Git-Mirrors/DISARMframeworks
1
0
Fork 0
mirror of https://github.com/DISARMFoundation/DISARMframeworks.git synced 2024-12-24 06:49:47 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update descriptions for T0104.003, T0123.004, T0135.001, T0140.001 and files for STIX Bundle

Browse Source
This commit is contained in:
Stephen Campbell 2023-09-25 12:46:26 -04:00
parent 62680c33d5
commit a604c155cf
736 changed files with 15123 additions and 2928 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
DISARM_MASTER_DATA/DISARM_FRAMEWORKS_MASTER.xlsx
View File

Binary file not shown.

4789
generated_files/DISARM_STIX/DISARM.json
View File

File diff suppressed because it is too large Load Diff

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--9d6d2f6e-2e6a-43d9-bdba-af9566bd8a58",
"id": "bundle--ab87e5c2-32ad-41df-af71-14f4483f792a",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--00a91e2d-2e09-4e94-bae6-cef6102eae99",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.918207Z",
"modified": "2022-07-03T23:52:02.918207Z",
"created": "2023-09-25T16:17:56.646696Z",
"modified": "2023-09-25T16:17:56.646696Z",
"name": "Video Livestream",
"description": "A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0103.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0103.001.md",
"external_id": "T0103.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0102376a-e896-4191-b3fb-e58188301822.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--c4fe22ac-f3a8-48b6-9b9b-75811f6ed656",
"id": "bundle--6cda89ac-9536-4420-94c0-ea3b9bfcb766",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0102376a-e896-4191-b3fb-e58188301822",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.905109Z",
"modified": "2022-07-03T23:52:02.905109Z",
"name": "Organize Events",
"created": "2023-09-25T16:17:56.57895Z",
"modified": "2023-09-25T16:17:56.57895Z",
"name": "Organise Events",
"description": "Coordinate and promote real-world events across media platforms, e.g. rallies, protests, gatherings in support of incident narratives.",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0057.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0057.md",
"external_id": "T0057"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--01449efe-95f9-4480-bc5e-1fe6ee04e333.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--28c60a17-dc8a-4517-9648-c9aad66c507b",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--01449efe-95f9-4480-bc5e-1fe6ee04e333",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.715094Z",
"modified": "2023-09-25T16:17:56.715094Z",
"name": "Subvert",
"description": "Sabotage, destroy, or damage a system, process, or relationship. The classic example is the Soviet strategy of \u201cactive measures\u201d involving deniable covert activities such as political influence, the use of front organisations, the orchestration of domestic unrest, and the spread of disinformation. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.003.md",
"external_id": "T0135.003"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--46b5719c-643d-47ae-98d7-9751f12297d1",
"id": "bundle--bcdbc88c-d981-4b2e-b70e-61fb74e64c50",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--026571cc-66db-42fb-9de3-790e1e7f243d",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.921327Z",
"modified": "2022-07-03T23:52:02.921327Z",
"created": "2023-09-25T16:17:56.664206Z",
"modified": "2023-09-25T16:17:56.664206Z",
"name": "Deliver Ads",
"description": "Delivering content via any form of paid media or advertising.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0114.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0114.md",
"external_id": "T0114"
}
],

14
generated_files/DISARM_STIX/attack-pattern/attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe.json
View File

@ -1,26 +1,26 @@
{
"type": "bundle",
"id": "bundle--45429bfc-5cd2-4a58-bace-33531dceb222",
"id": "bundle--e6ea6a34-499b-4e95-a58f-f5bcf2730aa1",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--03225a5c-f388-4453-a53c-f10be49bbcfe",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.922934Z",
"modified": "2022-07-03T23:52:02.922934Z",
"name": "Post Across Platform",
"description": "An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform. ",
"created": "2023-09-25T16:17:56.675524Z",
"modified": "2023-09-25T16:17:56.675524Z",
"name": "Post across Platform",
"description": "An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "maximize-exposure"
"phase_name": "maximise-exposure"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0119.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0119.002.md",
"external_id": "T0119.002"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--c81db8b4-8a35-4fc8-9c44-865d8803ac95",
"id": "bundle--e85d853b-c1df-42eb-bdef-64412710540c",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--032f24c1-bc1d-457a-8f43-6c5fc416f733",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.901769Z",
"modified": "2022-07-03T23:52:02.901769Z",
"created": "2023-09-25T16:17:56.555276Z",
"modified": "2023-09-25T16:17:56.555276Z",
"name": "Reframe Context",
"description": "Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions. ",
"description": "Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0023.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0023.001.md",
"external_id": "T0023.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--45168286-7ba9-4d14-9ae8-f39bf3738a21",
"id": "bundle--6a71f847-648c-4764-92f2-5105eefba46f",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--03692306-7b8e-4b5a-991f-23c91eeed4c5",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.90626Z",
"modified": "2022-07-03T23:52:02.90626Z",
"created": "2023-09-25T16:17:56.584821Z",
"modified": "2023-09-25T16:17:56.584821Z",
"name": "Segment Audiences",
"description": "Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics. ",
"description": "Create audience segmentations by features of interest to the influence campaign, including political affiliation, geographic location, income, demographics, and psychographics.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0072.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0072.md",
"external_id": "T0072"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--86018d97-4567-44a3-aa90-bbaa9508afd3",
"id": "bundle--995f0482-f315-44ff-a701-5e1d764887fb",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0461a925-3bb7-466c-a7ae-40aee015f403",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.918805Z",
"modified": "2022-07-03T23:52:02.918805Z",
"created": "2023-09-25T16:17:56.648664Z",
"modified": "2023-09-25T16:17:56.648664Z",
"name": "Private/Closed Social Networks",
"description": "An audio livestream refers to an online audio broadcast capability that allows for real-time communication to closed or open networks. Examples include Twitter Spaces, ",
"description": "Social networks that are not open to people outside of family, friends, neighbours, or co-workers. Non-work-related examples include Couple, FamilyWall, 23snaps, and Nextdoor. Some of the larger social network platforms enable closed communities: examples are Instagram Close Friends and Twitter (X) Circle. Work-related examples of private social networks include LinkedIn, Facebook Workplace, and enterprise communication platforms such as Slack or Microsoft Teams.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.003.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.003.md",
"external_id": "T0104.003"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--888a9163-0e7b-42a0-bf1a-e931e1602be2",
"id": "bundle--36d33f3d-7581-4699-96d5-7aab68125405",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--08db3527-8fc9-4bf6-bb49-e5a5249cc051",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.92688Z",
"modified": "2022-07-03T23:52:02.92688Z",
"created": "2023-09-25T16:17:56.689689Z",
"modified": "2023-09-25T16:17:56.689689Z",
"name": "Conceal Operational Activity",
"description": "Conceal the campaign's operational activity to avoid takedown and attribution.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.md",
"external_id": "T0129"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--08e50234-c956-48ed-a89c-41d112253317.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--3ee93375-0bb3-43ce-b9cc-a3f8a92ea6b0",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--08e50234-c956-48ed-a89c-41d112253317",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.718302Z",
"modified": "2023-09-25T16:17:56.718302Z",
"name": "Cultivate Support for Ally",
"description": "Elevate or fortify the public backing for a partner. Governments may interfere in other countries\u2019 elections by covertly favouring a party or candidate aligned with their interests. They may also mount an influence operation to bolster the reputation of an ally under attack. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.006.md",
"external_id": "T0136.006"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69.json
View File

