subtechnique description updates

Updated subtechniques so that now all have a description. Also made slight name changes to a few techniques and subtechniques but retained the disarm_id and overall nature of all of them
This commit is contained in:
Mike Klein 2022-07-02 15:40:09 -04:00
parent 1da43f79e0
commit c888a7d6f4
683 changed files with 6677 additions and 6679 deletions

View file

@ -1,6 +1,6 @@
# Technique T0009.001: Utilize Academic/Pseudoscientific Justifications
* **Summary**:
* **Summary**: Utilize Academic/Pseudoscientific Justifications
* **Belongs to tactic stage**: TA16

View file

@ -1,6 +1,6 @@
# Technique T0014.001: From bad actors
# Technique T0014.001: Raise funds from malign actors
* **Summary**:
* **Summary**: Raising funds from malign actors may include contributions from foreign agents, cutouts or proxies, shell companies, dark money groups, etc.
* **Belongs to tactic stage**: TA15

View file

@ -1,6 +1,6 @@
# Technique T0014.002: From ignorant agents
# Technique T0014.002: Raise funds from ignorant agents
* **Summary**:
* **Summary**: Raising funds from ignorant agents may include scams, donations intended for one stated purpose but then used for another, etc.
* **Belongs to tactic stage**: TA15

View file

@ -1,6 +1,6 @@
# Technique T0017.001: Conduct Crowdfunding Campaigns
* **Summary**:
* **Summary**: An influence operation may Conduct Crowdfunding Campaigns on platforms such as GoFundMe, GiveSendGo, Tipeee, Patreon, etc.
* **Belongs to tactic stage**: TA10

View file

@ -1,6 +1,6 @@
# Technique T0019.002: Hijack Hashtags
* **Summary**:
* **Summary**: Hashtag hijacking occurs when users “[use] a trending hashtag to promote topics that are substantially different from its recent context” (VanDam and Tan, 2016) or “to promote ones own social media agenda” (Darius and Stephany, 2019).
* **Belongs to tactic stage**: TA06

View file

@ -1,6 +1,6 @@
# Technique T0022.001: Amplify Existing Conspiracy Theory Narrative
# Technique T0022.001: Amplify Existing Conspiracy Theory Narratives
* **Summary**:
* **Summary**: An influence operation may amplify an existing conspiracy theory narrative that aligns with its incident or campaign goals. By amplifying existing conspiracy theory narratives, operators can leverage the power of the existing communities that support and propagate those theories without needing to expend resources creating new narratives or building momentum and buy in around new narratives.
* **Belongs to tactic stage**: TA14

View file

@ -1,6 +1,6 @@
# Technique T0022.002: Develop Original Conspiracy Theory Narratives
* **Summary**:
* **Summary**: While this requires more resources than amplifying existing conspiracy theory narratives, an influence operation may develop original conspiracy theory narratives in order to achieve greater control and alignment over the narrative and their campaign goals. Prominent examples include the USSR's Operation INFEKTION disinformation campaign run by the KGB in the 1980s to plant the idea that the United States had invented HIV/AIDS as part of a biological weapons research project at Fort Detrick, Maryland. More recently, Fort Detrick featured prominently in a new conspiracy theory narratives around the origins of the COVID-19 outbreak and pandemic.
* **Belongs to tactic stage**: TA14

View file

@ -1,6 +1,6 @@
# Technique T0043.001: Use Encrypted Chat Apps
* **Summary**:
* **Summary**: Examples include Signal, WhatsApp, Discord, Wire, etc.
* **Belongs to tactic stage**: TA07

View file

@ -1,6 +1,6 @@
# Technique T0043.002: Use Unencrypted Chats Apps
* **Summary**:
* **Summary**: Examples include SMS, etc.
* **Belongs to tactic stage**: TA07

View file

@ -1,6 +1,6 @@
# Technique T0084.002: Plagiarize Content
* **Summary**:
* **Summary**: An influence operation may take content from other sources without proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources.
* **Belongs to tactic stage**: TA06

View file

@ -1,6 +1,6 @@
# Technique T0084.003: Deceptively Labeled or Translated
* **Summary**:
* **Summary**: An influence operation may take authentic content from other sources and add deceptive labels or deceptively translate the content into other langauges.
* **Belongs to tactic stage**: TA06

View file

@ -1,6 +1,6 @@
# Technique T0084.004: Appropriate Content
* **Summary**:
* **Summary**: An influence operation may take content from other sources with proper attribution. This content may be either misinformation content shared by others without malicious intent but now leveraged by the campaign as disinformation or disinformation content from other sources. Examples include the appropriation of content from one inauthentic news site to another inauthentic news site or network in ways that align with the originators licensing or terms of service.
* **Belongs to tactic stage**: TA06

View file

@ -1,6 +1,6 @@
# Technique T0085.002: Develop False or Altered Documents
* **Summary**:
* **Summary**: Develop False or Altered Documents
* **Belongs to tactic stage**: TA06

View file

@ -1,6 +1,6 @@
# Technique T0085.003: Develop Inauthentic News Articles
* **Summary**:
* **Summary**: An influence operation may develop false or misleading news articles aligned to their campaign goals or narratives.
* **Belongs to tactic stage**: TA06

View file

@ -1,4 +1,4 @@
# Technique T0086.003: Deceptively Edit Image (Cheap fakes)
# Technique T0086.003: Deceptively Edit Images (Cheap fakes)
* **Summary**: Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.

