mirror of
https://github.com/DISARMFoundation/DISARMframeworks.git
synced 2024-10-01 01:45:36 -04:00
10491 lines
450 KiB
JSON
10491 lines
450 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--98dd1be0-1910-4c70-bf4e-62144f4c53ef",
|
|
"objects": [
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--971d5c66-5172-47fd-9e20-d07b4ef95d40",
|
|
"created_by_ref": "identity--c2fea386-9f27-4c36-bee2-268c8eb5c775",
|
|
"created": "2022-07-02T04:22:03.064778Z",
|
|
"modified": "2022-07-02T04:22:03.064778Z",
|
|
"name": "Plan Strategy",
|
|
"description": "Define the desired end state, i.e. the set of required conditions that defines achievement of all objectives.",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA01.md",
|
|
"external_id": "TA01"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b87f39ee-d3f1-4057-8280-d9d6b67a39c5"
|
|
],
|
|
"x_mitre_shortname": "plan-strategy"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--86279474-6d7a-4378-9cd1-7e7e633fc4a1",
|
|
"created_by_ref": "identity--01f923a9-21a0-40f6-95eb-137960768153",
|
|
"created": "2022-07-02T04:22:03.065109Z",
|
|
"modified": "2022-07-02T04:22:03.065109Z",
|
|
"name": "Plan Objectives",
|
|
"description": "Set clearly defined, measurable, and achievable objectives. Achieving objectives ties execution of tactical tasks to reaching the desired end state. There are four primary considerations: \n- Each desired effect should link directly to one or more objectives \n- The effect should be measurable \n- The objective statement should not specify the way and means of accomplishment \n- The effect should be distinguishable from the objective it supports as a condition for success, not as another objective or task.",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA02.md",
|
|
"external_id": "TA02"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--284916f6-5727-483f-b376-1ffd84ac7a6b"
|
|
],
|
|
"x_mitre_shortname": "plan-objectives"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--a5db682a-f248-488f-ba6e-7233f82206ea",
|
|
"created_by_ref": "identity--5b063ff8-cc8e-42ba-bc4b-9236a07e6930",
|
|
"created": "2022-07-02T04:22:03.065411Z",
|
|
"modified": "2022-07-02T04:22:03.065411Z",
|
|
"name": "Microtarget",
|
|
"description": "Target very specific populations of people",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA05.md",
|
|
"external_id": "TA05"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--afed3b3e-d731-457a-b38b-f54e532a55ec"
|
|
],
|
|
"x_mitre_shortname": "microtarget"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--9d14f85f-5b05-4210-bc58-89988839305d",
|
|
"created_by_ref": "identity--86281e87-f065-40a2-a37e-c6d03a5e907c",
|
|
"created": "2022-07-02T04:22:03.065707Z",
|
|
"modified": "2022-07-02T04:22:03.065707Z",
|
|
"name": "Develop Content",
|
|
"description": "Create or acquire text, images, and other content",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA06.md",
|
|
"external_id": "TA06"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--bf212adb-498d-4915-9019-d91715324db9"
|
|
],
|
|
"x_mitre_shortname": "develop-content"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--d292d576-14ed-4061-a551-fb5efd0e3562",
|
|
"created_by_ref": "identity--e520ac5c-30c1-4a02-a46b-19f76051abce",
|
|
"created": "2022-07-02T04:22:03.066004Z",
|
|
"modified": "2022-07-02T04:22:03.066004Z",
|
|
"name": "Select Channels and Affordances",
|
|
"description": "Selecting platforms and affordances assesses which online or offline platforms and their associated affordances maximize an influence operation\u2019s ability to reach its target audience. To select the most appropriate platform(s), an operation may assess the technological affordances including platform algorithms, terms of service, permitted content types, or other attributes that determine platform usability and accessibility. Selecting platforms includes both choosing platforms on which the operation will publish its own content and platforms on which the operation will attempt to restrict adversarial content.",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA07.md",
|
|
"external_id": "TA07"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--df3916c3-4e30-429d-a720-009d2ed82da9"
|
|
],
|
|
"x_mitre_shortname": "select-channels-and-affordances"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--f17e1c66-7c06-47ac-af31-ec31507a50a3",
|
|
"created_by_ref": "identity--47e8301a-555d-4772-834c-b89cc315bb18",
|
|
"created": "2022-07-02T04:22:03.066313Z",
|
|
"modified": "2022-07-02T04:22:03.066313Z",
|
|
"name": "Conduct Pump Priming",
|
|
"description": "Release content on a targetted small scale, prior to general release, including releasing seed. Used for preparation before broader release, and as message honing. Used for preparation before broader release, and as message honing. ",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA08.md",
|
|
"external_id": "TA08"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d3811288-cb45-44ba-9d63-35de29fe33f3"
|
|
],
|
|
"x_mitre_shortname": "conduct-pump-priming"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--2c0d561c-0791-4d32-bf3b-43db96e8fee6",
|
|
"created_by_ref": "identity--0f0d287c-7061-408a-a9cc-5e44fca2e181",
|
|
"created": "2022-07-02T04:22:03.066608Z",
|
|
"modified": "2022-07-02T04:22:03.066608Z",
|
|
"name": "Deliver Content",
|
|
"description": "Release content to general public or larger population",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA09.md",
|
|
"external_id": "TA09"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--43a0fc28-1daa-4559-8816-19adc15e4ca9"
|
|
],
|
|
"x_mitre_shortname": "deliver-content"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--e99560eb-0686-4ab0-b382-bdfaefbbfa0a",
|
|
"created_by_ref": "identity--05c6d0a9-56d0-47c4-8510-56ce7806f0a4",
|
|
"created": "2022-07-02T04:22:03.066906Z",
|
|
"modified": "2022-07-02T04:22:03.066906Z",
|
|
"name": "Drive Offline Activity",
|
|
"description": "Move incident/campaign from online to offline. Encouraging users to move from the platform on which they initially viewed operation content and engage in the physical information space or offline world. This may include operation-aligned rallies or protests, radio, newspaper, or billboards. An influence operation may drive to physical forums to diversify its information channels and facilitate spaces where the target audience can engage with both operation content and like-minded individuals offline. ",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA10.md",
|
|
"external_id": "TA10"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--139dbce4-9158-41ad-8e81-96c30a158ec1"
|
|
],
|
|
"x_mitre_shortname": "drive-offline-activity"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--7f52e944-3c82-4820-9eb9-0529ca7814a6",
|
|
"created_by_ref": "identity--c2c68a27-d0de-4de8-aca6-c676655b3b20",
|
|
"created": "2022-07-02T04:22:03.067203Z",
|
|
"modified": "2022-07-02T04:22:03.067203Z",
|
|
"name": "Persist in the Information Environment",
|
|
"description": "Persist in the Information Space refers to taking measures that allow an operation to maintain its presence and avoid takedown by an external entity. Techniques in Persist in the Information Space help campaigns operate without detection and appear legitimate to the target audience and platform monitoring services. Influence operations on social media often persist online by varying the type of information assets and platforms used throughout the campaign.",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA11.md",
|
|
"external_id": "TA11"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--750f5009-f93b-43dd-8865-f2cff88e57f0"
|
|
],
|
|
"x_mitre_shortname": "persist-in-the-information-environment"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--3b95c4d5-3f0a-4616-be55-170cfb0ce7e4",
|
|
"created_by_ref": "identity--74fb787f-c6e0-4c63-969e-6ffefba845cb",
|
|
"created": "2022-07-02T04:22:03.067497Z",
|
|
"modified": "2022-07-02T04:22:03.067497Z",
|
|
"name": "Assess Effectiveness",
|
|
"description": "Assess effectiveness of action, for use in future plans ",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA12.md",
|
|
"external_id": "TA12"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--a1d30dea-6a85-45a3-a1b7-dbeca4c43b77"
|
|
],
|
|