@ -1,26 +1,26 @@
{
"type": "bundle",
"id": "bundle--ce468a5f-d940-455d-ab07-868be223e7c6",
"id": "bundle--de6a7958-0c59-4eae-a7db-26b3f704457a",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--091a6351-aca8-4cc8-9062-cae98f600e69",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.904871Z",
"modified": "2022-07-03T23:52:02.904871Z",
"created": "2023-09-25T16:17:56.57684Z",
"modified": "2023-09-25T16:17:56.57684Z",
"name": "Conduct Keyword Squatting",
"description": "Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term. ",
"description": "Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "maximize-exposure"
"phase_name": "maximise-exposure"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.006.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.006.md",
"external_id": "T0049.006"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--201504b5-4450-4a58-93fb-dccdaaeea60a",
"id": "bundle--9c63027f-3307-413e-8dde-f3b20f260f46",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--091f481d-b32b-4e5c-9626-b14a6ef02df7",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.91566Z",
"modified": "2022-07-03T23:52:02.91566Z",
"created": "2023-09-25T16:17:56.633319Z",
"modified": "2023-09-25T16:17:56.633319Z",
"name": "Leverage Content Farms",
"description": "Using the services of large-scale content providers for creating and amplifying campaign artifacts at scale.",
"description": "Using the services of large-scale content providers for creating and amplifying campaign artefacts at scale.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0096.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0096.md",
"external_id": "T0096"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--09d17df9-9bb5-4d64-ba5c-8ae47814bd4c.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--32a24cb8-328b-4165-bed7-d1cd22469180",
"id": "bundle--996d0e8f-1580-403b-b8a8-ae54cfaf9030",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--09d17df9-9bb5-4d64-ba5c-8ae47814bd4c",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.900805Z",
"modified": "2022-07-03T23:52:02.900805Z",
"name": "Generate information pollution",
"created": "2023-09-25T16:17:56.549871Z",
"modified": "2023-09-25T16:17:56.549871Z",
"name": "Generate Information Pollution",
"description": "Flood social channels; drive traffic/engagement to all assets; create aura/sense/perception of pervasiveness/consensus (for or against or both simultaneously) of an issue or topic. \"Nothing is true, but everything is possible.\" Akin to astroturfing campaign.",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0019.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0019.md",
"external_id": "T0019"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--d96c1eeb-f9ec-4192-a74e-311b7d649c43",
"id": "bundle--74f81e91-b0b4-4914-aea7-66a2d9d87597",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0a77a75a-09e7-44bf-927c-5e66a138862b",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.925141Z",
"modified": "2022-07-03T23:52:02.925141Z",
"created": "2023-09-25T16:17:56.68687Z",
"modified": "2023-09-25T16:17:56.68687Z",
"name": "Encourage Attendance at Events",
"description": "Operation encourages attendance at existing real world event.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0126.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0126.md",
"external_id": "T0126"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0c207d0a-1842-4740-aaed-cf7142cb895e.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--200a4953-d643-409d-9c73-4b54e240d7d5",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0c207d0a-1842-4740-aaed-cf7142cb895e",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.53594Z",
"modified": "2023-09-25T14:19:03.53594Z",
"name": "Smear",
"description": "Denigrate, disparage, or discredit an opponent. This is a common tactical objective in political campaigns with a larger strategic goal. It differs from efforts to harm a target through defamation.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.001.md",
"external_id": "T0135.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc.json
View File

@ -1,26 +1,26 @@
{
"type": "bundle",
"id": "bundle--4d5ac679-24dc-4c4d-a076-124a75060736",
"id": "bundle--70d072bd-7d72-4ac1-9f1c-9ca8fb648753",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0c765d19-99b2-4703-af48-e20a677c4bfc",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.904116Z",
"modified": "2022-07-03T23:52:02.904116Z",
"created": "2023-09-25T16:17:56.56869Z",
"modified": "2023-09-25T16:17:56.56869Z",
"name": "Flooding the Information Space",
"description": "Flooding and/or mobbing social media channels feeds and/or hashtag with excessive volume of content to control/shape online conversations and/or drown out opposing points of view. Bots and/or patriotic trolls are effective tools to acheive this effect.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "maximize-exposure"
"phase_name": "maximise-exposure"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.md",
"external_id": "T0049"
}
],

14
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944.json
View File

@ -1,26 +1,26 @@
{
"type": "bundle",
"id": "bundle--e713572f-43bd-411e-9bef-ebfef89bdf91",
"id": "bundle--59e63da9-73f0-44ac-9111-f773bc4df112",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0d094dfb-61f9-42d3-a9cf-697fdcbee944",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.922817Z",
"modified": "2022-07-03T23:52:02.922817Z",
"name": "Post Across Groups",
"description": "An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences. ",
"created": "2023-09-25T16:17:56.674845Z",
"modified": "2023-09-25T16:17:56.674845Z",
"name": "Post across Groups",
"description": "An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "maximize-exposure"
"phase_name": "maximise-exposure"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0119.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0119.001.md",
"external_id": "T0119.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--e771e853-02c2-48b4-874a-0b98be257aa8",
"id": "bundle--903a86a1-9de1-457f-8945-90e0c8bfc2e1",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0d8138a8-8690-491d-97b5-a330af054b39",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.903115Z",
"modified": "2022-07-03T23:52:02.903115Z",
"name": "Use fake experts",
"created": "2023-09-25T16:17:56.563226Z",
"modified": "2023-09-25T16:17:56.563226Z",
"name": "Use Fake Experts",
"description": "Use the fake experts that were set up during Establish Legitimacy. Pseudo-experts are disposable assets that often appear once and then disappear. Give \"credility\" to misinformation. Take advantage of credential bias",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0045.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0045.md",
"external_id": "T0045"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--78547cff-f924-4e42-991a-613e562b3cbf",
"id": "bundle--d487a4d3-63a0-4c72-8a39-e394d28a0fcb",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0ec5ae10-b99b-4d5a-a7e9-7b7c3533e8c9",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.918085Z",
"modified": "2022-07-03T23:52:02.918085Z",
"created": "2023-09-25T16:17:56.646329Z",
"modified": "2023-09-25T16:17:56.646329Z",
"name": "Livestream",
"description": "A livestream refers to an online broadcast capability that allows for real-time communication to closed or open networks.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0103.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0103.md",
"external_id": "T0103"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0f310aaf-6bde-49bb-b58e-55a438b42525.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--05b89bf9-a73f-4eff-8847-0a53aea80aeb",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0f310aaf-6bde-49bb-b58e-55a438b42525",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.57554Z",
"modified": "2023-09-25T14:19:03.57554Z",
"name": "Recruit Members",
"description": "Motivate followers to join or subscribe as members of the team. Organisations may mount recruitment drives that use propaganda to entice sympathisers to sign up. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.007.md",
"external_id": "T0136.007"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--0f6e5675-c9b0-4f22-b2f2-6d12a301c113.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--47603dd3-5ad0-4fea-879b-9f313c2565d4",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--0f6e5675-c9b0-4f22-b2f2-6d12a301c113",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.725797Z",
"modified": "2023-09-25T16:17:56.725797Z",
"name": "Motivate to Act",
"description": "Persuade, impel, or provoke the target to behave in a specific manner favourable to the attacker. Some common behaviours are joining, subscribing, voting, buying, demonstrating, fighting, retreating, resigning, boycotting.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.md",
"external_id": "T0138"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--30c7cb3a-74c8-4a87-bd4f-6f6d82375457",
"id": "bundle--fca4ebcc-a1a3-493f-9780-de3843f815bc",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--11352e9a-a52b-4ade-ad4f-ec64a15fa1d5",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.917496Z",
"modified": "2022-07-03T23:52:02.917496Z",
"name": "Create Localized Content",
"description": "Localized content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localized content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localized content may help an operation increase legitimacy, avoid detection, and complicate external attribution.",
"created": "2023-09-25T16:17:56.640838Z",
"modified": "2023-09-25T16:17:56.640838Z",
"name": "Create Localised Content",
"description": "Localised content refers to content that appeals to a specific community of individuals, often in defined geographic areas. An operation may create localised content using local language and dialects to resonate with its target audience and blend in with other local news and social media. Localised content may help an operation increase legitimacy, avoid detection, and complicate external attribution.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0101.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0101.md",
"external_id": "T0101"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--11fa1071-a2e1-4162-9258-a43740bbcab0.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--a2c5086c-d17d-40ca-87c7-e94dbdf6788c",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--11fa1071-a2e1-4162-9258-a43740bbcab0",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.600653Z",
"modified": "2023-09-25T14:19:03.600653Z",
"name": "Spread Hate",
"description": "Publish and/or propagate demeaning, derisive, or humiliating content targeting an individual or group of individuals with the intent to cause emotional, psychological, or physical distress. Hate speech can cause harm directly or incite others to harm the target. It often aims to stigmatise the target by singling out immutable characteristics such as colour, race, religion, national or ethnic origin, gender, gender identity, sexual orientation, age, disease, or mental or physical disability. Thus, promoting hatred online may involve racism, antisemitism, Islamophobia, xenophobia, sexism, misogyny, homophobia, transphobia, ageism, ableism, or any combination thereof. Motivations for hate speech range from group preservation to ideological superiority to the unbridled infliction of suffering. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.003.md",
"external_id": "T0140.003"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--aebb1f3a-c627-4b6d-8870-d2f7c0bf054b",
"id": "bundle--0e81137e-8125-468e-a3e2-8dd6433586c9",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--127c5166-e619-42d7-a0f7-0cf0595bcdeb",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.903875Z",
"modified": "2022-07-03T23:52:02.903875Z",
"created": "2023-09-25T16:17:56.567162Z",
"modified": "2023-09-25T16:17:56.567162Z",
"name": "Threaten to Dox",
"description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content. ",
"description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0048.003.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0048.003.md",
"external_id": "T0048.003"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--21525ece-cc29-4717-a9cb-47e138d42c77",
"id": "bundle--d32f9a59-6055-46ed-b265-609b91baed95",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--14bec5aa-0823-4dde-9223-ec49a1cea65e",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.909865Z",
"modified": "2022-07-03T23:52:02.909865Z",
"created": "2023-09-25T16:17:56.611628Z",
"modified": "2023-09-25T16:17:56.611628Z",
"name": "Develop New Narratives",
"description": "Actors may develop new narratives to further strategic or tactical goals, especially when existing narratives adequately align with the campaign goals. New narratives provide more control in terms of crafting the message to achieve specific goals. However, new narratives may require more effort to disseminate than adapting or adopting existing narratives. ",
"description": "Actors may develop new narratives to further strategic or tactical goals, especially when existing narratives adequately align with the campaign goals. New narratives provide more control in terms of crafting the message to achieve specific goals. However, new narratives may require more effort to disseminate than adapting or adopting existing narratives.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0082.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0082.md",
"external_id": "T0082"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--16ca4580-d77f-493a-be0a-8be5f1462c9d",
"id": "bundle--a288e8f7-a0a9-45d5-84a9-b3ad51b13116",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--14ea9a49-0546-4fe9-be44-f158be5881e9",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.923904Z",
"modified": "2022-07-03T23:52:02.923904Z",
"created": "2023-09-25T16:17:56.683246Z",
"modified": "2023-09-25T16:17:56.683246Z",
"name": "Control Information Environment through Offensive Cyberspace Operations",
"description": "Controlling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of content in the information space to either prioritize operation messaging or block opposition messaging.",
"description": "Controlling the information environment through offensive cyberspace operations uses cyber tools and techniques to alter the trajectory of content in the information space to either prioritise operation messaging or block opposition messaging.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0123.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0123.md",
"external_id": "T0123"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--17416435-2d92-430a-8a23-e8ccf5216604.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--cefd7833-9f13-4ed2-9357-66c8f07c56ca",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--17416435-2d92-430a-8a23-e8ccf5216604",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.579246Z",
"modified": "2023-09-25T14:19:03.579246Z",
"name": "Manipulate Stocks",
"description": "Artificially inflate or deflate the price of stocks or other financial instruments and then trade on these to make profit. The most common securities fraud schemes are called \u201cpump and dump\u201d and \u201cpoop and scoop\u201d. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.006.md",
"external_id": "T0137.006"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--bdad18f8-dd21-42fc-b32c-c48eaae0200a",
"id": "bundle--25c47e08-838b-4399-830b-a62f9b0ca43c",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--17cba995-a8ab-4aa0-85fe-2b87d38a8f03",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.91098Z",
"modified": "2022-07-03T23:52:02.91098Z",
"created": "2023-09-25T16:17:56.615991Z",
"modified": "2023-09-25T16:17:56.615991Z",
"name": "Develop AI-Generated Text",
"description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.",
"description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0085.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.001.md",
"external_id": "T0085.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--1997947a-7e08-4ea9-802c-85391d561266.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--ca033e0b-a47f-496c-8716-487ad682f01f",
"id": "bundle--c417b21d-cb16-49d7-8789-09121c474c55",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--1997947a-7e08-4ea9-802c-85391d561266",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.92175Z",
"modified": "2022-07-03T23:52:02.92175Z",
"created": "2023-09-25T16:17:56.667424Z",
"modified": "2023-09-25T16:17:56.667424Z",
"name": "Post Content",
"description": "Delivering content by posting via owned media (assets that the operator controls). ",
"description": "Delivering content by posting via owned media (assets that the operator controls).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0115.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0115.md",
"external_id": "T0115"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--7261b635-bc44-4670-95f8-dcd41b663f58",
"id": "bundle--2823d85e-f8de-4b66-87e7-3f805383f78d",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--1a85cb33-f7cc-49d9-a23f-4b7ce82a2146",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.907478Z",
"modified": "2022-07-03T23:52:02.907478Z",
"created": "2023-09-25T16:17:56.593982Z",
"modified": "2023-09-25T16:17:56.593982Z",
"name": "Distort",
"description": "Twist the narrative. Take information, or artifacts like images, and change the framing around them.",
"description": "Twist the narrative. Take information, or artefacts like images, and change the framing around them.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0076.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0076.md",
"external_id": "T0076"
}
],

