mirror of
https://github.com/DISARMFoundation/DISARMframeworks.git
synced 2024-09-18 23:45:35 +00:00
Merge pull request #21 from DISARMFoundation/Sep13update
Corrected summary for T0139.001 (Discourage)
This commit is contained in:
adam-disarm
GitHub
commit
54fb3933be
Binary file not shown.
File diff suppressed because it is too large
Load Diff
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--ab87e5c2-32ad-41df-af71-14f4483f792a",
|
||||
"id": "bundle--96866e90-4a43-44b5-ad9c-948c09670963",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.646696Z",
|
||||
"modified": "2023-09-25T16:17:56.646696Z",
|
||||
"created": "2023-09-28T21:25:13.256885Z",
|
||||
"modified": "2023-09-28T21:25:13.256885Z",
|
||||
"name": "Video Livestream",
|
||||
"description": "A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--6cda89ac-9536-4420-94c0-ea3b9bfcb766",
|
||||
"id": "bundle--7e0b8688-d125-484c-a4f9-13137341b898",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0102376a-e896-4191-b3fb-e58188301822",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.57895Z",
|
||||
"modified": "2023-09-25T16:17:56.57895Z",
|
||||
"created": "2023-09-28T21:25:13.212125Z",
|
||||
"modified": "2023-09-28T21:25:13.212125Z",
|
||||
"name": "Organise Events",
|
||||
"description": "Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--bcdbc88c-d981-4b2e-b70e-61fb74e64c50",
|
||||
"id": "bundle--6bdc0034-a9ad-43e7-91b0-c54757577c9e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.664206Z",
|
||||
"modified": "2023-09-25T16:17:56.664206Z",
|
||||
"created": "2023-09-28T21:25:13.266843Z",
|
||||
"modified": "2023-09-28T21:25:13.266843Z",
|
||||
"name": "Deliver Ads",
|
||||
"description": "Delivering content via any form of paid media or advertising.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e6ea6a34-499b-4e95-a58f-f5bcf2730aa1",
|
||||
"id": "bundle--482fef6d-55ff-4da9-a49e-ceb149aae6ea",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.675524Z",
|
||||
"modified": "2023-09-25T16:17:56.675524Z",
|
||||
"created": "2023-09-28T21:25:13.273066Z",
|
||||
"modified": "2023-09-28T21:25:13.273066Z",
|
||||
"name": "Post across Platform",
|
||||
"description": "An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e85d853b-c1df-42eb-bdef-64412710540c",
|
||||
"id": "bundle--9325ea08-ba9a-444a-ab34-842dcc82d190",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.555276Z",
|
||||
"modified": "2023-09-25T16:17:56.555276Z",
|
||||
"created": "2023-09-28T21:25:13.201279Z",
|
||||
"modified": "2023-09-28T21:25:13.201279Z",
|
||||
"name": "Reframe Context",
|
||||
"description": "Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--6a71f847-648c-4764-92f2-5105eefba46f",
|
||||
"id": "bundle--2942a238-1b75-45e3-9022-ad5e15b3dd6c",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.584821Z",
|
||||
"modified": "2023-09-25T16:17:56.584821Z",
|
||||
"created": "2023-09-28T21:25:13.214551Z",
|
||||
"modified": "2023-09-28T21:25:13.214551Z",
|
||||
"name": "Segment Audiences",
|
||||
"description": "Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--995f0482-f315-44ff-a701-5e1d764887fb",
|
||||
"id": "bundle--d4a83f50-42d8-434f-95a7-f36433f65d3a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.648664Z",
|
||||
"modified": "2023-09-25T16:17:56.648664Z",
|
||||
"created": "2023-09-28T21:25:13.257984Z",
|
||||
"modified": "2023-09-28T21:25:13.257984Z",
|
||||
"name": "Private/Closed Social Networks",
|
||||
"description": "Social networks that are not open to people outside of family, friends, neighbours, or co-workers. Non-work-related examples include Couple, FamilyWall, 23snaps, and Nextdoor. Some of the larger social network platforms enable closed communities: examples are Instagram Close Friends and Twitter (X) Circle. Work-related examples of private social networks include LinkedIn, Facebook Workplace, and enterprise communication platforms such as Slack or Microsoft Teams.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c3c5b525-2432-4594-a38a-acd5d2e3b52e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--07070de8-0d3f-41f6-9861-33c090bbeaf2",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.295946Z",
|
||||
"modified": "2023-09-28T21:25:13.295946Z",
|
||||
"name": "Sell Items under False Pretences",
|
||||
"description": "Offer products for sale under false pretences. Campaigns may hijack or create causes built on disinformation to sell promotional merchandise. Or charlatans may amplify victims\u2019 unfounded fears to sell them items of questionable utility such as supplements or survival gear. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.004.md",
|
||||
"external_id": "T0137.004"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--36d33f3d-7581-4699-96d5-7aab68125405",
|
||||
"id": "bundle--d6e00044-58a7-4ddb-bf88-30f8653b5f09",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.689689Z",
|
||||
"modified": "2023-09-25T16:17:56.689689Z",
|
||||
"created": "2023-09-28T21:25:13.279115Z",
|
||||
"modified": "2023-09-28T21:25:13.279115Z",
|
||||
"name": "Conceal Operational Activity",
|
||||
"description": "Conceal the campaign's operational activity to avoid takedown and attribution.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--de6a7958-0c59-4eae-a7db-26b3f704457a",
|
||||
"id": "bundle--c1247e3b-818a-4a71-b381-cbedbde5efe1",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.57684Z",
|
||||
"modified": "2023-09-25T16:17:56.57684Z",
|
||||
"created": "2023-09-28T21:25:13.211835Z",
|
||||
"modified": "2023-09-28T21:25:13.211835Z",
|
||||
"name": "Conduct Keyword Squatting",
|
||||
"description": "Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--9c63027f-3307-413e-8dde-f3b20f260f46",
|
||||
"id": "bundle--869a9a71-029c-4338-8243-0d7ee648acaa",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.633319Z",
|
||||
"modified": "2023-09-25T16:17:56.633319Z",
|
||||
"created": "2023-09-28T21:25:13.247708Z",
|
||||
"modified": "2023-09-28T21:25:13.247708Z",
|
||||
"name": "Leverage Content Farms",
|
||||
"description": "Using the services of large-scale content providers for creating and amplifying campaign artefacts at scale.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--996d0e8f-1580-403b-b8a8-ae54cfaf9030",
|
||||
"id": "bundle--6fe400a2-cb0f-4888-9675-1a4c8851c2fd",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--09d17df9-9bb5-4d64-ba5c-8ae47814bd4c",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.549871Z",
|
||||
"modified": "2023-09-25T16:17:56.549871Z",
|
||||
"created": "2023-09-28T21:25:13.196968Z",
|
||||
"modified": "2023-09-28T21:25:13.196968Z",
|
||||
"name": "Generate Information Pollution",
|
||||
"description": "Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. \"Nothing is true, but everything is possible.\" Akin to astroturfing campaign.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--74f81e91-b0b4-4914-aea7-66a2d9d87597",
|
||||
"id": "bundle--806c52c7-049a-4309-9cc4-54e8ef929b0c",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.68687Z",
|
||||
"modified": "2023-09-25T16:17:56.68687Z",
