similar to major news organizations based in Seoul, however, the intended deception would have easily been uncovered,” explained Song Tae-eun, an assistant professor in the Department of National Security & Unification Studies at the Korea National Diplomatic Academy, to The Readable. “There is also the possibility that they are using the regional areas as an attempt to form ties with the local community; that being the government, the private sector, and religious communities.””

The firm styled their news site to resemble existing local news outlets in their target region (T0097.201: Local Institution Persona, T0097.202: News Outlet Persona, T0143.003: Impersonated Persona). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents/I00095.md b/generated_pages/incidents/I00095.md new file mode 100644 index 0000000..757043f --- /dev/null +++ b/generated_pages/incidents/I00095.md @@ -0,0 +1,29 @@ +# Incident I00095: Meta: Chinese disinformation network was behind London front company recruiting content creators + +* **Summary:** “A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta.

“In a report published Wednesday, Meta revealed it had removed more than 100 accounts on Facebook and dozens on Instagram connected to the operation targeting “multiple internet services,” including almost all of the major social media platforms.

“The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited.

“London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta.

“While the actual operators of this network attempted to conceal their identities, Meta said its investigation had "found links to individuals in China associated with Xi'an Tainwendian Network Technology, an information technology company.” + +* **incident type**: + +* **Year started:** + +* **Countries:** , + +* **Found via:** + +* **Date added:** + + +| Reference | Pub Date | Authors | Org | Archive | +| --------- | -------- | ------- | --- | ------- | +| [https://therecord.media/china-disinformation-meta-london-new-media-europe](https://therecord.media/china-disinformation-meta-london-new-media-europe) | 2023/05/03 | Alexander Martin | The Record | [https://web.archive.org/web/20240120161445/https://therecord.media/china-disinformation-meta-london-new-media-europe](https://web.archive.org/web/20240120161445/https://therecord.media/china-disinformation-meta-london-new-media-europe) | + + + +| Technique | Description given for this incident | +| --------- | ------------------------- | +| [T0097.106 Recruiter Persona](../../generated_pages/techniques/T0097.106.md) | IT00000322 “A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta.

“The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited.

“London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta”.

In this example a front company was used (T0097.205: Business Persona) to enable actors to recruit targets for producing content (T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [T0097.205 Business Persona](../../generated_pages/techniques/T0097.205.md) | IT00000321 “A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta.

“The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited.

“London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta”.

In this example a front company was used (T0097.205: Business Persona) to enable actors to recruit targets for producing content (T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | IT00000323 “A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta.

“The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited.

“London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta”.

In this example a front company was used (T0097.205: Business Persona) to enable actors to recruit targets for producing content (T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/incidents_index.md b/generated_pages/incidents_index.md index c79eb02..1b31448 100644 --- a/generated_pages/incidents_index.md +++ b/generated_pages/incidents_index.md @@ -13,7 +13,7 @@ I00001 Blacktivists facebook group incident -2016 +2016.0 USA @@ -21,7 +21,7 @@ I00002 #VaccinateUS campaign -2014 +2014.0 World @@ -29,7 +29,7 @@ I00003 Beyonce protest rallies incident -2016 +2016.0 USA @@ -37,7 +37,7 @@ I00004 #Macrongate incident -2017 +2017.0 France @@ -45,7 +45,7 @@ I00005 Brexit vote campaign -2016 +2016.0 UK @@ -53,7 +53,7 @@ I00006 Columbian Chemicals incident -2014 +2014.0 USA @@ -61,7 +61,7 @@ I00007 Incirlik terrorists incident -2016 +2016.0 USA @@ -69,7 +69,7 @@ I00008 Bujic incident -2017 +2017.0 Serbia @@ -77,7 +77,7 @@ I00009 PhilippinesExpert incident -2017 +2017.0 Philippines @@ -85,7 +85,7 @@ I00010 ParklandTeens incident -2018 +2018.0 USA @@ -93,7 +93,7 @@ I00011 CovingtonTeen incident -2019 +2019.0 USA @@ -101,7 +101,7 @@ I00012 ChinaSmog incident -2011 +2011.0 China @@ -109,7 +109,7 @@ I00013 FranceBlacktivists incident -2014 +2014.0 France @@ -117,7 +117,7 @@ I00014 GiletsJaunePileon incident -2018 +2018.0 France @@ -125,7 +125,7 @@ I00015 ConcordDiscovery incident -2019 +2019.0 USA @@ -133,7 +133,7 @@ I00016 LithuanianElves campaign -2014 +2014.0 Lithuania @@ -141,7 +141,7 @@ I00017 US presidential elections campaign -2016 +2016.0 USA OII @@ -149,7 +149,7 @@ I00018 DNC email leak incident tactic -2016 +2016.0 USA OII @@ -157,7 +157,7 @@ I00019 MacronTiphaine incident -2017 +2017.0 France OII @@ -165,7 +165,7 @@ I00020 3000 tanks incident -2017 +2017.0 World OII @@ -173,7 +173,7 @@ I00021 Armenia elections campaign -2017 +2017.0 Armenia OII @@ -181,7 +181,7 @@ I00022 #Macronleaks incident -2017 +2017.0 France OII @@ -189,7 +189,7 @@ I00023 #dislikemacron incident -2017 +2017.0 France OII @@ -197,7 +197,7 @@ I00024 #syriahoax incident -2017 +2017.0 USA OII @@ -205,7 +205,7 @@ I00025 EU Army incident -2018 +2018.0 EU OII @@ -213,7 +213,7 @@ I00026 Netherlands referendum on Ukraine incident -2016 +2016.0 Netherlands OII @@ -221,7 +221,7 @@ I00027 crucifiedboy incident -2014 +2014.0 Ukraine OII @@ -229,7 +229,7 @@ I00028 mh17 downed incident -2014 +2014.0 Ukraine OII @@ -237,7 +237,7 @@ I00029 MH17 investigation campaign -2016 +2016.0 Ukraine OII @@ -245,7 +245,7 @@ I00030 LastJedi incident -2018 +2018.0 World OII @@ -253,7 +253,7 @@ I00031 antivax apt -2018 +2018.0 World OII @@ -261,7 +261,7 @@ I00032 Kavanaugh incident -2018 +2018.0 USA OII @@ -269,7 +269,7 @@ I00033 China 50cent Army apt -2014 +2014.0 China OII @@ -277,7 +277,7 @@ I00034 DibaFacebookExpedition incident -2016 +2016.0 Taiwan OII @@ -285,7 +285,7 @@ I00035 Brazilelections campaign -2014 +2014.0 Brazil OII @@ -293,7 +293,7 @@ I00036 BrazilPresDebate incident -2014 +2014.0 Brazil OII @@ -301,7 +301,7 @@ I00037 Rioelections incident -2016 +2016.0 Brazil OII @@ -309,7 +309,7 @@ I00038 Brazilimpeachment incident -2016 +2016.0 Brazil OII @@ -317,7 +317,7 @@ I00039 MerkelFacebook incident -2017 +2017.0 Germany OII @@ -325,7 +325,7 @@ I00040 modamaniSelfie incident -2015 +2015.0 Germany OII @@ -333,7 +333,7 @@ I00041 Refugee crime map incident -2017 +2017.0 Germany OII @@ -341,7 +341,7 @@ I00042 Saudi/Qatar bot dispute incident -2017 +2017.0 Qatar MIS @@ -349,7 +349,7 @@ I00043 FCC comments incident -2017 +2017.0 USA MIS @@ -357,7 +357,7 @@ I00044 JadeHelm exercise incident -2015 +2015.0 USA MIS @@ -365,7 +365,7 @@ I00045 Skripal incident -2018 +2018.0 UK @@ -373,7 +373,7 @@ I00046 North Macedonia incident -2018 +2018.0 Macedonia @@ -381,7 +381,7 @@ I00047 Sea of Azov incident -2018 +2018.0 World @@ -389,7 +389,7 @@ I00048 White Helmets campaign -2015 +2015.0 World @@ -397,7 +397,7 @@ I00049 White Helmets: Chemical Weapons incident -2017 +2017.0 World @@ -405,7 +405,7 @@ I00050 #HandsOffVenezuela incident -2019 +2019.0 World @@ -413,7 +413,7 @@ I00051 Integrity Initiative incident -2018 +2018.0 World @@ -421,7 +421,7 @@ I00052 China overiew campaign -2015 +2015.0 World @@ -429,7 +429,7 @@ I00053 China Huawei CFO Arrest incident -2018 +2018.0 World @@ -437,7 +437,7 @@ I00054 China Muslims incident -2018 +2018.0 World @@ -445,7 +445,7 @@ I00055 50 Cent Army campaign -2008 +2008.0 World @@ -453,7 +453,7 @@ I00056 Iran Influence Operations campaign -2012 +2012.0 World @@ -461,7 +461,7 @@ I00057 Mexico Election incident -2018 +2018.0 Mexico @@ -469,7 +469,7 @@ I00058 Chemnitz incident -2018 +2018.0 Germany @@ -477,7 +477,7 @@ I00059 Myanmar - Rohingya campaign -2014 +2014.0 Myanmar @@ -485,7 +485,7 @@ I00060 White Genocide campaign -2018 +2018.0 World @@ -493,7 +493,7 @@ I00061 Military veterans Targetting campaign -2017 +2017.0 US @@ -501,7 +501,7 @@ I00062 Brexit/UK ongoing campaign -2015 +2015.0 UK @@ -509,7 +509,7 @@ I00063 Olympic Doping Scandal campaign -2016 +2016.0 World @@ -517,7 +517,7 @@ I00064 Tinder nightmares: the promise and peril of political bots incident -2017 +2017.0 UK @@ -525,7 +525,7 @@ I00065 'Ghostwriter' Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned With Russian Security Interests campaign -2020 +2020.0 Lithuania, Latvia, Poland @@ -533,8 +533,544 @@ I00066 The online war between Qatar and Saudi Arabia incident -2017 +2017.0 Qatar + +I00067 +Understanding Information disorder + + + + + + +I00068 +Attempted Audio Deepfake Call Targets LastPass Employee + + + + + + +I00069 +Uncharmed: Untangling Iran's APT42 Operations + + + + + + +I00070 +Eli Lilly Clarifies It’s Not Offering Free Insulin After Tweet From Fake Verified Account—As Chaos Unfolds On Twitter + + + + + + +I00071 +Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland + + + + + + +I00072 +Behind the Dutch Terror Threat Video: The St. Petersburg "Troll Factory" Connection + + + + + + +I00073 +Disinformation campaign removed by Facebook linked to Russia’s Internet Research Agency + + + + + + +I00074 +The Tactics & Tropes of the Internet Research Agency + + + + + + +I00075 +How Russia Meddles Abroad for Profit: Cash, Trolls and a Cult Leader + + + + + + +I00076 +Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests + + + + + + +I00077 +Fronts & Friends: An Investigation into Two Twitter Networks Linked to Russian Actors + + + + + + +I00078 +Meta’s September 2020 Removal of Coordinated Inauthentic Behavior + + + + + + +I00079 +Three thousand fake tanks + + + + + + +I00080 +Hundreds Of Propaganda Accounts Targeting Iran And Qatar Have Been Removed From Facebook + + + + + + +I00081 +Belarus KGB created fake accounts to criticize Poland during border crisis, Facebook parent company says + + + + + + +I00082 +Meta’s November 2021 Adversarial Threat Report + + + + + + +I00083 +Fake Think Tanks Fuel Fake News—And the President's Tweets + + + + + + +I00084 +Russia turns its diplomats into disinformation warriors + + + + + + +I00085 +China’s large-scale media push: Attempts to influence Swedish media + + + + + + +I00086 +#WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media + + + + + + +I00087 +Challenging Truth and Trust: A Global Inventory of Organized Social Media Manipulation + + + + + + +I00088 +Much Ado About ‘Somethings’ - China-Linked Influence Operation Endures Despite Takedown + + + + + + +I00089 +Hackers Use Fake Facebook Profiles of Attractive Women to Spread Viruses, Steal Passwords + + + + + + +I00090 +Fake: US Intelligence Officer Says Poland Contributes to Ukraine’s Armed Forces Destruction + + + + + + +I00091 +Facebook uncovers Chinese network behind fake expert + + + + + + +I00092 +The Most Influential Spreader of Coronavirus Misinformation Online + + + + + + +I00093 +China Falsely Denies Disinformation Campaign Targeting Canada’s Prime Minister + + + + + + +I00094 +A glimpse inside a Chinese influence campaign: How bogus news websites blur the line between true and false + + + + + + +I00095 +Meta: Chinese disinformation network was behind London front company recruiting content creators + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/generated_pages/tactics/TA06.md b/generated_pages/tactics/TA06.md index 278d507..6778579 100644 --- a/generated_pages/tactics/TA06.md +++ b/generated_pages/tactics/TA06.md @@ -32,6 +32,7 @@ | [T0085.005 Develop Book](../../generated_pages/techniques/T0085.005.md) | | [T0085.006 Develop Opinion Article](../../generated_pages/techniques/T0085.006.md) | | [T0085.007 Create Fake Research](../../generated_pages/techniques/T0085.007.md) | +| [T0085.008 Machine Translated Text](../../generated_pages/techniques/T0085.008.md) | | [T0086 Develop Image-Based Content](../../generated_pages/techniques/T0086.md) | | [T0086.001 Develop Memes](../../generated_pages/techniques/T0086.001.md) | | [T0086.002 Develop AI-Generated Images (Deepfakes)](../../generated_pages/techniques/T0086.002.md) | diff --git a/generated_pages/tactics/TA15.md b/generated_pages/tactics/TA15.md index a9dbee5..6140091 100644 --- a/generated_pages/tactics/TA15.md +++ b/generated_pages/tactics/TA15.md @@ -10,7 +10,7 @@ This Tactic was previously called Establish Social Assets. | Tasks | | ----- | -| [TK0010 Create personas](../../generated_pages/tasks/TK0010.md) | +| [TK0010 Present Persona](../../generated_pages/tasks/TK0010.md) | | [TK0011 Recruit contractors](../../generated_pages/tasks/TK0011.md) | | [TK0012 Recruit partisans](../../generated_pages/tasks/TK0012.md) | | [TK0013 find influencers](../../generated_pages/tasks/TK0013.md) | @@ -58,6 +58,14 @@ This Tactic was previously called Establish Social Assets. | [T0141 Acquire Compromised Asset](../../generated_pages/techniques/T0141.md) | | [T0141.001 Acquire Compromised Account](../../generated_pages/techniques/T0141.001.md) | | [T0141.002 Acquire Compromised Website](../../generated_pages/techniques/T0141.002.md) | +| [T0145 Establish Account Imagery](../../generated_pages/techniques/T0145.md) | +| [T0145.001 Copy Account Imagery](../../generated_pages/techniques/T0145.001.md) | +| [T0145.002 AI-Generated Account Imagery](../../generated_pages/techniques/T0145.002.md) | +| [T0145.003 Animal Account Imagery](../../generated_pages/techniques/T0145.003.md) | +| [T0145.004 Scenery Account Imagery](../../generated_pages/techniques/T0145.004.md) | +| [T0145.005 Illustrated Character Account Imagery](../../generated_pages/techniques/T0145.005.md) | +| [T0145.006 Attractive Person Account Imagery](../../generated_pages/techniques/T0145.006.md) | +| [T0145.007 Stock Image Account Imagery](../../generated_pages/techniques/T0145.007.md) | diff --git a/generated_pages/tactics/TA16.md b/generated_pages/tactics/TA16.md index a5f4f70..44f16e7 100644 --- a/generated_pages/tactics/TA16.md +++ b/generated_pages/tactics/TA16.md @@ -13,24 +13,44 @@ | Techniques | | ---------- | -| [T0009 Create Fake Experts](../../generated_pages/techniques/T0009.md) | -| [T0009.001 Utilise Academic/Pseudoscientific Justifications](../../generated_pages/techniques/T0009.001.md) | -| [T0097 Create Personas](../../generated_pages/techniques/T0097.md) | -| [T0097.001 Produce Evidence for Persona](../../generated_pages/techniques/T0097.001.md) | +| [T0097 Present Persona](../../generated_pages/techniques/T0097.md) | +| [T0097.100 Individual Persona](../../generated_pages/techniques/T0097.100.md) | +| [T0097.101 Local Persona](../../generated_pages/techniques/T0097.101.md) | +| [T0097.102 Journalist Persona](../../generated_pages/techniques/T0097.102.md) | +| [T0097.103 Activist Persona](../../generated_pages/techniques/T0097.103.md) | +| [T0097.104 Hacktivist Persona](../../generated_pages/techniques/T0097.104.md) | +| [T0097.105 Military Personnel Persona](../../generated_pages/techniques/T0097.105.md) | +| [T0097.106 Recruiter Persona](../../generated_pages/techniques/T0097.106.md) | +| [T0097.107 Researcher Persona](../../generated_pages/techniques/T0097.107.md) | +| [T0097.108 Expert Persona](../../generated_pages/techniques/T0097.108.md) | +| [T0097.109 Romantic Suitor Persona](../../generated_pages/techniques/T0097.109.md) | +| [T0097.110 Party Official Persona](../../generated_pages/techniques/T0097.110.md) | +| [T0097.111 Government Official Persona](../../generated_pages/techniques/T0097.111.md) | +| [T0097.112 Government Employee Persona](../../generated_pages/techniques/T0097.112.md) | +| [T0097.200 Institutional Persona](../../generated_pages/techniques/T0097.200.md) | +| [T0097.201 Local Institution Persona](../../generated_pages/techniques/T0097.201.md) | +| [T0097.202 News Outlet Persona](../../generated_pages/techniques/T0097.202.md) | +| [T0097.203 Fact Checking Organisation Persona](../../generated_pages/techniques/T0097.203.md) | +| [T0097.204 Think Tank Persona](../../generated_pages/techniques/T0097.204.md) | +| [T0097.205 Business Persona](../../generated_pages/techniques/T0097.205.md) | +| [T0097.206 Government Institution Persona](../../generated_pages/techniques/T0097.206.md) | +| [T0097.207 NGO Persona](../../generated_pages/techniques/T0097.207.md) | +| [T0097.208 Social Cause Persona](../../generated_pages/techniques/T0097.208.md) | | [T0098 Establish Inauthentic News Sites](../../generated_pages/techniques/T0098.md) | | [T0098.001 Create Inauthentic News Sites](../../generated_pages/techniques/T0098.001.md) | | [T0098.002 Leverage Existing Inauthentic News Sites](../../generated_pages/techniques/T0098.002.md) | -| [T0099 Impersonate Existing Entity](../../generated_pages/techniques/T0099.md) | -| [T0099.002 Spoof/Parody Account/Site](../../generated_pages/techniques/T0099.002.md) | -| [T0099.003 Impersonate Existing Organisation](../../generated_pages/techniques/T0099.003.md) | -| [T0099.004 Impersonate Existing Media Outlet](../../generated_pages/techniques/T0099.004.md) | -| [T0099.005 Impersonate Existing Official](../../generated_pages/techniques/T0099.005.md) | -| [T0099.006 Impersonate Existing Influencer](../../generated_pages/techniques/T0099.006.md) | | [T0100 Co-Opt Trusted Sources](../../generated_pages/techniques/T0100.md) | | [T0100.001 Co-Opt Trusted Individuals](../../generated_pages/techniques/T0100.001.md) | | [T0100.002 Co-Opt Grassroots Groups](../../generated_pages/techniques/T0100.002.md) | | [T0100.003 Co-Opt Influencers](../../generated_pages/techniques/T0100.003.md) | -| [T0142 Fabricate Grassroots Movement](../../generated_pages/techniques/T0142.md) | +| [T0143 Persona Legitimacy](../../generated_pages/techniques/T0143.md) | +| [T0143.001 Authentic Persona](../../generated_pages/techniques/T0143.001.md) | +| [T0143.002 Fabricated Persona](../../generated_pages/techniques/T0143.002.md) | +| [T0143.003 Impersonated Persona](../../generated_pages/techniques/T0143.003.md) | +| [T0143.004 Parody Persona](../../generated_pages/techniques/T0143.004.md) | +| [T0144 Persona Legitimacy Evidence](../../generated_pages/techniques/T0144.md) | +| [T0144.001 Present Persona across Platforms](../../generated_pages/techniques/T0144.001.md) | +| [T0144.002 Persona Template](../../generated_pages/techniques/T0144.002.md) | diff --git a/generated_pages/tasks/TK0010.md b/generated_pages/tasks/TK0010.md index 2426d43..f56fa6b 100644 --- a/generated_pages/tasks/TK0010.md +++ b/generated_pages/tasks/TK0010.md @@ -1,6 +1,6 @@ -# Task TK0010: Create personas +# Task TK0010: Present Persona -* **Summary:** Create personas +* **Summary:** Present Persona * **Belongs to tactic stage:** TA15 diff --git a/generated_pages/tasks_index.md b/generated_pages/tasks_index.md index c6de61c..71fcd47 100644 --- a/generated_pages/tasks_index.md +++ b/generated_pages/tasks_index.md @@ -75,8 +75,8 @@ TK0010 -Create personas -Create personas +Present Persona +Present Persona TA15 diff --git a/generated_pages/techniques/T0009.001.md b/generated_pages/techniques/T0009.001.md deleted file mode 100644 index 2058c3f..0000000 --- a/generated_pages/techniques/T0009.001.md +++ /dev/null @@ -1,17 +0,0 @@ -# Technique T0009.001: Utilise Academic/Pseudoscientific Justifications - -* **Summary**: Utilise Academic/Pseudoscientific Justifications - -* **Belongs to tactic stage**: TA16 - - -| Incident | Descriptions given for this incident | -| -------- | -------------------- | - - - -| Counters | Response types | -| -------- | -------------- | - - -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0015.md b/generated_pages/techniques/T0015.md index aceddf4..3a9322e 100644 --- a/generated_pages/techniques/T0015.md +++ b/generated_pages/techniques/T0015.md @@ -8,6 +8,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | | [I00006 Columbian Chemicals](../../generated_pages/incidents/I00006.md) | Create and use hashtag | +| [I00086 #WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media](../../generated_pages/incidents/I00086.md) | In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”, which posted hashtags alongside campaign content (T0015: Create Hashtags and Search Artefacts):

“The accounts post generic images to fill their account feed to make the account seem real. They then employ a hidden hashtag in their posts, consisting of a seemingly random string of numbers and letters.

“The hypothesis regarding this tactic is that the group orchestrating these accounts utilizes these hashtags as a means of indexing them. This system likely serves a dual purpose: firstly, to keep track of the network’s expansive network of accounts and unique posts, and secondly, to streamline the process of boosting engagement among these accounts. By searching for these specific, unique hashtags, the group can quickly locate posts from their network and engage with them using other fake accounts, thereby artificially inflating the visibility and perceived authenticity of the fake account.” | diff --git a/generated_pages/techniques/T0016.md b/generated_pages/techniques/T0016.md index efef607..0d62716 100644 --- a/generated_pages/techniques/T0016.md +++ b/generated_pages/techniques/T0016.md @@ -8,6 +8,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | | [I00017 US presidential elections](../../generated_pages/incidents/I00017.md) | Click-bait (economic actors) fake news sites (ie: Denver Guardian; Macedonian teens) | +| [I00079 Three thousand fake tanks](../../generated_pages/incidents/I00079.md) | “On January 4 [2017], however, the Donbas News International (DNI) agency, based in Donetsk, Ukraine, and (since September 2016) an official state media outlet of the unrecognized separatist Donetsk People’s Republic, ran an article under the sensational headline, “US sends 3,600 tanks against Russia — massive NATO deployment under way.” DNI is run by Finnish exile Janus Putkonen, described by the Finnish national broadcaster, YLE, as a “Finnish info warrior”, and the first foreigner to be granted a Donetsk passport.

“The equally sensational opening paragraph ran, “The NATO war preparation against Russia, ‘Operation Atlantic Resolve’, is in full swing. 2,000 US tanks will be sent in coming days from Germany to Eastern Europe, and 1,600 US tanks is deployed to storage facilities in the Netherlands. At the same time, NATO countries are sending thousands of soldiers in to Russian borders.”

“The report is based around an obvious factual error, conflating the total number of vehicles with the actual number of tanks, and therefore multiplying the actual tank force 20 times over. For context, military website globalfirepower.com puts the total US tank force at 8,848. If the DNI story had been true, it would have meant sending 40% of all the US’ main battle tanks to Europe in one go.

“Could this have been an innocent mistake? The simple answer is “no”. The journalist who penned the story had a sufficient command of the details to be able to write, later in the same article, “In January, 26 tanks, 100 other vehicles and 120 containers will be transported by train to Lithuania. Germany will send the 122nd Infantry Battalion.” Yet the same author apparently believed, in the headline and first paragraph, that every single vehicle in Atlantic Resolve is a tank. To call this an innocent mistake is simply not plausible.

“The DNI story can only realistically be considered a deliberate fake designed to caricaturize and demonize NATO, the United States and Germany (tactfully referred to in the report as having “rolled over Eastern Europe in its war of extermination 75 years ago”) by grossly overstating the number of MBTs involved.”

This behaviour matches T0016: Create Clickbait because the person who wrote the story is shown to be aware of the fact that there were non-tank vehicles later in their story, but still chose to give the article a sensationalist headline claiming that all vehicles being sent were tanks. | diff --git a/generated_pages/techniques/T0023.md b/generated_pages/techniques/T0023.md index 04d4124..b2c20c5 100644 --- a/generated_pages/techniques/T0023.md +++ b/generated_pages/techniques/T0023.md @@ -9,6 +9,7 @@ | -------- | -------------------- | | [I00047 Sea of Azov](../../generated_pages/incidents/I00047.md) | (Distort) Kremlin-controlled RT cited Russian Minister of Foreign Affairs Sergei Lavrov suggesting that Ukraine deliberately provoked Russia in hopes of gaining additional support from the United States and Europe. | | [I00053 China Huawei CFO Arrest](../../generated_pages/incidents/I00053.md) | Distorted, saccharine “news” about the Chinese State and Party | +| [I00079 Three thousand fake tanks](../../generated_pages/incidents/I00079.md) | “On January 4 [2017], a little-known news site based in Donetsk, Ukraine published an article claiming that the United States was sending 3,600 tanks to Europe as part of “the NATO war preparation against Russia”.

“Like much fake news, this story started with a grain of truth: the US was about to reinforce its armored units in Europe. However, the article converted literally thousands of other vehicles — including hundreds of Humvees and trailers — into tanks, building the US force into something 20 times more powerful than it actually was.

“The story caught on online. Within three days it had been repeated by a dozen websites in the United States, Canada and Europe, and shared some 40,000 times. It was translated into Norwegian; quoted, unchallenged, by Russian state news agency RIA Novosti; and spread among Russian-language websites.

“It was also an obvious fake, as any Google news search would have revealed. Yet despite its evident falsehood, it spread widely, and not just in directly Kremlin-run media. Tracking the spread of this fake therefore shines a light on the wider question of how fake stories are dispersed.”

Russian state news agency RIA Novosti presents themselves as a news outlet (T0097.202: News Outlet Persona). RIO Novosti is a real news outlet (T0143.001: Authentic Persona), but it did not carry out a basic investigation into the veracity of the narrative they published implicitly expected of institutions presenting themselves as news outlets.

We can’t know how or why this narrative ended up being published by RIA Novosti, but we know that it presented a distorted reality as authentic information (T0023: Distort Facts), claiming that the US was sending 3,600 tanks, instead of 3,600 vehicles which included ~180 tanks. | diff --git a/generated_pages/techniques/T0039.md b/generated_pages/techniques/T0039.md index e4f73b6..bebaf12 100644 --- a/generated_pages/techniques/T0039.md +++ b/generated_pages/techniques/T0039.md @@ -1,8 +1,6 @@ # Technique T0039: Bait Influencer -* **Summary**: Influencers are people on social media platforms who have large audiences.  - -Threat Actors can try to trick Influencers such as celebrities, journalists, or local leaders who aren’t associated with their campaign into amplifying campaign content. This gives them access to the Influencer’s audience without having to go through the effort of building it themselves, and it helps legitimise their message by associating it with the Influencer, benefitting from their audience’s trust in them. +* **Summary**: Influencers are people on social media platforms who have large audiences.

Threat Actors can try to trick Influencers such as celebrities, journalists, or local leaders who aren’t associated with their campaign into amplifying campaign content. This gives them access to the Influencer’s audience without having to go through the effort of building it themselves, and it helps legitimise their message by associating it with the Influencer, benefitting from their audience’s trust in them. * **Belongs to tactic stage**: TA17 diff --git a/generated_pages/techniques/T0043.001.md b/generated_pages/techniques/T0043.001.md index 97cf901..597f5d1 100644 --- a/generated_pages/techniques/T0043.001.md +++ b/generated_pages/techniques/T0043.001.md @@ -7,6 +7,8 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00068 Attempted Audio Deepfake Call Targets LastPass Employee](../../generated_pages/incidents/I00068.md) | “While reports of [...] deepfake calls targeting private companies are luckily still rare, LastPass itself experienced a deepfake attempt earlier today that we are sharing with the larger community to help raise awareness that this tactic is spreading and all companies should be on the alert. In our case, an employee received a series of calls, texts, and at least one voicemail featuring an audio deepfake from a threat actor impersonating our CEO via WhatsApp. As the attempted communication was outside of normal business communication channels and due to the employee’s suspicion regarding the presence of many of the hallmarks of a social engineering attempt (such as forced urgency), our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness of the tactic both internally and externally.”

In this example attackers impersonated the CEO of LastPass (T0097.100: Individual Persona, T0143.003: Impersonated Persona), targeting one of its employees over WhatsApp (T0043.001: Use Encrypted Chat Apps) using deepfaked audio (T0088.001: Develop AI-Generated Audio (Deepfakes)). | +| [I00084 Russia turns its diplomats into disinformation warriors](../../generated_pages/incidents/I00084.md) | “[Russia’s social media] reach isn't the same as Russian state media, but they are trying to recreate what RT and Sputnik had done," said one EU official involved in tracking Russian disinformation. "It's a coordinated effort that goes beyond social media and involves specific websites."