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--5e8725a5-b473-4fd3-af32-a0cd83f91cbe",
"id": "bundle--27f7ef9e-63f8-4ac1-a16c-dd21aa0cd228",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--1ae9162c-ea88-4123-9c3f-b651eff4a77c",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.930411Z",
"modified": "2022-07-03T23:52:02.930411Z",
"name": "Action/attitude",
"description": "Measure current system state with respect to the effectiveness of influencing action/attitude. ",
"created": "2023-09-25T16:17:56.70866Z",
"modified": "2023-09-25T16:17:56.70866Z",
"name": "Action/Attitude",
"description": "Measure current system state with respect to the effectiveness of influencing action/attitude.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0133.005.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0133.005.md",
"external_id": "T0133.005"
}
],

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635.json
View File

@ -1,26 +1,26 @@
{
"type": "bundle",
"id": "bundle--ea55b785-b162-46a1-ad17-8ab8f1e27bc5",
"id": "bundle--f1b39e2e-740b-4232-a0c0-e795a35d5aed",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--1c13465b-8b75-4b7d-a763-fe5b1d091635",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.904237Z",
"modified": "2022-07-03T23:52:02.904237Z",
"name": "Trolls amplify and manipulate",
"created": "2023-09-25T16:17:56.569998Z",
"modified": "2023-09-25T16:17:56.569998Z",
"name": "Trolls Amplify and Manipulate",
"description": "Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "maximize-exposure"
"phase_name": "maximise-exposure"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.001.md",
"external_id": "T0049.001"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--c7a1e0af-73be-4d4b-835c-87c92ceee8e7",
"id": "bundle--901d77bc-86b4-4df5-915f-4d8bb3715126",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--1d48fe65-5062-4262-b9e2-890aca1da132",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.907845Z",
"modified": "2022-07-03T23:52:02.907845Z",
"created": "2023-09-25T16:17:56.601045Z",
"modified": "2023-09-25T16:17:56.601045Z",
"name": "Divide",
"description": "Create conflict between subgroups, to widen divisions in a community",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0079.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0079.md",
"external_id": "T0079"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--b01e548f-012d-4993-9760-b0808a30120d",
"id": "bundle--ba47c2f0-8810-49fd-bf31-9d671d07c417",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--1d8c14ac-9be0-4835-b379-45549267e8f8",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.919616Z",
"modified": "2022-07-03T23:52:02.919616Z",
"created": "2023-09-25T16:17:56.651719Z",
"modified": "2023-09-25T16:17:56.651719Z",
"name": "Video Sharing",
"description": "Examples include Youtube, TikTok, ShareChat, Rumble, etc",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0105.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0105.002.md",
"external_id": "T0105.002"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--1d917530-027d-4f82-b380-404c320dc783.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--25c62a7c-5a8c-4fc1-95ad-3c7a9d0cdfb3",
"id": "bundle--ae49aa92-8ba4-4522-aeb2-9e06598220aa",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--1d917530-027d-4f82-b380-404c320dc783",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.906641Z",
"modified": "2022-07-03T23:52:02.906641Z",
"created": "2023-09-25T16:17:56.585969Z",
"modified": "2023-09-25T16:17:56.585969Z",
"name": "Economic Segmentation",
"description": "An influence operation may target populations based on their income bracket, wealth, or other financial or economic division. ",
"description": "An influence operation may target populations based on their income bracket, wealth, or other financial or economic division.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0072.003.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0072.003.md",
"external_id": "T0072.003"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--95bdc81c-8e4e-4714-b84a-eb0e6c72276f",
"id": "bundle--16f0f600-500b-4a91-a8ea-c419c4a7bb48",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--1f7181dc-07e7-40a7-9894-8132b8390ba4",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.92526Z",
"modified": "2022-07-03T23:52:02.92526Z",
"name": "Call to action to attend ",
"created": "2023-09-25T16:17:56.687102Z",
"modified": "2023-09-25T16:17:56.687102Z",
"name": "Call to Action to Attend",
"description": "Call to action to attend an event",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0126.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0126.001.md",
"external_id": "T0126.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--14cf2dea-7cd2-4ec4-bd93-f387d3136803",
"id": "bundle--57260b3f-1b97-4db9-a84f-1d96d4232e09",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--20569b52-59da-4b87-9b04-a306f3c148ae",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.92609Z",
"modified": "2022-07-03T23:52:02.92609Z",
"created": "2023-09-25T16:17:56.688597Z",
"modified": "2023-09-25T16:17:56.688597Z",
"name": "Conceal Network Identity",
"description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organization. ",
"description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organisation.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0128.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0128.002.md",
"external_id": "T0128.002"
}
],