|
||||
"created": "2023-09-28T21:25:13.27669Z",
|
||||
"modified": "2023-09-28T21:25:13.27669Z",
|
||||
"name": "Encourage Attendance at Events",
|
||||
"description": "Operation encourages attendance at existing real world event.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--70d072bd-7d72-4ac1-9f1c-9ca8fb648753",
|
||||
"id": "bundle--6ac57769-ec69-4864-9538-3087bbba30c8",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.56869Z",
|
||||
"modified": "2023-09-25T16:17:56.56869Z",
|
||||
"created": "2023-09-28T21:25:13.21044Z",
|
||||
"modified": "2023-09-28T21:25:13.21044Z",
|
||||
"name": "Flooding the Information Space",
|
||||
"description": "Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--59e63da9-73f0-44ac-9111-f773bc4df112",
|
||||
"id": "bundle--df5f361a-9a5c-46e4-a3b9-3c67065697c5",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.674845Z",
|
||||
"modified": "2023-09-25T16:17:56.674845Z",
|
||||
"created": "2023-09-28T21:25:13.272851Z",
|
||||
"modified": "2023-09-28T21:25:13.272851Z",
|
||||
"name": "Post across Groups",
|
||||
"description": "An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--903a86a1-9de1-457f-8945-90e0c8bfc2e1",
|
||||
"id": "bundle--3a92da8a-6f8d-4cee-a3f1-c71f43c3cd5a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.563226Z",
|
||||
"modified": "2023-09-25T16:17:56.563226Z",
|
||||
"created": "2023-09-28T21:25:13.206512Z",
|
||||
"modified": "2023-09-28T21:25:13.206512Z",
|
||||
"name": "Use Fake Experts",
|
||||
"description": "Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give \"credility\" to misinformation. Take advantage of credential bias",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--d487a4d3-63a0-4c72-8a39-e394d28a0fcb",
|
||||
"id": "bundle--d03b0d2a-e3bd-4077-8b6a-e0a3b8c23a76",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.646329Z",
|
||||
"modified": "2023-09-25T16:17:56.646329Z",
|
||||
"created": "2023-09-28T21:25:13.256347Z",
|
||||
"modified": "2023-09-28T21:25:13.256347Z",
|
||||
"name": "Livestream",
|
||||
"description": "A livestream refers to an online broadcast capability that allows for real-time communication to closed or open networks.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--a07c8ff9-d999-4940-9987-1481c4674073",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--10d6ca0f-6fea-4ec0-b5c8-d55ddeabcc40",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.299559Z",
|
||||
"modified": "2023-09-28T21:25:13.299559Z",
|
||||
"name": "Intimidate",
|
||||
"description": "Coerce, bully, or frighten the target. An influence operation may use intimidation to compel the target to act against their will. Or the goal may be to frighten or even terrify the target into silence or submission. In some cases, the goal is simply to make the victim suffer. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.002.md",
|
||||
"external_id": "T0140.002"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--fca4ebcc-a1a3-493f-9780-de3843f815bc",
|
||||
"id": "bundle--92bb24f3-0189-4c1b-8650-52ee3c63e2fa",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.640838Z",
|
||||
"modified": "2023-09-25T16:17:56.640838Z",
|
||||
"created": "2023-09-28T21:25:13.254922Z",
|
||||
"modified": "2023-09-28T21:25:13.254922Z",
|
||||
"name": "Create Localised Content",
|
||||
"description": "Localised content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localised content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localised content may help an operation increase legitimacy, avoid detection, and complicate external attribution.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--0e81137e-8125-468e-a3e2-8dd6433586c9",
|
||||
"id": "bundle--815c8801-b5bf-4ce1-9cc8-8502206826eb",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.567162Z",
|
||||
"modified": "2023-09-25T16:17:56.567162Z",
|
||||
"created": "2023-09-28T21:25:13.2094Z",
|
||||
"modified": "2023-09-28T21:25:13.2094Z",
|
||||
"name": "Threaten to Dox",
|
||||
"description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--d32f9a59-6055-46ed-b265-609b91baed95",
|
||||
"id": "bundle--16d67122-d992-4258-9654-4e144f7db6a3",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.611628Z",
|
||||
"modified": "2023-09-25T16:17:56.611628Z",
|
||||
"created": "2023-09-28T21:25:13.227448Z",
|
||||
"modified": "2023-09-28T21:25:13.227448Z",
|
||||
"name": "Develop New Narratives",
|
||||
"description": "Actors may develop new narratives to further strategic or tactical goals, especially when existing narratives adequately align with the campaign goals. New narratives provide more control in terms of crafting the message to achieve specific goals. However, new narratives may require more effort to disseminate than adapting or adopting existing narratives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--a288e8f7-a0a9-45d5-84a9-b3ad51b13116",
|
||||
"id": "bundle--ce822db7-2c37-44b2-bb15-40bfcf69c926",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.683246Z",
|
||||
"modified": "2023-09-25T16:17:56.683246Z",
|
||||
"created": "2023-09-28T21:25:13.274372Z",
|
||||
"modified": "2023-09-28T21:25:13.274372Z",
|
||||
"name": "Control Information Environment through Offensive Cyberspace Operations",
|
||||
"description": "Controlling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of content in the information space to either prioritise operation messaging or block opposition messaging.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--25c47e08-838b-4399-830b-a62f9b0ca43c",
|
||||
"id": "bundle--f217bf9f-cbe8-40f1-b842-2c589fa35221",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.615991Z",
|
||||
"modified": "2023-09-25T16:17:56.615991Z",
|
||||
"created": "2023-09-28T21:25:13.230922Z",
|
||||
"modified": "2023-09-28T21:25:13.230922Z",
|
||||
"name": "Develop AI-Generated Text",
|
||||
"description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c417b21d-cb16-49d7-8789-09121c474c55",
|
||||
"id": "bundle--80ec494f-bad1-4f84-85b0-cf9cfde169f7",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1997947a-7e08-4ea9-802c-85391d561266",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.667424Z",
|
||||
"modified": "2023-09-25T16:17:56.667424Z",
|
||||
"created": "2023-09-28T21:25:13.268338Z",
|
||||
"modified": "2023-09-28T21:25:13.268338Z",
|
||||
"name": "Post Content",
|
||||
"description": "Delivering content by posting via owned media (assets that the operator controls).",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--2823d85e-f8de-4b66-87e7-3f805383f78d",
|
||||
"id": "bundle--1fe5fb34-dbda-44e4-acac-d0e5f45ebf40",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.593982Z",
|
||||
"modified": "2023-09-25T16:17:56.593982Z",
|
||||
"created": "2023-09-28T21:25:13.22009Z",
|
||||
"modified": "2023-09-28T21:25:13.22009Z",
|
||||
"name": "Distort",
|
||||
"description": "Twist the narrative. Take information, or artefacts like images, and change the framing around them.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--27f7ef9e-63f8-4ac1-a16c-dd21aa0cd228",
|
||||