“Central to that wider online playbook is a Telegram channel called Warfakes and an affiliated website. Since the beginning of the conflict, that social media channel has garnered more than 725,000 members and repeatedly shares alleged fact-checks aimed at debunking Ukrainian narratives, using language similar to Western-style fact-checking outlets.”

In this example a Telegram channel (T0043.001: Use Encrypted Chat Apps) was established which presented itself as a source of fact checks (T0097.203: Fact Checking Organisation Persona). | diff --git a/generated_pages/techniques/T0049.002.md b/generated_pages/techniques/T0049.002.md index a4ec428..64cf867 100644 --- a/generated_pages/techniques/T0049.002.md +++ b/generated_pages/techniques/T0049.002.md @@ -1,12 +1,6 @@ # Technique T0049.002: Flood Existing Hashtag -* **Summary**: Hashtags can be used by communities to collate information they post about particular topics (such as their interests, or current events) and users can find communities to join by exploring hashtags they’re interested in.  - -Threat actors can flood an existing hashtag to try to ruin hashtag functionality, posting content unrelated to the hashtag alongside it, making it a less reliable source of relevant information. They may also try to flood existing hashtags with campaign content, with the intent of maximising exposure to users. - -This Technique covers cases where threat actors flood existing hashtags with campaign content. - -This Technique covers behaviours previously documented by T0019.002: Hijack Hashtags, which has since been deprecated. This Technique was previously called Hijack Existing Hashtag. +* **Summary**: Hashtags can be used by communities to collate information they post about particular topics (such as their interests, or current events) and users can find communities to join by exploring hashtags they’re interested in.

Threat actors can flood an existing hashtag to try to ruin hashtag functionality, posting content unrelated to the hashtag alongside it, making it a less reliable source of relevant information. They may also try to flood existing hashtags with campaign content, with the intent of maximising exposure to users.

This Technique covers cases where threat actors flood existing hashtags with campaign content.

This Technique covers behaviours previously documented by T0019.002: Hijack Hashtags, which has since been deprecated. This Technique was previously called Hijack Existing Hashtag. * **Belongs to tactic stage**: TA17 diff --git a/generated_pages/techniques/T0049.008.md b/generated_pages/techniques/T0049.008.md index 77dd378..d13bae2 100644 --- a/generated_pages/techniques/T0049.008.md +++ b/generated_pages/techniques/T0049.008.md @@ -1,12 +1,6 @@ # Technique T0049.008: Generate Information Pollution -* **Summary**: Information Pollution occurs when threat actors attempt to ruin a source of information by flooding it with lots of inauthentic or unreliable content, intending to make it harder for legitimate users to find the information they’re looking for.  - -This subtechnique's objective is to reduce exposure to target information, rather than promoting exposure to campaign content, for which the parent technique T0049 can be used.  - -Analysts will need to infer what the motive for flooding an information space was when deciding whether to use T0049 or T0049.008 to tag a case when an information space is flooded. If such inference is not possible, default to T0049. - -This Technique previously used the ID T0019. +* **Summary**: Information Pollution occurs when threat actors attempt to ruin a source of information by flooding it with lots of inauthentic or unreliable content, intending to make it harder for legitimate users to find the information they’re looking for.

This sub-technique’s objective is to reduce exposure to target information, rather than promoting exposure to campaign content, for which the parent Technique T0049 can be used.

Analysts will need to infer what the motive for flooding an information space was when deciding whether to use T0049 or T0049.008 to tag a case when an information space is flooded. If such inference is not possible, default to T0049.

This Technique previously used the ID T0019. * **Belongs to tactic stage**: TA17 diff --git a/generated_pages/techniques/T0049.md b/generated_pages/techniques/T0049.md index da222fb..5c457b5 100644 --- a/generated_pages/techniques/T0049.md +++ b/generated_pages/techniques/T0049.md @@ -1,12 +1,6 @@ # Technique T0049: Flood Information Space -* **Summary**: Flooding sources of information (e.g. Social Media feeds) with a high volume of inauthentic content. - -This can be done to control/shape online conversations, drown out opposing points of view, or make it harder to find legitimate information.  - -Bots and/or patriotic trolls are effective tools to achieve this effect. - -This Technique previously used the name Flooding the Information Space. +* **Summary**: Flooding sources of information (e.g. Social Media feeds) with a high volume of inauthentic content.

This can be done to control/shape online conversations, drown out opposing points of view, or make it harder to find legitimate information.

Bots and/or patriotic trolls are effective tools to achieve this effect.

This Technique previously used the name Flooding the Information Space. * **Belongs to tactic stage**: TA17 diff --git a/generated_pages/techniques/T0084.002.md b/generated_pages/techniques/T0084.002.md index 973b504..2d7c159 100644 --- a/generated_pages/techniques/T0084.002.md +++ b/generated_pages/techniques/T0084.002.md @@ -7,6 +7,8 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00076 Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests](../../generated_pages/incidents/I00076.md) | “Some Twitter accounts in the network [of inauthentic accounts attributed to Iran] impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

“For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month”

[...]

“In another example, the account @ButlerJineea impersonated Jineea Butler, a 2018 candidate for New York’s 13th Congressional District, using a photograph of Butler for its profile picture and incorporating her campaign slogans into its background picture, as well as claiming in its Twitter bio to be a “US House candidate, NY-13” and linking to Butler’s website, jineeabutlerforcongress[.]com.”

In this example actors impersonated existing political candidates (T0097.110: Member of Political Party Persona, T0143.003: Impersonated Persona), strengthening the impersonation by copying legitimate accounts’ imagery (T0145.001: Copy Account Imagery), and copying its previous posts (T0084.002: Plagiarise Content). | +| [I00079 Three thousand fake tanks](../../generated_pages/incidents/I00079.md) | “The sixth [website to repost a confirmed false narrative investigated in this report] is an apparent think tank, the Center for Global Strategic Monitoring. This website describes itself, in English apparently written by a non-native speaker, as a “nonprofit and nonpartisan research and analysis institution dedicated to providing insights of the think tank community publications”. It does, indeed, publish think-tank reports on issues such as Turkey and US-China relations; however, the reports are the work of other think tanks, often unattributed (the two mentioned in this sentence were actually produced by the Brookings Institution, although the website makes no mention of the fact). It also fails to provide an address, or any other contact details other than an email, and its (long) list of experts includes entries apparently copied and pasted from other institutions. Thus, the “think tank” website which shared the fake story appears to be a fake itself.” In this example a website which amplified a false narrative presented itself as a think tank (T0097.204: Think Tank Persona).

This is an entirely fabricated persona (T0143.002: Fabricated Persona); it republished content from other think tanks without attribution (T0084.002: Plagiarise Content) and fabricated experts (T0097.108: Expert Persona, T0143.002: Fabricated Persona) to make it more believable that they were a real think tank. | diff --git a/generated_pages/techniques/T0085.001.md b/generated_pages/techniques/T0085.001.md index 8bb0573..d70514a 100644 --- a/generated_pages/techniques/T0085.001.md +++ b/generated_pages/techniques/T0085.001.md @@ -1,6 +1,6 @@ # Technique T0085.001: Develop AI-Generated Text -* **Summary**: AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience. +* **Summary**: AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.

Associated Techniques and Sub-techniques:
T0085.008: Machine Translated Text: Use this sub-technique when AI has been used to generate a translation of a piece of text. * **Belongs to tactic stage**: TA06 diff --git a/generated_pages/techniques/T0085.004.md b/generated_pages/techniques/T0085.004.md index affe996..e1de228 100644 --- a/generated_pages/techniques/T0085.004.md +++ b/generated_pages/techniques/T0085.004.md @@ -7,6 +7,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00071 Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland](../../generated_pages/incidents/I00071.md) | “On August 16, 2022, pro-Kremlin Telegram channel Joker DPR (Джокер ДНР) published a forged letter allegedly written by Ukrainian Foreign Minister Dmytro Kuleba. In the letter, Kuleba supposedly asked relevant Polish authorities to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII.

[...]

The letter is not dated, and Dmytro Kuleba’s signature seems to be copied from a publicly available letter signed by him in 2021.”

In this example the Telegram channel Joker DPR published a forged letter (T0085.004: Develop Document) in which they impersonated the Ukrainian Minister of Foreign Affairs (T0097.111: Government Official Persona, T0143.003: Impersonated Persona), using Ministry letterhead (T0097.206: Government Institution Persona, T0143.003: Impersonated Persona). | diff --git a/generated_pages/techniques/T0085.005.md b/generated_pages/techniques/T0085.005.md index 3a95861..05e155c 100644 --- a/generated_pages/techniques/T0085.005.md +++ b/generated_pages/techniques/T0085.005.md @@ -1,8 +1,6 @@ # Technique T0085.005: Develop Book -* **Summary**: Produce text content in the form of a book.  - -This technique covers both e-books and physical books, however, the former is more easily deployed by threat actors given the lower cost to develop. +* **Summary**: Produce text content in the form of a book. 

This technique covers both e-books and physical books, however, the former is more easily deployed by threat actors given the lower cost to develop. * **Belongs to tactic stage**: TA06 diff --git a/generated_pages/techniques/T0085.006.md b/generated_pages/techniques/T0085.006.md index 2466df3..a1f17ef 100644 --- a/generated_pages/techniques/T0085.006.md +++ b/generated_pages/techniques/T0085.006.md @@ -1,12 +1,6 @@ # Technique T0085.006: Develop Opinion Article -* **Summary**: Opinion articles (aka “Op-Eds” or “Editorials”) are articles or regular columns flagged as “opinion” posted to news sources, and can be contributed by people outside the organisation.  - -Flagging articles as opinions allow news organisations to distinguish them from the typical expectations of objective news reporting while distancing the presented opinion from the organisation or its employees. - -The use of this technique is not by itself an indication of malicious or inauthentic content; Op-eds are a common format in media. However, threat actors exploit op-eds to, for example, submit opinion articles to local media to promote their narratives. - -Examples from the perspective of a news site involve publishing op-eds from perceived prestigious voices to give legitimacy to an inauthentic publication, or supporting causes by hosting op-eds from actors aligned with the organisation’s goals. +* **Summary**: Opinion articles (aka “Op-Eds” or “Editorials”) are articles or regular columns flagged as “opinion” posted to news sources, and can be contributed by people outside the organisation. 

Flagging articles as opinions allow news organisations to distinguish them from the typical expectations of objective news reporting while distancing the presented opinion from the organisation or its employees.

The use of this technique is not by itself an indication of malicious or inauthentic content; Op-eds are a common format in media. However, threat actors exploit op-eds to, for example, submit opinion articles to local media to promote their narratives.

Examples from the perspective of a news site involve publishing op-eds from perceived prestigious voices to give legitimacy to an inauthentic publication, or supporting causes by hosting op-eds from actors aligned with the organisation’s goals. * **Belongs to tactic stage**: TA06 diff --git a/generated_pages/techniques/T0085.007.md b/generated_pages/techniques/T0085.007.md index d412a9d..49108ed 100644 --- a/generated_pages/techniques/T0085.007.md +++ b/generated_pages/techniques/T0085.007.md @@ -1,8 +1,6 @@ # Technique T0085.007: Create Fake Research -* **Summary**: Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx. - -This Technique previously used the ID T0019.001 +* **Summary**: Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx.

This Technique previously used the ID T0019.001. * **Belongs to tactic stage**: TA06 diff --git a/generated_pages/techniques/T0085.008.md b/generated_pages/techniques/T0085.008.md new file mode 100644 index 0000000..83b921c --- /dev/null +++ b/generated_pages/techniques/T0085.008.md @@ -0,0 +1,19 @@ +# Technique T0085.008: Machine Translated Text + +* **Summary**: Text which has been translated into another language using machine translation tools, such as AI. + +* **Belongs to tactic stage**: TA06 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00086 #WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media](../../generated_pages/incidents/I00086.md) | In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”.

“A conspicuous aspect of these accounts is the likely usage of machine-translated Hebrew. The disjointed and linguistically strange comments imply that the CIB’s architects are not Hebrew-speaking and likely translate to Hebrew using online tools. There’s no official way to confirm that a text is translated, but it is evident when the gender for nouns is incorrect, very unusual words or illogical grammar being used usually lead to the conclusion that the comment was not written by a native speaker that is aware of the nuances of the language.”

In this example analysts asserted that accounts were posting content which had been translated via machine (T0085.008: Machine Translated Text), based on indicators such as issues with grammar and gender. | +| [I00088 Much Ado About ‘Somethings’ - China-Linked Influence Operation Endures Despite Takedown](../../generated_pages/incidents/I00088.md) | “The broader War of Somethings (WoS) network, so dubbed because all the Facebook pages and user accounts in the network are connected to “The War of Somethings” page,  behaves very similarly to previous Spamouflage campaigns. [Spamouflage is a coordinated inauthentic behaviour network attributed to the Chinese state.]

“Like other components of Spamouflage, the WoS network sometimes intersperses apolitical content with its more agenda-driven material. Many members post nearly identical comments at almost the same time. The text includes markers of automatic translation while error messages included as profile photos indicate the automated pulling of stock images.”

In this example analysts found an indicator of automated use of stock images in Facebook accounts; some of the accounts in the network appeared to have mistakenly uploaded error messages as profile pictures (T0145.007: Stock Image Account Imagery). The text posted by the accounts also appeared to have been translated using automation (T0085.008: Machine Translated Text). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0086.002.md b/generated_pages/techniques/T0086.002.md index cedff3f..e5ba63b 100644 --- a/generated_pages/techniques/T0086.002.md +++ b/generated_pages/techniques/T0086.002.md @@ -1,6 +1,6 @@ # Technique T0086.002: Develop AI-Generated Images (Deepfakes) -* **Summary**: Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures. +* **Summary**: Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.

Associated Techniques and Sub-techniques:
T0145.002: AI-Generated Account Imagery: Analysts should use this sub-technique to document use of AI generated imagery in accounts’ profile pictures or other account imagery. * **Belongs to tactic stage**: TA06 diff --git a/generated_pages/techniques/T0088.001.md b/generated_pages/techniques/T0088.001.md index c1d4be8..92c9ea0 100644 --- a/generated_pages/techniques/T0088.001.md +++ b/generated_pages/techniques/T0088.001.md @@ -7,6 +7,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00068 Attempted Audio Deepfake Call Targets LastPass Employee](../../generated_pages/incidents/I00068.md) | “While reports of [...] deepfake calls targeting private companies are luckily still rare, LastPass itself experienced a deepfake attempt earlier today that we are sharing with the larger community to help raise awareness that this tactic is spreading and all companies should be on the alert. In our case, an employee received a series of calls, texts, and at least one voicemail featuring an audio deepfake from a threat actor impersonating our CEO via WhatsApp. As the attempted communication was outside of normal business communication channels and due to the employee’s suspicion regarding the presence of many of the hallmarks of a social engineering attempt (such as forced urgency), our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness of the tactic both internally and externally.”

In this example attackers impersonated the CEO of LastPass (T0097.100: Individual Persona, T0143.003: Impersonated Persona), targeting one of its employees over WhatsApp (T0043.001: Use Encrypted Chat Apps) using deepfaked audio (T0088.001: Develop AI-Generated Audio (Deepfakes)). | diff --git a/generated_pages/techniques/T0097.001.md b/generated_pages/techniques/T0097.001.md deleted file mode 100644 index b0ef21e..0000000 --- a/generated_pages/techniques/T0097.001.md +++ /dev/null @@ -1,23 +0,0 @@ -# Technique T0097.001: Produce Evidence for Persona - -* **Summary**: People may produce evidence which supports the persona they are deploying (T0097) (aka “backstopping” the persona). - -This Technique covers situations where evidence is developed or produced as part of an influence operation to increase the perceived legitimacy of a persona used during IO, including creating accounts for the same persona on multiple platforms. - -The use of personas (T0097), and providing evidence to improve people’s perception of one’s persona (T0097.001), are not necessarily malicious or inauthentic. However, sometimes people use personas to increase the perceived legitimacy of narratives for malicious purposes. - -This Technique was previously called Backstop Personas. - -* **Belongs to tactic stage**: TA16 - - -| Incident | Descriptions given for this incident | -| -------- | -------------------- | - - - -| Counters | Response types | -| -------- | -------------- | - - -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.100.md b/generated_pages/techniques/T0097.100.md new file mode 100644 index 0000000..533cbbd --- /dev/null +++ b/generated_pages/techniques/T0097.100.md @@ -0,0 +1,19 @@ +# Technique T0097.100: Individual Persona + +* **Summary**: This sub-technique can be used to indicate that an entity is presenting itself as an individual. If the person is presenting themselves as having one of the personas listed below then these sub-techniques should be used instead, as they indicate both the type of persona they presented and that the entity presented itself as an individual:

T0097.101: Local Persona
T0097.102: Journalist Persona
T0097.103: Activist Persona
T0097.104: Hacktivist Persona
T0097.105: Military Personnel Persona
T0097.106: Recruiter Persona
T0097.107: Researcher Persona
T0097.108: Expert Persona
T0097.109: Romantic Suitor Persona
T0097.110: Party Official Persona
T0097.111: Government Official Persona
T0097.112: Government Employee Persona + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00068 Attempted Audio Deepfake Call Targets LastPass Employee](../../generated_pages/incidents/I00068.md) | “While reports of [...] deepfake calls targeting private companies are luckily still rare, LastPass itself experienced a deepfake attempt earlier today that we are sharing with the larger community to help raise awareness that this tactic is spreading and all companies should be on the alert. In our case, an employee received a series of calls, texts, and at least one voicemail featuring an audio deepfake from a threat actor impersonating our CEO via WhatsApp. As the attempted communication was outside of normal business communication channels and due to the employee’s suspicion regarding the presence of many of the hallmarks of a social engineering attempt (such as forced urgency), our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness of the tactic both internally and externally.”

In this example attackers impersonated the CEO of LastPass (T0097.100: Individual Persona, T0143.003: Impersonated Persona), targeting one of its employees over WhatsApp (T0043.001: Use Encrypted Chat Apps) using deepfaked audio (T0088.001: Develop AI-Generated Audio (Deepfakes)). | +| [I00069 Uncharmed: Untangling Iran's APT42 Operations](../../generated_pages/incidents/I00069.md) | “[Iranian state-sponsored cyber espionage actor] APT42 cloud operations attack lifecycle can be described in details as follows:

- “Social engineering schemes involving decoys and trust building, which includes masquerading as legitimate NGOs and conducting ongoing correspondence with the target, sometimes lasting several weeks.
- The threat actor masqueraded as well-known international organizations in the legal and NGO fields and sent emails from domains typosquatting the original NGO domains, for example aspenlnstitute[.]org.
- The Aspen Institute became aware of this spoofed domain and collaborated with industry partners, including blocking it in SafeBrowsing, thus protecting users of Google Chrome and additional browsers.
- To increase their credibility, APT42 impersonated high-ranking personnel working at the aforementioned organizations when creating the email personas.
- APT42 enhanced their campaign credibility by using decoy material inviting targets to legitimate and relevant events and conferences. In one instance, the decoy material was hosted on an attacker-controlled SharePoint folder, accessible only after the victim entered their credentials. Mandiant did not identify malicious elements in the files, suggesting they were used solely to gain the victim’s trust.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created a domain impersonating the existing NGO The Aspen Institute (T0143.003: Impersonated Persona, T0097.207: NGO Persona). They increased the perceived legitimacy of the impersonation by also impersonating high-ranking employees of the NGO (T0097.100: Individual Persona, T0143.003: Impersonated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.101.md b/generated_pages/techniques/T0097.101.md new file mode 100644 index 0000000..438cb07 --- /dev/null +++ b/generated_pages/techniques/T0097.101.md @@ -0,0 +1,23 @@ +# Technique T0097.101: Local Persona + +* **Summary**: A person with a local persona presents themselves as living in a particular geography or having local knowledge relevant to a narrative.

While presenting as a local is not an indication of inauthentic behaviour,  an influence operation may have its narratives amplified by people presenting as local to a target area. Threat actors can fabricate locals (T0143.002: Fabricated Persona, T0097.101: Local Persona) to add credibility to their narratives, or to misrepresent the real opinions of locals in the area.

People who are legitimate locals (T0143.001: Authentic Persona, T0097.101: Local Persona) can use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a local to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.201: Local Institution Persona: Analysts should use this sub-technique to catalogue cases where an institution is presenting as a local, such as a local news organisation or local business. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00071 Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland](../../generated_pages/incidents/I00071.md) | “The August 17 [2022] Telegram post [which contained a falsified letter from the Ukrainian Minister of Foreign Affairs asking Poland to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII] also contained screenshots of Facebook posts that appeared on two Facebook accounts belonging to Polish nationals Piotr Górka, an expert in the history of the Polish Air Force, and Dariusz Walusiak, a Polish historian and documentary maker. The Górka post suggested that he fully supported the Polish government’s decision to change Belwederska Street to Stepan Bandera Street.

“In a statement to the DFRLab, Górka said his account was accessed without his consent. “This is not my post loaded to my Facebook page,” he explained. “My site was hacked, some days ago.” At the time of publishing, Piotr Górka’s post and his Facebook account were no longer accessible.

“The post on Górka’s Facebook page was shared by Dariusz Walusiak’s Facebook account; the account also reposted it on the Facebook walls of more than twenty other Facebook users, including Adam Kalita, currently working at Krakow branch of the Institute of National Remembrance; Jan Kasprzyk, head of the Office for War Veterans and Victims of Oppression; and Alicja Kondraciuk, a Polish public figure living in Krakow.

“Walusiak’s Facebook account is also no longer accessible. Given his work on Polish history and identity, it seems highly unlikely he would support the Bandera measure; the DFRLab has also reached out to him for comment.

“The fact that Joker DPR’s Telegram post included screenshots of their Facebook posts raises the strong possibility that both Facebook accounts were compromised, and that hackers planted false statements on their pages that would seem out of character for them in order to gain further attention to the forged documents.”

In this example, threat actors used compromised accounts (T0141.001: Acquire Compromised Account) of Polish historians who have enough relevant knowledge to plausibly weigh in on the forged letter’s narrative (T0143.003: Impersonated Persona, T0097.101: Local Persona, T0097.108: Expert Persona). 

This matches T0097.108: Expert Persona because the impersonation exploited Górka and Walusiak’s existing personas as experts in Polish history. | +| [I00076 Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests](../../generated_pages/incidents/I00076.md) | “In addition to directly posting material on social media, we observed some personas in the network [of inauthentic accounts attributed to Iran] leverage legitimate print and online media outlets in the U.S. and Israel to promote Iranian interests via the submission of letters, guest columns, and blog posts that were then published. We also identified personas that we suspect were fabricated for the sole purpose of submitting such letters, but that do not appear to maintain accounts on social media. The personas claimed to be based in varying locations depending on the news outlets they were targeting for submission; for example, a persona that listed their location as Seattle, WA in a letter submitted to the Seattle Times subsequently claimed to be located in Baytown, TX in a letter submitted to The Baytown Sun. Other accounts in the network then posted links to some of these letters on social media.”

In this example actors fabricated individuals who lived in areas which were being targeted for influence through the use of letters to local papers (T0097.101: Local Persona, T0143.002: Fabricated Persona). | +| [I00078 Meta’s September 2020 Removal of Coordinated Inauthentic Behavior](../../generated_pages/incidents/I00078.md) | “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [I00081 Belarus KGB created fake accounts to criticize Poland during border crisis, Facebook parent company says](../../generated_pages/incidents/I00081.md) | “Meta said it also removed 31 Facebook accounts, four groups, two events and four Instagram accounts that it believes originated in Poland and targeted Belarus and Iraq. Those allegedly fake accounts posed as Middle Eastern migrants posting about the border crisis. Meta did not link the accounts to a specific group.

““These fake personas claimed to be sharing their own negative experiences of trying to get from Belarus to Poland and posted about migrants’ difficult lives in Europe,” Meta said. “They also posted about Poland’s strict anti-migrant policies and anti-migrant neo-Nazi activity in Poland. They also shared links to news articles criticizing the Belarusian government’s handling of the border crisis and off-platform videos alleging migrant abuse in Europe.””

In this example accounts falsely presented themselves as having local insight into the border crisis narrative (T0097.101: Local Persona, T0143.002: Fabricated Persona). | +| [I00086 #WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media](../../generated_pages/incidents/I00086.md) | Accounts which were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023” were presenting themselves as locals to Israel (T0097.101: Local Persona):

“Unlike usual low-effort fake accounts, these accounts meticulously mimic young Israelis. They stand out due to the extraordinary lengths taken to ensure their authenticity, from unique narratives to the content they produce to their seemingly authentic interactions.” | +| [I00087 Challenging Truth and Trust: A Global Inventory of Organized Social Media Manipulation](../../generated_pages/incidents/I00087.md) | “Another actor operating in China is the American-based company Devumi. Most of the Twitter accounts managed by Devumi resemble real people, and some are even associated with a kind of large-scale social identity theft. At least 55,000 of the accounts use the names, profile pictures, hometowns and other personal details of real Twitter users, including minors, according to The New York Times (Confessore et al., 2018)).”

In this example accounts impersonated real locals while spreading operation narratives (T0143.003: Impersonated Persona, T0097.101: Local Persona). The impersonation included stealing the legitimate accounts’ profile pictures (T0145.001: Copy Account Imagery). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.102.md b/generated_pages/techniques/T0097.102.md new file mode 100644 index 0000000..be03b83 --- /dev/null +++ b/generated_pages/techniques/T0097.102.md @@ -0,0 +1,20 @@ +# Technique T0097.102: Journalist Persona + +* **Summary**: A person with a journalist persona presents themselves as a reporter or journalist delivering news, conducting interviews, investigations etc.

While presenting as a journalist is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as journalists. Threat actors can fabricate journalists to give the appearance of legitimacy, justifying the actor’s requests for interviews, etc (T0143.002: Fabricated Persona, T0097.102: Journalist Persona).

People who have legitimately developed a persona as a journalist (T0143.001: Authentic Persona, T0097.102: Journalist Persona) can use it for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a trusted journalist to provide legitimacy to a false narrative or be tricked into doing so without the journalist’s knowledge.

Associated Techniques and Sub-techniques
T0097.202: News Organisation Persona: People with a journalist persona may present as being part of a news organisation.
T0097.101: Local Persona: People with a journalist persona may present themselves as local reporters. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00076 Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests](../../generated_pages/incidents/I00076.md) | “Accounts in the network [of inauthentic accounts attributed to Iran], under the guise of journalist personas, also solicited various individuals over Twitter for interviews and chats, including real journalists and politicians. The personas appear to have successfully conducted remote video and audio interviews with U.S. and UK-based individuals, including a prominent activist, a radio talk show host, and a former U.S. Government official, and subsequently posted the interviews on social media, showing only the individual being interviewed and not the interviewer. The interviewees expressed views that Iran would likely find favorable, discussing topics such as the February 2019 Warsaw summit, an attack on a military parade in the Iranian city of Ahvaz, and the killing of Jamal Khashoggi.

“The provenance of these interviews appear to have been misrepresented on at least one occasion, with one persona appearing to have falsely claimed to be operating on behalf of a mainstream news outlet; a remote video interview with a US-based activist about the Jamal Khashoggi killing was posted by an account adopting the persona of a journalist from the outlet Newsday, with the Newsday logo also appearing in the video. We did not identify any Newsday interview with the activist in question on this topic. In another instance, a persona posing as a journalist directed tweets containing audio of an interview conducted with a former U.S. Government official at real media personalities, calling on them to post about the interview.”

In this example actors fabricated journalists (T0097.102: Journalist Persona, T0143.002: Fabricated Persona) who worked at existing news outlets (T0097.202: News Outlet Persona, T0143.003: Impersonated Persona) in order to conduct interviews with targeted individuals. | +| [I00080 Hundreds Of Propaganda Accounts Targeting Iran And Qatar Have Been Removed From Facebook](../../generated_pages/incidents/I00080.md) | “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler (noun) (linking verb) (noun/verb/adjective),” which appears to reveal the formula used to write Twitter bios for the accounts.”

The Jenny Powel account used in this influence operation presents as both a journalist and an activist (T0097.102: Journalist Persona, T0097.103: Activist Persona, T0143.002: Fabricated Persona). This example shows how threat actors can easily follow a template to present a fabricated persona to their target audience (T0144.002: Persona Template). | +| [I00082 Meta’s November 2021 Adversarial Threat Report ](../../generated_pages/incidents/I00082.md) | “[Meta] removed 41 Facebook accounts, five Groups, and four Instagram accounts for violating our policy against coordinated inauthentic behavior. This activity originated in Belarus and primarily targeted audiences in the Middle East and Europe.

“The core of this activity began in October 2021, with some accounts created as recently as mid-November. The people behind it used newly-created fake accounts — many of which were detected and disabled by our automated systems soon after creation — to pose as journalists and activists from the European Union, particularly Poland and Lithuania. Some of the accounts used profile photos likely generated using artificial intelligence techniques like generative adversarial networks (GAN). These fictitious personas posted criticism of Poland in English, Polish, and Kurdish, including pictures and videos about Polish border guards allegedly violating migrants’ rights, and compared Poland’s treatment of migrants against other countries’. They also posted to Groups focused on the welfare of migrants in Europe. A few accounts posted in Russian about relations between Belarus and the Baltic States.”

This example shows how accounts identified as participating in coordinated inauthentic behaviour were presenting themselves as journalists and activists while spreading operation narratives (T0097.102: Journalist Persona, T0097.103: Activist Persona).

Additionally, analysts at Meta identified accounts which were participating in coordinated inauthentic behaviour that had likely used AI-Generated images as their profile pictures (T0145.002: AI-Generated Account Imagery). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.103.md b/generated_pages/techniques/T0097.103.md new file mode 100644 index 0000000..74f2575 --- /dev/null +++ b/generated_pages/techniques/T0097.103.md @@ -0,0 +1,21 @@ +# Technique T0097.103: Activist Persona + +* **Summary**: A person with an activist persona presents themselves as an activist; an individual who campaigns for a political cause, organises related events, etc.

While presenting as an activist is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as activists. Threat actors can fabricate activists to give the appearance of popular support for an evolving grassroots movement (see T0143.002: Fabricated Persona, T0097.103: Activist Persona).