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--39462655-edde-4533-ae7e-236689d25188",
"id": "bundle--420c71d5-845b-47eb-bf0b-6bcf4df6d48f",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--21fc458a-ea4d-41bb-9442-aac7ddd24794",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.899769Z",
"modified": "2022-07-03T23:52:02.899769Z",
"name": "Prepare fundraising campaigns",
"description": "Fundraising campaigns refer to an influence operation\u2019s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities. ",
"created": "2023-09-25T16:17:56.546873Z",
"modified": "2023-09-25T16:17:56.546873Z",
"name": "Prepare Fundraising Campaigns",
"description": "Fundraising campaigns refer to an influence operation\u2019s systematic effort to seek financial support for a charity, cause, or other enterprise using online activities that further promote operation information pathways while raising a profit. Many influence operations have engaged in crowdfunding services on platforms including Tipee, Patreon, and GoFundMe. An operation may use its previously prepared fundraising campaigns (see: Develop Information Pathways) to promote operation messaging while raising money to support its activities.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0014.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0014.md",
"external_id": "T0014"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--22a3c794-41ac-4296-9e0a-d866a2ba91bc.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--b04c88fc-dfd9-4802-9849-b6eb42b604aa",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--22a3c794-41ac-4296-9e0a-d866a2ba91bc",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.728285Z",
"modified": "2023-09-25T16:17:56.728285Z",
"name": "Provoke",
"description": "Instigate, incite, or arouse a target to act. Social media manipulators exploit moral outrage to propel targets to spread hate, take to the streets to protest, or engage in acts of violence. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.002.md",
"external_id": "T0138.002"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--23e51ece-142b-48c4-bc1a-8ec4abd0ab14.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--060c77b2-bbc8-4630-9f34-9c54feb0db0c",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--23e51ece-142b-48c4-bc1a-8ec4abd0ab14",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.717505Z",
"modified": "2023-09-25T16:17:56.717505Z",
"name": "Boost Reputation",
"description": "Elevate the estimation of the actor in the public\u2019s mind. Improve their image or standing. Public relations professionals use persuasive overt communications to achieve this goal; manipulators use covert disinformation. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.004.md",
"external_id": "T0136.004"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--f4570314-9a14-4ac3-baeb-b4519003fc38",
"id": "bundle--e9142697-6949-498a-b2fa-2747fcc12268",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--23fc4de3-6f2c-4080-b8ed-13e996b1a4b9",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.902483Z",
"modified": "2022-07-03T23:52:02.902483Z",
"name": "Chat apps",
"created": "2023-09-25T16:17:56.561233Z",
"modified": "2023-09-25T16:17:56.561233Z",
"name": "Chat Apps",
"description": "Direct messaging via chat app is an increasing method of delivery. These messages are often automated and new delivery and storage methods make them anonymous, viral, and ephemeral. This is a difficult space to monitor, but also a difficult space to build acclaim or notoriety.",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0043.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0043.md",
"external_id": "T0043"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--0196d599-d857-41f1-acd0-19a60c71543b",
"id": "bundle--29d77994-26c8-4911-935e-d7c19694c427",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--245d117b-2700-462e-97d4-be9b4b3745c4",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.921206Z",
"modified": "2022-07-03T23:52:02.921206Z",
"created": "2023-09-25T16:17:56.663835Z",
"modified": "2023-09-25T16:17:56.663835Z",
"name": "Employ Commercial Analytic Firms",
"description": "Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences. ",
"description": "Commercial analytic firms collect data on target audience activities and evaluate the data to detect trends, such as content receiving high click-rates. An influence operation may employ commercial analytic firms to facilitate external collection on its target audience, complicating attribution efforts and better tailoring the content to audience preferences.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0113.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0113.md",
"external_id": "T0113"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--2594c19d-6fe5-459f-8485-cbab0212ea3e.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--bd988825-4f09-41e2-9049-9f1d365003bf",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2594c19d-6fe5-459f-8485-cbab0212ea3e",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.579748Z",
"modified": "2023-09-25T14:19:03.579748Z",
"name": "Encourage",
"description": "Inspire, animate, or exhort a target to act. An actor can use propaganda, disinformation, or conspiracy theories to stimulate a target to act in its interest. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.001.md",
"external_id": "T0138.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--25e63104-3939-425b-a5db-2b9d14796686.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--97a88afc-67cf-4040-8a33-d0e122eb0882",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--25e63104-3939-425b-a5db-2b9d14796686",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.577361Z",
"modified": "2023-09-25T14:19:03.577361Z",
"name": "Generate Ad Revenue",
"description": "Earn income from digital advertisements published alongside inauthentic content. Conspiratorial, false, or provocative content drives internet traffic. Content owners earn money from impressions of, or clicks on, or conversions of ads published on their websites, social media profiles, or streaming services, or ads published when their content appears in search engine results. Fraudsters simulate impressions, clicks, and conversions, or they spin up inauthentic sites or social media profiles just to generate ad revenue. Conspiracy theorists and political operators generate ad revenue as a byproduct of their operation or as a means of sustaining their campaign. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.001.md",
"external_id": "T0137.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--b3ac089d-07cb-4a67-b631-f064beb3ce5c",
"id": "bundle--e3ebbeba-6868-4c0f-9f18-e4f2325027cd",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--27061558-ebf9-402b-b8e2-0c7c9d86aea5",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.920969Z",
"modified": "2022-07-03T23:52:02.920969Z",
"created": "2023-09-25T16:17:56.662034Z",
"modified": "2023-09-25T16:17:56.662034Z",
"name": "Radio",
"description": "Radio",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0111.003.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0111.003.md",
"external_id": "T0111.003"
}
],

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--283333f5-e161-4195-9070-5a7c22505adf.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--72cfae44-6fe2-43ef-b141-c834bf024653",
"id": "bundle--f3339f2a-fe80-445b-91be-a3e7b9fde7a2",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--283333f5-e161-4195-9070-5a7c22505adf",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.91702Z",
"modified": "2022-07-03T23:52:02.91702Z",
"name": "Co-opt Trusted Sources",
"description": "An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: \n- National or local new outlets \n- Research or academic publications \n- Online blogs or websites ",
"created": "2023-09-25T16:17:56.637907Z",
"modified": "2023-09-25T16:17:56.637907Z",
"name": "Co-Opt Trusted Sources",
"description": "An influence operation may co-opt trusted sources by infiltrating or repurposing a source to reach a target audience through existing, previously reliable networks. Co-opted trusted sources may include: - National or local new outlets - Research or academic publications - Online blogs or websites",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0100.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0100.md",
"external_id": "T0100"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--d1778e44-6aba-493a-a348-c222789d31a5",
"id": "bundle--1a0a7cea-9346-4b64-858f-921cf5a91016",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--283453fd-36c5-4d66-b24d-f29ea35fa8a1",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.913361Z",
"modified": "2022-07-03T23:52:02.913361Z",
"created": "2023-09-25T16:17:56.623306Z",
"modified": "2023-09-25T16:17:56.623306Z",
"name": "Create Anonymous Accounts",
"description": "Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation. ",
"description": "Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0090.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0090.001.md",
"external_id": "T0090.001"
}
],