"id": "bundle--305e5346-1792-4b24-baa9-68ccbcf07386",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.70866Z",
|
||||
"modified": "2023-09-25T16:17:56.70866Z",
|
||||
"created": "2023-09-28T21:25:13.289879Z",
|
||||
"modified": "2023-09-28T21:25:13.289879Z",
|
||||
"name": "Action/Attitude",
|
||||
"description": "Measure current system state with respect to the effectiveness of influencing action/attitude.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--947a1974-2a16-4785-bf46-059fa05ebf72",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1ba99e5a-e7f0-4075-a9bf-9da7bd87f15d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.297331Z",
|
||||
"modified": "2023-09-28T21:25:13.297331Z",
|
||||
"name": "Provoke",
|
||||
"description": "Instigate, incite, or arouse a target to act. Social media manipulators exploit moral outrage to propel targets to spread hate, take to the streets to protest, or engage in acts of violence. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.002.md",
|
||||
"external_id": "T0138.002"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f1b39e2e-740b-4232-a0c0-e795a35d5aed",
|
||||
"id": "bundle--6110421d-886d-4664-87e0-fe3072ad1829",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.569998Z",
|
||||
"modified": "2023-09-25T16:17:56.569998Z",
|
||||
"created": "2023-09-28T21:25:13.210665Z",
|
||||
"modified": "2023-09-28T21:25:13.210665Z",
|
||||
"name": "Trolls Amplify and Manipulate",
|
||||
"description": "Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--901d77bc-86b4-4df5-915f-4d8bb3715126",
|
||||
"id": "bundle--3fcf4a8d-335e-4e1f-9906-9bde08ced2fe",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.601045Z",
|
||||
"modified": "2023-09-25T16:17:56.601045Z",
|
||||
"created": "2023-09-28T21:25:13.221608Z",
|
||||
"modified": "2023-09-28T21:25:13.221608Z",
|
||||
"name": "Divide",
|
||||
"description": "Create conflict between subgroups, to widen divisions in a community",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--ba47c2f0-8810-49fd-bf31-9d671d07c417",
|
||||
"id": "bundle--885db17d-b390-4455-9431-59a8034e8fc2",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.651719Z",
|
||||
"modified": "2023-09-25T16:17:56.651719Z",
|
||||
"created": "2023-09-28T21:25:13.260018Z",
|
||||
"modified": "2023-09-28T21:25:13.260018Z",
|
||||
"name": "Video Sharing",
|
||||
"description": "Examples include Youtube, TikTok, ShareChat, Rumble, etc",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--ae49aa92-8ba4-4522-aeb2-9e06598220aa",
|
||||
"id": "bundle--f8a98b0c-d415-42ed-bd09-d92bbede864d",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1d917530-027d-4f82-b380-404c320dc783",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.585969Z",
|
||||
"modified": "2023-09-25T16:17:56.585969Z",
|
||||
"created": "2023-09-28T21:25:13.216032Z",
|
||||
"modified": "2023-09-28T21:25:13.216032Z",
|
||||
"name": "Economic Segmentation",
|
||||
"description": "An influence operation may target populations based on their income bracket, wealth, or other financial or economic division.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--92369578-5d8a-4a5b-a4c4-0246c467b8c9",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1e8087ee-e56c-4647-ad77-523634c39b28",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.291932Z",
|
||||
"modified": "2023-09-28T21:25:13.291932Z",
|
||||
"name": "Cultivate Support",
|
||||
"description": "Grow or maintain the base of support for the actor, ally, or action. This includes hard core recruitment, managing alliances, and generating or maintaining sympathy among a wider audience, including reputation management and public relations. Sub-techniques assume support for actor (self) unless otherwise specified. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.md",
|
||||
"external_id": "T0136"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": false,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--16f0f600-500b-4a91-a8ea-c419c4a7bb48",
|
||||
"id": "bundle--b902ec75-3655-428a-b579-e421b5f22f6e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.687102Z",
|
||||
"modified": "2023-09-25T16:17:56.687102Z",
|
||||
"created": "2023-09-28T21:25:13.276828Z",
|
||||
"modified": "2023-09-28T21:25:13.276828Z",
|
||||
"name": "Call to Action to Attend",
|
||||
"description": "Call to action to attend an event",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--57260b3f-1b97-4db9-a84f-1d96d4232e09",
|
||||
"id": "bundle--4f658070-6407-496d-9da4-52ffdff60192",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.688597Z",
|
||||
"modified": "2023-09-25T16:17:56.688597Z",
|
||||
"created": "2023-09-28T21:25:13.27818Z",
|
||||
"modified": "2023-09-28T21:25:13.27818Z",
|
||||
"name": "Conceal Network Identity",
|
||||
"description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--3f5f338b-96a6-4197-b8a6-060498c7edb6",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--20e074c4-9010-41b8-b097-65091268531c",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.298168Z",
|
||||
"modified": "2023-09-28T21:25:13.298168Z",
|
||||
"name": "Discourage",
|
||||
"description": "To make a target disinclined or reluctant to act. Manipulators use disinformation to cause targets to question the utility, legality, or morality of taking an action. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.001.md",
|
||||
"external_id": "T0139.001"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--420c71d5-845b-47eb-bf0b-6bcf4df6d48f",
|
||||
"id": "bundle--47a925ff-1268-4aa7-b09f-adb1dd5ac364",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.546873Z",
|
||||
"modified": "2023-09-25T16:17:56.546873Z",
|
||||
"created": "2023-09-28T21:25:13.195168Z",
|
||||
"modified": "2023-09-28T21:25:13.195168Z",
|
||||
"name": "Prepare Fundraising Campaigns",
|
||||
"description": "Fundraising campaigns refer to an influence operation\u2019s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e9142697-6949-498a-b2fa-2747fcc12268",
|
||||
"id": "bundle--bd956c8e-2b1e-4b2d-9d3b-7a72a2bf0b9f",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.561233Z",
|
||||
"modified": "2023-09-25T16:17:56.561233Z",
|
||||
"created": "2023-09-28T21:25:13.204367Z",
|
||||
"modified": "2023-09-28T21:25:13.204367Z",
|
||||
"name": "Chat Apps",
|
||||
"description": "Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--29d77994-26c8-4911-935e-d7c19694c427",
|
||||
"id": "bundle--6932f059-0b1f-4ac7-9479-aa083f500e32",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.663835Z",
|
||||
"modified": "2023-09-25T16:17:56.663835Z",
|
||||
"created": "2023-09-28T21:25:13.266341Z",
|
||||
"modified": "2023-09-28T21:25:13.266341Z",
|
||||
"name": "Employ Commercial Analytic Firms",
|
||||
"description": "Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e3ebbeba-6868-4c0f-9f18-e4f2325027cd",
|
||||
"id": "bundle--b8903b69-42ef-4c7f-8d29-e0664ebf3893",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.662034Z",
|
||||
"modified": "2023-09-25T16:17:56.662034Z",
|
||||
"created": "2023-09-28T21:25:13.265297Z",
|
||||