People who are legitimate activists can use this persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as an activist to provide visibility to a false narrative or be tricked into doing so without their knowledge (T0143.001: Authentic Persona, T0097.103: Activist Persona).

Associated Techniques and Sub-techniques
T0097.104: Hacktivist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as someone engaged in activism who uses technical tools and methods, including building technical infrastructure and conducting offensive cyber operations, to achieve their goals.
T0097.207: NGO Persona: People with an activist persona may present as being part of an NGO.
T0097.208: Social Cause Persona: Analysts should use this sub-technique to catalogue cases where an online account is presenting as posting content related to a particular social cause, while not presenting as an individual. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00069 Uncharmed: Untangling Iran's APT42 Operations](../../generated_pages/incidents/I00069.md) | “In March 2023, [Iranian state-sponsored cyber espionage actor] APT42 sent a spear-phishing email with a fake Google Meet invitation, allegedly sent on behalf of Mona Louri, a likely fake persona leveraged by APT42, claiming to be a human rights activist and researcher. Upon entry, the user was presented with a fake Google Meet page and asked to enter their credentials, which were subsequently sent to the attackers.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created an account which presented as a human rights activist (T0097.103: Activist Persona) and researcher (T0097.107: Researcher Persona). The analysts assert that it was likely the persona was fabricated (T0143.002: Fabricated Persona) | +| [I00077 Fronts & Friends: An Investigation into Two Twitter Networks Linked to Russian Actors](../../generated_pages/incidents/I00077.md) | “The Syria portion of the network [of inauthentic accounts attributed to Russia] included additional sockpuppet accounts. One of these claimed to be a gay rights defender in Syria. Several said they were Syrian journalists. Another account, @SophiaHammer3, said she was born in Syria but currently lives in London. “I’m fond of history and politics. I struggle for justice.” Twitter users had previously observed that Sophia was likely a sockpuppet.”

This behaviour matches T0097.103: Activist Persona because the account presents itself as defending a political cause - in this case gay rights.

Twitter’s technical indicators allowed their analysts to assert that these accounts were “reliably tied to Russian state actors”, meaning the presented personas were entirely fabricated (T0143.002: Fabricated Persona); these accounts are not legitimate gay rights defenders or journalists, they’re assets controlled by Russia publishing narratives beneficial to their agenda. | +| [I00080 Hundreds Of Propaganda Accounts Targeting Iran And Qatar Have Been Removed From Facebook](../../generated_pages/incidents/I00080.md) | “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler (noun) (linking verb) (noun/verb/adjective),” which appears to reveal the formula used to write Twitter bios for the accounts.”

The Jenny Powel account used in this influence operation presents as both a journalist and an activist (T0097.102: Journalist Persona, T0097.103: Activist Persona, T0143.002: Fabricated Persona). This example shows how threat actors can easily follow a template to present a fabricated persona to their target audience (T0144.002: Persona Template). | +| [I00082 Meta’s November 2021 Adversarial Threat Report ](../../generated_pages/incidents/I00082.md) | “[Meta] removed a network of accounts in Vietnam for violating our Inauthentic Behavior policy against mass reporting. They coordinated the targeting of activists and other people who publicly criticized the Vietnamese government and used false reports of various violations in an attempt to have these users removed from our platform. The people behind this activity relied primarily on authentic and duplicate accounts to submit hundreds — in some cases, thousands — of complaints against their targets through our abuse reporting flows.

“Many operators also maintained fake accounts — some of which were detected and disabled by our automated systems — to pose as their targets so they could then report the legitimate accounts as fake. They would frequently change the gender and name of their fake accounts to resemble the target individual. Among the most common claims in this misleading reporting activity were complaints of impersonation, and to a much lesser extent inauthenticity. The network also advertised abusive services in their bios and constantly evolved their tactics in an attempt to evade detection.“

In this example actors repurposed their accounts to impersonate targeted activists (T0097.103: Activist Persona, T0143.003: Impersonated Persona) in order to falsely report the activists’ legitimate accounts as impersonations (T0124.001: Report Non-Violative Opposing Content). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.104.md b/generated_pages/techniques/T0097.104.md new file mode 100644 index 0000000..33ae696 --- /dev/null +++ b/generated_pages/techniques/T0097.104.md @@ -0,0 +1,17 @@ +# Technique T0097.104: Hacktivist Persona + +* **Summary**: A person with a hacktivist persona presents themselves as an activist who conducts offensive cyber operations or builds technical infrastructure for political purposes, rather than the financial motivations commonly attributed to hackers; hacktivists are hacker activists who use their technical knowledge to take political action.

Hacktivists can build technical infrastructure to support other activists, including secure communication channels and surveillance and censorship circumvention. They can also conduct DDOS attacks and other offensive cyber operations, aiming to take down digital assets or gain access to proprietary information. An influence operation may use hacktivist personas to support their operational narratives and legitimise their operational activities.

Fabricated Hacktivists are sometimes referred to as “Faketivists”.

Associated Techniques and Sub-techniques
T0097.103: Activist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as someone engaged in activism but doesn’t present themselves as using technical tools and methods to achieve their goals. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.105.md b/generated_pages/techniques/T0097.105.md new file mode 100644 index 0000000..d3bc4b0 --- /dev/null +++ b/generated_pages/techniques/T0097.105.md @@ -0,0 +1,17 @@ +# Technique T0097.105: Military Personnel Persona + +* **Summary**: A person with a military personnel persona presents themselves as a serving member or veteran of a military organisation operating in an official capacity on behalf of a government.

While presenting as military personnel is not an indication of inauthentic behaviour,  an influence operation may have its narratives amplified by people presenting as military personnel. Threat actors can fabricate military personnel (T0143.002: Fabricated Persona, T0097.105: Military Personnel Persona) to pose as experts on military topics, or to discredit geopolitical adversaries by pretending to be one of their military personnel and spreading discontent.

People who have legitimately developed a military persona (T0143.001: Authentic Persona, T0097.105: Military Personnel Persona) can use it for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a member of the military to provide legitimacy to a false narrative or be tricked into doing so without their knowledge. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.106.md b/generated_pages/techniques/T0097.106.md new file mode 100644 index 0000000..ffe32ff --- /dev/null +++ b/generated_pages/techniques/T0097.106.md @@ -0,0 +1,21 @@ +# Technique T0097.106: Recruiter Persona + +* **Summary**: A person with a recruiter persona presents themselves as a potential employer or provider of freelance work.

While presenting as a recruiter is not an indication of inauthentic behaviour, threat actors fabricate recruiters (T0143.002: Fabricated Persona, T0097.106: Recruiter Persona) to justify asking for personal information from their targets or to trick targets into working for the threat actors (without revealing who they are).

Associated Techniques and Sub-techniques
T0097.205: Business Persona: People with a recruiter persona may present as being part of a business which they are recruiting for. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00074 The Tactics & Tropes of the Internet Research Agency](../../generated_pages/incidents/I00074.md) | “A few press investigations have alluded to the [Russia’s Internet Research Agency]’s job ads. The extent of the human asset recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a priority. Posts encouraging Americans to perform various types of tasks for IRA handlers appeared in Black, Left, and Right-targeted groups, though they were most numerous in the Black community. They included:

- Requests for contact with preachers from Black churches (Black_Baptist_Church)
- Offers of free counsellingcounseling to people with sexual addiction (Army of Jesus)
- Soliciting volunteers to hand out fliers
- Soliciting volunteers to teach self-defense classes
- Offering free self-defense classes (Black Fist/Fit Black)
- Requests for followers to attend political rallies
- Requests for photographers to document protests
- Requests for speakers at protests
- Requests to protest the Westborough Baptist Church (LGBT United)
- Job offers for designers to help design fliers, sites, Facebook sticker packs
- Requests for female followers to send photos for a calendar
- Requests for followers to send photos to be shared to the Page (Back the Badge)
- Soliciting videos for a YouTube contest called “Pee on Hillary”
- Encouraging people to apply to be part of a Black reality TV show
- Posting a wide variety of job ads (write for BlackMattersUS and others)
- Requests for lawyers to volunteer to assist with immigration cases”

This behaviour matches T0097.106: Recruiter Persona because the threat actors are presenting tasks for their target audience to complete in the style of a job posting (even though some of the tasks were presented as voluntary / unpaid efforts), including calls for people to attend political rallies (T0126.001: Call to Action to Attend). | +| [I00078 Meta’s September 2020 Removal of Coordinated Inauthentic Behavior](../../generated_pages/incidents/I00078.md) | “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [I00091 Facebook uncovers Chinese network behind fake expert](../../generated_pages/incidents/I00091.md) | “Earlier in July [2021], an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China.

“State media outlets, including CGTN, Shanghai Daily and Global Times, had cited the so-called biologist based on his Facebook profile.

“However, the Swiss embassy said in August that the person likely did not exist, as the Facebook account was opened only two weeks prior to its first post and only had three friends.

“It added "there was no registry of a Swiss citizen with the name "Wilson Edwards" and no academic articles under the name", and urged Chinese media outlets to take down any mention of him.

[...]

“It also said that his profile photo also appeared to have been generated using machine-learning capabilities.”

In this example an account created on Facebook presented itself as a Swiss biologist to present a narrative related to COVID-19 (T0143.002: Fabricated Persona, T0097.106: Researcher Persona). It used an AI-Generated profile picture to disguise itself (T0145.002: AI-Generated Account Imagery). | +| [I00095 Meta: Chinese disinformation network was behind London front company recruiting content creators](../../generated_pages/incidents/I00095.md) | “A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta.

“The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited.

“London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta”.

In this example a front company was used (T0097.205: Business Persona) to enable actors to recruit targets for producing content (T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.107.md b/generated_pages/techniques/T0097.107.md new file mode 100644 index 0000000..43eabf1 --- /dev/null +++ b/generated_pages/techniques/T0097.107.md @@ -0,0 +1,18 @@ +# Technique T0097.107: Researcher Persona + +* **Summary**: A person with a researcher persona presents themselves as conducting research (e.g. for academic institutions, or think tanks), or having previously conducted research.

While presenting as a researcher is not an indication of inauthentic behaviour,  an influence operation may have its narratives amplified by people presenting as researchers. Threat actors can fabricate researchers (T0143.002: Fabricated Persona, T0097.107: Researcher Persona) to add credibility to their narratives.

People who are legitimate researchers (T0143.001: Authentic Persona, T0097.107: Researcher Persona) can use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a Researcher to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.204: Think Tank Persona: People with a researcher persona may present as being part of a think tank.
T0097.108: Expert Persona: People who present as researching a given topic are likely to also present as having expertise in the area. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00069 Uncharmed: Untangling Iran's APT42 Operations](../../generated_pages/incidents/I00069.md) | “In March 2023, [Iranian state-sponsored cyber espionage actor] APT42 sent a spear-phishing email with a fake Google Meet invitation, allegedly sent on behalf of Mona Louri, a likely fake persona leveraged by APT42, claiming to be a human rights activist and researcher. Upon entry, the user was presented with a fake Google Meet page and asked to enter their credentials, which were subsequently sent to the attackers.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created an account which presented as a human rights activist (T0097.103: Activist Persona) and researcher (T0097.107: Researcher Persona). The analysts assert that it was likely the persona was fabricated (T0143.002: Fabricated Persona) | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.108.md b/generated_pages/techniques/T0097.108.md new file mode 100644 index 0000000..3ef14a7 --- /dev/null +++ b/generated_pages/techniques/T0097.108.md @@ -0,0 +1,19 @@ +# Technique T0097.108: Expert Persona + +* **Summary**: A person with an expert persona presents themselves as having expertise or experience in a field. Commonly the persona’s expertise will be called upon to add credibility to a given narrative.

While presenting as an expert is not an indication of inauthentic behaviour,  an influence operation may have its narratives amplified by people presenting as experts. Threat actors can fabricate experts (T0143.002: Fabricated Persona, T0097.107: Researcher Persona) to add credibility to their narratives.

People who are legitimate experts (T0143.001: Authentic Persona, T0097.107: Researcher Persona) can make mistakes, use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as an expert to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.107: Researcher Persona: People who present as experts may also present as conducting or having conducted research into their specialist subject.
T0097.204: Think Tank Persona: People with an expert persona may present as being part of a think tank. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00071 Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland](../../generated_pages/incidents/I00071.md) | “The August 17 [2022] Telegram post [which contained a falsified letter from the Ukrainian Minister of Foreign Affairs asking Poland to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII] also contained screenshots of Facebook posts that appeared on two Facebook accounts belonging to Polish nationals Piotr Górka, an expert in the history of the Polish Air Force, and Dariusz Walusiak, a Polish historian and documentary maker. The Górka post suggested that he fully supported the Polish government’s decision to change Belwederska Street to Stepan Bandera Street.

“In a statement to the DFRLab, Górka said his account was accessed without his consent. “This is not my post loaded to my Facebook page,” he explained. “My site was hacked, some days ago.” At the time of publishing, Piotr Górka’s post and his Facebook account were no longer accessible.

“The post on Górka’s Facebook page was shared by Dariusz Walusiak’s Facebook account; the account also reposted it on the Facebook walls of more than twenty other Facebook users, including Adam Kalita, currently working at Krakow branch of the Institute of National Remembrance; Jan Kasprzyk, head of the Office for War Veterans and Victims of Oppression; and Alicja Kondraciuk, a Polish public figure living in Krakow.

“Walusiak’s Facebook account is also no longer accessible. Given his work on Polish history and identity, it seems highly unlikely he would support the Bandera measure; the DFRLab has also reached out to him for comment.

“The fact that Joker DPR’s Telegram post included screenshots of their Facebook posts raises the strong possibility that both Facebook accounts were compromised, and that hackers planted false statements on their pages that would seem out of character for them in order to gain further attention to the forged documents.”

In this example, threat actors used compromised accounts (T0141.001: Acquire Compromised Account) of Polish historians who have enough relevant knowledge to plausibly weigh in on the forged letter’s narrative (T0143.003: Impersonated Persona, T0097.101: Local Persona, T0097.108: Expert Persona). 

This matches T0097.108: Expert Persona because the impersonation exploited Górka and Walusiak’s existing personas as experts in Polish history. | +| [I00079 Three thousand fake tanks](../../generated_pages/incidents/I00079.md) | “The sixth [website to repost a confirmed false narrative investigated in this report] is an apparent think tank, the Center for Global Strategic Monitoring. This website describes itself, in English apparently written by a non-native speaker, as a “nonprofit and nonpartisan research and analysis institution dedicated to providing insights of the think tank community publications”. It does, indeed, publish think-tank reports on issues such as Turkey and US-China relations; however, the reports are the work of other think tanks, often unattributed (the two mentioned in this sentence were actually produced by the Brookings Institution, although the website makes no mention of the fact). It also fails to provide an address, or any other contact details other than an email, and its (long) list of experts includes entries apparently copied and pasted from other institutions. Thus, the “think tank” website which shared the fake story appears to be a fake itself.” In this example a website which amplified a false narrative presented itself as a think tank (T0097.204: Think Tank Persona).

This is an entirely fabricated persona (T0143.002: Fabricated Persona); it republished content from other think tanks without attribution (T0084.002: Plagiarise Content) and fabricated experts (T0097.108: Expert Persona, T0143.002: Fabricated Persona) to make it more believable that they were a real think tank. | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.109.md b/generated_pages/techniques/T0097.109.md new file mode 100644 index 0000000..766ba5a --- /dev/null +++ b/generated_pages/techniques/T0097.109.md @@ -0,0 +1,17 @@ +# Technique T0097.109: Romantic Suitor Persona + +* **Summary**: A person with a romantic suitor persona presents themselves as seeking a romantic or physical connection with another person.

While presenting as seeking a romantic or physical connection is not an indication of inauthentic behaviour, threat actors can use dating apps, social media channels or dating websites to fabricate romantic suitors to lure targets they can blackmail, extract information from, deceive or trick into giving them money (T0143.002: Fabricated Persona, T0097.109: Romantic Suitor Persona).

Honeypotting in espionage and Big Butchering in scamming are commonly associated with romantic suitor personas.

Associated Techniques and Sub-techniques
T0104.002: Dating App: Analysts can use this sub-technique for tagging cases where an account has been identified as using a dating platform. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.110.md b/generated_pages/techniques/T0097.110.md new file mode 100644 index 0000000..59bbc4e --- /dev/null +++ b/generated_pages/techniques/T0097.110.md @@ -0,0 +1,19 @@ +# Technique T0097.110: Party Official Persona + +* **Summary**: A person who presents as an official member of a political party, such as leaders of political parties, candidates standing to represent constituents, and campaign staff.

Presenting as an official of a political party is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in political parties to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.110: Party Official Persona). They may also impersonate existing officials of political parties (T0143.003: Impersonated Persona, T0097.110: Party Official Persona).

Legitimate members of political parties could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.110: Party Official Persona). For example, an electoral candidate could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting as a member of a government. 

Some party officials will also be government officials. For example, in the United Kingdom the head of government is commonly also the head of their political party.

Some party officials won’t be government officials. For example, members of a party standing in an election, or party officials who work outside of government (e.g. campaign staff). + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00075 How Russia Meddles Abroad for Profit: Cash, Trolls and a Cult Leader](../../generated_pages/incidents/I00075.md) | “In the campaign’s final weeks, Pastor Mailhol said, the team of Russians made a request: Drop out of the race and support Mr. Rajoelina. He refused.

“The Russians made the same proposal to the history professor running for president, saying, “If you accept this deal you will have money” according to Ms. Rasamimanana, the professor’s campaign manager.

When the professor refused, she said, the Russians created a fake Facebook page that mimicked his official page and posted an announcement on it that he was supporting Mr. Rajoelina.”

In this example actors created online accounts styled to look like official pages to trick targets into thinking that the presidential candidate announced that they had dropped out of the election (T0097.110: Party Official Persona, T0143.003: Impersonated Persona) | +| [I00076 Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests](../../generated_pages/incidents/I00076.md) | “Some Twitter accounts in the network [of inauthentic accounts attributed to Iran] impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

“For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month”

[...]

“In another example, the account @ButlerJineea impersonated Jineea Butler, a 2018 candidate for New York’s 13th Congressional District, using a photograph of Butler for its profile picture and incorporating her campaign slogans into its background picture, as well as claiming in its Twitter bio to be a “US House candidate, NY-13” and linking to Butler’s website, jineeabutlerforcongress[.]com.”

In this example actors impersonated existing political candidates (T0097.110: Member of Political Party Persona, T0143.003: Impersonated Persona), strengthening the impersonation by copying legitimate accounts’ imagery (T0145.001: Copy Account Imagery), and copying its previous posts (T0084.002: Plagiarise Content). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.111.md b/generated_pages/techniques/T0097.111.md new file mode 100644 index 0000000..cb39a51 --- /dev/null +++ b/generated_pages/techniques/T0097.111.md @@ -0,0 +1,21 @@ +# Technique T0097.111: Government Official Persona + +* **Summary**: A person who presents as an active or previous government official has the government official persona. These are officials serving in government, such as heads of government departments, leaders of countries, and members of government selected to represent constituents.

Presenting as a government official is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in government to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.111: Government Official Persona). They may also impersonate existing members of government (T0143.003: Impersonated Persona, T0097.111: Government Official Persona).

Legitimate government officials could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.111: Government Official Persona). For example, a government official could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.110: Party Official Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting as a member of a political party. 

Not all government officials are political party officials (such as outside experts brought into government) and not all political party officials are government officials (such as people standing for office who are not yet working in government).

T0097.206: Government Institution Persona: People presenting as members of a government may also represent a government institution which they are associated with.

T0097.112: Government Employee Persona: Analysts should use this sub-technique to document people presenting as professionals hired to serve in government institutions and departments, not officials selected to represent constituents, or assigned official roles in government (such as heads of departments). + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00071 Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland](../../generated_pages/incidents/I00071.md) | “On August 16, 2022, pro-Kremlin Telegram channel Joker DPR (Джокер ДНР) published a forged letter allegedly written by Ukrainian Foreign Minister Dmytro Kuleba. In the letter, Kuleba supposedly asked relevant Polish authorities to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII.

[...]

The letter is not dated, and Dmytro Kuleba’s signature seems to be copied from a publicly available letter signed by him in 2021.”

In this example the Telegram channel Joker DPR published a forged letter (T0085.004: Develop Document) in which they impersonated the Ukrainian Minister of Foreign Affairs (T0097.111: Government Official Persona, T0143.003: Impersonated Persona), using Ministry letterhead (T0097.206: Government Institution Persona, T0143.003: Impersonated Persona). | +| [I00084 Russia turns its diplomats into disinformation warriors](../../generated_pages/incidents/I00084.md) | “After the European Union banned Kremlin-backed media outlets and social media giants demoted their posts for peddling falsehoods about the war in Ukraine, Moscow has turned to its cadre of diplomats, government spokespeople and ministers — many of whom have extensive followings on social media — to promote disinformation about the conflict in Eastern Europe, according to four EU and United States officials.”

In this example authentic Russian government officials used their own accounts to promote false narratives (T0143.001: Authentic Persona, T0097.111: Government Official Persona).

The use of accounts managed by authentic Government / Diplomats to spread false narratives makes it harder for platforms to enforce content moderation, because of the political ramifications they may face for censoring elected officials (T0131: Exploit TOS/Content Moderation). For example, Twitter previously argued that official channels of world leaders are not removed due to the high public interest associated with their activities. | +| [I00085 China’s large-scale media push: Attempts to influence Swedish media](../../generated_pages/incidents/I00085.md) | “Four media companies – Svenska Dagbladet, Expressen, Sveriges Radio, and Sveriges Television – stated that they had been contacted by the Chinese embassy on several occasions, and that they, for instance, had been criticized on their publications, both by letters and e-mails.

The media company Svenska Dagbladet, had been contacted on several occasions in the past two years, including via e-mails directly from the Chinese ambassador to Sweden. Several times, China and the Chinese ambassador had criticized the media company’s publications regarding the conditions in China. Individual reporters also reported having been subjected to criticism.

The tabloid Expressen had received several letters and e-mails from the embassy, e-mails containing criticism and threatening formulations regarding the coverage of the Swedish book publisher Gui Minhai, who has been imprisoned in China since 2015. Formulations such as “media tyranny” could be found in the e-mails.”

In this case, the Chinese ambassador is using their official role (T0143.001: Authentic Persona, T0097.111: Government Official Persona) to try to influence Swedish press. A government official trying to interfere in other countries' media activities could be a violation of press freedom. In this specific case, the Chinese diplomats are trying to silence criticism against China (T0139.002: Silence).” | +| [I00093 China Falsely Denies Disinformation Campaign Targeting Canada’s Prime Minister](../../generated_pages/incidents/I00093.md) | “On October 23, Canada’s Foreign Ministry said it had discovered a disinformation campaign, likely tied to China, aimed at discrediting dozens of Canadian politicians, including Prime Minister Justin Trudeau.

“The ministry said the campaign took place in August and September. It used new and hijacked social media accounts to bulk-post messages targeting Canadian politicians (T0141.001: Acquire Compromised Account).

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

““Canada was a downright liar and disseminator of false information… Beijing has never meddled in another nation’s domestic affairs.”

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

“That is false.

“The Canadian government's report is based on an investigation conducted by its Rapid Response Mechanism cyber intelligence unit in cooperation with the social media platforms.

“The investigation exposed China’s disinformation campaign dubbed “Spamouflage” -- for its tactic of using “a network of new or hijacked social media accounts that posts and increases the number of propaganda messages across multiple social media platforms – including Facebook, X/Twitter, Instagram, YouTube, Medium, Reddit, TikTok, and LinkedIn.””

In this case a network of accounts attributed to China were identified operating on multiple platforms. The report was dismissed as false information by an official in the Chinese Embassy in Canada (T0143.001: Authentic Persona, T0097.111: Government Official Persona, T0129.006: Deny Involvement). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.112.md b/generated_pages/techniques/T0097.112.md new file mode 100644 index 0000000..5137410 --- /dev/null +++ b/generated_pages/techniques/T0097.112.md @@ -0,0 +1,17 @@ +# Technique T0097.112: Government Employee Persona + +* **Summary**: A person who presents as an active or previous civil servant has the government employee persona. These are professionals hired to serve in government institutions and departments, not officials selected to represent constituents, or assigned official roles in government (such as heads of departments).

Presenting as a government employee is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in government to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.112: Government Employee Persona). They may also impersonate existing government employees (T0143.003: Impersonated Persona, T0097.112: Government Employee Persona).

Legitimate government employees could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.112: Government Employee Persona). For example, a government employee could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Analysts should use this technique to document people who present as an active or previous government official, such as heads of government departments, leaders of countries, and members of government selected to represent constituents.
T0097.206: Government Institution Persona: People presenting as members of a government may also present a government institution which they are associated with. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.200.md b/generated_pages/techniques/T0097.200.md new file mode 100644 index 0000000..f7c5d80 --- /dev/null +++ b/generated_pages/techniques/T0097.200.md @@ -0,0 +1,17 @@ +# Technique T0097.200: Institutional Persona + +* **Summary**: This Technique can be used to indicate that an entity is presenting itself as an institution. If the organisation is presenting itself as having one of the personas listed below then these Techniques should be used instead, as they indicate both that the entity presented itself as an institution, and the type of persona they presented:

T0097.201: Local Institution Persona
T0097.202: News Outlet Persona
T0097.203: Fact Checking Organisation Persona
T0097.204: Think Tank Persona
T0097.205: Business Persona
T0097.206: Government Institution Persona
T0097.207: NGO Persona
T0097.208: Social Cause Persona + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.201.md b/generated_pages/techniques/T0097.201.md new file mode 100644 index 0000000..944b7bd --- /dev/null +++ b/generated_pages/techniques/T0097.201.md @@ -0,0 +1,18 @@ +# Technique T0097.201: Local Institution Persona + +* **Summary**: Institutions which present themselves as operating in a particular geography, or as having local knowledge relevant to a narrative, are presenting a local institution persona.

While presenting as a local institution is not an indication of inauthentic behaviour, threat actors may present themselves as such (T0143.002: Fabricated Persona, T0097.201: Local Institution Persona) to add credibility to their narratives, or misrepresent the real opinions of locals in the area.

Legitimate local institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.201: Local Institution Persona). For example, a local institution could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.101: Local Persona: Institutions presenting as local may also present locals working within the organisation. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00094 A glimpse inside a Chinese influence campaign: How bogus news websites blur the line between true and false](../../generated_pages/incidents/I00094.md) | Researchers identified websites managed by a Chinese marketing firm which presented themselves as news organisations.

“On its official website, the Chinese marketing firm boasted that they were in contact with news organizations across the globe, including one in South Korea called the “Chungcheng Times.” According to the joint team, this outlet is a fictional news organization created by the offending company. The Chinese company sought to disguise the site’s true identity and purpose by altering the name attached to it by one character—making it very closely resemble the name of a legitimate outlet operating out of Chungchengbuk-do.

“The marketing firm also established a news organization under the Korean name “Gyeonggido Daily,” which closely resembles legitimate news outlets operating out of Gyeonggi province such as “Gyeonggi Daily,” “Daily Gyeonggi Newspaper,” and “Gyeonggi N Daily.” One of the fake news sites was named “Incheon Focus,” a title that could be easily mistaken for the legitimate local news outlet, “Focus Incheon.” Furthermore, the Chinese marketing company operated two fake news sites with names identical to two separate local news organizations, one of which ceased operations in December 2022.

“In total, fifteen out of eighteen Chinese fake news sites incorporated the correct names of real regions in their fake company names. “If the operators had created fake news sites similar to major news organizations based in Seoul, however, the intended deception would have easily been uncovered,” explained Song Tae-eun, an assistant professor in the Department of National Security & Unification Studies at the Korea National Diplomatic Academy, to The Readable. “There is also the possibility that they are using the regional areas as an attempt to form ties with the local community; that being the government, the private sector, and religious communities.””

The firm styled their news site to resemble existing local news outlets in their target region (T0097.201: Local Institution Persona, T0097.202: News Outlet Persona, T0143.003: Impersonated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.202.md b/generated_pages/techniques/T0097.202.md new file mode 100644 index 0000000..9db0e56 --- /dev/null +++ b/generated_pages/techniques/T0097.202.md @@ -0,0 +1,23 @@ +# Technique T0097.202: News Outlet Persona + +* **Summary**: An institution with a news outlet persona presents itself as an organisation which delivers new information to its target audience.

While presenting as a news outlet is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by news organisations. Threat actors can fabricate news organisations (T0143.002: Fabricated Persona, T0097.202: News Outlet Persona), or they can impersonate existing news outlets (T0143.003: Impersonated Persona, T0097.202: News Outlet Persona).

Legitimate news organisations could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.202: News Outlet Persona).

Associated Techniques and Sub-techniques
T0097.102: Journalist Persona: Institutions presenting as news outlets may also present journalists working within the organisation.
T0097.201: Local Institution Persona: Institutions presenting as news outlets may present as being a local news outlet.
T0097.203: Fact Checking Organisation Persona: Institutions presenting as news outlets may also deliver a fact checking service (e.g. The UK’s BBC News has the fact checking service BBC Verify). When an actor presents as the fact checking arm of a news outlet, they are presenting both a News Outlet Persona and a Fact Checking Organisation Persona. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00069 Uncharmed: Untangling Iran's APT42 Operations](../../generated_pages/incidents/I00069.md) | “Mandiant identified at least three clusters of infrastructure used by [Iranian state-sponsored cyber espionage actor] APT42 to harvest credentials from targets in the policy and government sectors, media organizations and journalists, and NGOs and activists. The three clusters employ similar tactics, techniques and procedures (TTPs) to target victim credentials (spear-phishing emails), but use slightly varied domains, masquerading patterns, decoys, and themes.

Cluster A: Posing as News Outlets and NGOs:
- Suspected Targeting: credentials of journalists, researchers, and geopolitical entities in regions of interest to Iran.
- Masquerading as: The Washington Post (U.S.), The Economist (UK), The Jerusalem Post (IL), Khaleej Times (UAE), Azadliq (Azerbaijan), and more news outlets and NGOs. This often involves the use of typosquatted domains like washinqtonpost[.]press.