"x_mitre_shortname": "assess-effectiveness"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--cf99f34a-d95b-48a0-9d46-fe920bbb3d30",
|
|
"created_by_ref": "identity--5af700d5-5c43-407b-b3fb-7ce9f55a75ea",
|
|
"created": "2022-07-02T04:22:03.067794Z",
|
|
"modified": "2022-07-02T04:22:03.067794Z",
|
|
"name": "Target Audience Analysis",
|
|
"description": "Identifying and analyzing the target audience examines target audience member locations, political affiliations, financial situations, and other attributes that an influence operation may incorporate into its messaging strategy. During this tactic, influence operations may also identify existing similarities and differences between target audience members to unite like groups and divide opposing groups. Identifying and analyzing target audience members allows influence operations to tailor operation strategy and content to their analysis. ",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA13.md",
|
|
"external_id": "TA13"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--41c2e1d4-c966-47ee-8bf9-a052ff38a6ad"
|
|
],
|
|
"x_mitre_shortname": "target-audience-analysis"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--407782d0-915e-4d60-911b-12d991b06375",
|
|
"created_by_ref": "identity--a6e1a1e3-0f16-486b-b001-7063c0e8b23b",
|
|
"created": "2022-07-02T04:22:03.068086Z",
|
|
"modified": "2022-07-02T04:22:03.068086Z",
|
|
"name": "Develop Narratives",
|
|
"description": "The promotion of beneficial master narratives is perhaps the most effective method for achieving long-term strategic narrative dominance. From a \"\"whole of society\"\" perspective the promotion of the society's core master narratives should occupy a central strategic role. From a misinformation campaign / cognitive security perpectve the tactics around master narratives center more precisely on the day-to-day promotion and reinforcement of this messaging. In other words, beneficial, high-coverage master narratives are a central strategic goal and their promotion constitutes an ongoing tactical struggle carried out at a whole-of-society level. Tactically, their promotion covers a broad spectrum of activities both on- and offline.",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA14.md",
|
|
"external_id": "TA14"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--596ebe0d-44b9-4aa3-a9f7-2a1badf8a718"
|
|
],
|
|
"x_mitre_shortname": "develop-narratives"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--683505ce-6a91-4c8c-bd0d-1dc046b31a43",
|
|
"created_by_ref": "identity--7be23c48-d4ef-480e-b1e8-ce89e6050d7a",
|
|
"created": "2022-07-02T04:22:03.068383Z",
|
|
"modified": "2022-07-02T04:22:03.068383Z",
|
|
"name": "Establish Social Assets",
|
|
"description": "Establishing information assets generates messaging tools, including social media accounts, operation personnel, and organizations, including directly and indirectly managed assets. For assets under their direct control, the operation can add, change, or remove these assets at will. \nEstablishing information assets allows an influence operation to promote messaging directly to the target audience without navigating through external entities. Many online influence operations create or compromise social media accounts as a primary vector of information dissemination.",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA15.md",
|
|
"external_id": "TA15"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--bdfe64bf-7961-4de7-8cf6-5f7b578934e9"
|
|
],
|
|
"x_mitre_shortname": "establish-social-assets"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--584bd613-05a9-4ac7-9e45-085bd5404935",
|
|
"created_by_ref": "identity--4e116b7e-7d40-4f0a-af37-237480192cf1",
|
|
"created": "2022-07-02T04:22:03.06868Z",
|
|
"modified": "2022-07-02T04:22:03.06868Z",
|
|
"name": "Establish Legitimacy",
|
|
"description": "Establish assets that create trust",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA16.md",
|
|
"external_id": "TA16"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3311ca12-4d04-4786-9e01-f71c73876441"
|
|
],
|
|
"x_mitre_shortname": "establish-legitimacy"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--20dc8fc1-f9ea-4b3d-8fc7-0121ce4c5077",
|
|
"created_by_ref": "identity--c1e030cc-a58e-45d9-bcf5-e56a6f66f5e8",
|
|
"created": "2022-07-02T04:22:03.068986Z",
|
|
"modified": "2022-07-02T04:22:03.068986Z",
|
|
"name": "Maximize Exposure",
|
|
"description": "Maximize exposure of the target audience to incident/campaign content via flooding, amplifying, and cross-posting.",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA17.md",
|
|
"external_id": "TA17"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--9bbd4289-e469-4f4e-9bdb-be52d82cd9c2"
|
|
],
|
|
"x_mitre_shortname": "maximize-exposure"
|
|
},
|
|
{
|
|
"type": "x-mitre-tactic",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-tactic--80615355-3450-4f18-8de3-3ba289da460d",
|
|
"created_by_ref": "identity--b802798d-4577-451d-aeec-6602450b39eb",
|
|
"created": "2022-07-02T04:22:03.069283Z",
|
|
"modified": "2022-07-02T04:22:03.069283Z",
|
|
"name": "Drive Online Harms",
|
|
"description": "Actions taken by an influence operation to harm their opponents in online spaces through harassment, suppression, releasing private information, and controlling the information space through offensive cyberspace operations. ",
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/tactics/TA18.md",
|
|
"external_id": "TA18"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--28a37fbc-c74f-41e4-92f5-58ffc7ed33a8"
|
|
],
|
|
"x_mitre_shortname": "drive-online-harms"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9a82d3fd-df71-4489-a0d7-245bea04182d",
|
|
"created_by_ref": "identity--f02c8df3-0367-4404-91f5-5b6959d81073",
|
|
"created": "2022-07-02T04:22:03.069804Z",
|
|
"modified": "2022-07-02T04:22:03.069804Z",
|
|
"name": "Facilitate State Propaganda",
|
|
"description": "TA02",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-objectives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0002.md",
|
|
"external_id": "T0002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--972ee251-e1f3-41a1-af4f-502489669fe0"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4ba887ca-bcfd-4966-b3b5-0ff968a7627f",
|
|
"created_by_ref": "identity--35122bb0-23ae-4ced-ae58-cfa5d8afe02f",
|
|
"created": "2022-07-02T04:22:03.070144Z",
|
|
"modified": "2022-07-02T04:22:03.070144Z",
|
|
"name": "Leverage Existing Narratives",
|
|
"description": "TA14",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-narratives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0003.md",
|
|
"external_id": "T0003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--2710f384-a856-4d93-ab2c-52e9b24a62ed"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--abb6632d-fbab-4396-af2f-db30061de7a3",
|
|
"created_by_ref": "identity--9582f102-dfc2-4a4f-a84d-1c9b52f3694c",
|
|
"created": "2022-07-02T04:22:03.070467Z",
|
|
"modified": "2022-07-02T04:22:03.070467Z",
|
|
"name": "Develop Competing Narratives",
|
|
"description": "TA14",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-narratives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0004.md",
|
|
"external_id": "T0004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--10fd91bb-5b0d-4792-9b9a-cf7f0bb0c1c1"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--73bdca75-4eef-4f13-84fc-2816c11d26d5",
|
|
"created_by_ref": "identity--ca5695f6-25ff-4f98-bf09-fb041e0cc545",
|
|
"created": "2022-07-02T04:22:03.070786Z",
|
|
"modified": "2022-07-02T04:22:03.070786Z",
|
|
"name": "Create Inauthentic Social Media Pages and Groups",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0007.md",
|
|
"external_id": "T0007"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e316868a-9ab7-40ef-91b0-49a8b0112a26"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--cf7766aa-f234-4e7b-9c9a-f3ae82b94555",
|
|
"created_by_ref": "identity--2e016c22-5535-4557-8921-6c91586a2f5b",
|
|
"created": "2022-07-02T04:22:03.071107Z",
|
|
"modified": "2022-07-02T04:22:03.071107Z",
|
|
"name": "Create fake experts",
|
|
"description": "TA16",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0009.md",
|
|
"external_id": "T0009"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--8ef0659a-489b-4a38-8e81-dc49efea6184"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--90193cf9-5cc8-4af5-98b4-0b24ba83c7ee",
|