"modified": "2023-09-28T21:25:13.265297Z",
|
||||
"name": "Radio",
|
||||
"description": "Radio",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f3339f2a-fe80-445b-91be-a3e7b9fde7a2",
|
||||
"id": "bundle--793cc6ec-dc65-4bf2-a3a5-425e83da0a68",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--283333f5-e161-4195-9070-5a7c22505adf",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.637907Z",
|
||||
"modified": "2023-09-25T16:17:56.637907Z",
|
||||
"created": "2023-09-28T21:25:13.252865Z",
|
||||
"modified": "2023-09-28T21:25:13.252865Z",
|
||||
"name": "Co-Opt Trusted Sources",
|
||||
"description": "An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: - National or local new outlets - Research or academic publications - Online blogs or websites",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--1a0a7cea-9346-4b64-858f-921cf5a91016",
|
||||
"id": "bundle--6217b633-fcd8-470f-bf91-16f51d9b02db",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.623306Z",
|
||||
"modified": "2023-09-25T16:17:56.623306Z",
|
||||
"created": "2023-09-28T21:25:13.24035Z",
|
||||
"modified": "2023-09-28T21:25:13.24035Z",
|
||||
"name": "Create Anonymous Accounts",
|
||||
"description": "Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--1a57a61b-44d9-4f1c-9aeb-c83510a1b4e4",
|
||||
"id": "bundle--d2c4d87c-409f-4f32-9a31-9e337e970741",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.675855Z",
|
||||
"modified": "2023-09-25T16:17:56.675855Z",
|
||||
"created": "2023-09-28T21:25:13.273283Z",
|
||||
"modified": "2023-09-28T21:25:13.273283Z",
|
||||
"name": "Post across Disciplines",
|
||||
"description": "Post Across Disciplines",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--15fe208a-ffe0-4c8a-9641-7e3d50bffe88",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--2b17f29f-f65f-4398-9e35-1c1d8836c20d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.291627Z",
|
||||
"modified": "2023-09-28T21:25:13.291627Z",
|
||||
"name": "Polarise",
|
||||
"description": "To cause a target audience to divide into two completely opposing groups. This is a special case of subversion. To divide and conquer is an age-old approach to subverting and overcoming an enemy.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.004.md",
|
||||
"external_id": "T0135.004"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--0ec8031a-afdc-4610-8b51-b2e33efb1dba",
|
||||
"id": "bundle--707137b3-6225-472e-a07c-4a92d0a22b6c",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.687957Z",
|
||||
"modified": "2023-09-25T16:17:56.687957Z",
|
||||
"created": "2023-09-28T21:25:13.277436Z",
|
||||
"modified": "2023-09-28T21:25:13.277436Z",
|
||||
"name": "Encourage Physical Violence",
|
||||
"description": "An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c5f8db5e-d6c3-4a1c-8069-c257d2bf994b",
|
||||
"id": "bundle--44f9daac-a4fc-4e7e-9682-03efa042ab82",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.602362Z",
|
||||
"modified": "2023-09-25T16:17:56.602362Z",
|
||||
"created": "2023-09-28T21:25:13.222968Z",
|
||||
"modified": "2023-09-28T21:25:13.222968Z",
|
||||
"name": "Evaluate Media Surveys",
|
||||
"description": "An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience\u2019s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--1e740e7e-7716-4bba-a102-e30d9cd2e144",
|
||||
"id": "bundle--c7ea2d2f-edf4-491f-9d18-8a26b73d30ff",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.562266Z",
|
||||
"modified": "2023-09-25T16:17:56.562266Z",
|
||||
"created": "2023-09-28T21:25:13.205471Z",
|
||||
"modified": "2023-09-28T21:25:13.205471Z",
|
||||
"name": "Use Unencrypted Chats Apps",
|
||||
"description": "Examples include SMS, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--70cae426-7cb8-46d0-b192-66a18437220b",
|
||||
"id": "bundle--386d5b67-da78-41e2-a782-36e8d364c8bd",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.635795Z",
|
||||
"modified": "2023-09-25T16:17:56.635795Z",
|
||||
"created": "2023-09-28T21:25:13.250986Z",
|
||||
"modified": "2023-09-28T21:25:13.250986Z",
|
||||
"name": "Leverage Existing Inauthentic News Sites",
|
||||
"description": "Leverage Existing Inauthentic News Sites",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--49274f7c-7e51-4a10-9f41-224176d246b6",
|
||||
"id": "bundle--597df03d-5951-42b5-a04b-a2aab5bc9ecf",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.656146Z",
|
||||
"modified": "2023-09-25T16:17:56.656146Z",
|
||||
"created": "2023-09-28T21:25:13.263697Z",
|
||||
"modified": "2023-09-28T21:25:13.263697Z",
|
||||
"name": "Traditional Media",
|
||||
"description": "Examples include TV, Newspaper, Radio, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--d88a72dc-ab3b-427c-84fd-5f854abd8a62",
|
||||
"id": "bundle--411884ce-8862-403a-ac58-1ebf7cb5fb49",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.671099Z",
|
||||
"modified": "2023-09-25T16:17:56.671099Z",
|
||||
"created": "2023-09-28T21:25:13.270307Z",
|
||||
"modified": "2023-09-28T21:25:13.270307Z",
|
||||
"name": "Comment or Reply on Content",
|
||||
"description": "Delivering content by replying or commenting via owned media (assets that the operator controls).",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c1e7df4e-e357-491c-abc2-52824aeb0374",
|
||||
"id": "bundle--9f1138e3-d221-4fb8-9853-210f71b9fd2e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.560097Z",
|
||||
"modified": "2023-09-25T16:17:56.560097Z",
|
||||
"created": "2023-09-28T21:25:13.203339Z",
|
||||
"modified": "2023-09-28T21:25:13.203339Z",
|
||||
"name": "Demand Insurmountable Proof",
|
||||
"description": "Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the \"firehose of misinformation\". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of \"questions\" while the truth teller is burdened with higher and higher standards of proof.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--fde745b8-b26b-4ec6-998a-d0df32e6b3ed",
|
||||
"id": "bundle--c25a4ed5-ff5c-4184-af40-63185fd027f0",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.694715Z",
|
||||
"modified": "2023-09-25T16:17:56.694715Z",
|
||||
"created": "2023-09-28T21:25:13.282451Z",
|
||||
"modified": "2023-09-28T21:25:13.282451Z",
|
||||
"name": "Redirect URLs",
|
||||
"description": "An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e4fe910d-5992-4c9e-9700-21358991eca5",
|
||||
"id": "bundle--4d5be5ab-9066-40d6-af57-347d231e4fb6",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.616791Z",
|
||||
"modified": "2023-09-25T16:17:56.616791Z",
|
||||
"created": "2023-09-28T21:25:13.231884Z",
|
||||
"modified": "2023-09-28T21:25:13.231884Z",
|
||||
"name": "Develop Inauthentic News Articles",
|
||||
"description": "An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e09ee49f-efc8-46b5-ad8b-a4f0c337c00d",
|
||||
"id": "bundle--dedb20af-a3ed-4eb4-8daf-16cd2e08c1e6",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.697724Z",
|
||||
"modified": "2023-09-25T16:17:56.697724Z",
|
||||
"created": "2023-09-28T21:25:13.285122Z",
|
||||
"modified": "2023-09-28T21:25:13.285122Z",
|
||||
"name": "Utilise Bulletproof Hosting",