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9.json
View File

@ -1,26 +1,26 @@
{
"type": "bundle",
"id": "bundle--fe7a9000-03bc-4f7d-9094-ace8736762dd",
"id": "bundle--1a57a61b-44d9-4f1c-9aeb-c83510a1b4e4",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--29dd92fd-fb77-4565-b58a-74795144c9a9",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.923053Z",
"modified": "2022-07-03T23:52:02.923053Z",
"name": "Post Across Disciplines",
"created": "2023-09-25T16:17:56.675855Z",
"modified": "2023-09-25T16:17:56.675855Z",
"name": "Post across Disciplines",
"description": "Post Across Disciplines",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "maximize-exposure"
"phase_name": "maximise-exposure"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0119.003.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0119.003.md",
"external_id": "T0119.003"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--4a78b86f-2a81-4c74-be3c-941fdefdf439",
"id": "bundle--0ec8031a-afdc-4610-8b51-b2e33efb1dba",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2b297e7b-51a7-4cfc-80da-fbc21c789a9e",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.92573Z",
"modified": "2022-07-03T23:52:02.92573Z",
"created": "2023-09-25T16:17:56.687957Z",
"modified": "2023-09-25T16:17:56.687957Z",
"name": "Encourage Physical Violence",
"description": "An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals. ",
"description": "An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0127.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0127.002.md",
"external_id": "T0127.002"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--45e0a756-4cfd-4425-a064-719608eaff94",
"id": "bundle--c5f8db5e-d6c3-4a1c-8069-c257d2bf994b",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2cb5fe24-da3f-4cc7-aa76-6e3d38c537a1",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.90826Z",
"modified": "2022-07-03T23:52:02.90826Z",
"created": "2023-09-25T16:17:56.602362Z",
"modified": "2023-09-25T16:17:56.602362Z",
"name": "Evaluate Media Surveys",
"description": "An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience\u2019s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.",
"description": "An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience\u2019s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0080.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0080.002.md",
"external_id": "T0080.002"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--fd250fa0-aae2-43c2-abbf-9918fe1b924c",
"id": "bundle--1e740e7e-7716-4bba-a102-e30d9cd2e144",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2d540add-b708-402a-93ff-f5aa50d30eb9",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.902719Z",
"modified": "2022-07-03T23:52:02.902719Z",
"created": "2023-09-25T16:17:56.562266Z",
"modified": "2023-09-25T16:17:56.562266Z",
"name": "Use Unencrypted Chats Apps",
"description": "Examples include SMS, etc.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0043.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0043.002.md",
"external_id": "T0043.002"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--1d06c678-db54-4f16-923d-f81b0270a54b",
"id": "bundle--70cae426-7cb8-46d0-b192-66a18437220b",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2d9a40e8-fbb5-40c7-b23e-61d5d92b5321",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.916523Z",
"modified": "2022-07-03T23:52:02.916523Z",
"created": "2023-09-25T16:17:56.635795Z",
"modified": "2023-09-25T16:17:56.635795Z",
"name": "Leverage Existing Inauthentic News Sites",
"description": "Leverage Existing Inauthentic News Sites",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0098.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0098.002.md",
"external_id": "T0098.002"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--2e61790e-1e44-48e4-91d0-45464b67572c.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--a638e9b6-aec0-4e2a-8119-0cba5e74403a",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2e61790e-1e44-48e4-91d0-45464b67572c",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.557443Z",
"modified": "2023-09-25T14:19:03.557443Z",
"name": "Thwart",
"description": "Prevent the successful outcome of a policy, operation, or initiative. Actors conduct influence operations to stymie or foil proposals, plans, or courses of action which are not in their interest. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.002.md",
"external_id": "T0135.002"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--2e8ddb66-1cf8-425b-8eea-8cc21d86d9f5.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--9ed0b650-93e3-4fee-82d3-b9a7ff5e585f",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2e8ddb66-1cf8-425b-8eea-8cc21d86d9f5",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.590444Z",
"modified": "2023-09-25T16:17:56.590444Z",
"name": "Economic Advantage",
"description": "Favourable position domestically or internationally in the realms of commerce, trade, finance, industry. Economics involves nation-states, corporations, banks, trade blocs, industry associations, cartels. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-strategy"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0074.003.md",
"external_id": "T0074.003"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--2f4b79f6-74d1-4951-8e01-4abc1ae514f6.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--7c01d6cf-7147-4bf0-a7ef-fc404d56c084",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--2f4b79f6-74d1-4951-8e01-4abc1ae514f6",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.718756Z",
"modified": "2023-09-25T16:17:56.718756Z",
"name": "Increase Prestige",
"description": "Improve personal standing within a community. Gain fame, approbation, or notoriety. Conspiracy theorists, those with special access, and ideologues can gain prominence in a community by propagating disinformation, leaking confidential documents, or spreading hate. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.008.md",
"external_id": "T0136.008"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--62b77793-064c-420e-b704-c9e207c1438e",
"id": "bundle--49274f7c-7e51-4a10-9f41-224176d246b6",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--314ecce1-6d89-4304-a149-1c3d8fddaf9e",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.920619Z",
"modified": "2022-07-03T23:52:02.920619Z",
"created": "2023-09-25T16:17:56.656146Z",
"modified": "2023-09-25T16:17:56.656146Z",
"name": "Traditional Media",
"description": "Examples include TV, Newspaper, Radio, etc.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0111.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0111.md",
"external_id": "T0111"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--93f509d1-5702-452a-944e-4445297bd180",
"id": "bundle--d88a72dc-ab3b-427c-84fd-5f854abd8a62",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--318f2a34-07b6-4c4b-9bb0-58f5bca681fc",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.922232Z",
"modified": "2022-07-03T23:52:02.922232Z",
"created": "2023-09-25T16:17:56.671099Z",
"modified": "2023-09-25T16:17:56.671099Z",
"name": "Comment or Reply on Content",
"description": "Delivering content by replying or commenting via owned media (assets that the operator controls). ",
"description": "Delivering content by replying or commenting via owned media (assets that the operator controls).",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0116.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0116.md",
"external_id": "T0116"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--31c33890-0c7e-4060-ae8a-b154af12740d.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--f8ebb140-9922-4586-931a-d078f8a4278d",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--31c33890-0c7e-4060-ae8a-b154af12740d",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.728771Z",
"modified": "2023-09-25T16:17:56.728771Z",
"name": "Dissuade from Acting",
"description": "Discourage, deter, or inhibit the target from actions which would be unfavourable to the attacker. The actor may want the target to refrain from voting, buying, fighting, or supplying. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0139.md",
"external_id": "T0139"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--6164b13a-f54c-4053-b88a-2dde05af19a8",
"id": "bundle--c1e7df4e-e357-491c-abc2-52824aeb0374",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--328ce801-be1a-4596-9961-008e1d9b85f7",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.902247Z",
"modified": "2022-07-03T23:52:02.902247Z",
"name": "Demand insurmountable proof",
"created": "2023-09-25T16:17:56.560097Z",
"modified": "2023-09-25T16:17:56.560097Z",
"name": "Demand Insurmountable Proof",
"description": "Campaigns often leverage tactical and informational asymmetries on the threat surface, as seen in the Distort and Deny strategies, and the \"firehose of misinformation\". Specifically, conspiracy theorists can be repeatedly wrong, but advocates of the truth need to be perfect. By constantly escalating demands for proof, propagandists can effectively leverage this asymmetry while also priming its future use, often with an even greater asymmetric advantage. The conspiracist is offered freer rein for a broader range of \"questions\" while the truth teller is burdened with higher and higher standards of proof.",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0040.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0040.md",
"external_id": "T0040"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--e684d3e4-90fc-4e8d-aba3-859125963534",
"id": "bundle--fde745b8-b26b-4ec6-998a-d0df32e6b3ed",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--32ddaf21-ebef-4270-9416-d9ef74bd23f6",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.927833Z",
"modified": "2022-07-03T23:52:02.927833Z",
"created": "2023-09-25T16:17:56.694715Z",
"modified": "2023-09-25T16:17:56.694715Z",
"name": "Redirect URLs",
"description": "An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection. ",
"description": "An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.008.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.008.md",
"external_id": "T0129.008"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--c6b0966c-faf8-4d27-a655-3bfff4279031",
"id": "bundle--e4fe910d-5992-4c9e-9700-21358991eca5",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--330de45e-8e37-4b57-95e4-fa75580b36a8",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.911262Z",
"modified": "2022-07-03T23:52:02.911262Z",
"created": "2023-09-25T16:17:56.616791Z",
"modified": "2023-09-25T16:17:56.616791Z",
"name": "Develop Inauthentic News Articles",
"description": "An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives. ",
"description": "An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0085.003.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0085.003.md",
"external_id": "T0085.003"
}
],