|
"created_by_ref": "identity--68b8274a-f361-49a2-8176-a95bc483971f",
|
|
"created": "2022-07-02T04:22:03.071431Z",
|
|
"modified": "2022-07-02T04:22:03.071431Z",
|
|
"name": "Cultivate ignorant agents",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0010.md",
|
|
"external_id": "T0010"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--45d1c510-525f-4cba-87bc-55f6accf6e4a"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--887a9015-6d4a-4b69-b084-284d03ebed32",
|
|
"created_by_ref": "identity--4ca338bb-6c23-43fb-bf7a-a183dc1cf3c7",
|
|
"created": "2022-07-02T04:22:03.071769Z",
|
|
"modified": "2022-07-02T04:22:03.071769Z",
|
|
"name": "Compromise legitimate accounts",
|
|
"description": "TA16",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0011.md",
|
|
"external_id": "T0011"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--df27fb77-bf84-44a4-8194-10a9a383d923"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--42d2e081-acd9-4d7b-8f16-9e46a9d9a1ad",
|
|
"created_by_ref": "identity--a9f223e2-c47e-415f-b66d-703b21539125",
|
|
"created": "2022-07-02T04:22:03.072086Z",
|
|
"modified": "2022-07-02T04:22:03.072086Z",
|
|
"name": "Create inauthentic websites",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0013.md",
|
|
"external_id": "T0013"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d47916c5-6f70-4705-99db-9f1bafbc9f08"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--70ae7415-b668-419e-8978-38176f101a67",
|
|
"created_by_ref": "identity--9534e263-c745-492d-9069-f5a2fe8ae333",
|
|
"created": "2022-07-02T04:22:03.072401Z",
|
|
"modified": "2022-07-02T04:22:03.072401Z",
|
|
"name": "Prepare fundraising campaigns",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0014.md",
|
|
"external_id": "T0014"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--27ed9ea7-523e-4edb-b12c-274230f3dd8c"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--e9cf013f-501a-4051-87fd-69d871cf3bfa",
|
|
"created_by_ref": "identity--0bb92b95-cc87-45ff-87ee-577853e68830",
|
|
"created": "2022-07-02T04:22:03.072717Z",
|
|
"modified": "2022-07-02T04:22:03.072717Z",
|
|
"name": "Create hashtags and search artifacts",
|
|
"description": "TA06",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0015.md",
|
|
"external_id": "T0015"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--9c5e1625-6af7-4b29-a5aa-c17895cc07d0"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0577caea-3336-48cd-bc1a-177e3fbb1906",
|
|
"created_by_ref": "identity--8640ea23-915e-41cb-9dbd-c81bf70b9b5a",
|
|
"created": "2022-07-02T04:22:03.073031Z",
|
|
"modified": "2022-07-02T04:22:03.073031Z",
|
|
"name": "Create Clickbait",
|
|
"description": "TA05",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "microtarget"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0016.md",
|
|
"external_id": "T0016"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5510c27d-c910-4dbf-b594-3d01b57b12a5"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--6876b9ed-bbce-4362-ab1b-f6c638ab5f66",
|
|
"created_by_ref": "identity--76a68ce5-8b2d-4b7d-9181-eda62c5e0f10",
|
|
"created": "2022-07-02T04:22:03.073393Z",
|
|
"modified": "2022-07-02T04:22:03.073393Z",
|
|
"name": "Conduct fundraising",
|
|
"description": "TA10",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0017.md",
|
|
"external_id": "T0017"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--98ba3683-fff6-4bc6-8a2a-fa2cfbd71c79"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--717cb7d3-87b6-471a-9797-dcf92b4e28fe",
|
|
"created_by_ref": "identity--11d50ab2-8230-48ad-9510-9a8177a97035",
|
|
"created": "2022-07-02T04:22:03.073719Z",
|
|
"modified": "2022-07-02T04:22:03.073719Z",
|
|
"name": "Purchase Targeted Advertisements",
|
|
"description": "TA05",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "microtarget"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0018.md",
|
|
"external_id": "T0018"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e341cefb-f33e-4083-ba3f-acf62edd7cd3"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4b08d625-9526-4617-bfb1-fb169298ee81",
|
|
"created_by_ref": "identity--95d9a68a-7a96-4c0b-936c-0c77a4f8257f",
|
|
"created": "2022-07-02T04:22:03.074036Z",
|
|
"modified": "2022-07-02T04:22:03.074036Z",
|
|
"name": "Generate information pollution",
|
|
"description": "TA06",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0019.md",
|
|
"external_id": "T0019"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--352c3cca-1077-4df3-b7d9-a9617913e5ce"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0ff2ef87-d70c-49f3-972a-16108fbfdb82",
|
|
"created_by_ref": "identity--4b533ae4-3c34-4ccc-8a29-db42dd7be09e",
|
|
"created": "2022-07-02T04:22:03.074377Z",
|
|
"modified": "2022-07-02T04:22:03.074377Z",
|
|
"name": "Trial content",
|
|
"description": "TA08",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "conduct-pump-priming"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0020.md",
|
|
"external_id": "T0020"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--64269a16-723b-405c-b048-a9e040d96eba"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--cb5ef19d-1eec-4159-a195-429daecc6648",
|
|
"created_by_ref": "identity--bc5f7861-2842-42d4-948d-4016ad4d922b",
|
|
"created": "2022-07-02T04:22:03.074699Z",
|
|
"modified": "2022-07-02T04:22:03.074699Z",
|
|
"name": "Leverage Conspiracy Theory Narratives",
|
|
"description": "TA14",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-narratives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0022.md",
|
|
"external_id": "T0022"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d783662b-63fd-4cfd-81e4-25b7bfa50d44"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8395fe52-b162-4e30-9477-2107d1b38e84",
|
|
"created_by_ref": "identity--c895c5b6-2637-4aa6-812a-a4c0adf398eb",
|
|
"created": "2022-07-02T04:22:03.075018Z",
|
|
"modified": "2022-07-02T04:22:03.075018Z",
|
|
"name": "Distort facts",
|
|
"description": "TA06",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0023.md",
|
|
"external_id": "T0023"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--6759d070-e2e5-4900-8a16-75a6439257ee"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1944a6a4-0101-4c95-bd6d-1d8b674a712f",
|
|
"created_by_ref": "identity--2ce1558c-41e6-4805-b4d8-19824d5d876b",
|
|
"created": "2022-07-02T04:22:03.075336Z",
|
|
"modified": "2022-07-02T04:22:03.075336Z",
|
|
"name": "Online polls",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0029.md",
|
|
"external_id": "T0029"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--bc185ad5-3887-4955-bda7-998d5442b6c1"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f30e451f-2822-4501-98b9-df1cd9965e3c",
|
|
"created_by_ref": "identity--40af6348-f525-437b-b3ce-46993d6ab657",
|
|
"created": "2022-07-02T04:22:03.07565Z",
|
|
"modified": "2022-07-02T04:22:03.07565Z",
|
|
"name": "Bait legitimate influencers",
|
|
"description": "TA08",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "conduct-pump-priming"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0039 .md",
|
|
"external_id": "T0039"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--9a149875-736e-4547-b0f2-a4cc2b48ed45"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--623b66b8-356f-4982-8831-db67abf46dec",
|
|
"created_by_ref": "identity--255ebc5e-1dfd-45d0-9d1d-6b7a09683392",
|
|
"created": "2022-07-02T04:22:03.075967Z",
|
|
"modified": "2022-07-02T04:22:03.075967Z",
|
|
"name": "Demand insurmountable proof",
|
|
"description": "TA14",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-narratives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0040.md",
|
|
"external_id": "T0040"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--4ee312e7-edb9-410f-90c3-a08b0ae3b2e3"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--5468558b-bbc8-49d6-af74-99450ca31dd3",
|
|
"created_by_ref": "identity--361ac418-44d7-484d-bae0-51abbfe90344",
|
|
"created": "2022-07-02T04:22:03.076286Z",
|
|
"modified": "2022-07-02T04:22:03.076286Z",
|
|
"name": "Seed Kernel of truth",
|
|
"description": "TA08",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "conduct-pump-priming"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0042.md",
|
|
"external_id": "T0042"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--64eec2bb-aca1-4f71-ba4f-1ec00156c4f7"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--abd82758-c4a7-402e-b511-eb6205b46810",