“Mandiant did not observe APT42 target or compromise these organizations, but rather impersonate them.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, impersonated existing news organisations and NGOs (T0097.202 News Outlet Persona, T0097.207: NGO Persona, T0143.003: Impersonated Persona) in attempts to steal credentials from targets (T0141.001: Acquire Compromised Account), using elements of influence operations to facilitate their cyber attacks. | +| [I00074 The Tactics & Tropes of the Internet Research Agency](../../generated_pages/incidents/I00074.md) | “The Black Matters Facebook Page [operated by Russia’s Internet Research Agency] explored several visual brand identities, moving from a plain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran the Facebook Page announced the launch of the website, blackmattersus[.]com, emphasizing media distrust and a desire to build Black independent media; [“I DIDN’T BELIEVE THE MEDIA / SO I BECAME ONE”]”

In this example an asset controlled by Russia’s Internet Research Agency began to present itself as a source of “Black independent media”, claiming that the media could not be trusted (T0097.208: Social Cause Persona, T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | +| [I00076 Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests](../../generated_pages/incidents/I00076.md) | “Accounts in the network [of inauthentic accounts attributed to Iran], under the guise of journalist personas, also solicited various individuals over Twitter for interviews and chats, including real journalists and politicians. The personas appear to have successfully conducted remote video and audio interviews with U.S. and UK-based individuals, including a prominent activist, a radio talk show host, and a former U.S. Government official, and subsequently posted the interviews on social media, showing only the individual being interviewed and not the interviewer. The interviewees expressed views that Iran would likely find favorable, discussing topics such as the February 2019 Warsaw summit, an attack on a military parade in the Iranian city of Ahvaz, and the killing of Jamal Khashoggi.

“The provenance of these interviews appear to have been misrepresented on at least one occasion, with one persona appearing to have falsely claimed to be operating on behalf of a mainstream news outlet; a remote video interview with a US-based activist about the Jamal Khashoggi killing was posted by an account adopting the persona of a journalist from the outlet Newsday, with the Newsday logo also appearing in the video. We did not identify any Newsday interview with the activist in question on this topic. In another instance, a persona posing as a journalist directed tweets containing audio of an interview conducted with a former U.S. Government official at real media personalities, calling on them to post about the interview.”

In this example actors fabricated journalists (T0097.102: Journalist Persona, T0143.002: Fabricated Persona) who worked at existing news outlets (T0097.202: News Outlet Persona, T0143.003: Impersonated Persona) in order to conduct interviews with targeted individuals. | +| [I00077 Fronts & Friends: An Investigation into Two Twitter Networks Linked to Russian Actors](../../generated_pages/incidents/I00077.md) | “Two accounts [in the second network of accounts taken down by Twitter] appear to have been operated by Oriental Review and the Strategic Culture Foundation, respectively. Oriental Review bills itself as an “open source site for free thinking”, though it trades in outlandish conspiracy theories and posts content bylined by fake people. Stanford Internet Observatory researchers and investigative journalists have previously noted the presence of content bylined by fake “reporter” personas tied to the GRU-linked front Inside Syria Media Center, posted on Oriental Review.”

In an effort to make the Oriental Review’s stories appear more credible, the threat actors created fake journalists and pretended they wrote the articles on their website (aka “bylined” them).

In DISARM terms, they fabricated journalists (T0143.002: Fabricated Persona, T0097.003: Journalist Persona), and then used these fabricated journalists to increase perceived legitimacy (T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | +| [I00079 Three thousand fake tanks](../../generated_pages/incidents/I00079.md) | “On January 4 [2017], a little-known news site based in Donetsk, Ukraine published an article claiming that the United States was sending 3,600 tanks to Europe as part of “the NATO war preparation against Russia”.

“Like much fake news, this story started with a grain of truth: the US was about to reinforce its armored units in Europe. However, the article converted literally thousands of other vehicles — including hundreds of Humvees and trailers — into tanks, building the US force into something 20 times more powerful than it actually was.

“The story caught on online. Within three days it had been repeated by a dozen websites in the United States, Canada and Europe, and shared some 40,000 times. It was translated into Norwegian; quoted, unchallenged, by Russian state news agency RIA Novosti; and spread among Russian-language websites.

“It was also an obvious fake, as any Google news search would have revealed. Yet despite its evident falsehood, it spread widely, and not just in directly Kremlin-run media. Tracking the spread of this fake therefore shines a light on the wider question of how fake stories are dispersed.”

Russian state news agency RIA Novosti presents themselves as a news outlet (T0097.202: News Outlet Persona). RIO Novosti is a real news outlet (T0143.001: Authentic Persona), but it did not carry out a basic investigation into the veracity of the narrative they published implicitly expected of institutions presenting themselves as news outlets.

We can’t know how or why this narrative ended up being published by RIA Novosti, but we know that it presented a distorted reality as authentic information (T0023: Distort Facts), claiming that the US was sending 3,600 tanks, instead of 3,600 vehicles which included ~180 tanks. | +| [I00094 A glimpse inside a Chinese influence campaign: How bogus news websites blur the line between true and false](../../generated_pages/incidents/I00094.md) | Researchers identified websites managed by a Chinese marketing firm which presented themselves as news organisations.

“On its official website, the Chinese marketing firm boasted that they were in contact with news organizations across the globe, including one in South Korea called the “Chungcheng Times.” According to the joint team, this outlet is a fictional news organization created by the offending company. The Chinese company sought to disguise the site’s true identity and purpose by altering the name attached to it by one character—making it very closely resemble the name of a legitimate outlet operating out of Chungchengbuk-do.

“The marketing firm also established a news organization under the Korean name “Gyeonggido Daily,” which closely resembles legitimate news outlets operating out of Gyeonggi province such as “Gyeonggi Daily,” “Daily Gyeonggi Newspaper,” and “Gyeonggi N Daily.” One of the fake news sites was named “Incheon Focus,” a title that could be easily mistaken for the legitimate local news outlet, “Focus Incheon.” Furthermore, the Chinese marketing company operated two fake news sites with names identical to two separate local news organizations, one of which ceased operations in December 2022.

“In total, fifteen out of eighteen Chinese fake news sites incorporated the correct names of real regions in their fake company names. “If the operators had created fake news sites similar to major news organizations based in Seoul, however, the intended deception would have easily been uncovered,” explained Song Tae-eun, an assistant professor in the Department of National Security & Unification Studies at the Korea National Diplomatic Academy, to The Readable. “There is also the possibility that they are using the regional areas as an attempt to form ties with the local community; that being the government, the private sector, and religious communities.””

The firm styled their news site to resemble existing local news outlets in their target region (T0097.201: Local Institution Persona, T0097.202: News Outlet Persona, T0143.003: Impersonated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.203.md b/generated_pages/techniques/T0097.203.md new file mode 100644 index 0000000..4fda303 --- /dev/null +++ b/generated_pages/techniques/T0097.203.md @@ -0,0 +1,18 @@ +# Technique T0097.203: Fact Checking Organisation Persona + +* **Summary**: An institution with a fact checking organisation persona presents itself as an organisation which produces reports which assess the validity of others’ reporting / statements.

While presenting as a fact checking organisation is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by fact checking organisations. Threat actors can fabricate fact checking organisations (T0143.002: Fabricated Persona, T0097.202: News Outlet Persona), or they can impersonate existing fact checking outlets (T0143.003: Impersonated Persona, T0097.202: News Outlet Persona).

Legitimate fact checking organisations could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.202: News Outlet Persona).

Associated Techniques and Sub-techniques
T0097.102: Journalist Persona: Institutions presenting as fact checking organisations may also present journalists working within the organisation.
T0097.202: News Outlet Persona: Fact checking organisations may present as operating as part of a larger news outlet (e.g. The UK’s BBC News has the fact checking service BBC Verify). When an actor presents as the fact checking arm of a news outlet, they are presenting both a News Outlet Persona and a Fact Checking Organisation Persona. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00084 Russia turns its diplomats into disinformation warriors](../../generated_pages/incidents/I00084.md) | “[Russia’s social media] reach isn't the same as Russian state media, but they are trying to recreate what RT and Sputnik had done," said one EU official involved in tracking Russian disinformation. "It's a coordinated effort that goes beyond social media and involves specific websites."

“Central to that wider online playbook is a Telegram channel called Warfakes and an affiliated website. Since the beginning of the conflict, that social media channel has garnered more than 725,000 members and repeatedly shares alleged fact-checks aimed at debunking Ukrainian narratives, using language similar to Western-style fact-checking outlets.”

In this example a Telegram channel (T0043.001: Use Encrypted Chat Apps) was established which presented itself as a source of fact checks (T0097.203: Fact Checking Organisation Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.204.md b/generated_pages/techniques/T0097.204.md new file mode 100644 index 0000000..86879fc --- /dev/null +++ b/generated_pages/techniques/T0097.204.md @@ -0,0 +1,22 @@ +# Technique T0097.204: Think Tank Persona + +* **Summary**: An institution with a think tank persona presents itself as a think tank; an organisation that aims to conduct original research and propose new policies or solutions, especially for social and scientific problems.

While presenting as a think tank is not an indication of inauthentic behaviour, think tank personas are commonly used by threat actors as a front for their operational activity (T0143.002: Fabricated Persona, T0097.204: Think Tank Persona). They may be created to give legitimacy to narratives and allow them to suggest politically beneficial solutions to societal issues.

Legitimate think tanks could have a political bias that they may not be transparent about, they could use their persona for malicious purposes, or they could be exploited by threat actors (T0143.001: Authentic Persona, T0097.204: Think Tank Persona). For example, a think tank could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.107: Researcher Persona: Institutions presenting as think tanks may also present researchers working within the organisation. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00072 Behind the Dutch Terror Threat Video: The St. Petersburg "Troll Factory" Connection](../../generated_pages/incidents/I00072.md) | “The creator of Geopolitika[.]ru is Aleksandr Dugin, who was sanctioned by the United States Department of Treasury in 2015 for his role in the Eurasian Youth Union “for being responsible for or complicit in actions or policies that threaten the peace, security, stability, or sovereignty or territorial integrity of Ukraine.”

[...]

“Currently, the website geopolika[.]ru redirects directly to another partner website, Katehon.

“Katehon poses itself as a think tank focused on geopolitics in an English edition of its website. In contrast, in Russian, it states its aim to develop “ideological, political, diplomatic, economic and military strategy for Russia of the future” with a special role of religion. The president of Katehon’s supervisory board is Konstantin Malofeev, a Russian millionaire with connections to the Russian orthodox church and presidential administration, who founded Tsargrad TV, a known source of disinformation. Malofeev was sanctioned by the U.S. Department of Treasury and the European Union in 2014 for material support and financial backing of Russian-backed separatists in eastern Ukraine. Another known figure from the board is Sergei Glaziev, former advisor to Putin in 2012–2019. Dugin is also on the board in the Russian edition of the website, whereas he is omitted in English.”

In this example a website managed by an actor previously sanctioned by the US department of treasury has been configured to redirect to another website; Katehon (T0129.008: Redirect URLs).

Katehon presents itself as a geopolitical think tank in English (T0097.204: Think Tank Persona), but does not maintain this persona when presenting itself to a Russian speaking audience. | +| [I00074 The Tactics & Tropes of the Internet Research Agency](../../generated_pages/incidents/I00074.md) | “[Russia’s Internet Research Agency, the IRA] pushed narratives with longform blog content. They created media properties, websites designed to produce stories that would resonate with those targeted. It appears, based on the data set provided by Alphabet, that the IRA may have also expanded into think tank-style communiques. One such page, previously unattributed to the IRA but included in the Alphabet data, was GI Analytics, a geopolitics blog with an international masthead that included American authors. This page was promoted via AdWords and YouTube videos; it has strong ties to more traditional Russian propaganda networks, which will be discussed later in this analysis. GI Analytics wrote articles articulating nuanced academic positions on a variety of sophisticated topics. From the site’s About page:

““Our purpose and mission are to provide high-quality analysis at a time when we are faced with a multitude of crises, a collapsing global economy, imperialist wars, environmental disasters, corporate greed, terrorism, deceit, GMO food, a migration crisis and a crackdown on small farmers and ranchers.””

In this example Alphabet’s technical indicators allowed them to assert that GI Analytics, which presented itself as a think tank, was a fabricated institution associated with Russia’s Internet Research Agency (T0097.204: Think Tank Persona, T0143.002: Fabricated Persona). | +| [I00078 Meta’s September 2020 Removal of Coordinated Inauthentic Behavior](../../generated_pages/incidents/I00078.md) | “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [I00079 Three thousand fake tanks](../../generated_pages/incidents/I00079.md) | “The sixth [website to repost a confirmed false narrative investigated in this report] is an apparent think tank, the Center for Global Strategic Monitoring. This website describes itself, in English apparently written by a non-native speaker, as a “nonprofit and nonpartisan research and analysis institution dedicated to providing insights of the think tank community publications”. It does, indeed, publish think-tank reports on issues such as Turkey and US-China relations; however, the reports are the work of other think tanks, often unattributed (the two mentioned in this sentence were actually produced by the Brookings Institution, although the website makes no mention of the fact). It also fails to provide an address, or any other contact details other than an email, and its (long) list of experts includes entries apparently copied and pasted from other institutions. Thus, the “think tank” website which shared the fake story appears to be a fake itself.” In this example a website which amplified a false narrative presented itself as a think tank (T0097.204: Think Tank Persona).

This is an entirely fabricated persona (T0143.002: Fabricated Persona); it republished content from other think tanks without attribution (T0084.002: Plagiarise Content) and fabricated experts (T0097.108: Expert Persona, T0143.002: Fabricated Persona) to make it more believable that they were a real think tank. | +| [I00083 Fake Think Tanks Fuel Fake News—And the President's Tweets](../../generated_pages/incidents/I00083.md) | “[This article discusses a] longstanding network of bogus "think tanks" raise disinformation to a pseudoscience, and their studies' pull quotes and flashy stats become the "evidence" driving viral, fact-free stories

[...]

“[These inauthentic Think Tanks] tend toward hate: There's the white supremacist National Policy Institute and Jared Taylor's New Century Foundation; the anti-LGBTQ work of the Family Research Council and American College of Pediatricians; and a whole slew of groups fixated on immigration. Three of the biggest---Federation for American Immigration Reform, the Center for Immigration Studies, and NumbersUSA---are intertwined, all connected in their origins to white nationalist John Tanton.

“The Southern Poverty Law Center designates most of these organizations as bona fide hate groups. And yet most---FRC, CIS and FAIR in particular---enjoy relationships with some powerful politicians. Trump himself has met with leaders of the anti-immigration groups, hired people from FAIR and the Family Research Council, and cited the anti-immigration groups' erroneous figures.

“That's because phony think tanks are professional mimics, from the innocuous-sounding names---the Employment Policies Institute practically steals its name from the Economic Policy Institute---to their online presences. "It used to be you could trust a dot-edu or a dot-org," says Heidi Beirich, director of the Southern Poverty Law Center's Intelligence Project. "Now some of the main hate sites are dot-orgs.””

In this example an organisation designated as a hate group is presenting itself as a think tank (T0097.204: Think Tank Persona) in order to boost the perceived legitimacy of narratives. | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.205.md b/generated_pages/techniques/T0097.205.md new file mode 100644 index 0000000..4a385b5 --- /dev/null +++ b/generated_pages/techniques/T0097.205.md @@ -0,0 +1,19 @@ +# Technique T0097.205: Business Persona + +* **Summary**: An institution with a business persona presents itself as a for-profit organisation which provides goods or services for a price.

While presenting as a business is not an indication of inauthentic behaviour, business personas may be used by threat actors as a front for their operational activity (T0143.002: Fabricated Persona, T0097.205: Business Persona).

Threat actors may also impersonate existing businesses (T0143.003: Impersonated Persona, T0097.205: Business Persona) to exploit their brand or cause reputational damage.

Legitimate businesses could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.205: Business Persona). For example, a business could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00070 Eli Lilly Clarifies It’s Not Offering Free Insulin After Tweet From Fake Verified Account—As Chaos Unfolds On Twitter](../../generated_pages/incidents/I00070.md) | “Twitter Blue launched [November 2022], giving any users who pay $8 a month the ability to be verified on the site, a feature previously only available to public figures, government officials and journalists as a way to show they are who they claim to be.

“[A day after the launch], an account with the handle @EliLillyandCo labeled itself with the name “Eli Lilly and Company,” and by using the same logo as the company in its profile picture and with the verification checkmark, was indistinguishable from the real company (the picture has since been removed and the account has labeled itself as a parody profile).

The parody account tweeted “we are excited to announce insulin is free now.””

In this example an account impersonated the pharmaceutical company Eli Lilly (T0097.205: Business Persona, T0143.003: Impersonated Persona) by copying its name, profile picture (T0145.001: Copy Account Imagery), and paying for verification. | +| [I00095 Meta: Chinese disinformation network was behind London front company recruiting content creators](../../generated_pages/incidents/I00095.md) | “A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta.

“The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited.

“London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta”.

In this example a front company was used (T0097.205: Business Persona) to enable actors to recruit targets for producing content (T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.206.md b/generated_pages/techniques/T0097.206.md new file mode 100644 index 0000000..ab87cc3 --- /dev/null +++ b/generated_pages/techniques/T0097.206.md @@ -0,0 +1,18 @@ +# Technique T0097.206: Government Institution Persona + +* **Summary**: Institutions which present themselves as governments, or government ministries, are presenting a government institution persona.

While presenting as a government institution is not an indication of inauthentic behaviour, threat actors may impersonate existing government institutions as part of their operation (T0143.003: Impersonated Persona, T0097.206: Government Institution Persona), to add legitimacy to their narratives, or discredit the government.

Legitimate government institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.206: Government Institution Persona). For example, a government institution could be used by elected officials to spread inauthentic narratives.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Institutions presenting as governments may also present officials working within the organisation.
T0097.112: Government Employee Persona: Institutions presenting as governments may also present employees working within the organisation. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00071 Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland](../../generated_pages/incidents/I00071.md) | “On August 16, 2022, pro-Kremlin Telegram channel Joker DPR (Джокер ДНР) published a forged letter allegedly written by Ukrainian Foreign Minister Dmytro Kuleba. In the letter, Kuleba supposedly asked relevant Polish authorities to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII.

[...]

The letter is not dated, and Dmytro Kuleba’s signature seems to be copied from a publicly available letter signed by him in 2021.”

In this example the Telegram channel Joker DPR published a forged letter (T0085.004: Develop Document) in which they impersonated the Ukrainian Minister of Foreign Affairs (T0097.111: Government Official Persona, T0143.003: Impersonated Persona), using Ministry letterhead (T0097.206: Government Institution Persona, T0143.003: Impersonated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.207.md b/generated_pages/techniques/T0097.207.md new file mode 100644 index 0000000..a51300e --- /dev/null +++ b/generated_pages/techniques/T0097.207.md @@ -0,0 +1,18 @@ +# Technique T0097.207: NGO Persona + +* **Summary**: Institutions which present themselves as an NGO (Non-Governmental Organisation), an organisation which provides services or advocates for public policy (while not being directly affiliated with any government), are presenting an NGO persona.

While presenting as an NGO is not an indication of inauthentic behaviour, NGO personas are commonly used by threat actors (such as intelligence services) as a front for their operational activity (T0143.002: Fabricated Persona, T0097.207: NGO Persona). They are created to give legitimacy to the influence operation and potentially infiltrate grassroots movements

Legitimate NGOs could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.207: NGO Persona). For example, an NGO could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques:
T0097.103: Activist Persona: Institutions presenting as activist groups may also present activists working within the organisation. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00069 Uncharmed: Untangling Iran's APT42 Operations](../../generated_pages/incidents/I00069.md) | “[Iranian state-sponsored cyber espionage actor] APT42 cloud operations attack lifecycle can be described in details as follows:

- “Social engineering schemes involving decoys and trust building, which includes masquerading as legitimate NGOs and conducting ongoing correspondence with the target, sometimes lasting several weeks.
- The threat actor masqueraded as well-known international organizations in the legal and NGO fields and sent emails from domains typosquatting the original NGO domains, for example aspenlnstitute[.]org.
- The Aspen Institute became aware of this spoofed domain and collaborated with industry partners, including blocking it in SafeBrowsing, thus protecting users of Google Chrome and additional browsers.
- To increase their credibility, APT42 impersonated high-ranking personnel working at the aforementioned organizations when creating the email personas.
- APT42 enhanced their campaign credibility by using decoy material inviting targets to legitimate and relevant events and conferences. In one instance, the decoy material was hosted on an attacker-controlled SharePoint folder, accessible only after the victim entered their credentials. Mandiant did not identify malicious elements in the files, suggesting they were used solely to gain the victim’s trust.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created a domain impersonating the existing NGO The Aspen Institute (T0143.003: Impersonated Persona, T0097.207: NGO Persona). They increased the perceived legitimacy of the impersonation by also impersonating high-ranking employees of the NGO (T0097.100: Individual Persona, T0143.003: Impersonated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.208.md b/generated_pages/techniques/T0097.208.md new file mode 100644 index 0000000..600fcef --- /dev/null +++ b/generated_pages/techniques/T0097.208.md @@ -0,0 +1,18 @@ +# Technique T0097.208: Social Cause Persona + +* **Summary**: Online accounts which present themselves as focusing on a social cause are presenting the Social Cause Persona. Examples include accounts which post about current affairs, such as discrimination faced by minorities.

While presenting as an account invested in a social cause is not an indication of inauthentic behaviour, such personas have been used by threat actors to exploit peoples’ legitimate emotional investment regarding social causes that matter to them (T0143.002: Fabricated Persona, T0097.208: Social Cause Persona).

Legitimate accounts focused on a social cause could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.208: Social Cause Persona). For example, the account holders could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques:
T0097.103: Activist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as an activist related to a social cause. Accounts with social cause personas do not present themselves as individuals, but may have activists controlling the accounts. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00074 The Tactics & Tropes of the Internet Research Agency](../../generated_pages/incidents/I00074.md) | “The Black Matters Facebook Page [operated by Russia’s Internet Research Agency] explored several visual brand identities, moving from a plain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran the Facebook Page announced the launch of the website, blackmattersus[.]com, emphasizing media distrust and a desire to build Black independent media; [“I DIDN’T BELIEVE THE MEDIA / SO I BECAME ONE”]”

In this example an asset controlled by Russia’s Internet Research Agency began to present itself as a source of “Black independent media”, claiming that the media could not be trusted (T0097.208: Social Cause Persona, T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0097.md b/generated_pages/techniques/T0097.md index c13c0fb..3f541e5 100644 --- a/generated_pages/techniques/T0097.md +++ b/generated_pages/techniques/T0097.md @@ -1,6 +1,6 @@ -# Technique T0097: Create Personas +# Technique T0097: Present Persona -* **Summary**: Creating fake people, often with accounts across multiple platforms. These personas can be as simple as a name, can contain slightly more background like location, profile pictures, backstory, or can be effectively backstopped with indicators like fake identity documents. +* **Summary**: This Technique contains different types of personas commonly taken on by threat actors during influence operations.

Analysts should use T0097’s sub-techniques to document the type of persona which an account is presenting. For example, an account which describes itself as being a journalist can be tagged with T0097.102: Journalist Persona.

Personas presented by individuals include:

T0097.100: Individual Persona
T0097.101: Local Persona
T0097.102: Journalist Persona
T0097.103: Activist Persona
T0097.104: Hacktivist Persona
T0097.105: Military Personnel Persona
T0097.106: Recruiter Persona
T0097.107: Researcher Persona
T0097.108: Expert Persona
T0097.109: Romantic Suitor Persona
T0097.110: Party Official Persona
T0097.111: Government Official Persona
T0097.112: Government Employee Persona

This Technique also houses institutional personas commonly taken on by threat actors:

T0097.200: Institutional Persona
T0097.201: Local Institution Persona
T0097.202: News Outlet Persona
T0097.203: Fact Checking Organisation Persona
T0097.204: Think Tank Persona
T0097.205: Business Persona
T0097.206: Government Institution Persona
T0097.207: NGO Persona
T0097.208: Social Cause Persona

By using a persona, a threat actor is adding the perceived legitimacy of the persona to their narratives and activities. * **Belongs to tactic stage**: TA16 diff --git a/generated_pages/techniques/T0099.002.md b/generated_pages/techniques/T0099.002.md deleted file mode 100644 index 2de758c..0000000 --- a/generated_pages/techniques/T0099.002.md +++ /dev/null @@ -1,17 +0,0 @@ -# Technique T0099.002: Spoof/Parody Account/Site - -* **Summary**: An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organisations, or state entities. - -* **Belongs to tactic stage**: TA16 - - -| Incident | Descriptions given for this incident | -| -------- | -------------------- | - - - -| Counters | Response types | -| -------- | -------------- | - - -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0099.003.md b/generated_pages/techniques/T0099.003.md deleted file mode 100644 index 2a0c0ab..0000000 --- a/generated_pages/techniques/T0099.003.md +++ /dev/null @@ -1,19 +0,0 @@ -# Technique T0099.003: Impersonate Existing Organisation - -* **Summary**: A situation where a threat actor styles their online assets or content to mimic an existing organisation. - -This can be done to take advantage of peoples’ trust in the organisation to increase narrative believability, to smear the organisation, or to make the organisation less trustworthy. - -* **Belongs to tactic stage**: TA16 - - -| Incident | Descriptions given for this incident | -| -------- | -------------------- | - - - -| Counters | Response types | -| -------- | -------------- | - - -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0099.004.md b/generated_pages/techniques/T0099.004.md deleted file mode 100644 index 7233b1b..0000000 --- a/generated_pages/techniques/T0099.004.md +++ /dev/null @@ -1,19 +0,0 @@ -# Technique T0099.004: Impersonate Existing Media Outlet - -* **Summary**: A situation where a threat actor styles their online assets or content to mimic an existing media outlet. - -This can be done to take advantage of peoples’ trust in the outlet to increase narrative believability, to smear the outlet, or to make the outlet less trustworthy. - -* **Belongs to tactic stage**: TA16 - - -| Incident | Descriptions given for this incident | -| -------- | -------------------- | - - - -| Counters | Response types | -| -------- | -------------- | - - -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0099.005.md b/generated_pages/techniques/T0099.005.md deleted file mode 100644 index bc68b21..0000000 --- a/generated_pages/techniques/T0099.005.md +++ /dev/null @@ -1,17 +0,0 @@ -# Technique T0099.005: Impersonate Existing Official - -* **Summary**: A situation where a threat actor styles their online assets or content to impersonate an official (including government officials, organisation officials, etc). - -* **Belongs to tactic stage**: TA16 - - -| Incident | Descriptions given for this incident | -| -------- | -------------------- | - - - -| Counters | Response types | -| -------- | -------------- | - - -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0099.006.md b/generated_pages/techniques/T0099.006.md deleted file mode 100644 index 9c2df73..0000000 --- a/generated_pages/techniques/T0099.006.md +++ /dev/null @@ -1,17 +0,0 @@ -# Technique T0099.006: Impersonate Existing Influencer - -* **Summary**: A situation where a threat actor styles their online assets or content to impersonate an influencer or celebrity, typically to exploit users’ existing faith in the impersonated target. - -* **Belongs to tactic stage**: TA16 - - -| Incident | Descriptions given for this incident | -| -------- | -------------------- | - - - -| Counters | Response types | -| -------- | -------------- | - - -DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0104.002.md b/generated_pages/techniques/T0104.002.md index c1edf21..ff080b3 100644 --- a/generated_pages/techniques/T0104.002.md +++ b/generated_pages/techniques/T0104.002.md @@ -1,21 +1,13 @@ # Technique T0104.002: Dating App -* **Summary**: “Dating App” refers to any platform (or platform feature) in which the ostensive purpose is for users to develop a physical/romantic relationship with other users. - -Threat Actors can exploit users’ quest for love to trick them into doing things like revealing sensitive information or giving them money. - -Examples include Tinder, Bumble, Grindr, Facebook Dating, Tantan, Badoo, Plenty of Fish, hinge, LOVOO, OkCupid, happn, and Mamba. +* **Summary**: “Dating App” refers to any platform (or platform feature) in which the ostensive purpose is for users to develop a physical/romantic relationship with other users.

Threat Actors can exploit users’ quest for love to trick them into doing things like revealing sensitive information or giving them money.

Examples include Tinder, Bumble, Grindr, Facebook Dating, Tantan, Badoo, Plenty of Fish, hinge, LOVOO, OkCupid, happn, and Mamba.

Associated Techniques and Sub-techniques
T0097.109: Romantic Suitor Persona: Analysts can use this sub-technique for tagging cases where an account presents itself as seeking a romantic or physical connection with another person. * **Belongs to tactic stage**: TA07 | Incident | Descriptions given for this incident | | -------- | -------------------- | -| [I00064 Tinder nightmares: the promise and peril of political bots](../../generated_pages/incidents/I00064.md) | > In the days leading up to the UK’s [2017] general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes. - -> Tinder is a dating app where users swipe right to indicate attraction and interest in a potential partner. If both people swipe right on each other’s profile, a dialogue box becomes available for them to privately chat. After meeting their crowdfunding goal of only £500, the team built a tool which took over and operated the accounts of recruited Tinder-users. By upgrading the profiles to Tinder Premium, the team was able to place bots in any contested constituency across the UK. Once planted, the bots swiped right on all users in the attempt to get the largest number of matches and inquire into their voting intentions. - -This incident matches _T0104.002: Dating App,_ as users of Tinder were targeted in an attempt to persuade users to vote for a particular party in the upcoming election, rather than for the purpose of connecting those who were authentically interested in dating each other. | +| [I00064 Tinder nightmares: the promise and peril of political bots](../../generated_pages/incidents/I00064.md) | _"In the days leading up to the UK’s [2017] general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes._

_"Tinder is a dating app where users swipe right to indicate attraction and interest in a potential partner. If both people swipe right on each other’s profile, a dialogue box becomes available for them to privately chat. After meeting their crowdfunding goal of only £500, the team built a tool which took over and operated the accounts of recruited Tinder-users. By upgrading the profiles to Tinder Premium, the team was able to place bots in any contested constituency across the UK. Once planted, the bots swiped right on all users in the attempt to get the largest number of matches and inquire into their voting intentions."_

This incident matches T0104.002: Dating App, as users of Tinder were targeted in an attempt to persuade users to vote for a particular party in the upcoming election, rather than for the purpose of connecting those who were authentically interested in dating each other. | diff --git a/generated_pages/techniques/T0124.001.md b/generated_pages/techniques/T0124.001.md index a50a8ed..8477774 100644 --- a/generated_pages/techniques/T0124.001.md +++ b/generated_pages/techniques/T0124.001.md @@ -7,6 +7,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00082 Meta’s November 2021 Adversarial Threat Report ](../../generated_pages/incidents/I00082.md) | “[Meta] removed a network of accounts in Vietnam for violating our Inauthentic Behavior policy against mass reporting. They coordinated the targeting of activists and other people who publicly criticized the Vietnamese government and used false reports of various violations in an attempt to have these users removed from our platform. The people behind this activity relied primarily on authentic and duplicate accounts to submit hundreds — in some cases, thousands — of complaints against their targets through our abuse reporting flows.