View file

@ -1,6 +1,6 @@
# Technique T0086.004: Aggregate Information into Evidence Collages
* **Summary**: image files that aggregate positive evidence (Joan Donovan)
* **Summary**: Image files that aggregate positive evidence (Joan Donovan)
* **Belongs to tactic stage**: TA06

View file

@ -1,6 +1,6 @@
# Technique T0089.001: Leak Authentic Documents
# Technique T0089.001: Obtain Authentic Documents
* **Summary**:
* **Summary**: Procure authentic documents that are not publicly available, by whatever means -- whether legal or illegal, highly-resourced or less so. These documents can be "leaked" during later stages in the operation.
* **Belongs to tactic stage**: TA06

View file

@ -1,6 +1,6 @@
# Technique T0089.002: Leak False Documents
# Technique T0089.002: Create Inauthentic Documents
* **Summary**:
* **Summary**: Create inauthentic documents intended to appear as if they are authentic non-public documents. These documents can be "leaked" during later stages in the operation.
* **Belongs to tactic stage**: TA06

View file

@ -1,6 +1,6 @@
# Technique T0089.003: Leak Altered Documents
# Technique T0089.003: Alter Authentic Documents
* **Summary**: Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources.
* **Summary**: Alter authentic documents (public or non-public) to achieve campaign goals. The altered documents are intended to appear as if they are authentic can be "leaked" during later stages in the operation.
* **Belongs to tactic stage**: TA06

View file

@ -1,6 +1,6 @@
# Technique T0091.001: Recruit Contractors
* **Summary**:
* **Summary**: Operators recruit paid contractor to support the campaign.
* **Belongs to tactic stage**: TA15

View file

@ -1,6 +1,6 @@
# Technique T0091.002: Recruit Partisans
* **Summary**:
* **Summary**: Operators recruit partisans (ideologically-aligned individuals) to support the campaign.
* **Belongs to tactic stage**: TA15

View file

@ -1,4 +1,4 @@
# Technique T0091: Recruit bad actors
# Technique T0091: Recruit malign actors
* **Summary**: Operators recruit bad actors paying recruiting, or exerting control over individuals includes trolls, partisans, and contractors.

View file

@ -1,6 +1,6 @@
# Technique T0092.002: Follow Trains
# Technique T0092.002: Use Follow Trains
* **Summary**:
* **Summary**: A follow train is a group of people who follow each other on a social media platform, often as a way for an individual or campaign to grow its social media following. Follow trains may be a violation of platform Terms of Service. They are also known as follow-for-follow groups.
* **Belongs to tactic stage**: TA15

View file

@ -1,6 +1,6 @@
# Technique T0092.003: Create Community or Sub-group
* **Summary**:
* **Summary**: When there is not an existing community or sub-group that meets a campaign's goals, an influence operation may seek to create a community or sub-group.
* **Belongs to tactic stage**: TA15

View file

@ -1,6 +1,6 @@
# Technique T0093.002: Botnets
# Technique T0093.002: Acquire Botnets
* **Summary**:
* **Summary**: A botnet is a group of bots that can function in coordination with each other.
* **Belongs to tactic stage**: TA15

View file

@ -1,4 +1,4 @@
# Technique T0093: Acquire/ recruit Network
# Technique T0093: Acquire/Recruit Network
* **Summary**: Operators acquire an existing network by paying, recruiting, or exerting control over the leaders of the existing network.

View file

@ -1,6 +1,6 @@
# Technique T0094.001: Identify susceptible targets in networks
* **Summary**:
* **Summary**: When seeking to infiltrate an existing network, an influence operation may identify individuals and groups that might be susceptible to being co-opted or influenced.
* **Belongs to tactic stage**: TA15

View file

@ -1,4 +1,4 @@
# Technique T0094.002: Utilize Butterfly Attack
# Technique T0094.002: Utilize Butterfly Attacks
* **Summary**: Butterfly attacks occur when operators pretend to be members of a certain social group, usually a group that struggles for representation. An influence operation may mimic a group to insert controversial statements into the discourse, encourage the spread of operation content, or promote harassment among group members. Unlike astroturfing, butterfly attacks aim to infiltrate and discredit existing grassroots movements, organizations, and media campaigns.