|
|
"created_by_ref": "identity--a3c30889-82ef-4249-bb7b-a6f28c92963d",
|
|
"created": "2022-07-02T04:22:03.076624Z",
|
|
"modified": "2022-07-02T04:22:03.076624Z",
|
|
"name": "Chat apps",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0043.md",
|
|
"external_id": "T0043"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e5ed330a-0662-4b52-ab69-fb2d24e77b4e"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--7f575e26-30ca-4e17-8692-ab8c82ac0490",
|
|
"created_by_ref": "identity--cd0fe3a2-0828-4c78-829a-3c19156e2026",
|
|
"created": "2022-07-02T04:22:03.076963Z",
|
|
"modified": "2022-07-02T04:22:03.076963Z",
|
|
"name": "Seed distortions",
|
|
"description": "TA08",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "conduct-pump-priming"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0044.md",
|
|
"external_id": "T0044"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--15c1585d-6439-4f3e-bc52-b36fe12f839d"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--911a9cdc-8b08-4aae-85fe-d39353ba915c",
|
|
"created_by_ref": "identity--2e54d49c-fb8a-40b4-8c4f-f23b62059022",
|
|
"created": "2022-07-02T04:22:03.077317Z",
|
|
"modified": "2022-07-02T04:22:03.077317Z",
|
|
"name": "Use fake experts",
|
|
"description": "TA08",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "conduct-pump-priming"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0045.md",
|
|
"external_id": "T0045"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--81cd094c-e5a5-4ef0-96fe-73f51bdb8018"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--38ed6ccc-d02f-4b2b-82c1-1f004f0ab70a",
|
|
"created_by_ref": "identity--e16fdbc6-d28f-4fb4-853f-1926b2239460",
|
|
"created": "2022-07-02T04:22:03.077643Z",
|
|
"modified": "2022-07-02T04:22:03.077643Z",
|
|
"name": "Use Search Engine Optimization",
|
|
"description": "TA08",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "conduct-pump-priming"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0046.md",
|
|
"external_id": "T0046"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--a9a61ae8-9683-485e-aa42-d2afbaabe597"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9c599b99-df5e-489a-891b-286a7926c865",
|
|
"created_by_ref": "identity--646c9db0-b328-4481-9f31-ef2c92b1e036",
|
|
"created": "2022-07-02T04:22:03.077963Z",
|
|
"modified": "2022-07-02T04:22:03.077963Z",
|
|
"name": "Censor social media as a political force",
|
|
"description": "TA18",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0047.md",
|
|
"external_id": "T0047"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d7ce11e3-0987-475a-95b8-4c42f4c89467"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--6a0ec15e-b628-4d9b-97f9-a593c036eb39",
|
|
"created_by_ref": "identity--af348b26-2c4c-4e1b-8705-7393401dbbcc",
|
|
"created": "2022-07-02T04:22:03.078283Z",
|
|
"modified": "2022-07-02T04:22:03.078283Z",
|
|
"name": "Harass",
|
|
"description": "TA18",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0048.md",
|
|
"external_id": "T0048"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ddfd0d32-6516-4933-b525-cb5e045870ff"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--6cb2b1b5-5a51-4f19-a6f2-08d6bc238121",
|
|
"created_by_ref": "identity--5ec74ba3-ff5f-4a42-8f3c-9c745c902d69",
|
|
"created": "2022-07-02T04:22:03.078608Z",
|
|
"modified": "2022-07-02T04:22:03.078608Z",
|
|
"name": "Flooding the Information Space",
|
|
"description": "TA17",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.md",
|
|
"external_id": "T0049"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fb3da8f5-ec81-4e38-987c-d306969b80f3"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--41e751ac-d098-48a5-b9a6-2f671ff9c035",
|
|
"created_by_ref": "identity--69b8c806-3de4-4b21-9abd-00817341f626",
|
|
"created": "2022-07-02T04:22:03.078926Z",
|
|
"modified": "2022-07-02T04:22:03.078926Z",
|
|
"name": "Organize Events",
|
|
"description": "TA10",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0057.md",
|
|
"external_id": "T0057"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c1c812a2-5c51-49e6-b920-4da49282862a"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--a8457151-6ecc-48a6-b610-1c26ce153dac",
|
|
"created_by_ref": "identity--f4f95d88-6748-402b-816e-901a041a0220",
|
|
"created": "2022-07-02T04:22:03.079245Z",
|
|
"modified": "2022-07-02T04:22:03.079245Z",
|
|
"name": "Play the long game",
|
|
"description": "TA11",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0059.md",
|
|
"external_id": "T0059"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--38974deb-c2d6-4f9d-86c8-73d964cd17fb"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--3d2940d4-9e8b-4bad-aab8-3ac52b65c2ce",
|
|
"created_by_ref": "identity--c21779fb-809a-4561-8e69-d904f65ddc82",
|
|
"created": "2022-07-02T04:22:03.079565Z",
|
|
"modified": "2022-07-02T04:22:03.079565Z",
|
|
"name": "Continue to Amplify",
|
|
"description": "TA11",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0060.md",
|
|
"external_id": "T0060"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--409c183e-7f53-4d8d-8bb4-7cfd49f07ff0"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d8f74235-8217-4681-8bb5-1784e0b43789",
|
|
"created_by_ref": "identity--cd2547d3-5891-4f8d-85b6-df4db3fa506b",
|
|
"created": "2022-07-02T04:22:03.079896Z",
|
|
"modified": "2022-07-02T04:22:03.079896Z",
|
|
"name": "Sell Merchandise",
|
|
"description": "TA10",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0061.md",
|
|
"external_id": "T0061"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--19336005-032d-41dd-a427-c054b55838a5"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d2ddf5ad-3edf-4ed7-92cc-c786a1fd5f12",
|
|
"created_by_ref": "identity--f9dc9612-dea2-4a80-a866-4a2b105a50ae",
|
|
"created": "2022-07-02T04:22:03.080209Z",
|
|
"modified": "2022-07-02T04:22:03.080209Z",
|
|
"name": "Prepare Physical Broadcast Capabilities",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0065.md",
|
|
"external_id": "T0065"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e102ad02-2273-468c-905c-e95869aa1825"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0c2361a2-11a9-4aad-ab3a-a258e4e0ce85",
|
|
"created_by_ref": "identity--bb013d68-f517-43ff-befa-514e3fca120c",
|
|
"created": "2022-07-02T04:22:03.080523Z",
|
|
"modified": "2022-07-02T04:22:03.080523Z",
|
|
"name": "Degrade Adversary",
|
|
"description": "TA02",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-objectives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0066.md",
|
|
"external_id": "T0066"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b83349c1-fa4d-454e-90f1-a0fc1f36d6b7"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--77cfedae-2306-461f-bc2b-976170ae2305",
|
|
"created_by_ref": "identity--5ae001c6-18fc-41a6-bf37-8564f5519ca9",
|
|
"created": "2022-07-02T04:22:03.08085Z",
|
|
"modified": "2022-07-02T04:22:03.08085Z",
|
|
"name": "Respond to Breaking News Event or Active Crisis",
|
|
"description": "TA14",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-narratives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0068.md",
|
|
"external_id": "T0068"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5dcdd76b-e488-4016-bb89-72664e886e9c"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--36291e89-6ea2-40d3-a50c-3908a5c0bc99",
|
|
"created_by_ref": "identity--461e5e65-6430-4261-bf34-e1c7005aac64",
|
|
"created": "2022-07-02T04:22:03.081167Z",
|
|
"modified": "2022-07-02T04:22:03.081167Z",
|
|
"name": "Segment Audiences",
|
|
"description": "TA13",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0072.md",
|
|
"external_id": "T0072"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e05f4c1b-05a0-4c94-9d8a-360ff3187774"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9c761c71-ace3-460d-ab9e-87bb6db999d0",
|
|
"created_by_ref": "identity--946cfca0-1a9a-49d5-8052-86383cba9e80",
|
|
"created": "2022-07-02T04:22:03.081481Z",
|
|
"modified": "2022-07-02T04:22:03.081481Z",
|
|
"name": "Determine Target Audiences",
|
|
"description": "TA01",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-strategy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0073.md",
|
|
"external_id": "T0073"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c791c314-d8c9-4230-8681-481b7be3d76a"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--5396f0c0-9a8c-48c9-ba26-7c1cb8a4ddfb",
