mirror of
https://github.com/DISARMFoundation/DISARMframeworks.git
synced 2024-10-01 01:45:36 -04:00
40 lines
2.8 KiB
JSON
40 lines
2.8 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--b83086c0-b76a-45b4-b775-b336e4f5b623",
|
|
"objects": [
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--40e784b7-3850-4115-b90c-a39e155bbe2c",
|
|
"created_by_ref": "identity--f1a0f560-2d9e-4c5d-bf47-7e96e805de82",
|
|
"created": "2023-09-28T21:25:13.256193Z",
|
|
"modified": "2023-09-28T21:25:13.256193Z",
|
|
"name": "Exploit Data Voids",
|
|
"description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. A 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalising on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "microtarget"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://github.com/DISARMFoundation/DISARMframeworks/blob/main/generated_pages/techniques/T0102.003.md",
|
|
"external_id": "T0102.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--f79f25d2-8b96-4580-b169-eb7b613a7c31"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "2.1"
|
|
}
|
|
]
|
|
}
|