|
||||
"description": "Hosting refers to services through which storage and computing resources are provided to an individual or organisation for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilise bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--70957dad-c2fd-42d4-9b1d-a64946ae8178",
|
||||
"id": "bundle--eeaf0531-be7c-45b6-afc0-dbed1617f77c",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3437993c-c521-4145-a2d8-b860399876b0",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.690653Z",
|
||||
"modified": "2023-09-25T16:17:56.690653Z",
|
||||
"created": "2023-09-28T21:25:13.2801Z",
|
||||
"modified": "2023-09-28T21:25:13.2801Z",
|
||||
"name": "Break Association with Content",
|
||||
"description": "Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f0c6c5c7-8d81-4426-aac7-51a3ac94a32b",
|
||||
"id": "bundle--5de819f5-8460-41e6-8d44-e7259c9e748e",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--348c10cd-e24e-409e-a6eb-983f85c1e590",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.550971Z",
|
||||
"modified": "2023-09-25T16:17:56.550971Z",
|
||||
"created": "2023-09-28T21:25:13.198072Z",
|
||||
"modified": "2023-09-28T21:25:13.198072Z",
|
||||
"name": "Hijack Hashtags",
|
||||
"description": "Hashtag hijacking occurs when users \u201c[use] a trending hashtag to promote topics that are substantially different from its recent context\u201d (VanDam and Tan, 2016) or \u201cto promote one\u2019s own social media agenda\u201d (Darius and Stephany, 2019).",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--b0b0c190-2e34-47d8-88de-a4aa362dc713",
|
||||
"id": "bundle--a6d496d1-d241-4852-b5d4-327c5ffd64e2",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.548384Z",
|
||||
"modified": "2023-09-25T16:17:56.548384Z",
|
||||
"created": "2023-09-28T21:25:13.195892Z",
|
||||
"modified": "2023-09-28T21:25:13.195892Z",
|
||||
"name": "Create Clickbait",
|
||||
"description": "Create attention grabbing headlines (outrage, doubt, humour) required to drive traffic & engagement. This is a key asset.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--1a37af76-1674-4215-b070-436efe42e556",
|
||||
"id": "bundle--bcd1ecab-1563-4d85-8e3b-80064349facd",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.665004Z",
|
||||
"modified": "2023-09-25T16:17:56.665004Z",
|
||||
"created": "2023-09-28T21:25:13.267305Z",
|
||||
"modified": "2023-09-28T21:25:13.267305Z",
|
||||
"name": "Social Media",
|
||||
"description": "Social Media",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--941bb670-63e1-41b6-9395-7d4c33cbad42",
|
||||
"id": "bundle--1d1a0b5f-1be3-4c52-8c8c-6f7466953698",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.650615Z",
|
||||
"modified": "2023-09-25T16:17:56.650615Z",
|
||||
"created": "2023-09-28T21:25:13.258959Z",
|
||||
"modified": "2023-09-28T21:25:13.258959Z",
|
||||
"name": "Create Dedicated Hashtag",
|
||||
"description": "Create a campaign/incident specific hashtag.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--06885429-f9cf-4ca5-997d-4df6140844e9",
|
||||
"id": "bundle--3713c941-49b8-4f24-8083-6c506a11ce72",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.684273Z",
|
||||
"modified": "2023-09-25T16:17:56.684273Z",
|
||||
"created": "2023-09-28T21:25:13.275328Z",
|
||||
"modified": "2023-09-28T21:25:13.275328Z",
|
||||
"name": "Conduct Server Redirect",
|
||||
"description": "A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side or client-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--57b9d162-1470-49b9-8921-f4a66278588d",
|
||||
"id": "bundle--6a0de0a1-88d4-4005-8a2c-e41f4063bb91",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.561668Z",
|
||||
"modified": "2023-09-25T16:17:56.561668Z",
|
||||
"created": "2023-09-28T21:25:13.204899Z",
|
||||
"modified": "2023-09-28T21:25:13.204899Z",
|
||||
"name": "Use Encrypted Chat Apps",
|
||||
"description": "Examples include Signal, WhatsApp, Discord, Wire, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f4b16241-d9ec-4469-93c9-33593829021b",
|
||||
"id": "bundle--f9bab428-c384-4942-b2de-195baf6ac01b",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.630048Z",
|
||||
"modified": "2023-09-25T16:17:56.630048Z",
|
||||
"created": "2023-09-28T21:25:13.243236Z",
|
||||
"modified": "2023-09-28T21:25:13.243236Z",
|
||||
"name": "Use Follow Trains",
|
||||
"description": "A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--964f3842-e0ee-4236-8477-a2430a41938a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--37d7a656-a425-4ec8-8128-c39848350716",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.295682Z",
|
||||
"modified": "2023-09-28T21:25:13.295682Z",
|
||||
"name": "Raise Funds",
|
||||
"description": "Solicit donations for a cause. Popular conspiracy theorists can attract financial contributions from their followers. Fighting back against the establishment is a popular crowdfunding narrative. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.003.md",
|
||||
"external_id": "T0137.003"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--8a8d6b6f-e087-409f-bc08-3150760a4ed0",
|
||||
"id": "bundle--597354a2-caf2-4a4f-937b-3ba4210154dd",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.622228Z",
|
||||
"modified": "2023-09-25T16:17:56.622228Z",
|
||||
"created": "2023-09-28T21:25:13.239371Z",
|
||||
"modified": "2023-09-28T21:25:13.239371Z",
|
||||
"name": "Alter Authentic Documents",
|
||||
"description": "Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic can be \"leaked\" during later stages in the operation.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--6b76d491-eab9-45bd-ae52-9cc36b2acf32",
|
||||
"id": "bundle--9763ce34-ff06-439f-9e5a-6189eb3500d7",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.633693Z",
|
||||
"modified": "2023-09-25T16:17:56.633693Z",
|
||||
"created": "2023-09-28T21:25:13.248135Z",
|
||||
"modified": "2023-09-28T21:25:13.248135Z",
|
||||
"name": "Create Content Farms",
|
||||
"description": "An influence operation may create an organisation for creating and amplifying campaign artefacts at scale.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--fbdc843e-96fc-46b8-9914-be814206754d",
|
||||
"id": "bundle--7930ed30-e163-4178-b29d-60e7e54310ff",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.68731Z",
|
||||
"modified": "2023-09-25T16:17:56.68731Z",
|
||||
"created": "2023-09-28T21:25:13.276967Z",
|
||||
"modified": "2023-09-28T21:25:13.276967Z",
|
||||
"name": "Facilitate Logistics or Support for Attendance",
|
||||
"description": "Facilitate logistics or support for travel, food, housing, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--4d401c0a-8949-4b06-8392-c83f69b24f4d",
|
||||
"id": "bundle--7b84f97c-4639-43b1-a7b5-a15b77650011",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.644763Z",
|
||||
"modified": "2023-09-25T16:17:56.644763Z",
|
||||
"created": "2023-09-28T21:25:13.255837Z",
|
||||
"modified": "2023-09-28T21:25:13.255837Z",
|
||||
"name": "Use Existing Echo Chambers/Filter Bubbles",
|
||||