|
|
"created_by_ref": "identity--e7a82b59-1d03-4c90-8022-f6ca17d33c4f",
|
|
"created": "2022-07-02T04:22:03.081798Z",
|
|
"modified": "2022-07-02T04:22:03.081798Z",
|
|
"name": "Determine Strategic Ends",
|
|
"description": "TA01",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-strategy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0074.md",
|
|
"external_id": "T0074"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d29e6e81-7178-44cb-82e5-4555d023e588"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0e463661-3676-4344-82a7-f5358aeae31d",
|
|
"created_by_ref": "identity--3a2b5b1b-b29c-41ec-b262-125a61465224",
|
|
"created": "2022-07-02T04:22:03.082142Z",
|
|
"modified": "2022-07-02T04:22:03.082142Z",
|
|
"name": "Dismiss",
|
|
"description": "TA02",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-objectives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0075.md",
|
|
"external_id": "T0075"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--df5096ac-d0f1-4f54-9781-79f405df9bf8"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--e1c4f52f-7ec0-4bbe-8153-2ea112aa9571",
|
|
"created_by_ref": "identity--b0f611e8-9db9-4150-8256-0c7268f6c4f1",
|
|
"created": "2022-07-02T04:22:03.082478Z",
|
|
"modified": "2022-07-02T04:22:03.082478Z",
|
|
"name": "Distort",
|
|
"description": "TA02",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-objectives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0076.md",
|
|
"external_id": "T0076"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--bdd0ff52-f2dc-4dbb-a25f-c4075603527e"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1a11d543-72b6-4dbb-b43d-fb074f0f4cea",
|
|
"created_by_ref": "identity--47060639-328a-4575-8b0d-4fdb1509db99",
|
|
"created": "2022-07-02T04:22:03.082795Z",
|
|
"modified": "2022-07-02T04:22:03.082795Z",
|
|
"name": "Distract",
|
|
"description": "TA02",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-objectives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0077.md",
|
|
"external_id": "T0077"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0e5e1495-8b8b-4049-ad11-e12bfafb28b1"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--36a63293-15c7-4641-b676-7dc3818a48a9",
|
|
"created_by_ref": "identity--bf099cbe-a53c-4e8d-a917-30e757cb5e59",
|
|
"created": "2022-07-02T04:22:03.083111Z",
|
|
"modified": "2022-07-02T04:22:03.083111Z",
|
|
"name": "Dismay",
|
|
"description": "TA02",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-objectives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0078.md",
|
|
"external_id": "T0078"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3b3a7dc4-3a6c-4d1b-9223-cdf239b62306"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b9bcdca2-c971-4548-847e-89730e8f28c1",
|
|
"created_by_ref": "identity--1d1e135c-2b02-4b05-8c8b-8206185e484e",
|
|
"created": "2022-07-02T04:22:03.083426Z",
|
|
"modified": "2022-07-02T04:22:03.083426Z",
|
|
"name": "Divide",
|
|
"description": "TA02",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-objectives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0079.md",
|
|
"external_id": "T0079"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--2c53d46e-34e6-4025-b3f4-79400900c1d7"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d197bfce-4b71-4637-b192-58e93a5c3cbf",
|
|
"created_by_ref": "identity--efc19d35-c779-4626-969e-de25ec811af0",
|
|
"created": "2022-07-02T04:22:03.083746Z",
|
|
"modified": "2022-07-02T04:22:03.083746Z",
|
|
"name": "Map Target Audience Information Environment",
|
|
"description": "TA13",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0080.md",
|
|
"external_id": "T0080"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--f8e81ee7-64a5-4e00-a611-f81720ed951c"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--fb4e9ccf-951c-4a0c-b496-8a694bf68463",
|
|
"created_by_ref": "identity--a5aa005a-c602-4b54-b5f4-a351826d344b",
|
|
"created": "2022-07-02T04:22:03.084061Z",
|
|
"modified": "2022-07-02T04:22:03.084061Z",
|
|
"name": "Identify Social and Technical Vulnerabilities",
|
|
"description": "TA13",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.md",
|
|
"external_id": "T0081"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--a7a8441a-db63-424f-bc32-41f882e09368"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--a6bfb6e7-f6a4-40cc-aaf0-20d43f5ae0ad",
|
|
"created_by_ref": "identity--214f62bd-35e6-4d12-9662-859a73c02af4",
|
|
"created": "2022-07-02T04:22:03.084383Z",
|
|
"modified": "2022-07-02T04:22:03.084383Z",
|
|
"name": "Develop New Narratives",
|
|
"description": "TA14",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-narratives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0082.md",
|
|
"external_id": "T0082"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c1d8ab7d-aa11-466e-8d31-76276feab087"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--28c4447e-c922-4e62-b632-6f85c3befc22",
|
|
"created_by_ref": "identity--7eaf5956-0ca5-4c46-a5cb-ccf3f6d1cfaa",
|
|
"created": "2022-07-02T04:22:03.084704Z",
|
|
"modified": "2022-07-02T04:22:03.084704Z",
|
|
"name": "Integrate Target Audience Vulnerabilities into Narrative",
|
|
"description": "TA14",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-narratives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0083.md",
|
|
"external_id": "T0083"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3f3ab8b8-d66b-4b73-9e0b-bd7c5bd81b9a"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--bb391ff6-c66b-4bd7-ae94-4606e06a5c41",
|
|
"created_by_ref": "identity--a732274e-c609-424f-aba4-df5c3c78bffc",
|
|
"created": "2022-07-02T04:22:03.085033Z",
|
|
"modified": "2022-07-02T04:22:03.085033Z",
|
|
"name": "Reuse Existing Content",
|
|
"description": "TA06",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0084.md",
|
|
"external_id": "T0084"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--00258f28-a8ae-4ccc-9c88-84b65e62efa2"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--c21486c6-11d4-4491-a39a-8ab54256065a",
|
|
"created_by_ref": "identity--46bb5ca0-333e-4cca-82bd-ed4652809928",
|
|
"created": "2022-07-02T04:22:03.085352Z",
|
|
"modified": "2022-07-02T04:22:03.085352Z",
|
|
"name": "Develop Text-based Content",
|
|
"description": "TA06",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0085.md",
|
|
"external_id": "T0085"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--736aceb6-04a6-4240-a127-083f4b076cac"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--134fb9f0-ca77-4e1f-af85-2a7b49382224",
|
|
"created_by_ref": "identity--daf39689-4e5c-4591-8322-211f133d7944",
|
|
"created": "2022-07-02T04:22:03.085667Z",
|
|
"modified": "2022-07-02T04:22:03.085667Z",
|
|
"name": "Develop Image-based Content",
|
|
"description": "TA06",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0086.md",
|
|
"external_id": "T0086"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--26b1768d-df1e-4c22-882e-2f5734b270aa"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0a2d5ebd-0296-45e3-9575-a14b2a1e9dc8",
|
|
"created_by_ref": "identity--9c8de478-97d2-4c9d-88b0-5b6e5313f851",
|
|
"created": "2022-07-02T04:22:03.085981Z",
|
|
"modified": "2022-07-02T04:22:03.085981Z",
|
|
"name": "Develop Video-based Content",
|
|
"description": "TA06",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0087.md",
|
|
"external_id": "T0087"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--abca5f1b-b4e3-4317-bc5c-34cbc80e9538"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--66474820-fb28-45b1-814a-4a0599fe448f",
|
|
"created_by_ref": "identity--0c0e0d12-91e4-4c31-a187-175b82b36a30",
|
|
"created": "2022-07-02T04:22:03.086298Z",
|
|
"modified": "2022-07-02T04:22:03.086298Z",
|
|
"name": "Develop Audio-based Content",
|
|
"description": "TA06",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0088.md",
|
|
"external_id": "T0088"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--65beaddf-40a3-4358-9f39-549c75f99348"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--01a0834b-c185-4ab4-811e-3a3ecd234f71",
|
|
"created_by_ref": "identity--80b01bdf-d8c9-4c1a-bcaa-9b95361cdba0",
|
|
"created": "2022-07-02T04:22:03.086614Z",
|
|
"modified": "2022-07-02T04:22:03.086614Z",
|
|
"name": "Obtain Private Documents",
|
|
"description": "TA06",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0089.md",