View file

@ -1,6 +1,6 @@
# Technique T0096.001: Create a Content Farm
# Technique T0096.001: Create Content Farms
* **Summary**:
* **Summary**: An influence operation may create an organization for creating and amplifying campaign artifacts at scale.
* **Belongs to tactic stage**: TA15

View file

@ -1,4 +1,4 @@
# Technique T0096: Leverage Content Farm
# Technique T0096: Leverage Content Farms
* **Summary**: Using the services of large-scale content providers for creating and amplifying campaign artifacts at scale.

View file

@ -1,6 +1,6 @@
# Technique T0098.001: Create Inauthentic News Sites
* **Summary**:
* **Summary**: Create Inauthentic News Sites
* **Belongs to tactic stage**: TA16

View file

@ -1,7 +1,6 @@
# Technique T0098.002: Leverage Existing Inauthentic News Sites
* **Summary**: An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognizable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organizations, or state entities.
An influence operation may use a wide variety of cyber techniques to impersonate a legitimate entitys website or social media account. Typosquatting87 is the international registration of a domain name with purposeful variations of the impersonated domain name through intentional typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation of falsified websites by creating similar domain names in the URL box, leaving it to the user to confirm that the URL is correct.
* **Summary**: Leverage Existing Inauthentic News Sites
* **Belongs to tactic stage**: TA16

View file

@ -1,6 +1,6 @@
# Technique T0099.002: Spoof/parody account/site
* **Summary**:
* **Summary**: An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognizable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organizations, or state entities.
* **Belongs to tactic stage**: TA16

View file

@ -1,6 +1,6 @@
# Technique T0100.001: Co-Opt Trusted Individuals
* **Summary**:
* **Summary**: Co-Opt Trusted Individuals
* **Belongs to tactic stage**: TA16

View file

@ -1,6 +1,6 @@
# Technique T0100.002: Co-Opt Grassroots Groups
* **Summary**:
* **Summary**: Co-Opt Grassroots Groups
* **Belongs to tactic stage**: TA16

View file

@ -1,6 +1,6 @@
# Technique T0100.003: Co-opt Influencers
* **Summary**:
* **Summary**: Co-opt Influencers
* **Belongs to tactic stage**: TA16

View file

@ -1,6 +1,6 @@
# Technique T0102.001: Use existing Echo Chambers/Filter Bubbles
* **Summary**:
* **Summary**: Use existing Echo Chambers/Filter Bubbles
* **Belongs to tactic stage**: TA05

View file

@ -1,6 +1,6 @@
# Technique T0102.002: Create Echo Chambers/Filter Bubbles
* **Summary**:
* **Summary**: Create Echo Chambers/Filter Bubbles
* **Belongs to tactic stage**: TA05

View file

@ -1,6 +1,6 @@
# Technique T0104.001: Mainstream Social Networks
* **Summary**: Examples include Facebook, Twitter, LinkedIn, VK,
* **Summary**: Examples include Facebook, Twitter, LinkedIn, etc.
* **Belongs to tactic stage**: TA07

View file

@ -1,6 +1,6 @@
# Technique T0104.002: Dating Apps
* **Summary**:
* **Summary**: A video livestream refers to an online video broadcast capability that allows for real-time communication to closed or open networks. Examples include Facebook Live, Instagram, Youtube, Tik Tok, and Twitter.
* **Belongs to tactic stage**: TA07

View file

@ -1,6 +1,6 @@
# Technique T0104.003: Private/Closed Social Networks
* **Summary**:
* **Summary**: An audio livestream refers to an online audio broadcast capability that allows for real-time communication to closed or open networks. Examples include Twitter Spaces,
* **Belongs to tactic stage**: TA07

View file

@ -1,6 +1,6 @@
# Technique T0111.001: TV
* **Summary**:
* **Summary**: TV
* **Belongs to tactic stage**: TA07

View file

@ -1,6 +1,6 @@
# Technique T0111.002: Newspaper
* **Summary**:
* **Summary**: Newspaper
* **Belongs to tactic stage**: TA07

View file

@ -1,6 +1,6 @@
# Technique T0111.003: Radio
* **Summary**:
* **Summary**: Radio
* **Belongs to tactic stage**: TA07

View file

@ -1,6 +1,6 @@
# Technique T0114.001: Social media
* **Summary**:
* **Summary**: Social Media
* **Belongs to tactic stage**: TA09

View file

@ -1,6 +1,6 @@
# Technique T0115.002: Post Violative Content to Provoke Takedown and Backlash
* **Summary**:
* **Summary**: Post Violative Content to Provoke Takedown and Backlash.
* **Belongs to tactic stage**: TA09

View file

@ -1,6 +1,6 @@
# Technique T0119.001: Post Across Groups
* **Summary**:
* **Summary**: An influence operation may post content across groups to spread narratives and content to new communities within the target audiences or to new target audiences.
* **Belongs to tactic stage**: TA17