"description": "Use existing Echo Chambers/Filter Bubbles",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--839afbed-8398-44e9-83e2-ab119851aafb",
|
||||
"id": "bundle--807eca38-8021-4c57-922b-8ff2179acd1a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3ae4fb28-4864-468d-8085-cb8035cbb272",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.636164Z",
|
||||
"modified": "2023-09-25T16:17:56.636164Z",
|
||||
"created": "2023-09-28T21:25:13.251463Z",
|
||||
"modified": "2023-09-28T21:25:13.251463Z",
|
||||
"name": "Prepare Assets Impersonating Legitimate Entities",
|
||||
"description": "An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organisations, or state entities. An influence operation may use a wide variety of cyber techniques to impersonate a legitimate entity\u2019s website or social media account. Typosquatting87 is the international registration of a domain name with purposeful variations of the impersonated domain name through intentional typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation of falsified websites by creating similar domain names in the URL box, leaving it to the user to confirm that the URL is correct.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--3c001660-0994-46bb-a356-b0d180d2afbe",
|
||||
"id": "bundle--524c667d-ba42-44dc-99ff-f0341f294492",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.547204Z",
|
||||
"modified": "2023-09-25T16:17:56.547204Z",
|
||||
"created": "2023-09-28T21:25:13.195475Z",
|
||||
"modified": "2023-09-28T21:25:13.195475Z",
|
||||
"name": "Raise Funds from Malign Actors",
|
||||
"description": "Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e222b4e4-f6d8-48a3-918a-81eb82e53356",
|
||||
"id": "bundle--e270b35a-fd95-4c34-879c-ef98af69a7a2",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.586611Z",
|
||||
"modified": "2023-09-25T16:17:56.586611Z",
|
||||
"created": "2023-09-28T21:25:13.216489Z",
|
||||
"modified": "2023-09-28T21:25:13.216489Z",
|
||||
"name": "Psychographic Segmentation",
|
||||
"description": "An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--1e5fc844-3f42-4cde-9772-07f1df06135a",
|
||||
"id": "bundle--8df61d22-73e4-42fe-81f8-88f17e1f440a",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.647861Z",
|
||||
"modified": "2023-09-25T16:17:56.647861Z",
|
||||
"created": "2023-09-28T21:25:13.257668Z",
|
||||
"modified": "2023-09-28T21:25:13.257668Z",
|
||||
"name": "Mainstream Social Networks",
|
||||
"description": "Examples include Facebook, Twitter, LinkedIn, etc.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--babba90b-5cfa-4f2e-8896-ce7cfad22e93",
|
||||
"id": "bundle--b83086c0-b76a-45b4-b775-b336e4f5b623",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.645644Z",
|
||||
"modified": "2023-09-25T16:17:56.645644Z",
|
||||
"created": "2023-09-28T21:25:13.256193Z",
|
||||
"modified": "2023-09-28T21:25:13.256193Z",
|
||||
"name": "Exploit Data Voids",
|
||||
"description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--64a79515-06e4-4c33-8deb-aa9a7b38448e",
|
||||
"id": "bundle--d36d25dd-ffcd-4218-853b-23d09e3325d4",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.606169Z",
|
||||
"modified": "2023-09-25T16:17:56.606169Z",
|
||||
"created": "2023-09-28T21:25:13.223959Z",
|
||||
"modified": "2023-09-28T21:25:13.223959Z",
|
||||
"name": "Identify Social and Technical Vulnerabilities",
|
||||
"description": "Identifying social and technical vulnerabilities determines weaknesses within the target audience information environment for later exploitation. Vulnerabilities include decisive political issues, weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment. Identifying social and technical vulnerabilities facilitates the later exploitation of the identified weaknesses to advance operation objectives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--9f222bb2-514d-428c-a048-f310b6766320",
|
||||
"id": "bundle--790268d5-f369-403b-a46d-5ad509c30df0",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4282febe-c8a6-46da-863c-f19081615d80",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.57385Z",
|
||||
"modified": "2023-09-25T16:17:56.57385Z",
|
||||
"created": "2023-09-28T21:25:13.21143Z",
|
||||
"modified": "2023-09-28T21:25:13.21143Z",
|
||||
"name": "Utilise Spamoflauge",
|
||||
"description": "Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, \"you've w0n our jackp0t!\". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--3838a234-bf8c-4cfb-ab62-e2979906641d",
|
||||
"id": "bundle--38165465-d447-4aad-8084-f23ebfbfb2da",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.632961Z",
|
||||
"modified": "2023-09-25T16:17:56.632961Z",
|
||||
"created": "2023-09-28T21:25:13.247214Z",
|
||||
"modified": "2023-09-28T21:25:13.247214Z",
|
||||
"name": "Develop Owned Media Assets",
|
||||
"description": "An owned media asset refers to an agency or organisation through which an influence operation may create, develop, and host content and narratives. Owned media assets include websites, blogs, social media pages, forums, and other platforms that facilitate the creation and organisation of content.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--baedd8cd-24dd-4bdb-a75d-283f44a93339",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--456e7902-1294-4ee0-aeb1-cfed13346a72",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.217706Z",
|
||||
"modified": "2023-09-28T21:25:13.217706Z",
|
||||
"name": "Domestic Political Advantage",
|
||||
"description": "Favourable position vis-\u00e0-vis national or sub-national political opponents such as political parties, interest groups, politicians, candidates. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-strategy"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.002.md",
|
||||
"external_id": "T0074.002"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--0137cfa4-b0ba-41da-869a-9e79398db70a",
|
||||
"id": "bundle--8d9d6aaf-d143-4278-b601-05613e12dfcb",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.603123Z",
|
||||
"modified": "2023-09-25T16:17:56.603123Z",
|
||||
"created": "2023-09-28T21:25:13.223372Z",
|
||||
"modified": "2023-09-28T21:25:13.223372Z",
|
||||
"name": "Conduct Web Traffic Analysis",
|
||||
"description": "An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c736365e-18c7-4c46-adb4-c8abd29b935e",
|
||||
"id": "bundle--fdec7679-d363-46e2-b4f0-eb885fcec3d2",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.607352Z",
|
||||
"modified": "2023-09-25T16:17:56.607352Z",
|
||||
"created": "2023-09-28T21:25:13.224398Z",
|
||||
"modified": "2023-09-28T21:25:13.224398Z",
|
||||
"name": "Find Echo Chambers",
|
||||
"description": "Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--0e53788a-9453-4465-8f13-9226eec32027",
|
||||
"id": "bundle--254ab946-c35a-4f26-9e74-9ad45e2ff842",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.554157Z",
|
||||
"modified": "2023-09-25T16:17:56.554157Z",
|
||||
"created": "2023-09-28T21:25:13.200791Z",
|
||||
"modified": "2023-09-28T21:25:13.200791Z",
|
||||
"name": "Distort Facts",
|
||||
"description": "Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--e3de4a3b-78e1-458b-b410-44c260185b18",