|
|
"external_id": "T0089"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3f66a390-8323-4ae1-a279-e0829041aac7"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--c33b08b4-0ad0-4589-9b67-9dbe5697e945",
|
|
"created_by_ref": "identity--023b5525-699c-41d9-b1f0-1fe21e6d31d8",
|
|
"created": "2022-07-02T04:22:03.08693Z",
|
|
"modified": "2022-07-02T04:22:03.08693Z",
|
|
"name": "Create Inauthentic Accounts",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0090.md",
|
|
"external_id": "T0090"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--a25bd050-66fe-4f01-9487-a1c39d8e5229"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9723320e-e9d1-44dc-8ee9-4fb3174c44e4",
|
|
"created_by_ref": "identity--1cd1d85e-b06b-4c2e-9ff8-88023992c1be",
|
|
"created": "2022-07-02T04:22:03.087247Z",
|
|
"modified": "2022-07-02T04:22:03.087247Z",
|
|
"name": "Recruit bad actors",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0091.md",
|
|
"external_id": "T0091"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--9e493618-c116-4ad9-a47a-126b10ab558d"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--ca9c2c2a-da40-4acc-b032-9df2fa13405d",
|
|
"created_by_ref": "identity--6669e59d-a16e-4dd4-b2e9-f08d6f7808e8",
|
|
"created": "2022-07-02T04:22:03.087572Z",
|
|
"modified": "2022-07-02T04:22:03.087572Z",
|
|
"name": "Build Network",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0092.md",
|
|
"external_id": "T0092"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5f6f7cab-3425-4be7-8434-9817317cf133"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8911a837-749f-47d2-a07d-9c05cef6b87b",
|
|
"created_by_ref": "identity--a8fd57b2-1cf1-479c-b5f0-0a8f4720f590",
|
|
"created": "2022-07-02T04:22:03.087994Z",
|
|
"modified": "2022-07-02T04:22:03.087994Z",
|
|
"name": "Acquire/ recruit Network",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0093.md",
|
|
"external_id": "T0093"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--feaee474-56df-4f8c-80f7-fc7ec4b5852d"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--c92deaef-cf61-4e75-ada2-a75e3c11afe6",
|
|
"created_by_ref": "identity--0bc02e9d-b6d2-48f3-8f43-437d0b8515c1",
|
|
"created": "2022-07-02T04:22:03.088338Z",
|
|
"modified": "2022-07-02T04:22:03.088338Z",
|
|
"name": "Infiltrate Existing Networks",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0094.md",
|
|
"external_id": "T0094"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--2efdf5ca-4533-4493-a893-56458815b8bf"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--bb0fc2b3-d3f5-4e25-8f48-dd9dcd91187f",
|
|
"created_by_ref": "identity--e2669787-c734-46af-8e39-1647aee8b147",
|
|
"created": "2022-07-02T04:22:03.088664Z",
|
|
"modified": "2022-07-02T04:22:03.088664Z",
|
|
"name": "Develop Owned Media Assets",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0095.md",
|
|
"external_id": "T0095"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--795daf79-cdf0-426c-a0dc-1ff167ac0781"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--60545e2c-e9f6-48b2-a2e2-8bda93434e64",
|
|
"created_by_ref": "identity--08a59c27-6138-4574-ac73-a05027315a90",
|
|
"created": "2022-07-02T04:22:03.088983Z",
|
|
"modified": "2022-07-02T04:22:03.088983Z",
|
|
"name": "Leverage Content Farm",
|
|
"description": "TA15",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0096.md",
|
|
"external_id": "T0096"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d2048343-3311-4bbe-9373-bd04cfc60521"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--89d40adf-6f6e-418f-8e27-1dd214995c1d",
|
|
"created_by_ref": "identity--bd0397d0-ecb1-4c94-86c4-e59dabd8fb22",
|
|
"created": "2022-07-02T04:22:03.089303Z",
|
|
"modified": "2022-07-02T04:22:03.089303Z",
|
|
"name": "Create personas",
|
|
"description": "TA16",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0097.md",
|
|
"external_id": "T0097"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--aa73818a-574c-41a6-8aa3-67f50ec203ec"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--e03d047c-ab58-40e6-944c-6bc1eab12559",
|
|
"created_by_ref": "identity--521bc1c7-88ec-4815-8f06-f85dd40d835d",
|
|
"created": "2022-07-02T04:22:03.089628Z",
|
|
"modified": "2022-07-02T04:22:03.089628Z",
|
|
"name": "Establish Inauthentic News Sites",
|
|
"description": "TA16",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0098.md",
|
|
"external_id": "T0098"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--187453cd-e15a-4ea0-8195-e6f42ef5ef94"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--de48f162-abb1-440e-b264-04ba0a9e6881",
|
|
"created_by_ref": "identity--e93cccfb-8374-4e23-b068-1d6a2fbffaf1",
|
|
"created": "2022-07-02T04:22:03.089954Z",
|
|
"modified": "2022-07-02T04:22:03.089954Z",
|
|
"name": "Prepare Assets Impersonating Legitimate Entities",
|
|
"description": "TA16",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0099.md",
|
|
"external_id": "T0099"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3f116c43-211e-44ed-8372-f3bbc3a5de98"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d9c6cb8b-122f-4ff9-ae38-4aa693068bf8",
|
|
"created_by_ref": "identity--18e95ac2-d7cb-495e-898e-9575ed859864",
|
|
"created": "2022-07-02T04:22:03.090333Z",
|
|
"modified": "2022-07-02T04:22:03.090333Z",
|
|
"name": "Co-opt Trusted Sources",
|
|
"description": "TA16",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0100.md",
|
|
"external_id": "T0100"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--20bbfa95-8fc3-4f0f-b5dd-c05ec908c3c5"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1aa64eda-9ca1-4bee-9d8e-03df564224be",
|
|
"created_by_ref": "identity--c7d44c36-4d0d-4b23-8908-74b169e8b1e1",
|
|
"created": "2022-07-02T04:22:03.090706Z",
|
|
"modified": "2022-07-02T04:22:03.090706Z",
|
|
"name": "Create Localized Content",
|
|
"description": "TA05",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "microtarget"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0101.md",
|
|
"external_id": "T0101"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d907d1c7-4986-40e2-90a3-f22ab0a818c0"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b569654a-48b9-403a-ad02-5c0520f24c2a",
|
|
"created_by_ref": "identity--c364c851-d82e-4738-9479-f8d30d14dfd4",
|
|
"created": "2022-07-02T04:22:03.091087Z",
|
|
"modified": "2022-07-02T04:22:03.091087Z",
|
|
"name": "Leverage Echo Chambers/Filter Bubbles",
|
|
"description": "TA05",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "microtarget"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0102.md",
|
|
"external_id": "T0102"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d470cc1f-37b3-48c5-b3a7-63641f6d7ae2"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--187e3391-9355-412c-94bd-3aa951359917",
|
|
"created_by_ref": "identity--f78a2e25-3eb2-4bfe-9004-25f538766eca",
|
|
"created": "2022-07-02T04:22:03.09143Z",
|
|
"modified": "2022-07-02T04:22:03.09143Z",
|
|
"name": "Livestream",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0103.md",
|
|
"external_id": "T0103"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--8e0217a7-cf78-4582-be4d-e0e0849b7061"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--92f696dc-5a56-4768-a6d2-1a69c6642c7a",
|
|
"created_by_ref": "identity--cbe28949-eb39-458b-94ef-22073e0cb3a5",
|
|
"created": "2022-07-02T04:22:03.091754Z",
|
|
"modified": "2022-07-02T04:22:03.091754Z",
|
|
"name": "Social Networks",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.md",
|
|
"external_id": "T0104"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0bcdea95-9b96-48fa-8669-60418e5c9798"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1e3fe580-e721-43ae-b231-6a1ffa7c7427",
|
|
"created_by_ref": "identity--06d6bbce-9166-4ecf-8033-76d96d6ae7f9",
|
|
"created": "2022-07-02T04:22:03.092074Z",
|
|
"modified": "2022-07-02T04:22:03.092074Z",
|
|
"name": "Media Sharing Networks",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0105.md",
|
|
"external_id": "T0105"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ecb980c1-872e-4bef-989e-3a44e5b68c8f"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d004bc13-8282-46b2-9793-5a0b62f2dffa",
|
|
"created_by_ref": "identity--2a8173c4-bdc6-4887-8881-c7640dc05b4e",
|
|
"created": "2022-07-02T04:22:03.092395Z",
|
|
"modified": "2022-07-02T04:22:03.092395Z",
|
|
"name": "Discussion Forums",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0106.md",