“Many operators also maintained fake accounts — some of which were detected and disabled by our automated systems — to pose as their targets so they could then report the legitimate accounts as fake. They would frequently change the gender and name of their fake accounts to resemble the target individual. Among the most common claims in this misleading reporting activity were complaints of impersonation, and to a much lesser extent inauthenticity. The network also advertised abusive services in their bios and constantly evolved their tactics in an attempt to evade detection.“

In this example actors repurposed their accounts to impersonate targeted activists (T0097.103: Activist Persona, T0143.003: Impersonated Persona) in order to falsely report the activists’ legitimate accounts as impersonations (T0124.001: Report Non-Violative Opposing Content). | diff --git a/generated_pages/techniques/T0126.001.md b/generated_pages/techniques/T0126.001.md index 76f2c3b..f7d684e 100644 --- a/generated_pages/techniques/T0126.001.md +++ b/generated_pages/techniques/T0126.001.md @@ -7,6 +7,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00074 The Tactics & Tropes of the Internet Research Agency](../../generated_pages/incidents/I00074.md) | “A few press investigations have alluded to the [Russia’s Internet Research Agency]’s job ads. The extent of the human asset recruitment strategy is revealed in the organic data set. It is expansive, and was clearly a priority. Posts encouraging Americans to perform various types of tasks for IRA handlers appeared in Black, Left, and Right-targeted groups, though they were most numerous in the Black community. They included:

- Requests for contact with preachers from Black churches (Black_Baptist_Church)
- Offers of free counsellingcounseling to people with sexual addiction (Army of Jesus)
- Soliciting volunteers to hand out fliers
- Soliciting volunteers to teach self-defense classes
- Offering free self-defense classes (Black Fist/Fit Black)
- Requests for followers to attend political rallies
- Requests for photographers to document protests
- Requests for speakers at protests
- Requests to protest the Westborough Baptist Church (LGBT United)
- Job offers for designers to help design fliers, sites, Facebook sticker packs
- Requests for female followers to send photos for a calendar
- Requests for followers to send photos to be shared to the Page (Back the Badge)
- Soliciting videos for a YouTube contest called “Pee on Hillary”
- Encouraging people to apply to be part of a Black reality TV show
- Posting a wide variety of job ads (write for BlackMattersUS and others)
- Requests for lawyers to volunteer to assist with immigration cases”

This behaviour matches T0097.106: Recruiter Persona because the threat actors are presenting tasks for their target audience to complete in the style of a job posting (even though some of the tasks were presented as voluntary / unpaid efforts), including calls for people to attend political rallies (T0126.001: Call to Action to Attend). | diff --git a/generated_pages/techniques/T0129.006.md b/generated_pages/techniques/T0129.006.md index 9013831..06f643e 100644 --- a/generated_pages/techniques/T0129.006.md +++ b/generated_pages/techniques/T0129.006.md @@ -7,6 +7,8 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00075 How Russia Meddles Abroad for Profit: Cash, Trolls and a Cult Leader](../../generated_pages/incidents/I00075.md) | “Only three of the Russian operatives identified by local hires of the campaign responded to requests for comment. All acknowledged visiting Madagascar last year, but only one admitted working as a pollster on behalf of the president.

“The others said they were simply tourists. Pyotr Korolyov, described as a sociologist on one spreadsheet, spent much of the summer of 2018 and fall hunched over a computer, deep in polling data at La Résidence Ankerana, a hotel the Russians used as their headquarters, until he was hospitalized with the measles, according to one person who worked with him.

“In an email exchange, Mr. Korolyov confirmed that he had come down with the measles, but rejected playing a role in a Russian operation. He did defend the idea of one, though.

““Russia should influence elections around the world, the same way the United States influences elections,” he wrote. “Sooner or later Russia will return to global politics as a global player,” he added. “And the American establishment will just have to accept that.””

This behaviour matches T0129.006: Deny Involvement because the actors contacted by journalists denied that they had participated in election interference (in spite of the evidence to the contrary). | +| [I00093 China Falsely Denies Disinformation Campaign Targeting Canada’s Prime Minister](../../generated_pages/incidents/I00093.md) | “On October 23, Canada’s Foreign Ministry said it had discovered a disinformation campaign, likely tied to China, aimed at discrediting dozens of Canadian politicians, including Prime Minister Justin Trudeau.

“The ministry said the campaign took place in August and September. It used new and hijacked social media accounts to bulk-post messages targeting Canadian politicians (T0141.001: Acquire Compromised Account).

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

““Canada was a downright liar and disseminator of false information… Beijing has never meddled in another nation’s domestic affairs.”

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

“That is false.

“The Canadian government's report is based on an investigation conducted by its Rapid Response Mechanism cyber intelligence unit in cooperation with the social media platforms.

“The investigation exposed China’s disinformation campaign dubbed “Spamouflage” -- for its tactic of using “a network of new or hijacked social media accounts that posts and increases the number of propaganda messages across multiple social media platforms – including Facebook, X/Twitter, Instagram, YouTube, Medium, Reddit, TikTok, and LinkedIn.””

In this case a network of accounts attributed to China were identified operating on multiple platforms. The report was dismissed as false information by an official in the Chinese Embassy in Canada (T0143.001: Authentic Persona, T0097.111: Government Official Persona, T0129.006: Deny Involvement). | diff --git a/generated_pages/techniques/T0129.008.md b/generated_pages/techniques/T0129.008.md index db6f75c..75e5d30 100644 --- a/generated_pages/techniques/T0129.008.md +++ b/generated_pages/techniques/T0129.008.md @@ -7,6 +7,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00072 Behind the Dutch Terror Threat Video: The St. Petersburg "Troll Factory" Connection](../../generated_pages/incidents/I00072.md) | “The creator of Geopolitika[.]ru is Aleksandr Dugin, who was sanctioned by the United States Department of Treasury in 2015 for his role in the Eurasian Youth Union “for being responsible for or complicit in actions or policies that threaten the peace, security, stability, or sovereignty or territorial integrity of Ukraine.”

[...]

“Currently, the website geopolika[.]ru redirects directly to another partner website, Katehon.

“Katehon poses itself as a think tank focused on geopolitics in an English edition of its website. In contrast, in Russian, it states its aim to develop “ideological, political, diplomatic, economic and military strategy for Russia of the future” with a special role of religion. The president of Katehon’s supervisory board is Konstantin Malofeev, a Russian millionaire with connections to the Russian orthodox church and presidential administration, who founded Tsargrad TV, a known source of disinformation. Malofeev was sanctioned by the U.S. Department of Treasury and the European Union in 2014 for material support and financial backing of Russian-backed separatists in eastern Ukraine. Another known figure from the board is Sergei Glaziev, former advisor to Putin in 2012–2019. Dugin is also on the board in the Russian edition of the website, whereas he is omitted in English.”

In this example a website managed by an actor previously sanctioned by the US department of treasury has been configured to redirect to another website; Katehon (T0129.008: Redirect URLs).

Katehon presents itself as a geopolitical think tank in English (T0097.204: Think Tank Persona), but does not maintain this persona when presenting itself to a Russian speaking audience. | diff --git a/generated_pages/techniques/T0131.md b/generated_pages/techniques/T0131.md index 0ec99a5..d28b7c3 100644 --- a/generated_pages/techniques/T0131.md +++ b/generated_pages/techniques/T0131.md @@ -7,6 +7,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00084 Russia turns its diplomats into disinformation warriors](../../generated_pages/incidents/I00084.md) | “After the European Union banned Kremlin-backed media outlets and social media giants demoted their posts for peddling falsehoods about the war in Ukraine, Moscow has turned to its cadre of diplomats, government spokespeople and ministers — many of whom have extensive followings on social media — to promote disinformation about the conflict in Eastern Europe, according to four EU and United States officials.”

In this example authentic Russian government officials used their own accounts to promote false narratives (T0143.001: Authentic Persona, T0097.111: Government Official Persona).

The use of accounts managed by authentic Government / Diplomats to spread false narratives makes it harder for platforms to enforce content moderation, because of the political ramifications they may face for censoring elected officials (T0131: Exploit TOS/Content Moderation). For example, Twitter previously argued that official channels of world leaders are not removed due to the high public interest associated with their activities. | diff --git a/generated_pages/techniques/T0137.md b/generated_pages/techniques/T0137.md index b15cc10..a5d551a 100644 --- a/generated_pages/techniques/T0137.md +++ b/generated_pages/techniques/T0137.md @@ -7,6 +7,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00075 How Russia Meddles Abroad for Profit: Cash, Trolls and a Cult Leader](../../generated_pages/incidents/I00075.md) | “But while Russia’s efforts [at election interference] in the United States fit Moscow’s campaign to upend Western democracy and rattle Mr. Putin’s geopolitical rivals, the undertaking in Madagascar often seemed to have a much simpler objective: profit.

“Before the election, a Russian company that local officials and foreign diplomats say is controlled by Mr. Prigozhin acquired a major stake in a government-run company that mines chromium, a mineral valued for its use in stainless steel. The acquisition set off protests by workers complaining of unpaid wages, cancelledcanceled benefits and foreign intrusion into a sector that had been a source of national pride for Madagascar.

“It repeated a pattern in which Russia has swooped into African nations, hoping to reshape their politics for material gain. In the Central African Republic, a former Russian intelligence officer is the top security adviser to the country’s president, while companies linked to Mr. Prigozhin have spread across the nation, snapping up diamonds in both legal and illegal ways, according to government officials, warlords in the diamond trade and registration documents showing Mr. Prigozhin’s growing military and commercial footprint.

[...] “The [operation switched from supporting the incumbent candidate on realising he would lose the election]. After the Russians pirouetted to help Mr. Rajoelina — their former opponent — win the election, Mr. Prigozhin’s company was able to negotiate with the new government to keep control of the chromium mining operation, despite the worker protests, and Mr. Prigozhin’s political operatives remain stationed in the capital to this day.”

This behaviour matches T0137: Make Money because analysts have asserted that the identified influence operation was in part motivated by a goal to generate profit | diff --git a/generated_pages/techniques/T0139.002.md b/generated_pages/techniques/T0139.002.md index adf4b24..3db21a0 100644 --- a/generated_pages/techniques/T0139.002.md +++ b/generated_pages/techniques/T0139.002.md @@ -7,6 +7,7 @@ | Incident | Descriptions given for this incident | | -------- | -------------------- | +| [I00085 China’s large-scale media push: Attempts to influence Swedish media](../../generated_pages/incidents/I00085.md) | “Four media companies – Svenska Dagbladet, Expressen, Sveriges Radio, and Sveriges Television – stated that they had been contacted by the Chinese embassy on several occasions, and that they, for instance, had been criticized on their publications, both by letters and e-mails.

The media company Svenska Dagbladet, had been contacted on several occasions in the past two years, including via e-mails directly from the Chinese ambassador to Sweden. Several times, China and the Chinese ambassador had criticized the media company’s publications regarding the conditions in China. Individual reporters also reported having been subjected to criticism.

The tabloid Expressen had received several letters and e-mails from the embassy, e-mails containing criticism and threatening formulations regarding the coverage of the Swedish book publisher Gui Minhai, who has been imprisoned in China since 2015. Formulations such as “media tyranny” could be found in the e-mails.”

In this case, the Chinese ambassador is using their official role (T0143.001: Authentic Persona, T0097.111: Government Official Persona) to try to influence Swedish press. A government official trying to interfere in other countries' media activities could be a violation of press freedom. In this specific case, the Chinese diplomats are trying to silence criticism against China (T0139.002: Silence).” | diff --git a/generated_pages/techniques/T0141.001.md b/generated_pages/techniques/T0141.001.md index a0127b2..fe19511 100644 --- a/generated_pages/techniques/T0141.001.md +++ b/generated_pages/techniques/T0141.001.md @@ -1,23 +1,16 @@ # Technique T0141.001: Acquire Compromised Account -* **Summary**: Threat Actors can take over existing users’ accounts to distribute campaign content.  - -The actor may maintain the asset’s previous identity to capitalise on the perceived legitimacy its previous owner had cultivated. - -The actor may completely rebrand the account to exploit its existing reach, or relying on the account’s history to avoid more stringent automated content moderation rules applied to new accounts. - -See also [Mitre ATT&CK’s T1586 Compromise Accounts](https://attack.mitre.org/techniques/T1586/) for more technical information on how threat actors may achieve this objective. - -This Technique was previously called Compromise Legitimate Accounts, and used the ID T0011. +* **Summary**: Threat Actors can take over existing users’ accounts to distribute campaign content.

The actor may maintain the asset’s previous identity to capitalise on the perceived legitimacy its previous owner had cultivated.

The actor may completely rebrand the account to exploit its existing reach, or relying on the account’s history to avoid more stringent automated content moderation rules applied to new accounts.

See also [Mitre ATT&CK’s T1586 Compromise Accounts](https://attack.mitre.org/techniques/T1586/) for more technical information on how threat actors may achieve this objective.

This Technique was previously called Compromise Legitimate Accounts, and used the ID T0011. * **Belongs to tactic stage**: TA15 | Incident | Descriptions given for this incident | | -------- | -------------------- | -| [I00065 'Ghostwriter' Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned With Russian Security Interests](../../generated_pages/incidents/I00065.md) | > Overall, narratives promoted in the five operations appear to represent a concerted effort to discredit the ruling political coalition, widen existing domestic political divisions and project an image of coalition disunity in Poland. In each incident, content was primarily disseminated via Twitter, Facebook, and/ or Instagram accounts belonging to Polish politicians, all of whom have publicly claimed their accounts were compromised at the times the posts were made.   - -This example demonstrates how threat actors can use _T0141.001: Acquire Compromised Account_ to distribute inauthentic content while exploiting the legitimate account holder’s persona. | +| [I00064 Tinder nightmares: the promise and peril of political bots](../../generated_pages/incidents/I00064.md) | “In the days leading up to the UK’s [2019] general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes. [...]

“The activists maintain that the project was meant to foster democratic engagement. But screenshots of the bots’ activity expose a harsher reality. Images of conversations between real users and these bots, posted on i-D, Mashable, as well as on Fowler and Goodman’s public Twitter accounts, show that the bots did not identify themselves as automated accounts, instead posing as the user whose profile they had taken over. While conducting research for this story, it turned out that a number of [the reporters’ friends] living in Oxford had interacted with the bot in the lead up to the election and had no idea that it was not a real person.”

In this example people offered up their real accounts for the automation of political messaging; the actors convinced the users to give up access to their accounts to use in the operation (T0141.001: Acquire Compromised Account). The actors maintained the accounts’ existing persona, and presented themselves as potential romantic suitors for legitimate platform users (T0097:109 Romantic Suitor Persona, T0143.003: Impersonated Persona). | +| [I00065 'Ghostwriter' Influence Campaign: Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned With Russian Security Interests](../../generated_pages/incidents/I00065.md) | _”Overall, narratives promoted in the five operations appear to represent a concerted effort to discredit the ruling political coalition, widen existing domestic political divisions and project an image of coalition disunity in Poland. In each incident, content was primarily disseminated via Twitter, Facebook, and/ or Instagram accounts belonging to Polish politicians, all of whom have publicly claimed their accounts were compromised at the times the posts were made."_

This example demonstrates how threat actors can use _T0141.001: Acquire Compromised Account_ to distribute inauthentic content while exploiting the legitimate account holder’s persona. | +| [I00069 Uncharmed: Untangling Iran's APT42 Operations](../../generated_pages/incidents/I00069.md) | “Mandiant identified at least three clusters of infrastructure used by [Iranian state-sponsored cyber espionage actor] APT42 to harvest credentials from targets in the policy and government sectors, media organizations and journalists, and NGOs and activists. The three clusters employ similar tactics, techniques and procedures (TTPs) to target victim credentials (spear-phishing emails), but use slightly varied domains, masquerading patterns, decoys, and themes.

Cluster A: Posing as News Outlets and NGOs:
- Suspected Targeting: credentials of journalists, researchers, and geopolitical entities in regions of interest to Iran.
- Masquerading as: The Washington Post (U.S.), The Economist (UK), The Jerusalem Post (IL), Khaleej Times (UAE), Azadliq (Azerbaijan), and more news outlets and NGOs. This often involves the use of typosquatted domains like washinqtonpost[.]press.

“Mandiant did not observe APT42 target or compromise these organizations, but rather impersonate them.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, impersonated existing news organisations and NGOs (T0097.202 News Outlet Persona, T0097.207: NGO Persona, T0143.003: Impersonated Persona) in attempts to steal credentials from targets (T0141.001: Acquire Compromised Account), using elements of influence operations to facilitate their cyber attacks. | +| [I00071 Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland](../../generated_pages/incidents/I00071.md) | “The August 17 [2022] Telegram post [which contained a falsified letter from the Ukrainian Minister of Foreign Affairs asking Poland to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII] also contained screenshots of Facebook posts that appeared on two Facebook accounts belonging to Polish nationals Piotr Górka, an expert in the history of the Polish Air Force, and Dariusz Walusiak, a Polish historian and documentary maker. The Górka post suggested that he fully supported the Polish government’s decision to change Belwederska Street to Stepan Bandera Street.

“In a statement to the DFRLab, Górka said his account was accessed without his consent. “This is not my post loaded to my Facebook page,” he explained. “My site was hacked, some days ago.” At the time of publishing, Piotr Górka’s post and his Facebook account were no longer accessible.

“The post on Górka’s Facebook page was shared by Dariusz Walusiak’s Facebook account; the account also reposted it on the Facebook walls of more than twenty other Facebook users, including Adam Kalita, currently working at Krakow branch of the Institute of National Remembrance; Jan Kasprzyk, head of the Office for War Veterans and Victims of Oppression; and Alicja Kondraciuk, a Polish public figure living in Krakow.

“Walusiak’s Facebook account is also no longer accessible. Given his work on Polish history and identity, it seems highly unlikely he would support the Bandera measure; the DFRLab has also reached out to him for comment.

“The fact that Joker DPR’s Telegram post included screenshots of their Facebook posts raises the strong possibility that both Facebook accounts were compromised, and that hackers planted false statements on their pages that would seem out of character for them in order to gain further attention to the forged documents.”

In this example, threat actors used compromised accounts (T0141.001: Acquire Compromised Account) of Polish historians who have enough relevant knowledge to plausibly weigh in on the forged letter’s narrative (T0143.003: Impersonated Persona, T0097.101: Local Persona, T0097.108: Expert Persona). 

This matches T0097.108: Expert Persona because the impersonation exploited Górka and Walusiak’s existing personas as experts in Polish history. | diff --git a/generated_pages/techniques/T0141.002.md b/generated_pages/techniques/T0141.002.md index 1eca8d1..b820364 100644 --- a/generated_pages/techniques/T0141.002.md +++ b/generated_pages/techniques/T0141.002.md @@ -1,23 +1,13 @@ # Technique T0141.002: Acquire Compromised Website -* **Summary**: Threat Actors may take over existing websites to publish or amplify inauthentic narratives. This includes the defacement of websites, and cases where websites’ personas are maintained to add credence to threat actors’ narratives. - -See also [Mitre ATT&CK’s T1584 Compromise Infrastructure](https://attack.mitre.org/techniques/T1584/) for more technical information on how threat actors may achieve this objective. +* **Summary**: Threat Actors may take over existing websites to publish or amplify inauthentic narratives. This includes the defacement of websites, and cases where websites’ personas are maintained to add credence to threat actors’ narratives.

See also [Mitre ATT&CK’s T1584 Compromise Infrastructure](https://attack.mitre.org/techniques/T1584/) for more technical information on how threat actors may achieve this objective. * **Belongs to tactic stage**: TA15 | Incident | Descriptions given for this incident | | -------- | -------------------- | -| [I00066 The online war between Qatar and Saudi Arabia](../../generated_pages/incidents/I00066.md) | > In the early hours of 24 May 2017, a news story appeared on the website of Qatar's official news agency, QNA, reporting that the country's emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech. - -> […] - -> Qatar claimed that the QNA had been hacked. And they said the hack was designed to deliberately spread fake news about the country's leader and its foreign policies. The Qataris specifically blamed UAE, an allegation later repeated by a Washington Post report which cited US intelligence sources. The UAE categorically denied those reports. - -> But the story of the emir's speech unleashed a media free-for-all. Within minutes, Saudi and UAE-owned TV networks - Al Arabiya and Sky News Arabia - picked up on the comments attributed to al-Thani. Both networks accused Qatar of funding extremist groups and of destabilising the region. - -This incident demonstrates how threat actors used _T0141.002: Acquire Compromised Website_ to allow for an inauthentic narrative to be given a level of credibility which caused significant political fallout. | +| [I00066 The online war between Qatar and Saudi Arabia](../../generated_pages/incidents/I00066.md) | _"In the early hours of 24 May 2017, a news story appeared on the website of Qatar's official news agency, QNA, reporting that the country's emir, Sheikh Tamim bin Hamad al-Thani, had made an astonishing speech."_

_"[…]_

_"Qatar claimed that the QNA had been hacked. And they said the hack was designed to deliberately spread fake news about the country's leader and its foreign policies. The Qataris specifically blamed UAE, an allegation later repeated by a Washington Post report which cited US intelligence sources. The UAE categorically denied those reports._

_"But the story of the emir's speech unleashed a media free-for-all. Within minutes, Saudi and UAE-owned TV networks - Al Arabiya and Sky News Arabia - picked up on the comments attributed to al-Thani. Both networks accused Qatar of funding extremist groups and of destabilising the region."_

This incident demonstrates how threat actors used _T0141.002: Acquire Compromised Website_ to allow for an inauthentic narrative to be given a level of credibility which caused significant political fallout. | diff --git a/generated_pages/techniques/T0143.001.md b/generated_pages/techniques/T0143.001.md new file mode 100644 index 0000000..eeb6927 --- /dev/null +++ b/generated_pages/techniques/T0143.001.md @@ -0,0 +1,23 @@ +# Technique T0143.001: Authentic Persona + +* **Summary**: An individual or institution presenting a persona that legitimately matches who or what they are is presenting an authentic persona.

For example, an account which presents as being managed by a member of a country’s military, and is legitimately managed by that person, would be presenting an authentic persona (T0143.001: Authentic Persona, T0097.105: Military Personnel).

Sometimes people can authentically present themselves as who they are while still participating in malicious/inauthentic activity; a legitimate journalist (T0143.001: Authentic Persona, T0097.102: Journalist Persona) may accept bribes to promote products, or they could be tricked by threat actors into sharing an operation’s narrative. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00077 Fronts & Friends: An Investigation into Two Twitter Networks Linked to Russian Actors](../../generated_pages/incidents/I00077.md) | “The largest account [in the network of inauthentic accounts attributed to Russia] had 11,542 followers but only 8 had over 1,000 followers, and 11 had under ten. The accounts in aggregate had only 79,807 engagements across the entire tweet corpus, and appear to have been linked to the operations primarily via technical indicators rather than amplification or conversation between them. A few of the bios from accounts in the set claim to be journalists. Two profiles, belonging to an American activist and a Russian academic, were definitively real people; we do not have sufficient visibility into the technical indicators that led to their inclusion in the network and thus do not include them in our discussion.”

In this example the Stanford Internet Observatory has been provided data on two networks which, according to Twitter, showed signs of being affiliated with Russia’s Internet Research Agency (IRA). Two accounts investigated by Stanford were real people presenting their authentic personas, matching T0143.001: Authentic Persona.

Stanford didn’t have access to the technical indicators associating these accounts with the IRA, so they did not include data associated with these accounts for assessment. Analysts with access to platform logs may be able to uncover indicators of suspicious behaviour in accounts presenting authentic personas, using attribution methods unavailable to analysts working with open source data. | +| [I00078 Meta’s September 2020 Removal of Coordinated Inauthentic Behavior](../../generated_pages/incidents/I00078.md) | “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [I00079 Three thousand fake tanks](../../generated_pages/incidents/I00079.md) | “On January 4 [2017], a little-known news site based in Donetsk, Ukraine published an article claiming that the United States was sending 3,600 tanks to Europe as part of “the NATO war preparation against Russia”.

“Like much fake news, this story started with a grain of truth: the US was about to reinforce its armored units in Europe. However, the article converted literally thousands of other vehicles — including hundreds of Humvees and trailers — into tanks, building the US force into something 20 times more powerful than it actually was.

“The story caught on online. Within three days it had been repeated by a dozen websites in the United States, Canada and Europe, and shared some 40,000 times. It was translated into Norwegian; quoted, unchallenged, by Russian state news agency RIA Novosti; and spread among Russian-language websites.

“It was also an obvious fake, as any Google news search would have revealed. Yet despite its evident falsehood, it spread widely, and not just in directly Kremlin-run media. Tracking the spread of this fake therefore shines a light on the wider question of how fake stories are dispersed.”

Russian state news agency RIA Novosti presents themselves as a news outlet (T0097.202: News Outlet Persona). RIO Novosti is a real news outlet (T0143.001: Authentic Persona), but it did not carry out a basic investigation into the veracity of the narrative they published implicitly expected of institutions presenting themselves as news outlets.

We can’t know how or why this narrative ended up being published by RIA Novosti, but we know that it presented a distorted reality as authentic information (T0023: Distort Facts), claiming that the US was sending 3,600 tanks, instead of 3,600 vehicles which included ~180 tanks. | +| [I00084 Russia turns its diplomats into disinformation warriors](../../generated_pages/incidents/I00084.md) | “After the European Union banned Kremlin-backed media outlets and social media giants demoted their posts for peddling falsehoods about the war in Ukraine, Moscow has turned to its cadre of diplomats, government spokespeople and ministers — many of whom have extensive followings on social media — to promote disinformation about the conflict in Eastern Europe, according to four EU and United States officials.”

In this example authentic Russian government officials used their own accounts to promote false narratives (T0143.001: Authentic Persona, T0097.111: Government Official Persona).

The use of accounts managed by authentic Government / Diplomats to spread false narratives makes it harder for platforms to enforce content moderation, because of the political ramifications they may face for censoring elected officials (T0131: Exploit TOS/Content Moderation). For example, Twitter previously argued that official channels of world leaders are not removed due to the high public interest associated with their activities. | +| [I00085 China’s large-scale media push: Attempts to influence Swedish media](../../generated_pages/incidents/I00085.md) | “Four media companies – Svenska Dagbladet, Expressen, Sveriges Radio, and Sveriges Television – stated that they had been contacted by the Chinese embassy on several occasions, and that they, for instance, had been criticized on their publications, both by letters and e-mails.

The media company Svenska Dagbladet, had been contacted on several occasions in the past two years, including via e-mails directly from the Chinese ambassador to Sweden. Several times, China and the Chinese ambassador had criticized the media company’s publications regarding the conditions in China. Individual reporters also reported having been subjected to criticism.

The tabloid Expressen had received several letters and e-mails from the embassy, e-mails containing criticism and threatening formulations regarding the coverage of the Swedish book publisher Gui Minhai, who has been imprisoned in China since 2015. Formulations such as “media tyranny” could be found in the e-mails.”

In this case, the Chinese ambassador is using their official role (T0143.001: Authentic Persona, T0097.111: Government Official Persona) to try to influence Swedish press. A government official trying to interfere in other countries' media activities could be a violation of press freedom. In this specific case, the Chinese diplomats are trying to silence criticism against China (T0139.002: Silence).” | +| [I00093 China Falsely Denies Disinformation Campaign Targeting Canada’s Prime Minister](../../generated_pages/incidents/I00093.md) | “On October 23, Canada’s Foreign Ministry said it had discovered a disinformation campaign, likely tied to China, aimed at discrediting dozens of Canadian politicians, including Prime Minister Justin Trudeau.

“The ministry said the campaign took place in August and September. It used new and hijacked social media accounts to bulk-post messages targeting Canadian politicians (T0141.001: Acquire Compromised Account).

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

““Canada was a downright liar and disseminator of false information… Beijing has never meddled in another nation’s domestic affairs.”

“A Chinese Embassy in Canada spokesperson dismissed Canada’s accusation as baseless.

“That is false.

“The Canadian government's report is based on an investigation conducted by its Rapid Response Mechanism cyber intelligence unit in cooperation with the social media platforms.

“The investigation exposed China’s disinformation campaign dubbed “Spamouflage” -- for its tactic of using “a network of new or hijacked social media accounts that posts and increases the number of propaganda messages across multiple social media platforms – including Facebook, X/Twitter, Instagram, YouTube, Medium, Reddit, TikTok, and LinkedIn.””

In this case a network of accounts attributed to China were identified operating on multiple platforms. The report was dismissed as false information by an official in the Chinese Embassy in Canada (T0143.001: Authentic Persona, T0097.111: Government Official Persona, T0129.006: Deny Involvement). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0143.002.md b/generated_pages/techniques/T0143.002.md new file mode 100644 index 0000000..410085b --- /dev/null +++ b/generated_pages/techniques/T0143.002.md @@ -0,0 +1,29 @@ +# Technique T0143.002: Fabricated Persona + +* **Summary**: An individual or institution pretending to have a persona without any legitimate claim to that persona is presenting a fabricated persona, such as a person who presents themselves as a member of a country’s military without having worked in any capacity with the military (T0143.002: Fabricated Persona, T0097.105: Military Personnel).