|
||||
"id": "bundle--af941b53-2a08-4b7e-8300-dd82dc395059",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.629682Z",
|
||||
"modified": "2023-09-25T16:17:56.629682Z",
|
||||
"created": "2023-09-28T21:25:13.243054Z",
|
||||
"modified": "2023-09-28T21:25:13.243054Z",
|
||||
"name": "Create Organisations",
|
||||
"description": "Influence operations may establish organisations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--61580419-8a54-4441-9726-f1432a13a237",
|
||||
"id": "bundle--a66a21ef-a173-4cde-ba42-d60759c41c57",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.643292Z",
|
||||
"modified": "2023-09-25T16:17:56.643292Z",
|
||||
"created": "2023-09-28T21:25:13.255442Z",
|
||||
"modified": "2023-09-28T21:25:13.255442Z",
|
||||
"name": "Leverage Echo Chambers/Filter Bubbles",
|
||||
"description": "An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with \u201cothers with which they are already in agreement.\u201d A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--0d5a756b-bf16-49f0-bcfc-b6d4cbd17233",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4c06f94a-13d2-4b86-9505-38684b317bcb",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.295155Z",
|
||||
"modified": "2023-09-28T21:25:13.295155Z",
|
||||
"name": "Generate Ad Revenue",
|
||||
"description": "Earn income from digital advertisements published alongside inauthentic content. Conspiratorial, false, or provocative content drives internet traffic. Content owners earn money from impressions of, or clicks on, or conversions of ads published on their websites, social media profiles, or streaming services, or ads published when their content appears in search engine results. Fraudsters simulate impressions, clicks, and conversions, or they spin up inauthentic sites or social media profiles just to generate ad revenue. Conspiracy theorists and political operators generate ad revenue as a byproduct of their operation or as a means of sustaining their campaign. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.001.md",
|
||||
"external_id": "T0137.001"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--cf67488e-2c88-4ca2-8506-5badeebad00a",
|
||||
"id": "bundle--24d6d0eb-2e4c-41d5-bcd0-d96a3588d467",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.71158Z",
|
||||
"modified": "2023-09-25T16:17:56.71158Z",
|
||||
"created": "2023-09-28T21:25:13.290171Z",
|
||||
"modified": "2023-09-28T21:25:13.290171Z",
|
||||
"name": "Message Reach",
|
||||
"description": "Monitor and evaluate message reach in misinformation incidents.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--09595db4-c32a-4abe-b0be-541ff5442607",
|
||||
"id": "bundle--43f7eb05-0876-4b49-a574-4dd94a243847",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.632178Z",
|
||||
"modified": "2023-09-25T16:17:56.632178Z",
|
||||
"created": "2023-09-28T21:25:13.246267Z",
|
||||
"modified": "2023-09-28T21:25:13.246267Z",
|
||||
"name": "Identify Susceptible Targets in Networks",
|
||||
"description": "When seeking to infiltrate an existing network, an influence operation may identify individuals and groups that might be susceptible to being co-opted or influenced.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--a55645b8-26b9-490a-9f5a-79e40d635fc1",
|
||||
"id": "bundle--c8b9df5e-59ba-4442-8f92-91cde7dbcba9",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.61373Z",
|
||||
"modified": "2023-09-25T16:17:56.61373Z",
|
||||
"created": "2023-09-28T21:25:13.228328Z",
|
||||
"modified": "2023-09-28T21:25:13.228328Z",
|
||||
"name": "Use Copypasta",
|
||||
"description": "Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta\u2019s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--84509329-7bf2-419e-957d-d8c382046344",
|
||||
"id": "bundle--e5c4b351-10b3-46e7-9968-cd81945fe035",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4d86424a-26a1-4d9f-bc32-619620a18a8d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.545329Z",
|
||||
"modified": "2023-09-25T16:17:56.545329Z",
|
||||
"created": "2023-09-28T21:25:13.193793Z",
|
||||
"modified": "2023-09-28T21:25:13.193793Z",
|
||||
"name": "Compromise Legitimate Accounts",
|
||||
"description": "Hack or take over legimate accounts to distribute misinformation or damaging content.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--f1befdcf-3d25-41f8-a606-08f3d8d9dd4d",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--4ecd424d-11a8-4471-9ccc-a870a337284d",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.29877Z",
|
||||
"modified": "2023-09-28T21:25:13.29877Z",
|
||||
"name": "Deter",
|
||||
"description": "Prevent target from taking an action for fear of the consequences. Deterrence occurs in the mind of the target, who fears they will be worse off if they take an action than if they don\u2019t. When making threats, aggressors may bluff, feign irrationality, or engage in brinksmanship.",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.003.md",
|
||||
"external_id": "T0139.003"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--b99eed15-63a7-4a9e-8063-c1f4840a6c80",
|
||||
"id": "bundle--b85c35ca-6b6b-4157-a1d0-3d17eb612378",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--50f92bc8-f6ad-4267-bd00-f4c572370a72",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.564081Z",
|
||||
"modified": "2023-09-25T16:17:56.564081Z",
|
||||
"created": "2023-09-28T21:25:13.206965Z",
|
||||
"modified": "2023-09-28T21:25:13.206965Z",
|
||||
"name": "Use Search Engine Optimisation",
|
||||
"description": "Manipulate content engagement metrics (ie: Reddit & Twitter) to influence/impact news search results (e.g. Google), also elevates RT & Sputnik headline into Google news alert emails. aka \"Black-hat SEO\"",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--289770b3-6e12-44f0-9dca-a6a3b697bd2e",
|
||||
"id": "bundle--76846529-cada-411b-bd11-af4b98c3f1f4",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5251f6d0-6820-4617-afef-a0d8acafd3c1",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.671832Z",
|
||||
"modified": "2023-09-25T16:17:56.671832Z",
|
||||
"created": "2023-09-28T21:25:13.270783Z",
|
||||
"modified": "2023-09-28T21:25:13.270783Z",
|
||||
"name": "Post Inauthentic Social Media Comment",
|
||||
"description": "Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--04f6aa22-9982-4cdf-8212-0bb451857c06",
|
||||
"id": "bundle--bbd7a8b3-9663-4632-8a4d-b8bdd7f2f8e8",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--5414f74d-0b10-4562-ad9d-e5e1093e255a",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.592504Z",
|
||||
"modified": "2023-09-25T16:17:56.592504Z",
|
||||
"created": "2023-09-28T21:25:13.219041Z",
|
||||
"modified": "2023-09-28T21:25:13.219041Z",
|
||||
"name": "Dismiss",
|
||||
"description": "Push back against criticism by dismissing your critics. This might be arguing that the critics use a different standard for you than with other actors or themselves; or arguing that their criticism is biassed.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--02906a1b-afa4-47b6-a038-f4f50a04f0cb",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--54ea78c9-da07-4b80-90de-192e53719db5",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.290467Z",