|
|
"external_id": "T0106"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0f9f5990-5ded-4efe-b5a6-6f6d721c65cb"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--82ff2830-95e9-45d8-a370-e71c229043d6",
|
|
"created_by_ref": "identity--0a1a4298-b476-413c-8802-05f12abf5c4e",
|
|
"created": "2022-07-02T04:22:03.092716Z",
|
|
"modified": "2022-07-02T04:22:03.092716Z",
|
|
"name": "Bookmarking and Content Curation",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0107.md",
|
|
"external_id": "T0107"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--356e45e4-9832-431d-92f6-e7b520006171"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f79b6249-8470-4796-833f-30d00e8c7cda",
|
|
"created_by_ref": "identity--9c6c6d30-b360-4205-a5b1-37fd4e1af993",
|
|
"created": "2022-07-02T04:22:03.093054Z",
|
|
"modified": "2022-07-02T04:22:03.093054Z",
|
|
"name": "Blogging and Publishing Networks",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0108.md",
|
|
"external_id": "T0108"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e814441a-5f54-4ab6-817c-e1a2e2b0edc8"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--58b60765-77b3-4725-9c01-e70cc2ca9ff5",
|
|
"created_by_ref": "identity--e27f712a-7f54-49ab-ba51-4b3d0a3f058f",
|
|
"created": "2022-07-02T04:22:03.093374Z",
|
|
"modified": "2022-07-02T04:22:03.093374Z",
|
|
"name": "Consumer Review Networks",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0109.md",
|
|
"external_id": "T0109"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c33faf80-606a-46ea-bb04-b26804f0fac9"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--bc15b22a-e7ef-4f9c-9566-378123e73a22",
|
|
"created_by_ref": "identity--a44e4b5f-b627-4f27-ae48-a744abd628bd",
|
|
"created": "2022-07-02T04:22:03.09371Z",
|
|
"modified": "2022-07-02T04:22:03.09371Z",
|
|
"name": "Formal Diplomatic Channels",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0110.md",
|
|
"external_id": "T0110"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--4cb36b73-42cd-43d9-a8a4-a84391ec581f"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8a8eea1e-0bb0-45d1-8e03-62bf0203158f",
|
|
"created_by_ref": "identity--146d2a57-6845-4e48-8bd1-d914f03bed74",
|
|
"created": "2022-07-02T04:22:03.094029Z",
|
|
"modified": "2022-07-02T04:22:03.094029Z",
|
|
"name": "Traditional Media",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0111.md",
|
|
"external_id": "T0111"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--9dde6c16-43d0-4ab0-9aa5-c7aecd6d6f39"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--46edb68e-0257-4bbc-8666-3ddb6260462a",
|
|
"created_by_ref": "identity--9cd87489-b096-4f17-9f92-fabd41080497",
|
|
"created": "2022-07-02T04:22:03.09435Z",
|
|
"modified": "2022-07-02T04:22:03.09435Z",
|
|
"name": "Email",
|
|
"description": "TA07",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0112.md",
|
|
"external_id": "T0112"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0b295746-495c-4d97-a8db-0c5977789060"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b84d3151-9d2d-48e3-aff9-97f9cae72b6e",
|
|
"created_by_ref": "identity--1e5d8032-a109-4d18-b949-9a4dec9525b1",
|
|
"created": "2022-07-02T04:22:03.09467Z",
|
|
"modified": "2022-07-02T04:22:03.09467Z",
|
|
"name": "Employ Commercial Analytic Firms",
|
|
"description": "TA08",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "conduct-pump-priming"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0113.md",
|
|
"external_id": "T0113"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--deeb2d9c-f297-4457-8788-0b814b0d20a0"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--5279ebe3-f902-4f0b-a1ae-34a647b99df1",
|
|
"created_by_ref": "identity--9a99a0b8-9e99-41a6-b80f-c1b710bc7887",
|
|
"created": "2022-07-02T04:22:03.09499Z",
|
|
"modified": "2022-07-02T04:22:03.09499Z",
|
|
"name": "Deliver Ads",
|
|
"description": "TA09",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0114.md",
|
|
"external_id": "T0114"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--71b04a9e-f5d5-4822-a0e1-7db9f745560f"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--08a11627-de00-4ac2-b6ee-b11ad36b309b",
|
|
"created_by_ref": "identity--46b061de-34b2-4987-a18c-9e2e14a946c5",
|
|
"created": "2022-07-02T04:22:03.095308Z",
|
|
"modified": "2022-07-02T04:22:03.095308Z",
|
|
"name": "Post Content",
|
|
"description": "TA09",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0115.md",
|
|
"external_id": "T0115"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b335337d-178c-4d43-acc1-263ed50feb4c"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--875c2147-5059-4bb5-ae60-7c307222c222",
|
|
"created_by_ref": "identity--9dfa31fb-7782-42c8-8edf-dd3816a9473e",
|
|
"created": "2022-07-02T04:22:03.095651Z",
|
|
"modified": "2022-07-02T04:22:03.095651Z",
|
|
"name": "Comment or Reply on Content",
|
|
"description": "TA09",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0116.md",
|
|
"external_id": "T0116"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e0290f0b-f735-4a25-b756-cb491e8f3975"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--21ed5757-035d-42f8-86d0-97b83763afcc",
|
|
"created_by_ref": "identity--d249479e-c10e-43d4-8749-4b80bb7ce9ce",
|
|
"created": "2022-07-02T04:22:03.095971Z",
|
|
"modified": "2022-07-02T04:22:03.095971Z",
|
|
"name": "Attract Traditional Media",
|
|
"description": "TA09",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0117.md",
|
|
"external_id": "T0117"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--47bb1ff0-2270-42cf-bf6d-7fb46b7000a4"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4f599cdb-9fe0-459b-9eeb-37b54db6605e",
|
|
"created_by_ref": "identity--7affdd67-77d4-498b-97ec-c6ebaee6dd7e",
|
|
"created": "2022-07-02T04:22:03.096289Z",
|
|
"modified": "2022-07-02T04:22:03.096289Z",
|
|
"name": "Amplify Existing Narrative",
|
|
"description": "TA17",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0118.md",
|
|
"external_id": "T0118"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--59b3c253-d2d2-4267-842c-151e4a15d672"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9f08f8be-e32a-401b-b4e0-3a3735249d90",
|
|
"created_by_ref": "identity--91c7cd6e-96a1-4228-887b-6d75eb56181b",
|
|
"created": "2022-07-02T04:22:03.096613Z",
|
|
"modified": "2022-07-02T04:22:03.096613Z",
|
|
"name": "Cross-Posting",
|
|
"description": "TA17",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0119.md",
|
|
"external_id": "T0119"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fb899ba8-e72c-4e1e-a93f-d74c0ab60d7b"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9cdae3e8-394c-4244-91b6-ed5d2dfd5d5b",
|
|
"created_by_ref": "identity--9f884949-8877-48f5-a84c-6aa5aa2c54c9",
|
|
"created": "2022-07-02T04:22:03.096937Z",
|
|
"modified": "2022-07-02T04:22:03.096937Z",
|
|
"name": "Incentivize Sharing",
|
|
"description": "TA17",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0120.md",
|
|
"external_id": "T0120"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--bd14b937-422f-401e-90a8-3dbc8f32f0a7"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--58a8d163-c0f8-4bf5-b960-b95460c39dd3",
|
|
"created_by_ref": "identity--1d97c1ee-3a1a-413a-8a37-2f635ac60794",
|
|
"created": "2022-07-02T04:22:03.097257Z",
|
|
"modified": "2022-07-02T04:22:03.097257Z",
|
|
"name": "Manipulate Platform Algorithm",
|
|
"description": "TA17",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0121.md",
|
|
"external_id": "T0121"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--14128ab1-c193-4f7a-b515-7c6e3347e748"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--7e534b57-590a-4a35-8025-1d5682691584",
|
|
"created_by_ref": "identity--349ee88b-36ea-46e8-8929-fe18f342963e",
|
|
"created": "2022-07-02T04:22:03.097581Z",
|
|
"modified": "2022-07-02T04:22:03.097581Z",
|
|
"name": "Direct Users to Alternative Platforms",
|
|
"description": "TA17",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0122.md",
|
|
"external_id": "T0122"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3cc768a1-dd75-45eb-a3cd-c3156177f0ae"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--7d95c5b8-c76f-4761-800c-e91e60988af2",
|
|
"created_by_ref": "identity--ecbebe31-eeed-446b-a72f-ba236d9cacbb",
|
|
"created": "2022-07-02T04:22:03.097909Z",
|
|
"modified": "2022-07-02T04:22:03.097909Z",
|
|