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--0fa77fa3-0597-4369-8f40-bc9e997228b6",
"id": "bundle--e09ee49f-efc8-46b5-ad8b-a4f0c337c00d",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--331a83bb-2e5b-4c49-9446-e78a8f25b4eb",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.92842Z",
"modified": "2022-07-03T23:52:02.92842Z",
"name": "Utilize Bulletproof Hosting",
"description": "Hosting refers to services through which storage and computing resources are provided to an individual or organization for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilize bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend. ",
"created": "2023-09-25T16:17:56.697724Z",
"modified": "2023-09-25T16:17:56.697724Z",
"name": "Utilise Bulletproof Hosting",
"description": "Hosting refers to services through which storage and computing resources are provided to an individual or organisation for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilise bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0130.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0130.002.md",
"external_id": "T0130.002"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3437993c-c521-4145-a2d8-b860399876b0.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--892a6780-4986-487d-915a-a69664805639",
"id": "bundle--70957dad-c2fd-42d4-9b1d-a64946ae8178",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3437993c-c521-4145-a2d8-b860399876b0",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.927243Z",
"modified": "2022-07-03T23:52:02.927243Z",
"created": "2023-09-25T16:17:56.690653Z",
"modified": "2023-09-25T16:17:56.690653Z",
"name": "Break Association with Content",
"description": "Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation. ",
"description": "Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.003.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0129.003.md",
"external_id": "T0129.003"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--348c10cd-e24e-409e-a6eb-983f85c1e590.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--5fd20bc1-bce5-4bea-a5ac-e090a78f92cd",
"id": "bundle--f0c6c5c7-8d81-4426-aac7-51a3ac94a32b",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--348c10cd-e24e-409e-a6eb-983f85c1e590",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.901053Z",
"modified": "2022-07-03T23:52:02.901053Z",
"created": "2023-09-25T16:17:56.550971Z",
"modified": "2023-09-25T16:17:56.550971Z",
"name": "Hijack Hashtags",
"description": "Hashtag hijacking occurs when users \u201c[use] a trending hashtag to promote topics that are substantially different from its recent context\u201d (VanDam and Tan, 2016) or \u201cto promote one\u2019s own social media agenda\u201d (Darius and Stephany, 2019).",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0019.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0019.002.md",
"external_id": "T0019.002"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--862cab2a-3626-4903-b909-c4923ca6facc",
"id": "bundle--b0b0c190-2e34-47d8-88de-a4aa362dc713",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--34cda40c-8d27-48a0-b27c-c953b75c453d",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.900315Z",
"modified": "2022-07-03T23:52:02.900315Z",
"created": "2023-09-25T16:17:56.548384Z",
"modified": "2023-09-25T16:17:56.548384Z",
"name": "Create Clickbait",
"description": "Create attention grabbing headlines (outrage, doubt, humor) required to drive traffic & engagement. This is a key asset.",
"description": "Create attention grabbing headlines (outrage, doubt, humour) required to drive traffic & engagement. This is a key asset.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0016.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0016.md",
"external_id": "T0016"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--1a3ef160-82a5-4ebb-90ed-6992283b4bd9",
"id": "bundle--1a37af76-1674-4215-b070-436efe42e556",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--35444e68-bb94-44ad-aecf-fff893f3d0ca",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.921468Z",
"modified": "2022-07-03T23:52:02.921468Z",
"name": "Social media",
"created": "2023-09-25T16:17:56.665004Z",
"modified": "2023-09-25T16:17:56.665004Z",
"name": "Social Media",
"description": "Social Media",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0114.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0114.001.md",
"external_id": "T0114.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--ebc27e8d-4062-4597-8889-a2ded622c83c",
"id": "bundle--941bb670-63e1-41b6-9395-7d4c33cbad42",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--35d89673-deef-482e-b30d-bb6883e47b12",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.919237Z",
"modified": "2022-07-03T23:52:02.919237Z",
"name": "Create dedicated hashtag",
"created": "2023-09-25T16:17:56.650615Z",
"modified": "2023-09-25T16:17:56.650615Z",
"name": "Create Dedicated Hashtag",
"description": "Create a campaign/incident specific hashtag.",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.006.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.006.md",
"external_id": "T0104.006"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--097108cb-1b43-43f2-8842-50f8e441f6df",
"id": "bundle--06885429-f9cf-4ca5-997d-4df6140844e9",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3621d01e-eb49-42d7-b646-6427a5693291",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.92443Z",
"modified": "2022-07-03T23:52:02.92443Z",
"created": "2023-09-25T16:17:56.684273Z",
"modified": "2023-09-25T16:17:56.684273Z",
"name": "Conduct Server Redirect",
"description": "A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.",
"description": "A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side or client-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0123.004.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0123.004.md",
"external_id": "T0123.004"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--8b897270-4165-421d-8298-155f08b8fa38",
"id": "bundle--57b9d162-1470-49b9-8921-f4a66278588d",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--36f4dc58-e164-4819-83f8-52875377ff16",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.902601Z",
"modified": "2022-07-03T23:52:02.902601Z",
"created": "2023-09-25T16:17:56.561668Z",
"modified": "2023-09-25T16:17:56.561668Z",
"name": "Use Encrypted Chat Apps",
"description": "Examples include Signal, WhatsApp, Discord, Wire, etc.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0043.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0043.001.md",
"external_id": "T0043.001"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--374a3d2d-9df5-41d3-b6ea-ee92bf9c7643.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--700e940c-b6dd-4b81-b778-6c0b7f74a835",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--374a3d2d-9df5-41d3-b6ea-ee92bf9c7643",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.5588Z",
"modified": "2023-09-25T14:19:03.5588Z",
"name": "Cultivate Support",
"description": "Grow or maintain the base of support for the actor, ally, or action. This includes hard core recruitment, managing alliances, and generating or maintaining sympathy among a wider audience, including reputation management and public relations. Sub-techniques assume support for actor (self) unless otherwise specified. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.md",
"external_id": "T0136"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": false,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--afdf596a-8fa6-4124-8ba0-57b69da6d210",
"id": "bundle--f4b16241-d9ec-4469-93c9-33593829021b",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--37a192dd-8b33-482e-ba7a-b5a7b4f704b9",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.914589Z",
"modified": "2022-07-03T23:52:02.914589Z",
"created": "2023-09-25T16:17:56.630048Z",
"modified": "2023-09-25T16:17:56.630048Z",
"name": "Use Follow Trains",
"description": "A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups. ",
"description": "A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0092.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0092.002.md",
"external_id": "T0092.002"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--ef177071-6d4d-4be2-901c-27078683007f",
"id": "bundle--8a8d6b6f-e087-409f-bc08-3150760a4ed0",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3845d1f0-db88-41bb-95bf-8741ff9e72ea",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.9131Z",
"modified": "2022-07-03T23:52:02.9131Z",
"created": "2023-09-25T16:17:56.622228Z",
"modified": "2023-09-25T16:17:56.622228Z",
"name": "Alter Authentic Documents",
"description": "Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic can be \"leaked\" during later stages in the operation.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0089.003.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0089.003.md",
"external_id": "T0089.003"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--59f501c4-1315-4568-bd0b-df3e353ec348",
"id": "bundle--6b76d491-eab9-45bd-ae52-9cc36b2acf32",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3875e864-64d8-4ceb-8aa2-ef6e79224a85",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.915775Z",
"modified": "2022-07-03T23:52:02.915775Z",
"created": "2023-09-25T16:17:56.633693Z",
"modified": "2023-09-25T16:17:56.633693Z",
"name": "Create Content Farms",
"description": "An influence operation may create an organization for creating and amplifying campaign artifacts at scale.",
"description": "An influence operation may create an organisation for creating and amplifying campaign artefacts at scale.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0096.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0096.001.md",
"external_id": "T0096.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--7227c3ea-7826-4815-808a-ef860c238308",
"id": "bundle--fbdc843e-96fc-46b8-9914-be814206754d",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--394089a7-cd71-4e16-aef9-d7b885d421f1",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.925381Z",
"modified": "2022-07-03T23:52:02.925381Z",
"name": "Facilitate logistics or support for attendance",
"created": "2023-09-25T16:17:56.68731Z",
"modified": "2023-09-25T16:17:56.68731Z",
"name": "Facilitate Logistics or Support for Attendance",
"description": "Facilitate logistics or support for travel, food, housing, etc.",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0126.002.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0126.002.md",
"external_id": "T0126.002"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--b01a3ef4-beff-4a99-839a-5528bad900fd",
"id": "bundle--4d401c0a-8949-4b06-8392-c83f69b24f4d",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--39ceaac8-e5f8-49be-95cf-0cbad07dfe72",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.917731Z",
"modified": "2022-07-03T23:52:02.917731Z",
"name": "Use existing Echo Chambers/Filter Bubbles",
"created": "2023-09-25T16:17:56.644763Z",
"modified": "2023-09-25T16:17:56.644763Z",
"name": "Use Existing Echo Chambers/Filter Bubbles",
"description": "Use existing Echo Chambers/Filter Bubbles",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0102.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0102.001.md",
"external_id": "T0102.001"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3a9b4f90-2f59-4200-91a6-1cfd29157a28.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--d129c655-4f8a-4e0e-9677-a5a40056d151",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3a9b4f90-2f59-4200-91a6-1cfd29157a28",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.724288Z",
"modified": "2023-09-25T16:17:56.724288Z",
"name": "Sell Items under False Pretences",
"description": "Offer products for sale under false pretences. Campaigns may hijack or create causes built on disinformation to sell promotional merchandise. Or charlatans may amplify victims\u2019 unfounded fears to sell them items of questionable utility such as supplements or survival gear. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0137.004.md",
"external_id": "T0137.004"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3aa19ee4-7c0f-4108-b4ff-d7cbb37f7f66.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--4745f51a-b5e3-4685-ba6e-4c83eef0a5e2",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3aa19ee4-7c0f-4108-b4ff-d7cbb37f7f66",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.715365Z",
"modified": "2023-09-25T16:17:56.715365Z",
"name": "Polarise",
"description": "To cause a target audience to divide into two completely opposing groups. This is a special case of subversion. To divide and conquer is an age-old approach to subverting and overcoming an enemy.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0135.004.md",
"external_id": "T0135.004"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3ad5d98f-a138-4e8a-bbfa-24106e74dab2.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--57240dac-96dc-46c4-af40-d99226d12f8a",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3ad5d98f-a138-4e8a-bbfa-24106e74dab2",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.57444Z",
"modified": "2023-09-25T14:19:03.57444Z",
"name": "Cultvate Support for Initiative",
"description": "Elevate or fortify the public backing for a policy, operation, or idea. Domestic and foreign actors can use artificial means to fabricate or amplify public support for a proposal or action. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.005.md",
"external_id": "T0136.005"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3ae4fb28-4864-468d-8085-cb8035cbb272.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--8d04a0bd-81f7-4f6f-a353-de21ff63af11",
"id": "bundle--839afbed-8398-44e9-83e2-ab119851aafb",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3ae4fb28-4864-468d-8085-cb8035cbb272",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.916661Z",
"modified": "2022-07-03T23:52:02.916661Z",
"created": "2023-09-25T16:17:56.636164Z",
"modified": "2023-09-25T16:17:56.636164Z",
"name": "Prepare Assets Impersonating Legitimate Entities",
"description": "An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognizable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organizations, or state entities. \nAn influence operation may use a wide variety of cyber techniques to impersonate a legitimate entity\u2019s website or social media account. Typosquatting87 is the international registration of a domain name with purposeful variations of the impersonated domain name through intentional typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation of falsified websites by creating similar domain names in the URL box, leaving it to the user to confirm that the URL is correct. ",
"description": "An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognisable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organisations, or state entities. An influence operation may use a wide variety of cyber techniques to impersonate a legitimate entity\u2019s website or social media account. Typosquatting87 is the international registration of a domain name with purposeful variations of the impersonated domain name through intentional typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation of falsified websites by creating similar domain names in the URL box, leaving it to the user to confirm that the URL is correct.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0099.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0099.md",
"external_id": "T0099"
}
],