Sometimes real people can present entirely fabricated personas; they can use real names and photos on social media while also pretending to have credentials or traits they don’t have in real life. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00069 Uncharmed: Untangling Iran's APT42 Operations](../../generated_pages/incidents/I00069.md) | “In March 2023, [Iranian state-sponsored cyber espionage actor] APT42 sent a spear-phishing email with a fake Google Meet invitation, allegedly sent on behalf of Mona Louri, a likely fake persona leveraged by APT42, claiming to be a human rights activist and researcher. Upon entry, the user was presented with a fake Google Meet page and asked to enter their credentials, which were subsequently sent to the attackers.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created an account which presented as a human rights activist (T0097.103: Activist Persona) and researcher (T0097.107: Researcher Persona). The analysts assert that it was likely the persona was fabricated (T0143.002: Fabricated Persona) | +| [I00074 The Tactics & Tropes of the Internet Research Agency](../../generated_pages/incidents/I00074.md) | “The Black Matters Facebook Page [operated by Russia’s Internet Research Agency] explored several visual brand identities, moving from a plain logo to a gothic typeface on Jan 19th, 2016. On February 4th, 2016, the person who ran the Facebook Page announced the launch of the website, blackmattersus[.]com, emphasizing media distrust and a desire to build Black independent media; [“I DIDN’T BELIEVE THE MEDIA / SO I BECAME ONE”]”

In this example an asset controlled by Russia’s Internet Research Agency began to present itself as a source of “Black independent media”, claiming that the media could not be trusted (T0097.208: Social Cause Persona, T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | +| [I00076 Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests](../../generated_pages/incidents/I00076.md) | “In addition to directly posting material on social media, we observed some personas in the network [of inauthentic accounts attributed to Iran] leverage legitimate print and online media outlets in the U.S. and Israel to promote Iranian interests via the submission of letters, guest columns, and blog posts that were then published. We also identified personas that we suspect were fabricated for the sole purpose of submitting such letters, but that do not appear to maintain accounts on social media. The personas claimed to be based in varying locations depending on the news outlets they were targeting for submission; for example, a persona that listed their location as Seattle, WA in a letter submitted to the Seattle Times subsequently claimed to be located in Baytown, TX in a letter submitted to The Baytown Sun. Other accounts in the network then posted links to some of these letters on social media.”

In this example actors fabricated individuals who lived in areas which were being targeted for influence through the use of letters to local papers (T0097.101: Local Persona, T0143.002: Fabricated Persona). | +| [I00077 Fronts & Friends: An Investigation into Two Twitter Networks Linked to Russian Actors](../../generated_pages/incidents/I00077.md) | “Two accounts [in the second network of accounts taken down by Twitter] appear to have been operated by Oriental Review and the Strategic Culture Foundation, respectively. Oriental Review bills itself as an “open source site for free thinking”, though it trades in outlandish conspiracy theories and posts content bylined by fake people. Stanford Internet Observatory researchers and investigative journalists have previously noted the presence of content bylined by fake “reporter” personas tied to the GRU-linked front Inside Syria Media Center, posted on Oriental Review.”

In an effort to make the Oriental Review’s stories appear more credible, the threat actors created fake journalists and pretended they wrote the articles on their website (aka “bylined” them).

In DISARM terms, they fabricated journalists (T0143.002: Fabricated Persona, T0097.003: Journalist Persona), and then used these fabricated journalists to increase perceived legitimacy (T0097.202: News Outlet Persona, T0143.002: Fabricated Persona). | +| [I00078 Meta’s September 2020 Removal of Coordinated Inauthentic Behavior](../../generated_pages/incidents/I00078.md) | “[Meta has] removed one Page, five Facebook accounts, one Group and three Instagram accounts for foreign or government interference which is coordinated inauthentic behavior on behalf of a foreign or government entity. This small network originated in Russia and focused primarily on Turkey and Europe, and also on the United States.

“This operation relied on fake accounts — some of which had been already detected and removed by our automated systems — to manage their Page and their Group, and to drive people to their site purporting to be an independent think-tank based primarily in Turkey. These accounts posed as locals based in Turkey, Canada and the US. They also recruited people to write for their website. This network had almost no following on our platforms when we removed it.”

Meta identified that a network of accounts originating in Russia were driving people off platform to a site which presented itself as a think-tank (T0097.204: Think Tank Persona). Meta did not make an attribution about the authenticity of this off-site think tank, so neither T0143.001: Authentic Persona or T0143.002: Fabricated Persona are used here.

Meta had access to technical data for accounts on its platform, and asserted that they were fabricated individuals posing as locals who recruited targets to write content for their website (T0097.101: Local Persona, T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | +| [I00079 Three thousand fake tanks](../../generated_pages/incidents/I00079.md) | “The sixth [website to repost a confirmed false narrative investigated in this report] is an apparent think tank, the Center for Global Strategic Monitoring. This website describes itself, in English apparently written by a non-native speaker, as a “nonprofit and nonpartisan research and analysis institution dedicated to providing insights of the think tank community publications”. It does, indeed, publish think-tank reports on issues such as Turkey and US-China relations; however, the reports are the work of other think tanks, often unattributed (the two mentioned in this sentence were actually produced by the Brookings Institution, although the website makes no mention of the fact). It also fails to provide an address, or any other contact details other than an email, and its (long) list of experts includes entries apparently copied and pasted from other institutions. Thus, the “think tank” website which shared the fake story appears to be a fake itself.” In this example a website which amplified a false narrative presented itself as a think tank (T0097.204: Think Tank Persona).

This is an entirely fabricated persona (T0143.002: Fabricated Persona); it republished content from other think tanks without attribution (T0084.002: Plagiarise Content) and fabricated experts (T0097.108: Expert Persona, T0143.002: Fabricated Persona) to make it more believable that they were a real think tank. | +| [I00080 Hundreds Of Propaganda Accounts Targeting Iran And Qatar Have Been Removed From Facebook](../../generated_pages/incidents/I00080.md) | “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler (noun) (linking verb) (noun/verb/adjective),” which appears to reveal the formula used to write Twitter bios for the accounts.”

The Jenny Powel account used in this influence operation presents as both a journalist and an activist (T0097.102: Journalist Persona, T0097.103: Activist Persona, T0143.002: Fabricated Persona). This example shows how threat actors can easily follow a template to present a fabricated persona to their target audience (T0144.002: Persona Template). | +| [I00081 Belarus KGB created fake accounts to criticize Poland during border crisis, Facebook parent company says](../../generated_pages/incidents/I00081.md) | “Meta said it also removed 31 Facebook accounts, four groups, two events and four Instagram accounts that it believes originated in Poland and targeted Belarus and Iraq. Those allegedly fake accounts posed as Middle Eastern migrants posting about the border crisis. Meta did not link the accounts to a specific group.

““These fake personas claimed to be sharing their own negative experiences of trying to get from Belarus to Poland and posted about migrants’ difficult lives in Europe,” Meta said. “They also posted about Poland’s strict anti-migrant policies and anti-migrant neo-Nazi activity in Poland. They also shared links to news articles criticizing the Belarusian government’s handling of the border crisis and off-platform videos alleging migrant abuse in Europe.””

In this example accounts falsely presented themselves as having local insight into the border crisis narrative (T0097.101: Local Persona, T0143.002: Fabricated Persona). | +| [I00086 #WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media](../../generated_pages/incidents/I00086.md) | In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”.

“A core component of the detection methodology was applying qualitative linguistic analysis. This involved checking the fingerprint of language, syntax, and style used in the comments and profile of the suspected account. Each account bio consistently incorporated a combination of specific elements: emojis, nationality, location, educational institution or occupation, age, and a personal quote, sports team or band. The recurrence of this specific formula across multiple accounts hinted at a standardized template for bio construction.”

This example shows how actors can follow a templated formula to present a persona on social media platforms (T0143.002: Fabricated Persona, T0144.002: Persona Template). | +| [I00089 Hackers Use Fake Facebook Profiles of Attractive Women to Spread Viruses, Steal Passwords](../../generated_pages/incidents/I00089.md) | “On Facebook, Rita, Alona and Christina appeared to be just like the millions of other U.S citizens sharing their lives with the world. They discussed family outings, shared emojis and commented on each other's photographs.

“In reality, the three accounts were part of a highly-targeted cybercrime operation, used to spread malware that was able to steal passwords and spy on victims.

“Hackers with links to Lebanon likely ran the covert scheme using a strain of malware dubbed "Tempting Cedar Spyware," according to researchers from Prague-based anti-virus company Avast, which detailed its findings in a report released on Wednesday.

“In a honey trap tactic as old as time, the culprits' targets were mostly male, and lured by fake attractive women. 

“In the attack, hackers would send flirtatious messages using Facebook to the chosen victims, encouraging them to download a second , booby-trapped, chat application known as Kik Messenger to have "more secure" conversations. Upon analysis, Avast experts found that "many fell for the trap.””

In this example threat actors took on the persona of a romantic suitor on Facebook, directing their targets to another platform (T0097:109 Romantic Suitor Persona, T0145.006: Attractive Person Account Imagery, T0143.002: Fabricated Persona). | +| [I00091 Facebook uncovers Chinese network behind fake expert](../../generated_pages/incidents/I00091.md) | “Earlier in July [2021], an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China.

“State media outlets, including CGTN, Shanghai Daily and Global Times, had cited the so-called biologist based on his Facebook profile.

“However, the Swiss embassy said in August that the person likely did not exist, as the Facebook account was opened only two weeks prior to its first post and only had three friends.

“It added "there was no registry of a Swiss citizen with the name "Wilson Edwards" and no academic articles under the name", and urged Chinese media outlets to take down any mention of him.

[...]

“It also said that his profile photo also appeared to have been generated using machine-learning capabilities.”

In this example an account created on Facebook presented itself as a Swiss biologist to present a narrative related to COVID-19 (T0143.002: Fabricated Persona, T0097.106: Researcher Persona). It used an AI-Generated profile picture to disguise itself (T0145.002: AI-Generated Account Imagery). | +| [I00095 Meta: Chinese disinformation network was behind London front company recruiting content creators](../../generated_pages/incidents/I00095.md) | “A Chinese disinformation network operating fictitious employee personas across the internet used a front company in London to recruit content creators and translators around the world, according to Meta.

“The operation used a company called London New Europe Media, registered to an address on the upmarket Kensington High Street, that attempted to recruit real people to help it produce content. It is not clear how many people it ultimately recruited.

“London New Europe Media also “tried to engage individuals to record English-language videos scripted by the network,” in one case leading to a recording criticizing the United States being posted on YouTube, said Meta”.

In this example a front company was used (T0097.205: Business Persona) to enable actors to recruit targets for producing content (T0097.106: Recruiter Persona, T0143.002: Fabricated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0143.003.md b/generated_pages/techniques/T0143.003.md new file mode 100644 index 0000000..1781a9c --- /dev/null +++ b/generated_pages/techniques/T0143.003.md @@ -0,0 +1,27 @@ +# Technique T0143.003: Impersonated Persona + +* **Summary**: Threat actors may impersonate existing individuals or institutions to conceal their network identity, add legitimacy to content, or harm the impersonated target’s reputation. This Technique covers situations where an actor presents themselves as another existing individual or institution.

This Technique was previously called Prepare Assets Impersonating Legitimate Entities and used the ID T0099.

Associated Techniques and Sub-techniques
T0097: Presented Persona: Analysts can use the sub-techniques of T0097: Presented Persona to categorise the type of impersonation. For example, a document developed by a threat actor which falsely presented as a letter from a government department could be documented using T0085.004: Develop Document, T0143.003: Impersonated Persona, and T0097.206: Government Institution Persona.
T0145.001: Copy Account Imagery: Actors may take existing accounts’ profile pictures as part of their impersonation efforts. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00064 Tinder nightmares: the promise and peril of political bots](../../generated_pages/incidents/I00064.md) | “In the days leading up to the UK’s [2019] general election, youths looking for love online encountered a whole new kind of Tinder nightmare. A group of young activists built a Tinder chatbot to co-opt profiles and persuade swing voters to support Labour. The bot accounts sent 30,000-40,000 messages to targeted 18-25 year olds in battleground constituencies like Dudley North, which Labour ended up winning by only 22 votes. [...]

“The activists maintain that the project was meant to foster democratic engagement. But screenshots of the bots’ activity expose a harsher reality. Images of conversations between real users and these bots, posted on i-D, Mashable, as well as on Fowler and Goodman’s public Twitter accounts, show that the bots did not identify themselves as automated accounts, instead posing as the user whose profile they had taken over. While conducting research for this story, it turned out that a number of [the reporters’ friends] living in Oxford had interacted with the bot in the lead up to the election and had no idea that it was not a real person.”

In this example people offered up their real accounts for the automation of political messaging; the actors convinced the users to give up access to their accounts to use in the operation (T0141.001: Acquire Compromised Account). The actors maintained the accounts’ existing persona, and presented themselves as potential romantic suitors for legitimate platform users (T0097:109 Romantic Suitor Persona, T0143.003: Impersonated Persona). | +| [I00068 Attempted Audio Deepfake Call Targets LastPass Employee](../../generated_pages/incidents/I00068.md) | “While reports of [...] deepfake calls targeting private companies are luckily still rare, LastPass itself experienced a deepfake attempt earlier today that we are sharing with the larger community to help raise awareness that this tactic is spreading and all companies should be on the alert. In our case, an employee received a series of calls, texts, and at least one voicemail featuring an audio deepfake from a threat actor impersonating our CEO via WhatsApp. As the attempted communication was outside of normal business communication channels and due to the employee’s suspicion regarding the presence of many of the hallmarks of a social engineering attempt (such as forced urgency), our employee rightly ignored the messages and reported the incident to our internal security team so that we could take steps to both mitigate the threat and raise awareness of the tactic both internally and externally.”

In this example attackers impersonated the CEO of LastPass (T0097.100: Individual Persona, T0143.003: Impersonated Persona), targeting one of its employees over WhatsApp (T0043.001: Use Encrypted Chat Apps) using deepfaked audio (T0088.001: Develop AI-Generated Audio (Deepfakes)). | +| [I00069 Uncharmed: Untangling Iran's APT42 Operations](../../generated_pages/incidents/I00069.md) | “[Iranian state-sponsored cyber espionage actor] APT42 cloud operations attack lifecycle can be described in details as follows:

- “Social engineering schemes involving decoys and trust building, which includes masquerading as legitimate NGOs and conducting ongoing correspondence with the target, sometimes lasting several weeks.
- The threat actor masqueraded as well-known international organizations in the legal and NGO fields and sent emails from domains typosquatting the original NGO domains, for example aspenlnstitute[.]org.
- The Aspen Institute became aware of this spoofed domain and collaborated with industry partners, including blocking it in SafeBrowsing, thus protecting users of Google Chrome and additional browsers.
- To increase their credibility, APT42 impersonated high-ranking personnel working at the aforementioned organizations when creating the email personas.
- APT42 enhanced their campaign credibility by using decoy material inviting targets to legitimate and relevant events and conferences. In one instance, the decoy material was hosted on an attacker-controlled SharePoint folder, accessible only after the victim entered their credentials. Mandiant did not identify malicious elements in the files, suggesting they were used solely to gain the victim’s trust.”

In this example APT42, an Iranian state-sponsored cyber espionage actor, created a domain impersonating the existing NGO The Aspen Institute (T0143.003: Impersonated Persona, T0097.207: NGO Persona). They increased the perceived legitimacy of the impersonation by also impersonating high-ranking employees of the NGO (T0097.100: Individual Persona, T0143.003: Impersonated Persona). | +| [I00070 Eli Lilly Clarifies It’s Not Offering Free Insulin After Tweet From Fake Verified Account—As Chaos Unfolds On Twitter](../../generated_pages/incidents/I00070.md) | “Twitter Blue launched [November 2022], giving any users who pay $8 a month the ability to be verified on the site, a feature previously only available to public figures, government officials and journalists as a way to show they are who they claim to be.

“[A day after the launch], an account with the handle @EliLillyandCo labeled itself with the name “Eli Lilly and Company,” and by using the same logo as the company in its profile picture and with the verification checkmark, was indistinguishable from the real company (the picture has since been removed and the account has labeled itself as a parody profile).

The parody account tweeted “we are excited to announce insulin is free now.””

In this example an account impersonated the pharmaceutical company Eli Lilly (T0097.205: Business Persona, T0143.003: Impersonated Persona) by copying its name, profile picture (T0145.001: Copy Account Imagery), and paying for verification. | +| [I00071 Russia-aligned hacktivists stir up anti-Ukrainian sentiments in Poland](../../generated_pages/incidents/I00071.md) | “The August 17 [2022] Telegram post [which contained a falsified letter from the Ukrainian Minister of Foreign Affairs asking Poland to rename Belwederska Street in Warsaw — the location of the Russian embassy building — as Stepan Bandera Street, in honor of the far-right nationalist who led the Ukrainian Insurgent Army during WWII] also contained screenshots of Facebook posts that appeared on two Facebook accounts belonging to Polish nationals Piotr Górka, an expert in the history of the Polish Air Force, and Dariusz Walusiak, a Polish historian and documentary maker. The Górka post suggested that he fully supported the Polish government’s decision to change Belwederska Street to Stepan Bandera Street.

“In a statement to the DFRLab, Górka said his account was accessed without his consent. “This is not my post loaded to my Facebook page,” he explained. “My site was hacked, some days ago.” At the time of publishing, Piotr Górka’s post and his Facebook account were no longer accessible.

“The post on Górka’s Facebook page was shared by Dariusz Walusiak’s Facebook account; the account also reposted it on the Facebook walls of more than twenty other Facebook users, including Adam Kalita, currently working at Krakow branch of the Institute of National Remembrance; Jan Kasprzyk, head of the Office for War Veterans and Victims of Oppression; and Alicja Kondraciuk, a Polish public figure living in Krakow.

“Walusiak’s Facebook account is also no longer accessible. Given his work on Polish history and identity, it seems highly unlikely he would support the Bandera measure; the DFRLab has also reached out to him for comment.

“The fact that Joker DPR’s Telegram post included screenshots of their Facebook posts raises the strong possibility that both Facebook accounts were compromised, and that hackers planted false statements on their pages that would seem out of character for them in order to gain further attention to the forged documents.”

In this example, threat actors used compromised accounts (T0141.001: Acquire Compromised Account) of Polish historians who have enough relevant knowledge to plausibly weigh in on the forged letter’s narrative (T0143.003: Impersonated Persona, T0097.101: Local Persona, T0097.108: Expert Persona). 

This matches T0097.108: Expert Persona because the impersonation exploited Górka and Walusiak’s existing personas as experts in Polish history. | +| [I00075 How Russia Meddles Abroad for Profit: Cash, Trolls and a Cult Leader](../../generated_pages/incidents/I00075.md) | “In the campaign’s final weeks, Pastor Mailhol said, the team of Russians made a request: Drop out of the race and support Mr. Rajoelina. He refused.

“The Russians made the same proposal to the history professor running for president, saying, “If you accept this deal you will have money” according to Ms. Rasamimanana, the professor’s campaign manager.

When the professor refused, she said, the Russians created a fake Facebook page that mimicked his official page and posted an announcement on it that he was supporting Mr. Rajoelina.”

In this example actors created online accounts styled to look like official pages to trick targets into thinking that the presidential candidate announced that they had dropped out of the election (T0097.110: Party Official Persona, T0143.003: Impersonated Persona) | +| [I00076 Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests](../../generated_pages/incidents/I00076.md) | “Some Twitter accounts in the network [of inauthentic accounts attributed to Iran] impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

“For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month”

[...]

“In another example, the account @ButlerJineea impersonated Jineea Butler, a 2018 candidate for New York’s 13th Congressional District, using a photograph of Butler for its profile picture and incorporating her campaign slogans into its background picture, as well as claiming in its Twitter bio to be a “US House candidate, NY-13” and linking to Butler’s website, jineeabutlerforcongress[.]com.”

In this example actors impersonated existing political candidates (T0097.110: Member of Political Party Persona, T0143.003: Impersonated Persona), strengthening the impersonation by copying legitimate accounts’ imagery (T0145.001: Copy Account Imagery), and copying its previous posts (T0084.002: Plagiarise Content). | +| [I00082 Meta’s November 2021 Adversarial Threat Report ](../../generated_pages/incidents/I00082.md) | “[Meta] removed a network of accounts in Vietnam for violating our Inauthentic Behavior policy against mass reporting. They coordinated the targeting of activists and other people who publicly criticized the Vietnamese government and used false reports of various violations in an attempt to have these users removed from our platform. The people behind this activity relied primarily on authentic and duplicate accounts to submit hundreds — in some cases, thousands — of complaints against their targets through our abuse reporting flows.

“Many operators also maintained fake accounts — some of which were detected and disabled by our automated systems — to pose as their targets so they could then report the legitimate accounts as fake. They would frequently change the gender and name of their fake accounts to resemble the target individual. Among the most common claims in this misleading reporting activity were complaints of impersonation, and to a much lesser extent inauthenticity. The network also advertised abusive services in their bios and constantly evolved their tactics in an attempt to evade detection.“

In this example actors repurposed their accounts to impersonate targeted activists (T0097.103: Activist Persona, T0143.003: Impersonated Persona) in order to falsely report the activists’ legitimate accounts as impersonations (T0124.001: Report Non-Violative Opposing Content). | +| [I00087 Challenging Truth and Trust: A Global Inventory of Organized Social Media Manipulation](../../generated_pages/incidents/I00087.md) | “Another actor operating in China is the American-based company Devumi. Most of the Twitter accounts managed by Devumi resemble real people, and some are even associated with a kind of large-scale social identity theft. At least 55,000 of the accounts use the names, profile pictures, hometowns and other personal details of real Twitter users, including minors, according to The New York Times (Confessore et al., 2018)).”

In this example accounts impersonated real locals while spreading operation narratives (T0143.003: Impersonated Persona, T0097.101: Local Persona). The impersonation included stealing the legitimate accounts’ profile pictures (T0145.001: Copy Account Imagery). | +| [I00094 A glimpse inside a Chinese influence campaign: How bogus news websites blur the line between true and false](../../generated_pages/incidents/I00094.md) | Researchers identified websites managed by a Chinese marketing firm which presented themselves as news organisations.

“On its official website, the Chinese marketing firm boasted that they were in contact with news organizations across the globe, including one in South Korea called the “Chungcheng Times.” According to the joint team, this outlet is a fictional news organization created by the offending company. The Chinese company sought to disguise the site’s true identity and purpose by altering the name attached to it by one character—making it very closely resemble the name of a legitimate outlet operating out of Chungchengbuk-do.

“The marketing firm also established a news organization under the Korean name “Gyeonggido Daily,” which closely resembles legitimate news outlets operating out of Gyeonggi province such as “Gyeonggi Daily,” “Daily Gyeonggi Newspaper,” and “Gyeonggi N Daily.” One of the fake news sites was named “Incheon Focus,” a title that could be easily mistaken for the legitimate local news outlet, “Focus Incheon.” Furthermore, the Chinese marketing company operated two fake news sites with names identical to two separate local news organizations, one of which ceased operations in December 2022.

“In total, fifteen out of eighteen Chinese fake news sites incorporated the correct names of real regions in their fake company names. “If the operators had created fake news sites similar to major news organizations based in Seoul, however, the intended deception would have easily been uncovered,” explained Song Tae-eun, an assistant professor in the Department of National Security & Unification Studies at the Korea National Diplomatic Academy, to The Readable. “There is also the possibility that they are using the regional areas as an attempt to form ties with the local community; that being the government, the private sector, and religious communities.””

The firm styled their news site to resemble existing local news outlets in their target region (T0097.201: Local Institution Persona, T0097.202: News Outlet Persona, T0143.003: Impersonated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0143.004.md b/generated_pages/techniques/T0143.004.md new file mode 100644 index 0000000..622afd9 --- /dev/null +++ b/generated_pages/techniques/T0143.004.md @@ -0,0 +1,18 @@ +# Technique T0143.004: Parody Persona + +* **Summary**: Parody is a form of artistic expression that imitates the style or characteristics of a particular work, genre, or individual in a humorous or satirical way, often to comment on or critique the original work or subject matter. People may present as parodies to create humour or make a point by exaggerating or altering elements of the original, while still maintaining recognizable elements.

The use of parody is not an indication of inauthentic or malicious behaviour; parody allows people to present ideas or criticisms in a comedic or exaggerated manner, softening the impact of sensitive or contentious topics. Because parody is often protected as a form of free speech or artistic expression, it provides a legal and social framework for discussing controversial issues.

However, parody personas may be perceived as authentic personas, leading to people mistakenly believing that a parody account’s statements represent the real opinions of a parodied target. Threat actors may also use the guise of parody to spread campaign content. Parody personas may disclaim that they are operating as a parody, however this is not always the case, and is not always given prominence.

Associated Techniques and Sub-techniques T0097: Presented Persona: Analysts can use the sub-techniques of T0097: Presented Persona to categorise the type of parody. For example, an account presenting as a parody of a business could be documented using T0097.205: Business Persona and T0143.003: Parody Persona.
T0145.001: Copy Account Imagery: Actors may take existing accounts’ profile pictures as part of their parody efforts. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00067 Understanding Information disorder](../../generated_pages/incidents/I00067.md) | “A 2019 case in the US involved a Republican political operative who created a parody site designed to look like Joe Biden’s official website as the former vice president was campaigning to be the Democratic nominee for the 2020 presidential election. With a URL of joebiden[.]info, the parody site was indexed by Google higher than Biden’s official site, joebiden[.]com, when he launched his campaign in April 2019. The operative, who previously had created content for Donald Trump, said he did not create the site for the Trump campaign directly.

“The opening line on the parody site reads: “Uncle Joe is back and ready to take a hands-on approach to America’s problems!” It is full of images of Biden kissing and hugging young girls and women. At the bottom of the page a statement reads: “This site is political commentary and parody of Joe Biden’s Presidential campaign website. This is not Joe Biden’s actual website. It is intended for entertainment and political commentary only.””

In this example a website was created which claimed to be a parody of Joe Biden’s official website (T0143.004: Parody Persona).

Although the website was a parody, it ranked higher than Joe Biden’s real website on Google search. | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0143.md b/generated_pages/techniques/T0143.md new file mode 100644 index 0000000..4142f8d --- /dev/null +++ b/generated_pages/techniques/T0143.md @@ -0,0 +1,17 @@ +# Technique T0143: Persona Legitimacy + +* **Summary**: This Technique contains sub-techniques which analysts can use to assert whether an account is presenting an authentic, fabricated, or parody persona:

T0143.001: Authentic Persona
T0143.002: Fabricated Persona
T0143.003: Impersonated Persona
T0143.004: Parody Persona + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0144.001.md b/generated_pages/techniques/T0144.001.md new file mode 100644 index 0000000..f146380 --- /dev/null +++ b/generated_pages/techniques/T0144.001.md @@ -0,0 +1,18 @@ +# Technique T0144.001: Present Persona across Platforms + +* **Summary**: This sub-technique covers situations where analysts have identified the same persona being presented across multiple platforms.

Having multiple accounts presenting the same persona is not an indicator of inauthentic behaviour; many people create accounts and present as themselves on multiple platforms. However, threat actors are known to present the same persona across multiple platforms, benefiting from an increase in perceived legitimacy. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00077 Fronts & Friends: An Investigation into Two Twitter Networks Linked to Russian Actors](../../generated_pages/incidents/I00077.md) | “Approximately one-third of the suspended accounts [in the network of inauthentic accounts attributed to Russia] tweeted primarily about Syria, in English, Russian, and Arabic; many accounts tweeted in all three languages. The themes these accounts pushed will be familiar to anyone who has studied Russian overt or covert information operations about Syria: 

- Praising Russia’s role in Syria; claiming Russia was killing terrorists in Syria and highlighting Russia’s humanitarian aid
- Criticizing the role of the Turkey and the US in Syria; claiming the US killed civilians in Syria
- Criticizing the White Helmets, and claiming that they worked with Westerners to created scenes to make it look like the Syrian government used chemical weapons

“The two most prominent Syria accounts were @Syria_FreeNews and @PamSpenser. 

“@Syria_FreeNews had 20,505 followers and was created on April 6, 2017. The account’s bio said “Exclusive information about Middle East and Northern Africa countries events. BreaKing news from the scene.””

This behaviour matches T0097.202: News Outlet Persona because the account @Syrira_FreeNews presented itself as a news outlet in its name, bio, and branding, across all websites on which the persona had been established (T0144.001: Persona Presented across Platforms). Twitter’s technical indicators allowed them to attribute the account “can be reliably tied to Russian state actors”. Because of this we can assert that the persona is entirely fabricated (T0143.002: Fabricated Persona); this is not a legitimate news outlet providing information about Syria, it’s an asset controlled by Russia publishing narratives beneficial to their agenda. | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0144.002.md b/generated_pages/techniques/T0144.002.md new file mode 100644 index 0000000..304ec72 --- /dev/null +++ b/generated_pages/techniques/T0144.002.md @@ -0,0 +1,19 @@ +# Technique T0144.002: Persona Template + +* **Summary**: Threat actors have been observed following a template when filling their accounts’ online profiles. This may be done to enable account holders to quickly present themselves as a real person with a targeted persona.

For example, an actor may be instructed to create many fabricated local accounts for use in an operation using a template of “[flag emojis], [location], [personal quote], [political party] supporter” in their account’s description.

Associated Techniques and Sub-techniques
T0143.002: Fabricated Persona: The use of a templated account biography in a collection of accounts may be an indicator that the personas have been fabricated. + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00080 Hundreds Of Propaganda Accounts Targeting Iran And Qatar Have Been Removed From Facebook](../../generated_pages/incidents/I00080.md) | “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler (noun) (linking verb) (noun/verb/adjective),” which appears to reveal the formula used to write Twitter bios for the accounts.”