View file

@ -1,6 +1,6 @@
# Technique T0119.002: Post Across Platform
* **Summary**:
* **Summary**: An influence operation may post content across platforms to spread narratives and content to new communities within the target audiences or to new target audiences. Posting across platforms can also remove opposition and context, helping the narrative spread with less opposition on the cross-posted platform.
* **Belongs to tactic stage**: TA17

View file

@ -1,6 +1,6 @@
# Technique T0119.003: Post Across Disciplines
* **Summary**:
* **Summary**: Post Across Disciplines
* **Belongs to tactic stage**: TA17

View file

@ -1,6 +1,6 @@
# Technique T0120.001: Use Affiliate Marketing Programs
* **Summary**:
* **Summary**: Use Affiliate Marketing Programs
* **Belongs to tactic stage**: TA17

View file

@ -1,6 +1,6 @@
# Technique T0120.002: Use Contests and Prizes
* **Summary**:
* **Summary**: Use Contests and Prizes
* **Belongs to tactic stage**: TA17

View file

@ -1,6 +1,6 @@
# Technique T0124.003: Exploit Platform TOS/Content Moderation
* **Summary**:
* **Summary**: Exploit Platform TOS/Content Moderation
* **Belongs to tactic stage**: TA18

View file

@ -1,6 +1,6 @@
# Technique T0126.001: Call to action to attend
* **Summary**:
* **Summary**: Call to action to attend an event
* **Belongs to tactic stage**: TA10

View file

@ -1,6 +1,6 @@
# Technique T0127.001: Conduct Physical Violence
* **Summary**:
* **Summary**: An influence operation may directly Conduct Physical Violence to achieve campaign goals.
* **Belongs to tactic stage**: TA10

View file

@ -1,6 +1,6 @@
# Technique T0127.002: Encourage Physical Violence
* **Summary**:
* **Summary**: An influence operation may Encourage others to engage in Physical Violence to achieve campaign goals.
* **Belongs to tactic stage**: TA10

View file

@ -1,6 +1,6 @@
# Technique T0129.005: Coordinate on encrypted/ closed networks
# Technique T0129.005: Coordinate on encrypted/closed networks
* **Summary**:
* **Summary**: Coordinate on encrypted/ closed networks
* **Belongs to tactic stage**: TA11

View file

@ -1,6 +1,6 @@
# Technique T0130.003: Use Shell Organizations
* **Summary**:
* **Summary**: Use Shell Organizations to conceal sponsorship.
* **Belongs to tactic stage**: TA11

View file

@ -1,6 +1,6 @@
# Technique T0130.004: Use Cryptocurrency
* **Summary**:
* **Summary**: Use Cryptocurrency to conceal sponsorship. Examples include Bitcoin, Monero, and Etherium.
* **Belongs to tactic stage**: TA11

View file

@ -1,6 +1,6 @@
# Technique T0130.005: Obfuscate Payment
* **Summary**:
* **Summary**: Obfuscate Payment
* **Belongs to tactic stage**: TA11

View file

@ -1,6 +1,6 @@
# Technique T0131.002: Post Borderline Content
* **Summary**:
* **Summary**: Post Borderline Content
* **Belongs to tactic stage**: TA11

View file

@ -1,6 +1,6 @@
# Technique T0132.001: People Focused
* **Summary**:
* **Summary**: Measure the performance individuals in achieving campaign goals
* **Belongs to tactic stage**: TA12

View file

@ -1,6 +1,6 @@
# Technique T0132.002: Content Focused
* **Summary**:
* **Summary**: Measure the performance of campaign content
* **Belongs to tactic stage**: TA12

View file

@ -1,6 +1,6 @@
# Technique T0132.003: View Focused
* **Summary**:
* **Summary**: View Focused
* **Belongs to tactic stage**: TA12

View file

@ -1,6 +1,6 @@
# Technique T0133.002: Content
* **Summary**:
* **Summary**: Measure current system state with respect to the effectiveness of campaign content.
* **Belongs to tactic stage**: TA12

View file

@ -1,6 +1,6 @@
# Technique T0133.003: Awareness
* **Summary**:
* **Summary**: Measure current system state with respect to the effectiveness of influencing awareness.
* **Belongs to tactic stage**: TA12

View file

@ -1,6 +1,6 @@
# Technique T0133.004: Knowledge
* **Summary**:
* **Summary**: Measure current system state with respect to the effectiveness of influencing knowledge.
* **Belongs to tactic stage**: TA12

View file

@ -1,6 +1,6 @@
# Technique T0133.005: Action/attitude
* **Summary**:
* **Summary**: Measure current system state with respect to the effectiveness of influencing action/attitude.
* **Belongs to tactic stage**: TA12