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--3dda4d2f-5aa6-4ed2-b127-55b068401173",
"id": "bundle--3c001660-0994-46bb-a356-b0d180d2afbe",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3bc92e69-67e4-405a-a6fb-a2d742395c45",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.89989Z",
"modified": "2022-07-03T23:52:02.89989Z",
"name": "Raise funds from malign actors",
"description": "Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc. ",
"created": "2023-09-25T16:17:56.547204Z",
"modified": "2023-09-25T16:17:56.547204Z",
"name": "Raise Funds from Malign Actors",
"description": "Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0014.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0014.001.md",
"external_id": "T0014.001"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3fc4c436-9d09-4f3e-9ade-afe37a30c362.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--a319d5b4-9c53-41fe-89ee-70eb5135641e",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3fc4c436-9d09-4f3e-9ade-afe37a30c362",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T16:17:56.732466Z",
"modified": "2023-09-25T16:17:56.732466Z",
"name": "Defame",
"description": "Attempt to damage the target\u2019s personal reputation by impugning their character. This can range from subtle attempts to misrepresent or insinuate, to obvious attempts to denigrate or disparage, to blatant attempts to malign or vilify. Slander applies to oral expression. Libel applies to written or pictorial material. Defamation is often carried out by online trolls. The sole aim here is to cause harm to the target. If the threat actor uses defamation as a means of undermining the target, then choose sub-technique \u201cSmear\u201d of technique \u201cUndermine\u201d instead. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0140.001.md",
"external_id": "T0140.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--15648f53-8c1e-485b-bcd0-4013db9bc03e",
"id": "bundle--e222b4e4-f6d8-48a3-918a-81eb82e53356",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--3fd63a63-f597-40e5-9f6e-0aab00d4dc14",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.906762Z",
"modified": "2022-07-03T23:52:02.906762Z",
"created": "2023-09-25T16:17:56.586611Z",
"modified": "2023-09-25T16:17:56.586611Z",
"name": "Psychographic Segmentation",
"description": "An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes. ",
"description": "An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0072.004.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0072.004.md",
"external_id": "T0072.004"
}
],

8
generated_files/DISARM_STIX/attack-pattern/attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271.json
View File

@ -1,14 +1,14 @@
{
"type": "bundle",
"id": "bundle--df3622c2-d57b-4f8c-b0e8-76f0fde98d58",
"id": "bundle--1e5fc844-3f42-4cde-9772-07f1df06135a",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--404f0dd5-81d8-4d96-ad36-875a58c27271",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.918562Z",
"modified": "2022-07-03T23:52:02.918562Z",
"created": "2023-09-25T16:17:56.647861Z",
"modified": "2023-09-25T16:17:56.647861Z",
"name": "Mainstream Social Networks",
"description": "Examples include Facebook, Twitter, LinkedIn, etc.",
"kill_chain_phases": [
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0104.001.md",
"external_id": "T0104.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--f817e151-b579-450e-b381-a988c1db2a20",
"id": "bundle--babba90b-5cfa-4f2e-8896-ce7cfad22e93",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.917967Z",
"modified": "2022-07-03T23:52:02.917967Z",
"created": "2023-09-25T16:17:56.645644Z",
"modified": "2023-09-25T16:17:56.645644Z",
"name": "Exploit Data Voids",
"description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. \nA 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalizing on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term. ",
"description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0102.003.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0102.003.md",
"external_id": "T0102.003"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--90aea2cf-82c0-491b-9e92-800adf6e79cb",
"id": "bundle--64a79515-06e4-4c33-8deb-aa9a7b38448e",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--41062c4b-a462-419a-bad9-7f3f720f090b",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.908749Z",
"modified": "2022-07-03T23:52:02.908749Z",
"created": "2023-09-25T16:17:56.606169Z",
"modified": "2023-09-25T16:17:56.606169Z",
"name": "Identify Social and Technical Vulnerabilities",
"description": "Identifying social and technical vulnerabilities determines weaknesses within the target audience information environment for later exploitation. Vulnerabilities include decisive political issues, weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment. \nIdentifying social and technical vulnerabilities facilitates the later exploitation of the identified weaknesses to advance operation objectives. ",
"description": "Identifying social and technical vulnerabilities determines weaknesses within the target audience information environment for later exploitation. Vulnerabilities include decisive political issues, weak cybersecurity infrastructure, search engine data voids, and other technical and non technical weaknesses in the target information environment. Identifying social and technical vulnerabilities facilitates the later exploitation of the identified weaknesses to advance operation objectives.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.md",
"external_id": "T0081"
}
],

14
generated_files/DISARM_STIX/attack-pattern/attack-pattern--4282febe-c8a6-46da-863c-f19081615d80.json
View File