The Jenny Powel account used in this influence operation presents as both a journalist and an activist (T0097.102: Journalist Persona, T0097.103: Activist Persona, T0143.002: Fabricated Persona). This example shows how threat actors can easily follow a template to present a fabricated persona to their target audience (T0144.002: Persona Template). | +| [I00086 #WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media](../../generated_pages/incidents/I00086.md) | In this report accounts were identified as part of “a sophisticated and extensive coordinated network orchestrating a disinformation campaign targeting Israeli digital spaces since October 7th, 2023”.

“A core component of the detection methodology was applying qualitative linguistic analysis. This involved checking the fingerprint of language, syntax, and style used in the comments and profile of the suspected account. Each account bio consistently incorporated a combination of specific elements: emojis, nationality, location, educational institution or occupation, age, and a personal quote, sports team or band. The recurrence of this specific formula across multiple accounts hinted at a standardized template for bio construction.”

This example shows how actors can follow a templated formula to present a persona on social media platforms (T0143.002: Fabricated Persona, T0144.002: Persona Template). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0144.md b/generated_pages/techniques/T0144.md new file mode 100644 index 0000000..0fe47e5 --- /dev/null +++ b/generated_pages/techniques/T0144.md @@ -0,0 +1,17 @@ +# Technique T0144: Persona Legitimacy Evidence + +* **Summary**: This Technique contains behaviours which might indicate whether a persona is legitimate, a fabrication, or a parody.

For example, the same persona being consistently presented across platforms is consistent with how authentic users behave on social media. However, threat actors have also displayed this behaviour as a way to increase the perceived legitimacy of their fabricated personas (aka “backstopping”). + +* **Belongs to tactic stage**: TA16 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0145.001.md b/generated_pages/techniques/T0145.001.md new file mode 100644 index 0000000..55a8534 --- /dev/null +++ b/generated_pages/techniques/T0145.001.md @@ -0,0 +1,21 @@ +# Technique T0145.001: Copy Account Imagery + +* **Summary**: Account imagery copied from an existing account.

Analysts may use reverse image search tools to try to identify previous uses of account imagery (e.g. a profile picture) by other accounts.

Threat Actors have been known to copy existing accounts’ imagery to impersonate said accounts, or to provide imagery for unrelated accounts which aren’t intended to impersonate the original assets’ owner.

Associated Techniques and Sub-techniques
T0143.003: Impersonated Persona: Actors may copy existing accounts’ imagery in an attempt to impersonate them.
T0143.004: Parody Persona: Actors may copy existing accounts’ imagery as part of a parody of that account. + +* **Belongs to tactic stage**: TA15 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00070 Eli Lilly Clarifies It’s Not Offering Free Insulin After Tweet From Fake Verified Account—As Chaos Unfolds On Twitter](../../generated_pages/incidents/I00070.md) | “Twitter Blue launched [November 2022], giving any users who pay $8 a month the ability to be verified on the site, a feature previously only available to public figures, government officials and journalists as a way to show they are who they claim to be.

“[A day after the launch], an account with the handle @EliLillyandCo labeled itself with the name “Eli Lilly and Company,” and by using the same logo as the company in its profile picture and with the verification checkmark, was indistinguishable from the real company (the picture has since been removed and the account has labeled itself as a parody profile).

The parody account tweeted “we are excited to announce insulin is free now.””

In this example an account impersonated the pharmaceutical company Eli Lilly (T0097.205: Business Persona, T0143.003: Impersonated Persona) by copying its name, profile picture (T0145.001: Copy Account Imagery), and paying for verification. | +| [I00076 Network of Social Media Accounts Impersonates U.S. Political Candidates, Leverages U.S. and Israeli Media in Support of Iranian Interests](../../generated_pages/incidents/I00076.md) | “Some Twitter accounts in the network [of inauthentic accounts attributed to Iran] impersonated Republican political candidates that ran for House of Representatives seats in the 2018 U.S. congressional midterms. These accounts appropriated the candidates’ photographs and, in some cases, plagiarized tweets from the real individuals’ accounts. Aside from impersonating real U.S. political candidates, the behavior and activity of these accounts resembled that of the others in the network.

“For example, the account @livengood_marla impersonated Marla Livengood, a 2018 candidate for California’s 9th Congressional District, using a photograph of Livengood and a campaign banner for its profile and background pictures. The account began tweeting on Sept. 24, 2018, with its first tweet plagiarizing one from Livengood’s official account earlier that month”

[...]

“In another example, the account @ButlerJineea impersonated Jineea Butler, a 2018 candidate for New York’s 13th Congressional District, using a photograph of Butler for its profile picture and incorporating her campaign slogans into its background picture, as well as claiming in its Twitter bio to be a “US House candidate, NY-13” and linking to Butler’s website, jineeabutlerforcongress[.]com.”

In this example actors impersonated existing political candidates (T0097.110: Member of Political Party Persona, T0143.003: Impersonated Persona), strengthening the impersonation by copying legitimate accounts’ imagery (T0145.001: Copy Account Imagery), and copying its previous posts (T0084.002: Plagiarise Content). | +| [I00086 #WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media](../../generated_pages/incidents/I00086.md) | “In the wake of the Hamas attack on October 7th, the Israel Defense Forces (IDF) Information Security Department revealed a campaign of Instagram accounts impersonating young, attractive Israeli women who were actively engaging Israeli soldiers, attempting to extract information through direct messages.

[...]

“Some profiles underwent a reverse-image search of their photos to ascertain their authenticity. Many of the images searched were found to be appropriated from genuine social media profiles or sites such as Pinterest. When this was the case, the account was marked as confirmed to be inauthentic. One innovative method involves using photos that are initially frames from videos, which allows for evading reverse searches in most cases . This is seen in Figure 4, where an image uploaded by an inauthentic account was a screenshot taken from a TikTok video.”

In this example accounts associated with an influence operation used account imagery showing “young, attractive Israeli women” (T0145.006: Attractive Person Account Imagery), with some of these assets taken from existing accounts not associated with the operation (T0145.001: Copy Account Imagery). | +| [I00087 Challenging Truth and Trust: A Global Inventory of Organized Social Media Manipulation](../../generated_pages/incidents/I00087.md) | “In 2017, Tanya O'Carroll, a technology and human rights adviser for Amnesty International, published an investigation of the political impact of bots and trolls in Mexico (O’Carroll, 2017). An article by the BBC describes a video showing the operation of a "troll farm" in Mexico, where people were tweeting in support of Enrique Peña Nieto of the PRI in 2012 (Martinez, 2018).

“According to a report published by El País, the main target of parties’ online strategies are young people, including 14 million new voters who are expected to play a decisive role in the outcome of the July 2018 election (Peinado et al., 2018). Thus, one of the strategies employed by these bots was the use of profile photos of attractive people from other countries (Soloff, 2017).”

In this example accounts copied the profile pictures of attractive people from other countries (T0145.001: Copy Account Imagery, T0145.006: Attractive Person Account Imagery). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0145.002.md b/generated_pages/techniques/T0145.002.md new file mode 100644 index 0000000..3d5681a --- /dev/null +++ b/generated_pages/techniques/T0145.002.md @@ -0,0 +1,20 @@ +# Technique T0145.002: AI-Generated Account Imagery + +* **Summary**: AI Generated images used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived legitimacy. By using an AI-generated picture for this purpose, they are able to present themselves as a real person without compromising their own identity, or risking detection by taking a real person’s existing profile picture.

Associated Techniques and Sub-techniques
T0086.002: Develop AI-Generated Images (Deepfakes): Analysts should use this sub-technique to document use of AI generated imagery used to support narratives. + +* **Belongs to tactic stage**: TA15 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00082 Meta’s November 2021 Adversarial Threat Report ](../../generated_pages/incidents/I00082.md) | “[Meta] removed 41 Facebook accounts, five Groups, and four Instagram accounts for violating our policy against coordinated inauthentic behavior. This activity originated in Belarus and primarily targeted audiences in the Middle East and Europe.

“The core of this activity began in October 2021, with some accounts created as recently as mid-November. The people behind it used newly-created fake accounts — many of which were detected and disabled by our automated systems soon after creation — to pose as journalists and activists from the European Union, particularly Poland and Lithuania. Some of the accounts used profile photos likely generated using artificial intelligence techniques like generative adversarial networks (GAN). These fictitious personas posted criticism of Poland in English, Polish, and Kurdish, including pictures and videos about Polish border guards allegedly violating migrants’ rights, and compared Poland’s treatment of migrants against other countries’. They also posted to Groups focused on the welfare of migrants in Europe. A few accounts posted in Russian about relations between Belarus and the Baltic States.”

This example shows how accounts identified as participating in coordinated inauthentic behaviour were presenting themselves as journalists and activists while spreading operation narratives (T0097.102: Journalist Persona, T0097.103: Activist Persona).

Additionally, analysts at Meta identified accounts which were participating in coordinated inauthentic behaviour that had likely used AI-Generated images as their profile pictures (T0145.002: AI-Generated Account Imagery). | +| [I00088 Much Ado About ‘Somethings’ - China-Linked Influence Operation Endures Despite Takedown](../../generated_pages/incidents/I00088.md) | “The broader War of Somethings (WoS) network, so dubbed because all the Facebook pages and user accounts in the network are connected to “The War of Somethings” page,  behaves very similarly to previous Spamouflage campaigns.

“Spamouflage is a coordinated inatuhentic behaviour network attributed to the Chinese state.

“Despite the WoS network’s relative sophistication, there are tell-tale signs that it is an influence operation. Several user profile photos display signs of AI generation or do not match the profile’s listed gender.”

A network of accounts connected to the facebook page “The War of Somethings” used AI-generated images of people as their profile picture (T0145.002: AI-Generated Account Imagery). | +| [I00091 Facebook uncovers Chinese network behind fake expert](../../generated_pages/incidents/I00091.md) | “Earlier in July [2021], an account posing as a Swiss biologist called Wilson Edwards had made statements on Facebook and Twitter that the United States was applying pressure on the World Health Organization scientists who were studying the origins of Covid-19 in an attempt to blame the virus on China.

“State media outlets, including CGTN, Shanghai Daily and Global Times, had cited the so-called biologist based on his Facebook profile.

“However, the Swiss embassy said in August that the person likely did not exist, as the Facebook account was opened only two weeks prior to its first post and only had three friends.

“It added "there was no registry of a Swiss citizen with the name "Wilson Edwards" and no academic articles under the name", and urged Chinese media outlets to take down any mention of him.

[...]

“It also said that his profile photo also appeared to have been generated using machine-learning capabilities.”

In this example an account created on Facebook presented itself as a Swiss biologist to present a narrative related to COVID-19 (T0143.002: Fabricated Persona, T0097.106: Researcher Persona). It used an AI-Generated profile picture to disguise itself (T0145.002: AI-Generated Account Imagery). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0145.003.md b/generated_pages/techniques/T0145.003.md new file mode 100644 index 0000000..3cd545d --- /dev/null +++ b/generated_pages/techniques/T0145.003.md @@ -0,0 +1,18 @@ +# Technique T0145.003: Animal Account Imagery + +* **Summary**: Animal used in account imagery.

An influence operation might flesh out its account by uploading a profile picture, increasing its perceived authenticity.

People sometimes legitimately use images of animals as their profile pictures (e.g. of their pets), and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB. + +* **Belongs to tactic stage**: TA15 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00088 Much Ado About ‘Somethings’ - China-Linked Influence Operation Endures Despite Takedown](../../generated_pages/incidents/I00088.md) | “Beneath a video on Facebook about the war between Israel and Hamas, Lamonica Trout commented, “America is the war monger, the Jew’s own son!” She left identical comments beneath the same video on two other Facebook pages. Trout’s profile provides no information besides her name. It lists no friends, and there is not a single post or photograph in her feed. Trout’s profile photo shows an alligator.

“Lamonica Trout is likely an invention of the group behind Spamouflage, an ongoing, multi-year influence operation that promotes Beijing’s interests. Last year, Facebook’s parent company, Meta, took down 7,704 accounts and 954 pages it identified as part of the Spamouflage operation, which it described as the “largest known cross-platform influence operation [Meta had] disrupted to date.”2 Facebook’s terms of service prohibit a range of deceptive and inauthentic behaviors, including efforts to conceal the purpose of social media activity or the identity of those behind it.”

In this example an account attributed to a multi-year influence operation created the persona of Lamonica Trout in a Facebook account, which used an image of an animal in its profile picture (T0145.003: Animal Account Imagery). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0145.004.md b/generated_pages/techniques/T0145.004.md new file mode 100644 index 0000000..1280efe --- /dev/null +++ b/generated_pages/techniques/T0145.004.md @@ -0,0 +1,17 @@ +# Technique T0145.004: Scenery Account Imagery + +* **Summary**: Scenery or nature used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

People sometimes legitimately use images of scenery as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB. + +* **Belongs to tactic stage**: TA15 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0145.005.md b/generated_pages/techniques/T0145.005.md new file mode 100644 index 0000000..3f6d481 --- /dev/null +++ b/generated_pages/techniques/T0145.005.md @@ -0,0 +1,17 @@ +# Technique T0145.005: Illustrated Character Account Imagery + +* **Summary**: A cartoon/illustrated/anime character used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

People sometimes legitimately use images of illustrated characters as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB. + +* **Belongs to tactic stage**: TA15 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0145.006.md b/generated_pages/techniques/T0145.006.md new file mode 100644 index 0000000..ef9fb77 --- /dev/null +++ b/generated_pages/techniques/T0145.006.md @@ -0,0 +1,20 @@ +# Technique T0145.006: Attractive Person Account Imagery + +* **Summary**: Attractive person used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

Pictures of physically attractive people can benefit threat actors by increasing attention given to their posts.

People sometimes legitimately use images of attractive people as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.

Associated Techniques and Sub-techniques
T0097.109: Romantic Suitor Persona: Accounts presenting as a romantic suitor may use an attractive person in their account imagery.
T0104.002: Dating App: Analysts can use this sub-technique for tagging cases where an account has been identified as using a dating platform. + +* **Belongs to tactic stage**: TA15 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00086 #WeAreNotSafe – Exposing How a Post-October 7th Disinformation Network Operates on Israeli Social Media](../../generated_pages/incidents/I00086.md) | “In the wake of the Hamas attack on October 7th, the Israel Defense Forces (IDF) Information Security Department revealed a campaign of Instagram accounts impersonating young, attractive Israeli women who were actively engaging Israeli soldiers, attempting to extract information through direct messages.

[...]

“Some profiles underwent a reverse-image search of their photos to ascertain their authenticity. Many of the images searched were found to be appropriated from genuine social media profiles or sites such as Pinterest. When this was the case, the account was marked as confirmed to be inauthentic. One innovative method involves using photos that are initially frames from videos, which allows for evading reverse searches in most cases . This is seen in Figure 4, where an image uploaded by an inauthentic account was a screenshot taken from a TikTok video.”

In this example accounts associated with an influence operation used account imagery showing “young, attractive Israeli women” (T0145.006: Attractive Person Account Imagery), with some of these assets taken from existing accounts not associated with the operation (T0145.001: Copy Account Imagery). | +| [I00087 Challenging Truth and Trust: A Global Inventory of Organized Social Media Manipulation](../../generated_pages/incidents/I00087.md) | “In 2017, Tanya O'Carroll, a technology and human rights adviser for Amnesty International, published an investigation of the political impact of bots and trolls in Mexico (O’Carroll, 2017). An article by the BBC describes a video showing the operation of a "troll farm" in Mexico, where people were tweeting in support of Enrique Peña Nieto of the PRI in 2012 (Martinez, 2018).

“According to a report published by El País, the main target of parties’ online strategies are young people, including 14 million new voters who are expected to play a decisive role in the outcome of the July 2018 election (Peinado et al., 2018). Thus, one of the strategies employed by these bots was the use of profile photos of attractive people from other countries (Soloff, 2017).”

In this example accounts copied the profile pictures of attractive people from other countries (T0145.001: Copy Account Imagery, T0145.006: Attractive Person Account Imagery). | +| [I00089 Hackers Use Fake Facebook Profiles of Attractive Women to Spread Viruses, Steal Passwords](../../generated_pages/incidents/I00089.md) | “On Facebook, Rita, Alona and Christina appeared to be just like the millions of other U.S citizens sharing their lives with the world. They discussed family outings, shared emojis and commented on each other's photographs.

“In reality, the three accounts were part of a highly-targeted cybercrime operation, used to spread malware that was able to steal passwords and spy on victims.

“Hackers with links to Lebanon likely ran the covert scheme using a strain of malware dubbed "Tempting Cedar Spyware," according to researchers from Prague-based anti-virus company Avast, which detailed its findings in a report released on Wednesday.

“In a honey trap tactic as old as time, the culprits' targets were mostly male, and lured by fake attractive women. 

“In the attack, hackers would send flirtatious messages using Facebook to the chosen victims, encouraging them to download a second , booby-trapped, chat application known as Kik Messenger to have "more secure" conversations. Upon analysis, Avast experts found that "many fell for the trap.””

In this example threat actors took on the persona of a romantic suitor on Facebook, directing their targets to another platform (T0097:109 Romantic Suitor Persona, T0145.006: Attractive Person Account Imagery, T0143.002: Fabricated Persona). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0145.007.md b/generated_pages/techniques/T0145.007.md new file mode 100644 index 0000000..9d2d0b7 --- /dev/null +++ b/generated_pages/techniques/T0145.007.md @@ -0,0 +1,19 @@ +# Technique T0145.007: Stock Image Account Imagery + +* **Summary**: Stock images used in account imagery.

Stock image websites produce photos of people in various situations. Threat Actors can purchase or appropriate these images for use in their account imagery, increasing perceived legitimacy while avoiding the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery). 

Stock images tend to include physically attractive people, and this can benefit threat actors by increasing attention given to their posts.

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB. + +* **Belongs to tactic stage**: TA15 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | +| [I00080 Hundreds Of Propaganda Accounts Targeting Iran And Qatar Have Been Removed From Facebook](../../generated_pages/incidents/I00080.md) | “One example of a fake reporter account targeting Americans is “Jenny Powell,” a self-described Washington-based journalist, volunteer, and environmental activist. At first glance, Powell’s Twitter timeline looks like it belongs to a young and eager reporter amplifying her interests. But her profile photo is a stock image, and many of her links go to the propaganda sites.

“Powell, who joined the platform just last month, shares links to stories from major US news media outlets, retweets local news about Washington, DC, and regularly promotes content from The Foreign Code and The Economy Club. Other fake journalist accounts behaved similarly to Powell and had generic descriptions. One of the accounts, for a fake Bruce Lopez in Louisiana, has a bio that describes him as a “Correspondent Traveler noun|linking verb|noun/verb/adjective|,” which appears to reveal the formula used to write Twitter bios for the accounts.”

This behaviour matches T0145.007: Stock Image Account Imagery because the account was identified as using a stock image as its profile picture. | +| [I00088 Much Ado About ‘Somethings’ - China-Linked Influence Operation Endures Despite Takedown](../../generated_pages/incidents/I00088.md) | “The broader War of Somethings (WoS) network, so dubbed because all the Facebook pages and user accounts in the network are connected to “The War of Somethings” page,  behaves very similarly to previous Spamouflage campaigns. [Spamouflage is a coordinated inauthentic behaviour network attributed to the Chinese state.]

“Like other components of Spamouflage, the WoS network sometimes intersperses apolitical content with its more agenda-driven material. Many members post nearly identical comments at almost the same time. The text includes markers of automatic translation while error messages included as profile photos indicate the automated pulling of stock images.”

In this example analysts found an indicator of automated use of stock images in Facebook accounts; some of the accounts in the network appeared to have mistakenly uploaded error messages as profile pictures (T0145.007: Stock Image Account Imagery). The text posted by the accounts also appeared to have been translated using automation (T0085.008: Machine Translated Text). | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques/T0145.md b/generated_pages/techniques/T0145.md new file mode 100644 index 0000000..69daf21 --- /dev/null +++ b/generated_pages/techniques/T0145.md @@ -0,0 +1,17 @@ +# Technique T0145: Establish Account Imagery + +* **Summary**: Introduce visual elements to an account where a platform allows this functionality (e.g. a profile picture, a cover photo, etc). 

Threat Actors who don’t want to use pictures of themselves in their social media accounts may use alternate imagery to make their account appear more legitimate. + +* **Belongs to tactic stage**: TA15 + + +| Incident | Descriptions given for this incident | +| -------- | -------------------- | + + + +| Counters | Response types | +| -------- | -------------- | + + +DO NOT EDIT ABOVE THIS LINE - PLEASE ADD NOTES BELOW \ No newline at end of file diff --git a/generated_pages/techniques_index.md b/generated_pages/techniques_index.md index 28e85f3..51794df 100644 --- a/generated_pages/techniques_index.md +++ b/generated_pages/techniques_index.md @@ -32,18 +32,6 @@ TA15 -T0009 -Create Fake Experts -Stories planted or promoted in computational propaganda operations often make use of experts fabricated from whole cloth, sometimes specifically for the story itself. -TA16 - - -T0009.001 -Utilise Academic/Pseudoscientific Justifications -Utilise Academic/Pseudoscientific Justifications -TA16 - - T0010 Cultivate Ignorant Agents Cultivate propagandists for a cause, the goals of which are not fully comprehended, and who are used cynically by the leaders of the cause. Independent actors use social media and specialised web sites to strategically reinforce and spread messages compatible with their own. Their networks are infiltrated and used by state media disinformation organisations to amplify the state’s own disinformation strategies against target populations. Many are traffickers in conspiracy theories or hoaxes, unified by a suspicion of Western governments and mainstream media. Their narratives, which appeal to leftists hostile to globalism and military intervention and nationalists against immigration, are frequently infiltrated and shaped by state-controlled trolls and altered news items from agencies such as RT and Sputnik. Also know as "useful idiots" or "unwitting agents". @@ -154,9 +142,7 @@ T0039 Bait Influencer -Influencers are people on social media platforms who have large audiences.  - -Threat Actors can try to trick Influencers such as celebrities, journalists, or local leaders who aren’t associated with their campaign into amplifying campaign content. This gives them access to the Influencer’s audience without having to go through the effort of building it themselves, and it helps legitimise their message by associating it with the Influencer, benefitting from their audience’s trust in them. +Influencers are people on social media platforms who have large audiences.

Threat Actors can try to trick Influencers such as celebrities, journalists, or local leaders who aren’t associated with their campaign into amplifying campaign content. This gives them access to the Influencer’s audience without having to go through the effort of building it themselves, and it helps legitimise their message by associating it with the Influencer, benefitting from their audience’s trust in them. TA17 @@ -246,13 +232,7 @@ Threat Actors can try to trick Influencers such as celebrities, journalists, or T0049 Flood Information Space -Flooding sources of information (e.g. Social Media feeds) with a high volume of inauthentic content. - -This can be done to control/shape online conversations, drown out opposing points of view, or make it harder to find legitimate information.  - -Bots and/or patriotic trolls are effective tools to achieve this effect. - -This Technique previously used the name Flooding the Information Space. +Flooding sources of information (e.g. Social Media feeds) with a high volume of inauthentic content.

This can be done to control/shape online conversations, drown out opposing points of view, or make it harder to find legitimate information.

Bots and/or patriotic trolls are effective tools to achieve this effect.

This Technique previously used the name Flooding the Information Space. TA17 @@ -264,13 +244,7 @@ This Technique previously used the name Flooding the Information Space. T0049.002 Flood Existing Hashtag -Hashtags can be used by communities to collate information they post about particular topics (such as their interests, or current events) and users can find communities to join by exploring hashtags they’re interested in.  - -Threat actors can flood an existing hashtag to try to ruin hashtag functionality, posting content unrelated to the hashtag alongside it, making it a less reliable source of relevant information. They may also try to flood existing hashtags with campaign content, with the intent of maximising exposure to users. - -This Technique covers cases where threat actors flood existing hashtags with campaign content. - -This Technique covers behaviours previously documented by T0019.002: Hijack Hashtags, which has since been deprecated. This Technique was previously called Hijack Existing Hashtag. +Hashtags can be used by communities to collate information they post about particular topics (such as their interests, or current events) and users can find communities to join by exploring hashtags they’re interested in.

Threat actors can flood an existing hashtag to try to ruin hashtag functionality, posting content unrelated to the hashtag alongside it, making it a less reliable source of relevant information. They may also try to flood existing hashtags with campaign content, with the intent of maximising exposure to users.

This Technique covers cases where threat actors flood existing hashtags with campaign content.

This Technique covers behaviours previously documented by T0019.002: Hijack Hashtags, which has since been deprecated. This Technique was previously called Hijack Existing Hashtag. TA17 @@ -306,13 +280,7 @@ This Technique covers behaviours previously documented by T0019.002: Hijack Hash T0049.008 Generate Information Pollution -Information Pollution occurs when threat actors attempt to ruin a source of information by flooding it with lots of inauthentic or unreliable content, intending to make it harder for legitimate users to find the information they’re looking for.  - -This subtechnique's objective is to reduce exposure to target information, rather than promoting exposure to campaign content, for which the parent technique T0049 can be used.  - -Analysts will need to infer what the motive for flooding an information space was when deciding whether to use T0049 or T0049.008 to tag a case when an information space is flooded. If such inference is not possible, default to T0049. - -This Technique previously used the ID T0019. +Information Pollution occurs when threat actors attempt to ruin a source of information by flooding it with lots of inauthentic or unreliable content, intending to make it harder for legitimate users to find the information they’re looking for.

This sub-technique’s objective is to reduce exposure to target information, rather than promoting exposure to campaign content, for which the parent Technique T0049 can be used.

Analysts will need to infer what the motive for flooding an information space was when deciding whether to use T0049 or T0049.008 to tag a case when an information space is flooded. If such inference is not possible, default to T0049.

This Technique previously used the ID T0019. TA17 @@ -618,7 +586,7 @@ This Technique previously used the ID T0019. T0085.001 Develop AI-Generated Text -AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience. +AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.

Associated Techniques and Sub-techniques:
T0085.008: Machine Translated Text: Use this sub-technique when AI has been used to generate a translation of a piece of text. TA06 @@ -636,29 +604,25 @@ This Technique previously used the ID T0019. T0085.005 Develop Book -Produce text content in the form of a book.  - -This technique covers both e-books and physical books, however, the former is more easily deployed by threat actors given the lower cost to develop. +Produce text content in the form of a book. 

This technique covers both e-books and physical books, however, the former is more easily deployed by threat actors given the lower cost to develop. TA06 T0085.006 Develop Opinion Article -Opinion articles (aka “Op-Eds” or “Editorials”) are articles or regular columns flagged as “opinion” posted to news sources, and can be contributed by people outside the organisation.  - -Flagging articles as opinions allow news organisations to distinguish them from the typical expectations of objective news reporting while distancing the presented opinion from the organisation or its employees. - -The use of this technique is not by itself an indication of malicious or inauthentic content; Op-eds are a common format in media. However, threat actors exploit op-eds to, for example, submit opinion articles to local media to promote their narratives. - -Examples from the perspective of a news site involve publishing op-eds from perceived prestigious voices to give legitimacy to an inauthentic publication, or supporting causes by hosting op-eds from actors aligned with the organisation’s goals. +Opinion articles (aka “Op-Eds” or “Editorials”) are articles or regular columns flagged as “opinion” posted to news sources, and can be contributed by people outside the organisation. 

Flagging articles as opinions allow news organisations to distinguish them from the typical expectations of objective news reporting while distancing the presented opinion from the organisation or its employees.

The use of this technique is not by itself an indication of malicious or inauthentic content; Op-eds are a common format in media. However, threat actors exploit op-eds to, for example, submit opinion articles to local media to promote their narratives.

Examples from the perspective of a news site involve publishing op-eds from perceived prestigious voices to give legitimacy to an inauthentic publication, or supporting causes by hosting op-eds from actors aligned with the organisation’s goals. TA06 T0085.007 Create Fake Research -Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx. - -This Technique previously used the ID T0019.001 +Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx.

This Technique previously used the ID T0019.001. +TA06 + + +T0085.008 +Machine Translated Text +Text which has been translated into another language using machine translation tools, such as AI. TA06 @@ -676,7 +640,7 @@ This Technique previously used the ID T0019.001 T0086.002 Develop AI-Generated Images (Deepfakes) -Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures. +Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual’s face, body, voice, and physical gestures.

Associated Techniques and Sub-techniques:
T0145.002: AI-Generated Account Imagery: Analysts should use this sub-technique to document use of AI generated imagery in accounts’ profile pictures or other account imagery. TA06 @@ -885,20 +849,140 @@ This Technique previously used the ID T0019.001 T0097 -Create Personas -Creating fake people, often with accounts across multiple platforms. These personas can be as simple as a name, can contain slightly more background like location, profile pictures, backstory, or can be effectively backstopped with indicators like fake identity documents. +Present Persona +This Technique contains different types of personas commonly taken on by threat actors during influence operations.

Analysts should use T0097’s sub-techniques to document the type of persona which an account is presenting. For example, an account which describes itself as being a journalist can be tagged with T0097.102: Journalist Persona.