|
||||
"modified": "2023-09-28T21:25:13.290467Z",
|
||||
"name": "Undermine",
|
||||
"description": "Weaken, debilitate, or subvert a target or their actions. An influence operation may be designed to disparage an opponent; sabotage an opponent\u2019s systems or processes; compromise an opponent\u2019s relationships or support system; impair an opponent\u2019s capability; or thwart an opponent\u2019s initiative. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.md",
|
||||
"external_id": "T0135"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": false,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -0,0 +1,39 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--2c82d82c-89e2-41d4-9f07-c59167626ecd",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--54edae40-39dc-45c4-a473-cef151d299ff",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-28T21:25:13.296499Z",
|
||||
"modified": "2023-09-28T21:25:13.296499Z",
|
||||
"name": "Manipulate Stocks",
|
||||
"description": "Artificially inflate or deflate the price of stocks or other financial instruments and then trade on these to make profit. The most common securities fraud schemes are called \u201cpump and dump\u201d and \u201cpoop and scoop\u201d. ",
|
||||
"kill_chain_phases": [
|
||||
{
|
||||
"kill_chain_name": "mitre-attack",
|
||||
"phase_name": "plan-objectives"
|
||||
}
|
||||
],
|
||||
"external_references": [
|
||||
{
|
||||
"source_name": "mitre-attack",
|
||||
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.006.md",
|
||||
"external_id": "T0137.006"
|
||||
}
|
||||
],
|
||||
"object_marking_refs": [
|
||||
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
||||
],
|
||||
"x_mitre_is_subtechnique": true,
|
||||
"x_mitre_platforms": [
|
||||
"Windows",
|
||||
"Linux",
|
||||
"Mac"
|
||||
],
|
||||
"x_mitre_version": "2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--cf3ff00a-d0b8-40a4-842a-e75b27d83ec8",
|
||||
"id": "bundle--c1b1845f-f5b0-4d07-abe1-d98f26c7c32f",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--556fa171-ffd0-4787-84fa-171b99c703b5",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.684021Z",
|
||||
"modified": "2023-09-25T16:17:56.684021Z",
|
||||
"created": "2023-09-28T21:25:13.27495Z",
|
||||
"modified": "2023-09-28T21:25:13.27495Z",
|
||||
"name": "Destroy Information Generation Capabilities",
|
||||
"description": "Destroying information generation capabilities refers to actions taken to limit, degrade, or otherwise incapacitate an actor\u2019s ability to generate conflicting information. An influence operation may destroy an actor\u2019s information generation capabilities by physically dismantling the information infrastructure, disconnecting resources needed for information generation, or redirecting information generation personnel. An operation may destroy an adversary\u2019s information generation capabilities to limit conflicting content exposure to the target audience and crowd the information space with its own narratives.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--5bb27388-10ac-4aa1-9cd7-acee2a6f05d6",
|
||||
"id": "bundle--9383febc-dd7c-454b-a110-1ccfd70d3b91",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--55ecf54e-0e46-4ea1-86de-ab473c94705f",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.706462Z",
|
||||
"modified": "2023-09-25T16:17:56.706462Z",
|
||||
"created": "2023-09-28T21:25:13.289474Z",
|
||||
"modified": "2023-09-28T21:25:13.289474Z",
|
||||
"name": "Awareness",
|
||||
"description": "Measure current system state with respect to the effectiveness of influencing awareness.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--c879e6b7-35b5-455f-9030-11275001e409",
|
||||
"id": "bundle--a4edde62-06aa-4210-a2ed-4ab9cd239c55",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--55ff2ec4-8d1b-49f8-b774-d5996bc33648",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.608622Z",
|
||||
"modified": "2023-09-25T16:17:56.608622Z",
|
||||
"created": "2023-09-28T21:25:13.224906Z",
|
||||
"modified": "2023-09-28T21:25:13.224906Z",
|
||||
"name": "Identify Data Voids",
|
||||
"description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--b1ffeb61-505d-40b2-9150-5a42465e5b36",
|
||||
"id": "bundle--edd394c2-0676-4441-b36d-8883b9eb6ccf",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--56a35df8-3bda-4ee3-8be0-23b20b69fe63",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.687534Z",
|
||||
"modified": "2023-09-25T16:17:56.687534Z",
|
||||
"created": "2023-09-28T21:25:13.277105Z",
|
||||
"modified": "2023-09-28T21:25:13.277105Z",
|
||||
"name": "Physical Violence",
|
||||
"description": "Physical violence refers to the use of force to injure, abuse, damage, or destroy. An influence operation may conduct or encourage physical violence to discourage opponents from promoting conflicting content or draw attention to operation narratives using shock value.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--4cd40458-438b-4246-99dc-38c21c97413a",
|
||||
"id": "bundle--354801d3-22ba-4123-ab59-e8facb7b8800",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--570ba169-9d18-41ac-89ae-46b1376cdb82",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.687738Z",
|
||||
"modified": "2023-09-25T16:17:56.687738Z",
|
||||
"created": "2023-09-28T21:25:13.277243Z",
|
||||
"modified": "2023-09-28T21:25:13.277243Z",
|
||||
"name": "Conduct Physical Violence",
|
||||
"description": "An influence operation may directly Conduct Physical Violence to achieve campaign goals.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--7b5c5a3a-e4d9-4713-9db8-71fd743f6312",
|
||||
"id": "bundle--e04715f0-b252-4db3-977c-9e34cb387ab3",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--57f82c4a-4db0-47f4-b4a2-03cd2792b6dc",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.619753Z",
|
||||
"modified": "2023-09-25T16:17:56.619753Z",
|
||||
"created": "2023-09-28T21:25:13.235858Z",
|
||||
"modified": "2023-09-28T21:25:13.235858Z",
|
||||
"name": "Deceptively Edit Video (Cheap Fakes)",
|
||||
"description": "Cheap fakes utilise less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
@ -1,14 +1,14 @@
|
||||
{
|
||||
"type": "bundle",
|
||||
"id": "bundle--dd1e526a-fa40-431a-a4ce-6fb0ad53b36c",
|
||||
"id": "bundle--a3187df7-ce39-4a67-83cc-72bb0e1896b1",
|
||||
"objects": [
|
||||
{
|
||||
"type": "attack-pattern",
|
||||
"spec_version": "2.1",
|
||||
"id": "attack-pattern--58643f4a-7699-4cd7-aafa-76a3e6e09e99",
|
||||
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
||||
"created": "2023-09-25T16:17:56.627207Z",
|
||||
"modified": "2023-09-25T16:17:56.627207Z",
|
||||
"created": "2023-09-28T21:25:13.242366Z",
|
||||
"modified": "2023-09-28T21:25:13.242366Z",
|
||||
"name": "Recruit Contractors",
|
||||
"description": "Operators recruit paid contractor to support the campaign.",
|
||||
"kill_chain_phases": [
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user