@ -1,26 +1,26 @@
{
"type": "bundle",
"id": "bundle--b7a46dc9-fa2b-4946-88b8-dc6ec6a2e5cb",
"id": "bundle--9f222bb2-514d-428c-a048-f310b6766320",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--4282febe-c8a6-46da-863c-f19081615d80",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.904609Z",
"modified": "2022-07-03T23:52:02.904609Z",
"name": "Utilize Spamoflauge",
"description": "Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, \"you've w0n our jackp0t!\". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging. ",
"created": "2023-09-25T16:17:56.57385Z",
"modified": "2023-09-25T16:17:56.57385Z",
"name": "Utilise Spamoflauge",
"description": "Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, \"you've w0n our jackp0t!\". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "maximize-exposure"
"phase_name": "maximise-exposure"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.004.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0049.004.md",
"external_id": "T0049.004"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--9884f944-dff2-4b86-b084-a1f536b22663",
"id": "bundle--3838a234-bf8c-4cfb-ab62-e2979906641d",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--444c403e-a73f-4b78-9ffd-556f1dd29039",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.915543Z",
"modified": "2022-07-03T23:52:02.915543Z",
"created": "2023-09-25T16:17:56.632961Z",
"modified": "2023-09-25T16:17:56.632961Z",
"name": "Develop Owned Media Assets",
"description": "An owned media asset refers to an agency or organization through which an influence operation may create, develop, and host content and narratives. Owned media assets include websites, blogs, social media pages, forums, and other platforms that facilitate the creation and organization of content.",
"description": "An owned media asset refers to an agency or organisation through which an influence operation may create, develop, and host content and narratives. Owned media assets include websites, blogs, social media pages, forums, and other platforms that facilitate the creation and organisation of content.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0095.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0095.md",
"external_id": "T0095"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--2311391d-090d-40cd-81e7-d42fb705ed62",
"id": "bundle--0137cfa4-b0ba-41da-869a-9e79398db70a",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--45ab5d9e-88ee-494c-971b-6e4babf1dc34",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.908505Z",
"modified": "2022-07-03T23:52:02.908505Z",
"created": "2023-09-25T16:17:56.603123Z",
"modified": "2023-09-25T16:17:56.603123Z",
"name": "Conduct Web Traffic Analysis",
"description": "An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.",
"description": "An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0080.004.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0080.004.md",
"external_id": "T0080.004"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--26b59b11-8cec-421d-b817-fe497eddee32",
"id": "bundle--c736365e-18c7-4c46-adb4-c8abd29b935e",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--45d10a80-a2f7-4626-ae2c-dae8cf144157",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.908869Z",
"modified": "2022-07-03T23:52:02.908869Z",
"created": "2023-09-25T16:17:56.607352Z",
"modified": "2023-09-25T16:17:56.607352Z",
"name": "Find Echo Chambers",
"description": "Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with. ",
"description": "Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0081.001.md",
"external_id": "T0081.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--61040d31-308b-4800-ab99-a9b128729208",
"id": "bundle--0e53788a-9453-4465-8f13-9226eec32027",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--45dae307-ba74-4038-90ef-2282a32e38b9",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.901652Z",
"modified": "2022-07-03T23:52:02.901652Z",
"name": "Distort facts",
"created": "2023-09-25T16:17:56.554157Z",
"modified": "2023-09-25T16:17:56.554157Z",
"name": "Distort Facts",
"description": "Change, twist, or exaggerate existing facts to construct a narrative that differs from reality. Examples: images and ideas can be distorted by being placed in an improper content",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0023.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0023.md",
"external_id": "T0023"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--46f79206-5dfb-4590-b864-ad9d2a0012ad.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--1a098c7c-0699-4938-aefc-f57578f8673d",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--46f79206-5dfb-4590-b864-ad9d2a0012ad",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.580031Z",
"modified": "2023-09-25T14:19:03.580031Z",
"name": "Provoke",
"description": "Instigate, incite, or arouse a target to act. Social media manipulators exploit moral outrage to propel targets to spread hate, take to the streets to protest, or engage in acts of violence. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0138.002.md",
"external_id": "T0138.002"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--6da0e4cc-4d15-4454-88fe-5e05b5f41cba",
"id": "bundle--e3de4a3b-78e1-458b-b410-44c260185b18",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--47fb2b79-fab3-421f-b989-47ee312f727d",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.914471Z",
"modified": "2022-07-03T23:52:02.914471Z",
"name": "Create Organizations",
"description": "Influence operations may establish organizations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.",
"created": "2023-09-25T16:17:56.629682Z",
"modified": "2023-09-25T16:17:56.629682Z",
"name": "Create Organisations",
"description": "Influence operations may establish organisations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0092.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0092.001.md",
"external_id": "T0092.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--d430c59c-34c2-4815-a395-3c56bfe569df",
"id": "bundle--61580419-8a54-4441-9726-f1432a13a237",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--4a1d1dad-6784-42be-a7cd-1653cf8f34cc",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.917614Z",
"modified": "2022-07-03T23:52:02.917614Z",
"created": "2023-09-25T16:17:56.643292Z",
"modified": "2023-09-25T16:17:56.643292Z",
"name": "Leverage Echo Chambers/Filter Bubbles",
"description": "An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with \u201cothers with which they are already in agreement.\u201d A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members. ",
"description": "An echo chamber refers to an internet subgroup, often along ideological lines, where individuals only engage with \u201cothers with which they are already in agreement.\u201d A filter bubble refers to an algorithm's placement of an individual in content that they agree with or regularly engage with, possibly entrapping the user into a bubble of their own making. An operation may create these isolated areas of the internet by match existing groups, or aggregating individuals into a single target audience based on shared interests, politics, values, demographics, and other characteristics. Echo chambers and filter bubbles help to reinforce similar biases and content to the same target audience members.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0102.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0102.md",
"external_id": "T0102"
}
],

39
generated_files/DISARM_STIX/attack-pattern/attack-pattern--4b638832-557c-41e4-80f8-070de328d694.json Normal file
View File

@ -0,0 +1,39 @@
{
"type": "bundle",
"id": "bundle--c71547a5-635b-4c72-9f44-5295c9ec2a43",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--4b638832-557c-41e4-80f8-070de328d694",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2023-09-25T14:19:03.559372Z",
"modified": "2023-09-25T14:19:03.559372Z",
"name": "Defend Reputaton",
"description": "Preserve a positive perception in the public\u2019s mind following an accusation or adverse event. When accused of a wrongful act, an actor may engage in denial, counter accusations, whataboutism, or conspiracy theories to distract public attention and attempt to maintain a positive image. ",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
"phase_name": "plan-objectives"
}
],
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0136.001.md",
"external_id": "T0136.001"
}
],
"object_marking_refs": [
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
],
"x_mitre_is_subtechnique": true,
"x_mitre_platforms": [
"Windows",
"Linux",
"Mac"
],
"x_mitre_version": "2.1"
}
]
}

12
generated_files/DISARM_STIX/attack-pattern/attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--aede04fa-9443-4ae1-9789-a7cb6e9e10e3",
"id": "bundle--cf67488e-2c88-4ca2-8506-5badeebad00a",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--4c5e704a-acca-4bbd-8980-c915c0424ff8",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.930657Z",
"modified": "2022-07-03T23:52:02.930657Z",
"name": "Message reach",
"description": "Monitor and evaluate message reach in misinformation incidents. ",
"created": "2023-09-25T16:17:56.71158Z",
"modified": "2023-09-25T16:17:56.71158Z",
"name": "Message Reach",
"description": "Monitor and evaluate message reach in misinformation incidents.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0134.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0134.001.md",
"external_id": "T0134.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--97e2985c-4caa-4032-8c8d-633faab797a6",
"id": "bundle--09595db4-c32a-4abe-b0be-541ff5442607",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--4cb308a9-073c-49d3-81ed-894cf9b95acc",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.915298Z",
"modified": "2022-07-03T23:52:02.915298Z",
"name": "Identify susceptible targets in networks",
"created": "2023-09-25T16:17:56.632178Z",
"modified": "2023-09-25T16:17:56.632178Z",
"name": "Identify Susceptible Targets in Networks",
"description": "When seeking to infiltrate an existing network, an influence operation may identify individuals and groups that might be susceptible to being co-opted or influenced.",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0094.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0094.001.md",
"external_id": "T0094.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35.json
View File

@ -1,16 +1,16 @@
{
"type": "bundle",
"id": "bundle--8d6e615b-cbbc-4a98-836b-103826edb3ef",
"id": "bundle--a55645b8-26b9-490a-9f5a-79e40d635fc1",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--4cd719a9-e817-4acc-9581-6b6a60e42f35",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.910226Z",
"modified": "2022-07-03T23:52:02.910226Z",
"created": "2023-09-25T16:17:56.61373Z",
"modified": "2023-09-25T16:17:56.61373Z",
"name": "Use Copypasta",
"description": "Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta\u2019s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text. ",
"description": "Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta\u2019s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text.",
"kill_chain_phases": [
{
"kill_chain_name": "mitre-attack",
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0084.001.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0084.001.md",
"external_id": "T0084.001"
}
],

10
generated_files/DISARM_STIX/attack-pattern/attack-pattern--4d86424a-26a1-4d9f-bc32-619620a18a8d.json
View File

@ -1,15 +1,15 @@
{
"type": "bundle",
"id": "bundle--9c477b4f-b99a-4aa0-9a09-97fbe4657034",
"id": "bundle--84509329-7bf2-419e-957d-d8c382046344",
"objects": [
{
"type": "attack-pattern",
"spec_version": "2.1",
"id": "attack-pattern--4d86424a-26a1-4d9f-bc32-619620a18a8d",
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
"created": "2022-07-03T23:52:02.899482Z",
"modified": "2022-07-03T23:52:02.899482Z",
"name": "Compromise legitimate accounts",
"created": "2023-09-25T16:17:56.545329Z",
"modified": "2023-09-25T16:17:56.545329Z",
"name": "Compromise Legitimate Accounts",
"description": "Hack or take over legimate accounts to distribute misinformation or damaging content.",
"kill_chain_phases": [
{
@ -20,7 +20,7 @@
"external_references": [
{
"source_name": "mitre-attack",
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0011.md",
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0011.md",
"external_id": "T0011"
}
],

Some files were not shown because too many files have changed in this diff Show More