Personas presented by individuals include:

T0097.100: Individual Persona
T0097.101: Local Persona
T0097.102: Journalist Persona
T0097.103: Activist Persona
T0097.104: Hacktivist Persona
T0097.105: Military Personnel Persona
T0097.106: Recruiter Persona
T0097.107: Researcher Persona
T0097.108: Expert Persona
T0097.109: Romantic Suitor Persona
T0097.110: Party Official Persona
T0097.111: Government Official Persona
T0097.112: Government Employee Persona

This Technique also houses institutional personas commonly taken on by threat actors:

T0097.200: Institutional Persona
T0097.201: Local Institution Persona
T0097.202: News Outlet Persona
T0097.203: Fact Checking Organisation Persona
T0097.204: Think Tank Persona
T0097.205: Business Persona
T0097.206: Government Institution Persona
T0097.207: NGO Persona
T0097.208: Social Cause Persona

By using a persona, a threat actor is adding the perceived legitimacy of the persona to their narratives and activities. TA16 -T0097.001 -Produce Evidence for Persona -People may produce evidence which supports the persona they are deploying (T0097) (aka “backstopping” the persona). - -This Technique covers situations where evidence is developed or produced as part of an influence operation to increase the perceived legitimacy of a persona used during IO, including creating accounts for the same persona on multiple platforms. - -The use of personas (T0097), and providing evidence to improve people’s perception of one’s persona (T0097.001), are not necessarily malicious or inauthentic. However, sometimes people use personas to increase the perceived legitimacy of narratives for malicious purposes. - -This Technique was previously called Backstop Personas. +T0097.100 +Individual Persona +This sub-technique can be used to indicate that an entity is presenting itself as an individual. If the person is presenting themselves as having one of the personas listed below then these sub-techniques should be used instead, as they indicate both the type of persona they presented and that the entity presented itself as an individual:

T0097.101: Local Persona
T0097.102: Journalist Persona
T0097.103: Activist Persona
T0097.104: Hacktivist Persona
T0097.105: Military Personnel Persona
T0097.106: Recruiter Persona
T0097.107: Researcher Persona
T0097.108: Expert Persona
T0097.109: Romantic Suitor Persona
T0097.110: Party Official Persona
T0097.111: Government Official Persona
T0097.112: Government Employee Persona +TA16 + + +T0097.101 +Local Persona +A person with a local persona presents themselves as living in a particular geography or having local knowledge relevant to a narrative.

While presenting as a local is not an indication of inauthentic behaviour,  an influence operation may have its narratives amplified by people presenting as local to a target area. Threat actors can fabricate locals (T0143.002: Fabricated Persona, T0097.101: Local Persona) to add credibility to their narratives, or to misrepresent the real opinions of locals in the area.

People who are legitimate locals (T0143.001: Authentic Persona, T0097.101: Local Persona) can use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a local to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.201: Local Institution Persona: Analysts should use this sub-technique to catalogue cases where an institution is presenting as a local, such as a local news organisation or local business. +TA16 + + +T0097.102 +Journalist Persona +A person with a journalist persona presents themselves as a reporter or journalist delivering news, conducting interviews, investigations etc.

While presenting as a journalist is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as journalists. Threat actors can fabricate journalists to give the appearance of legitimacy, justifying the actor’s requests for interviews, etc (T0143.002: Fabricated Persona, T0097.102: Journalist Persona).

People who have legitimately developed a persona as a journalist (T0143.001: Authentic Persona, T0097.102: Journalist Persona) can use it for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a trusted journalist to provide legitimacy to a false narrative or be tricked into doing so without the journalist’s knowledge.

Associated Techniques and Sub-techniques
T0097.202: News Organisation Persona: People with a journalist persona may present as being part of a news organisation.
T0097.101: Local Persona: People with a journalist persona may present themselves as local reporters. +TA16 + + +T0097.103 +Activist Persona +A person with an activist persona presents themselves as an activist; an individual who campaigns for a political cause, organises related events, etc.

While presenting as an activist is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by people presenting as activists. Threat actors can fabricate activists to give the appearance of popular support for an evolving grassroots movement (see T0143.002: Fabricated Persona, T0097.103: Activist Persona).

People who are legitimate activists can use this persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as an activist to provide visibility to a false narrative or be tricked into doing so without their knowledge (T0143.001: Authentic Persona, T0097.103: Activist Persona).

Associated Techniques and Sub-techniques
T0097.104: Hacktivist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as someone engaged in activism who uses technical tools and methods, including building technical infrastructure and conducting offensive cyber operations, to achieve their goals.
T0097.207: NGO Persona: People with an activist persona may present as being part of an NGO.
T0097.208: Social Cause Persona: Analysts should use this sub-technique to catalogue cases where an online account is presenting as posting content related to a particular social cause, while not presenting as an individual. +TA16 + + +T0097.104 +Hacktivist Persona +A person with a hacktivist persona presents themselves as an activist who conducts offensive cyber operations or builds technical infrastructure for political purposes, rather than the financial motivations commonly attributed to hackers; hacktivists are hacker activists who use their technical knowledge to take political action.

Hacktivists can build technical infrastructure to support other activists, including secure communication channels and surveillance and censorship circumvention. They can also conduct DDOS attacks and other offensive cyber operations, aiming to take down digital assets or gain access to proprietary information. An influence operation may use hacktivist personas to support their operational narratives and legitimise their operational activities.

Fabricated Hacktivists are sometimes referred to as “Faketivists”.

Associated Techniques and Sub-techniques
T0097.103: Activist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as someone engaged in activism but doesn’t present themselves as using technical tools and methods to achieve their goals. +TA16 + + +T0097.105 +Military Personnel Persona +A person with a military personnel persona presents themselves as a serving member or veteran of a military organisation operating in an official capacity on behalf of a government.

While presenting as military personnel is not an indication of inauthentic behaviour,  an influence operation may have its narratives amplified by people presenting as military personnel. Threat actors can fabricate military personnel (T0143.002: Fabricated Persona, T0097.105: Military Personnel Persona) to pose as experts on military topics, or to discredit geopolitical adversaries by pretending to be one of their military personnel and spreading discontent.

People who have legitimately developed a military persona (T0143.001: Authentic Persona, T0097.105: Military Personnel Persona) can use it for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a member of the military to provide legitimacy to a false narrative or be tricked into doing so without their knowledge. +TA16 + + +T0097.106 +Recruiter Persona +A person with a recruiter persona presents themselves as a potential employer or provider of freelance work.

While presenting as a recruiter is not an indication of inauthentic behaviour, threat actors fabricate recruiters (T0143.002: Fabricated Persona, T0097.106: Recruiter Persona) to justify asking for personal information from their targets or to trick targets into working for the threat actors (without revealing who they are).

Associated Techniques and Sub-techniques
T0097.205: Business Persona: People with a recruiter persona may present as being part of a business which they are recruiting for. +TA16 + + +T0097.107 +Researcher Persona +A person with a researcher persona presents themselves as conducting research (e.g. for academic institutions, or think tanks), or having previously conducted research.

While presenting as a researcher is not an indication of inauthentic behaviour,  an influence operation may have its narratives amplified by people presenting as researchers. Threat actors can fabricate researchers (T0143.002: Fabricated Persona, T0097.107: Researcher Persona) to add credibility to their narratives.

People who are legitimate researchers (T0143.001: Authentic Persona, T0097.107: Researcher Persona) can use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as a Researcher to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.204: Think Tank Persona: People with a researcher persona may present as being part of a think tank.
T0097.108: Expert Persona: People who present as researching a given topic are likely to also present as having expertise in the area. +TA16 + + +T0097.108 +Expert Persona +A person with an expert persona presents themselves as having expertise or experience in a field. Commonly the persona’s expertise will be called upon to add credibility to a given narrative.

While presenting as an expert is not an indication of inauthentic behaviour,  an influence operation may have its narratives amplified by people presenting as experts. Threat actors can fabricate experts (T0143.002: Fabricated Persona, T0097.107: Researcher Persona) to add credibility to their narratives.

People who are legitimate experts (T0143.001: Authentic Persona, T0097.107: Researcher Persona) can make mistakes, use their persona for malicious purposes, or be exploited by threat actors. For example, someone could take money for using their position as an expert to provide legitimacy to a false narrative or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.107: Researcher Persona: People who present as experts may also present as conducting or having conducted research into their specialist subject.
T0097.204: Think Tank Persona: People with an expert persona may present as being part of a think tank. +TA16 + + +T0097.109 +Romantic Suitor Persona +A person with a romantic suitor persona presents themselves as seeking a romantic or physical connection with another person.

While presenting as seeking a romantic or physical connection is not an indication of inauthentic behaviour, threat actors can use dating apps, social media channels or dating websites to fabricate romantic suitors to lure targets they can blackmail, extract information from, deceive or trick into giving them money (T0143.002: Fabricated Persona, T0097.109: Romantic Suitor Persona).

Honeypotting in espionage and Big Butchering in scamming are commonly associated with romantic suitor personas.

Associated Techniques and Sub-techniques
T0104.002: Dating App: Analysts can use this sub-technique for tagging cases where an account has been identified as using a dating platform. +TA16 + + +T0097.110 +Party Official Persona +A person who presents as an official member of a political party, such as leaders of political parties, candidates standing to represent constituents, and campaign staff.

Presenting as an official of a political party is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in political parties to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.110: Party Official Persona). They may also impersonate existing officials of political parties (T0143.003: Impersonated Persona, T0097.110: Party Official Persona).

Legitimate members of political parties could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.110: Party Official Persona). For example, an electoral candidate could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting as a member of a government. 

Some party officials will also be government officials. For example, in the United Kingdom the head of government is commonly also the head of their political party.

Some party officials won’t be government officials. For example, members of a party standing in an election, or party officials who work outside of government (e.g. campaign staff). +TA16 + + +T0097.111 +Government Official Persona +A person who presents as an active or previous government official has the government official persona. These are officials serving in government, such as heads of government departments, leaders of countries, and members of government selected to represent constituents.

Presenting as a government official is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in government to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.111: Government Official Persona). They may also impersonate existing members of government (T0143.003: Impersonated Persona, T0097.111: Government Official Persona).

Legitimate government officials could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.111: Government Official Persona). For example, a government official could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.110: Party Official Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting as a member of a political party. 

Not all government officials are political party officials (such as outside experts brought into government) and not all political party officials are government officials (such as people standing for office who are not yet working in government).

T0097.206: Government Institution Persona: People presenting as members of a government may also represent a government institution which they are associated with.

T0097.112: Government Employee Persona: Analysts should use this sub-technique to document people presenting as professionals hired to serve in government institutions and departments, not officials selected to represent constituents, or assigned official roles in government (such as heads of departments). +TA16 + + +T0097.112 +Government Employee Persona +A person who presents as an active or previous civil servant has the government employee persona. These are professionals hired to serve in government institutions and departments, not officials selected to represent constituents, or assigned official roles in government (such as heads of departments).

Presenting as a government employee is not an indication of inauthentic behaviour, however threat actors may fabricate individuals who work in government to add credibility to their narratives (T0143.002: Fabricated Persona, T0097.112: Government Employee Persona). They may also impersonate existing government employees (T0143.003: Impersonated Persona, T0097.112: Government Employee Persona).

Legitimate government employees could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.112: Government Employee Persona). For example, a government employee could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Analysts should use this technique to document people who present as an active or previous government official, such as heads of government departments, leaders of countries, and members of government selected to represent constituents.
T0097.206: Government Institution Persona: People presenting as members of a government may also present a government institution which they are associated with. +TA16 + + +T0097.200 +Institutional Persona +This Technique can be used to indicate that an entity is presenting itself as an institution. If the organisation is presenting itself as having one of the personas listed below then these Techniques should be used instead, as they indicate both that the entity presented itself as an institution, and the type of persona they presented:

T0097.201: Local Institution Persona
T0097.202: News Outlet Persona
T0097.203: Fact Checking Organisation Persona
T0097.204: Think Tank Persona
T0097.205: Business Persona
T0097.206: Government Institution Persona
T0097.207: NGO Persona
T0097.208: Social Cause Persona +TA16 + + +T0097.201 +Local Institution Persona +Institutions which present themselves as operating in a particular geography, or as having local knowledge relevant to a narrative, are presenting a local institution persona.

While presenting as a local institution is not an indication of inauthentic behaviour, threat actors may present themselves as such (T0143.002: Fabricated Persona, T0097.201: Local Institution Persona) to add credibility to their narratives, or misrepresent the real opinions of locals in the area.

Legitimate local institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.201: Local Institution Persona). For example, a local institution could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.101: Local Persona: Institutions presenting as local may also present locals working within the organisation. +TA16 + + +T0097.202 +News Outlet Persona +An institution with a news outlet persona presents itself as an organisation which delivers new information to its target audience.

While presenting as a news outlet is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by news organisations. Threat actors can fabricate news organisations (T0143.002: Fabricated Persona, T0097.202: News Outlet Persona), or they can impersonate existing news outlets (T0143.003: Impersonated Persona, T0097.202: News Outlet Persona).

Legitimate news organisations could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.202: News Outlet Persona).

Associated Techniques and Sub-techniques
T0097.102: Journalist Persona: Institutions presenting as news outlets may also present journalists working within the organisation.
T0097.201: Local Institution Persona: Institutions presenting as news outlets may present as being a local news outlet.
T0097.203: Fact Checking Organisation Persona: Institutions presenting as news outlets may also deliver a fact checking service (e.g. The UK’s BBC News has the fact checking service BBC Verify). When an actor presents as the fact checking arm of a news outlet, they are presenting both a News Outlet Persona and a Fact Checking Organisation Persona. +TA16 + + +T0097.203 +Fact Checking Organisation Persona +An institution with a fact checking organisation persona presents itself as an organisation which produces reports which assess the validity of others’ reporting / statements.

While presenting as a fact checking organisation is not an indication of inauthentic behaviour, an influence operation may have its narratives amplified by fact checking organisations. Threat actors can fabricate fact checking organisations (T0143.002: Fabricated Persona, T0097.202: News Outlet Persona), or they can impersonate existing fact checking outlets (T0143.003: Impersonated Persona, T0097.202: News Outlet Persona).

Legitimate fact checking organisations could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.202: News Outlet Persona).

Associated Techniques and Sub-techniques
T0097.102: Journalist Persona: Institutions presenting as fact checking organisations may also present journalists working within the organisation.
T0097.202: News Outlet Persona: Fact checking organisations may present as operating as part of a larger news outlet (e.g. The UK’s BBC News has the fact checking service BBC Verify). When an actor presents as the fact checking arm of a news outlet, they are presenting both a News Outlet Persona and a Fact Checking Organisation Persona. +TA16 + + +T0097.204 +Think Tank Persona +An institution with a think tank persona presents itself as a think tank; an organisation that aims to conduct original research and propose new policies or solutions, especially for social and scientific problems.

While presenting as a think tank is not an indication of inauthentic behaviour, think tank personas are commonly used by threat actors as a front for their operational activity (T0143.002: Fabricated Persona, T0097.204: Think Tank Persona). They may be created to give legitimacy to narratives and allow them to suggest politically beneficial solutions to societal issues.

Legitimate think tanks could have a political bias that they may not be transparent about, they could use their persona for malicious purposes, or they could be exploited by threat actors (T0143.001: Authentic Persona, T0097.204: Think Tank Persona). For example, a think tank could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques
T0097.107: Researcher Persona: Institutions presenting as think tanks may also present researchers working within the organisation. +TA16 + + +T0097.205 +Business Persona +An institution with a business persona presents itself as a for-profit organisation which provides goods or services for a price.

While presenting as a business is not an indication of inauthentic behaviour, business personas may be used by threat actors as a front for their operational activity (T0143.002: Fabricated Persona, T0097.205: Business Persona).

Threat actors may also impersonate existing businesses (T0143.003: Impersonated Persona, T0097.205: Business Persona) to exploit their brand or cause reputational damage.

Legitimate businesses could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.205: Business Persona). For example, a business could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge. +TA16 + + +T0097.206 +Government Institution Persona +Institutions which present themselves as governments, or government ministries, are presenting a government institution persona.

While presenting as a government institution is not an indication of inauthentic behaviour, threat actors may impersonate existing government institutions as part of their operation (T0143.003: Impersonated Persona, T0097.206: Government Institution Persona), to add legitimacy to their narratives, or discredit the government.

Legitimate government institutions could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.206: Government Institution Persona). For example, a government institution could be used by elected officials to spread inauthentic narratives.

Associated Techniques and Sub-techniques
T0097.111: Government Official Persona: Institutions presenting as governments may also present officials working within the organisation.
T0097.112: Government Employee Persona: Institutions presenting as governments may also present employees working within the organisation. +TA16 + + +T0097.207 +NGO Persona +Institutions which present themselves as an NGO (Non-Governmental Organisation), an organisation which provides services or advocates for public policy (while not being directly affiliated with any government), are presenting an NGO persona.

While presenting as an NGO is not an indication of inauthentic behaviour, NGO personas are commonly used by threat actors (such as intelligence services) as a front for their operational activity (T0143.002: Fabricated Persona, T0097.207: NGO Persona). They are created to give legitimacy to the influence operation and potentially infiltrate grassroots movements

Legitimate NGOs could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.207: NGO Persona). For example, an NGO could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques:
T0097.103: Activist Persona: Institutions presenting as activist groups may also present activists working within the organisation. +TA16 + + +T0097.208 +Social Cause Persona +Online accounts which present themselves as focusing on a social cause are presenting the Social Cause Persona. Examples include accounts which post about current affairs, such as discrimination faced by minorities.

While presenting as an account invested in a social cause is not an indication of inauthentic behaviour, such personas have been used by threat actors to exploit peoples’ legitimate emotional investment regarding social causes that matter to them (T0143.002: Fabricated Persona, T0097.208: Social Cause Persona).

Legitimate accounts focused on a social cause could use their persona for malicious purposes, or be exploited by threat actors (T0143.001: Authentic Persona, T0097.208: Social Cause Persona). For example, the account holders could take money for using their position to provide legitimacy to a false narrative, or be tricked into doing so without their knowledge.

Associated Techniques and Sub-techniques:
T0097.103: Activist Persona: Analysts should use this sub-technique to catalogue cases where an individual is presenting themselves as an activist related to a social cause. Accounts with social cause personas do not present themselves as individuals, but may have activists controlling the accounts. TA16 @@ -920,52 +1004,6 @@ This Technique was previously called Backstop Personas. TA16 -T0099 -Impersonate Existing Entity -An influence operation may prepare assets impersonating existing entities (both organisations and people) to further conceal its network identity and add a layer of legitimacy to its operation content. Existing entities may include authentic news outlets, public figures, organisations, or state entities.  - -Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites.  - -An influence operation may use a wide variety of cyber techniques to impersonate a legitimate entity’s website or social media account.  - -This Technique was previously called Prepare Assets Impersonating Legitimate Entities. -TA16 - - -T0099.002 -Spoof/Parody Account/Site -An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organisations, or state entities. -TA16 - - -T0099.003 -Impersonate Existing Organisation -A situation where a threat actor styles their online assets or content to mimic an existing organisation. - -This can be done to take advantage of peoples’ trust in the organisation to increase narrative believability, to smear the organisation, or to make the organisation less trustworthy. -TA16 - - -T0099.004 -Impersonate Existing Media Outlet -A situation where a threat actor styles their online assets or content to mimic an existing media outlet. - -This can be done to take advantage of peoples’ trust in the outlet to increase narrative believability, to smear the outlet, or to make the outlet less trustworthy. -TA16 - - -T0099.005 -Impersonate Existing Official -A situation where a threat actor styles their online assets or content to impersonate an official (including government officials, organisation officials, etc). -TA16 - - -T0099.006 -Impersonate Existing Influencer -A situation where a threat actor styles their online assets or content to impersonate an influencer or celebrity, typically to exploit users’ existing faith in the impersonated target. -TA16 - - T0100 Co-Opt Trusted Sources An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: - National or local new outlets - Research or academic publications - Online blogs or websites @@ -1052,11 +1090,7 @@ This can be done to take advantage of peoples’ trust in the outlet to increase T0104.002 Dating App -“Dating App” refers to any platform (or platform feature) in which the ostensive purpose is for users to develop a physical/romantic relationship with other users. - -Threat Actors can exploit users’ quest for love to trick them into doing things like revealing sensitive information or giving them money. - -Examples include Tinder, Bumble, Grindr, Facebook Dating, Tantan, Badoo, Plenty of Fish, hinge, LOVOO, OkCupid, happn, and Mamba. +“Dating App” refers to any platform (or platform feature) in which the ostensive purpose is for users to develop a physical/romantic relationship with other users.

Threat Actors can exploit users’ quest for love to trick them into doing things like revealing sensitive information or giving them money.

Examples include Tinder, Bumble, Grindr, Facebook Dating, Tantan, Badoo, Plenty of Fish, hinge, LOVOO, OkCupid, happn, and Mamba.

Associated Techniques and Sub-techniques
T0097.109: Romantic Suitor Persona: Analysts can use this sub-technique for tagging cases where an account presents itself as seeking a romantic or physical connection with another person. TA07 @@ -1842,33 +1876,109 @@ Examples include Tinder, Bumble, Grindr, Facebook Dating, Tantan, Badoo, Plenty T0141.001 Acquire Compromised Account -Threat Actors can take over existing users’ accounts to distribute campaign content.  - -The actor may maintain the asset’s previous identity to capitalise on the perceived legitimacy its previous owner had cultivated. - -The actor may completely rebrand the account to exploit its existing reach, or relying on the account’s history to avoid more stringent automated content moderation rules applied to new accounts. - -See also [Mitre ATT&CK’s T1586 Compromise Accounts](https://attack.mitre.org/techniques/T1586/) for more technical information on how threat actors may achieve this objective. - -This Technique was previously called Compromise Legitimate Accounts, and used the ID T0011. +Threat Actors can take over existing users’ accounts to distribute campaign content.

The actor may maintain the asset’s previous identity to capitalise on the perceived legitimacy its previous owner had cultivated.

The actor may completely rebrand the account to exploit its existing reach, or relying on the account’s history to avoid more stringent automated content moderation rules applied to new accounts.

See also [Mitre ATT&CK’s T1586 Compromise Accounts](https://attack.mitre.org/techniques/T1586/) for more technical information on how threat actors may achieve this objective.

This Technique was previously called Compromise Legitimate Accounts, and used the ID T0011. TA15 T0141.002 Acquire Compromised Website -Threat Actors may take over existing websites to publish or amplify inauthentic narratives. This includes the defacement of websites, and cases where websites’ personas are maintained to add credence to threat actors’ narratives. - -See also [Mitre ATT&CK’s T1584 Compromise Infrastructure](https://attack.mitre.org/techniques/T1584/) for more technical information on how threat actors may achieve this objective. +Threat Actors may take over existing websites to publish or amplify inauthentic narratives. This includes the defacement of websites, and cases where websites’ personas are maintained to add credence to threat actors’ narratives.

See also [Mitre ATT&CK’s T1584 Compromise Infrastructure](https://attack.mitre.org/techniques/T1584/) for more technical information on how threat actors may achieve this objective. TA15 -T0142 -Fabricate Grassroots Movement -This technique, sometimes known as "astroturfing", occurs when an influence operation disguises itself as a grassroots movement or organisation that supports operation narratives.  - -Astroturfing aims to increase the appearance of popular support for an evolving grassroots movement in contrast to "Utilise Butterfly Attacks", which aims to discredit an existing grassroots movement.  - -This Technique was previously called Astroturfing, and used the ID T0099.001 +T0143 +Persona Legitimacy +This Technique contains sub-techniques which analysts can use to assert whether an account is presenting an authentic, fabricated, or parody persona:

T0143.001: Authentic Persona
T0143.002: Fabricated Persona
T0143.003: Impersonated Persona
T0143.004: Parody Persona TA16 + +T0143.001 +Authentic Persona +An individual or institution presenting a persona that legitimately matches who or what they are is presenting an authentic persona.

For example, an account which presents as being managed by a member of a country’s military, and is legitimately managed by that person, would be presenting an authentic persona (T0143.001: Authentic Persona, T0097.105: Military Personnel).

Sometimes people can authentically present themselves as who they are while still participating in malicious/inauthentic activity; a legitimate journalist (T0143.001: Authentic Persona, T0097.102: Journalist Persona) may accept bribes to promote products, or they could be tricked by threat actors into sharing an operation’s narrative. +TA16 + + +T0143.002 +Fabricated Persona +An individual or institution pretending to have a persona without any legitimate claim to that persona is presenting a fabricated persona, such as a person who presents themselves as a member of a country’s military without having worked in any capacity with the military (T0143.002: Fabricated Persona, T0097.105: Military Personnel).

Sometimes real people can present entirely fabricated personas; they can use real names and photos on social media while also pretending to have credentials or traits they don’t have in real life. +TA16 + + +T0143.003 +Impersonated Persona +Threat actors may impersonate existing individuals or institutions to conceal their network identity, add legitimacy to content, or harm the impersonated target’s reputation. This Technique covers situations where an actor presents themselves as another existing individual or institution.

This Technique was previously called Prepare Assets Impersonating Legitimate Entities and used the ID T0099.

Associated Techniques and Sub-techniques
T0097: Presented Persona: Analysts can use the sub-techniques of T0097: Presented Persona to categorise the type of impersonation. For example, a document developed by a threat actor which falsely presented as a letter from a government department could be documented using T0085.004: Develop Document, T0143.003: Impersonated Persona, and T0097.206: Government Institution Persona.
T0145.001: Copy Account Imagery: Actors may take existing accounts’ profile pictures as part of their impersonation efforts. +TA16 + + +T0143.004 +Parody Persona +Parody is a form of artistic expression that imitates the style or characteristics of a particular work, genre, or individual in a humorous or satirical way, often to comment on or critique the original work or subject matter. People may present as parodies to create humour or make a point by exaggerating or altering elements of the original, while still maintaining recognizable elements.

The use of parody is not an indication of inauthentic or malicious behaviour; parody allows people to present ideas or criticisms in a comedic or exaggerated manner, softening the impact of sensitive or contentious topics. Because parody is often protected as a form of free speech or artistic expression, it provides a legal and social framework for discussing controversial issues.

However, parody personas may be perceived as authentic personas, leading to people mistakenly believing that a parody account’s statements represent the real opinions of a parodied target. Threat actors may also use the guise of parody to spread campaign content. Parody personas may disclaim that they are operating as a parody, however this is not always the case, and is not always given prominence.

Associated Techniques and Sub-techniques T0097: Presented Persona: Analysts can use the sub-techniques of T0097: Presented Persona to categorise the type of parody. For example, an account presenting as a parody of a business could be documented using T0097.205: Business Persona and T0143.003: Parody Persona.
T0145.001: Copy Account Imagery: Actors may take existing accounts’ profile pictures as part of their parody efforts. +TA16 + + +T0144 +Persona Legitimacy Evidence +This Technique contains behaviours which might indicate whether a persona is legitimate, a fabrication, or a parody.

For example, the same persona being consistently presented across platforms is consistent with how authentic users behave on social media. However, threat actors have also displayed this behaviour as a way to increase the perceived legitimacy of their fabricated personas (aka “backstopping”). +TA16 + + +T0144.001 +Present Persona across Platforms +This sub-technique covers situations where analysts have identified the same persona being presented across multiple platforms.

Having multiple accounts presenting the same persona is not an indicator of inauthentic behaviour; many people create accounts and present as themselves on multiple platforms. However, threat actors are known to present the same persona across multiple platforms, benefiting from an increase in perceived legitimacy. +TA16 + + +T0144.002 +Persona Template +Threat actors have been observed following a template when filling their accounts’ online profiles. This may be done to enable account holders to quickly present themselves as a real person with a targeted persona.

For example, an actor may be instructed to create many fabricated local accounts for use in an operation using a template of “[flag emojis], [location], [personal quote], [political party] supporter” in their account’s description.

Associated Techniques and Sub-techniques
T0143.002: Fabricated Persona: The use of a templated account biography in a collection of accounts may be an indicator that the personas have been fabricated. +TA16 + + +T0145 +Establish Account Imagery +Introduce visual elements to an account where a platform allows this functionality (e.g. a profile picture, a cover photo, etc). 

Threat Actors who don’t want to use pictures of themselves in their social media accounts may use alternate imagery to make their account appear more legitimate. +TA15 + + +T0145.001 +Copy Account Imagery +Account imagery copied from an existing account.

Analysts may use reverse image search tools to try to identify previous uses of account imagery (e.g. a profile picture) by other accounts.

Threat Actors have been known to copy existing accounts’ imagery to impersonate said accounts, or to provide imagery for unrelated accounts which aren’t intended to impersonate the original assets’ owner.

Associated Techniques and Sub-techniques
T0143.003: Impersonated Persona: Actors may copy existing accounts’ imagery in an attempt to impersonate them.
T0143.004: Parody Persona: Actors may copy existing accounts’ imagery as part of a parody of that account. +TA15 + + +T0145.002 +AI-Generated Account Imagery +AI Generated images used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived legitimacy. By using an AI-generated picture for this purpose, they are able to present themselves as a real person without compromising their own identity, or risking detection by taking a real person’s existing profile picture.

Associated Techniques and Sub-techniques
T0086.002: Develop AI-Generated Images (Deepfakes): Analysts should use this sub-technique to document use of AI generated imagery used to support narratives. +TA15 + + +T0145.003 +Animal Account Imagery +Animal used in account imagery.

An influence operation might flesh out its account by uploading a profile picture, increasing its perceived authenticity.

People sometimes legitimately use images of animals as their profile pictures (e.g. of their pets), and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB. +TA15 + + +T0145.004 +Scenery Account Imagery +Scenery or nature used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

People sometimes legitimately use images of scenery as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB. +TA15 + + +T0145.005 +Illustrated Character Account Imagery +A cartoon/illustrated/anime character used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

People sometimes legitimately use images of illustrated characters as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB. +TA15 + + +T0145.006 +Attractive Person Account Imagery +Attractive person used in account imagery.

An influence operation might flesh out its account by uploading account imagery (e.g. a profile picture), increasing its perceived authenticity.

Pictures of physically attractive people can benefit threat actors by increasing attention given to their posts.

People sometimes legitimately use images of attractive people as their profile picture, and threat actors can mimic this behaviour to avoid the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery).

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB.

Associated Techniques and Sub-techniques
T0097.109: Romantic Suitor Persona: Accounts presenting as a romantic suitor may use an attractive person in their account imagery.
T0104.002: Dating App: Analysts can use this sub-technique for tagging cases where an account has been identified as using a dating platform. +TA15 + + +T0145.007 +Stock Image Account Imagery +Stock images used in account imagery.

Stock image websites produce photos of people in various situations. Threat Actors can purchase or appropriate these images for use in their account imagery, increasing perceived legitimacy while avoiding the risk of detection associated with stealing or AI-generating profile pictures (see T0145.001: Copy Account Imagery and T0145.002: AI-Generated Account Imagery). 

Stock images tend to include physically attractive people, and this can benefit threat actors by increasing attention given to their posts.

This Technique is often used by Coordinated Inauthentic Behaviour accounts (CIBs). A collection of accounts displaying the same behaviour using similar account imagery can indicate the presence of CIB. +TA15 +