"name": "Control Information Environment through Offensive Cyberspace Operations",
|
|
"description": "TA18",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0123.md",
|
|
"external_id": "T0123"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3958775c-e7d5-47da-b360-e11e2f55f203"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--5eee1595-4d0e-4ee9-9591-982ce7ec9b84",
|
|
"created_by_ref": "identity--2eacc7d1-01fd-4349-bcba-584c6da7bd84",
|
|
"created": "2022-07-02T04:22:03.098235Z",
|
|
"modified": "2022-07-02T04:22:03.098235Z",
|
|
"name": "Suppress Opposition",
|
|
"description": "TA18",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0124.md",
|
|
"external_id": "T0124"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--1371a378-36dc-4663-9025-00ee726c0ccb"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--5c461ed5-ed0b-4473-b07b-4624f79a6e82",
|
|
"created_by_ref": "identity--f4377a45-5680-414b-ae4b-392dc9908d63",
|
|
"created": "2022-07-02T04:22:03.098564Z",
|
|
"modified": "2022-07-02T04:22:03.098564Z",
|
|
"name": "Platform Filtering",
|
|
"description": "TA18",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0125.md",
|
|
"external_id": "T0125"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--4b30c99c-e04b-421f-b8d9-c87e2e5232df"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8f377c72-c924-402b-af87-eaaf96d9d0a3",
|
|
"created_by_ref": "identity--7bf8ee5c-3363-4aa2-a60d-39bb36969a28",
|
|
"created": "2022-07-02T04:22:03.09888Z",
|
|
"modified": "2022-07-02T04:22:03.09888Z",
|
|
"name": "Encourage Attendance at Events",
|
|
"description": "TA10",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0126.md",
|
|
"external_id": "T0126"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--157d36bd-789a-4430-9c94-0093a61e50e2"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--3cbdc5fc-976d-4264-9b9f-3657f6d81121",
|
|
"created_by_ref": "identity--bc58f435-38a0-43a8-872a-2d210fd9b889",
|
|
"created": "2022-07-02T04:22:03.0992Z",
|
|
"modified": "2022-07-02T04:22:03.0992Z",
|
|
"name": "Physical Violence",
|
|
"description": "TA10",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0127.md",
|
|
"external_id": "T0127"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ee0aa1ee-fbc9-4403-a81a-8221eb70c6ba"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1cb5bd52-aed3-4c59-a5ac-7fca75c22ae6",
|
|
"created_by_ref": "identity--d0d9e3d3-fe83-49db-aa1e-711c791b66fe",
|
|
"created": "2022-07-02T04:22:03.099517Z",
|
|
"modified": "2022-07-02T04:22:03.099517Z",
|
|
"name": "Conceal People",
|
|
"description": "TA11",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0128.md",
|
|
"external_id": "T0128"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--4cc5ae07-6466-44d3-804f-6b134e221ed0"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce",
|
|
"created_by_ref": "identity--2615d82a-b29c-44c8-9e4a-02addb976284",
|
|
"created": "2022-07-02T04:22:03.099858Z",
|
|
"modified": "2022-07-02T04:22:03.099858Z",
|
|
"name": "Conceal Operational Activity",
|
|
"description": "TA11",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.md",
|
|
"external_id": "T0129"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ae88f1b6-6430-4512-8119-452a54384323"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4063b46c-b959-4944-a569-37e88e497999",
|
|
"created_by_ref": "identity--16ac4005-1f90-4338-b93b-902a87581c22",
|
|
"created": "2022-07-02T04:22:03.100175Z",
|
|
"modified": "2022-07-02T04:22:03.100175Z",
|
|
"name": "Conceal Infrastructure",
|
|
"description": "TA11",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0130.md",
|
|
"external_id": "T0130"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5aa4547d-f973-40f5-adf1-dbcc4cd7600d"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--910f7a34-979d-44a8-a6d3-cfadb7172039",
|
|
"created_by_ref": "identity--7a8b43b7-9e78-4c3d-9470-37ce980efeb6",
|
|
"created": "2022-07-02T04:22:03.1005Z",
|
|
"modified": "2022-07-02T04:22:03.1005Z",
|
|
"name": "Exploit TOS/Content Moderation",
|
|
"description": "TA11",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0131.md",
|
|
"external_id": "T0131"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d4ea80be-d0e3-411e-af3f-cf6933e40c2e"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--48d17a8e-898e-45fe-9d05-3f264445c63c",
|
|
"created_by_ref": "identity--02ffcb17-e281-4840-acaf-8c8433210309",
|
|
"created": "2022-07-02T04:22:03.100815Z",
|
|
"modified": "2022-07-02T04:22:03.100815Z",
|
|
"name": "Measure Performance",
|
|
"description": "TA12",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0132.md",
|
|
"external_id": "T0132"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--22ede23b-e9f5-4088-a50a-bb14fd1a06ec"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d68ff2dd-a826-4465-a5f8-64368a42145c",
|
|
"created_by_ref": "identity--1b8c0ee5-d26d-4c49-a284-57a23941266f",
|
|
"created": "2022-07-02T04:22:03.101144Z",
|
|
"modified": "2022-07-02T04:22:03.101144Z",
|
|
"name": "Measure Effectiveness",
|
|
"description": "TA12",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0133.md",
|
|
"external_id": "T0133"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0aedeb61-c66f-493f-9b02-40836a679918"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--63b39e10-ced2-467d-8441-7d43754d2ce8",
|
|
"created_by_ref": "identity--1c29876d-878e-4b7c-8a7b-2818f9a7f5d7",
|
|
"created": "2022-07-02T04:22:03.101465Z",
|
|
"modified": "2022-07-02T04:22:03.101465Z",
|
|
"name": "Measure Effectiveness Indicators (or KPIs)",
|
|
"description": "TA12",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0134.md",
|
|
"external_id": "T0134"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b5415a27-0c8c-4cb6-a8e7-62dbd324f004"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--540e2d0d-4de2-4331-a130-ccbd14945e57",
|
|
"created_by_ref": "identity--d57f8b7c-a1a0-4112-b156-cf7bcbe28b6e",
|
|
"created": "2022-07-02T04:22:03.102063Z",
|
|
"modified": "2022-07-02T04:22:03.102063Z",
|
|
"name": "Discredit Credible Sources",
|
|
"description": "Plan to delegitimize the media landscape and degrade public trust in reporting, by discrediting credible sources. This makes it easier to promote influence operation content.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "plan-objectives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0075.001.md",
|
|
"external_id": "T0075.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--7b979c8f-a880-406d-abcd-21c71f656171"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--68ab5cae-ca42-46fd-bd2f-9d614e0654aa",
|
|
"created_by_ref": "identity--ef522925-773f-4be7-9cfd-0a8c61c7e946",
|
|
"created": "2022-07-02T04:22:03.102388Z",
|
|
"modified": "2022-07-02T04:22:03.102388Z",
|
|
"name": "Monitor Social Media Analytics",
|
|
"description": "An influence operation may use social media analytics to determine which factors will increase the operation content\u2019s exposure to its target audience on social media platforms, including views, interactions, and sentiment relating to topics and content types. The social media platform itself or a third-party tool may collect the metrics. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0080.001.md",
|
|
"external_id": "T0080.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--1578c3f2-57d3-4488-a9ec-5ff83f6fe5b2"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--23706f91-ddc8-4978-b008-9a8996489615",
|
|
"created_by_ref": "identity--4617f4f8-03e8-4bb4-8ced-5f39ee2c416e",
|
|
"created": "2022-07-02T04:22:03.102706Z",
|
|
"modified": "2022-07-02T04:22:03.102706Z",
|
|
"name": "Evaluate Media Surveys",
|
|
"description": "An influence operation may evaluate its own or third-party media surveys to determine what type of content appeals to its target audience. Media surveys may provide insight into an audience\u2019s political views, social class, general interests, or other indicators used to tailor operation messaging to its target audience.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0080.002.md",
|
|
"external_id": "T0080.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c8b7af04-4fa2-4f43-b41e-b2c5258b7490"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--cfc651f7-ade6-4ede-aa80-8f03bb34e605",
|
|
"created_by_ref": "identity--71e49bdd-dcbc-41ac-a33a-8cd8b3ea3b3a",
|
|
"created": "2022-07-02T04:22:03.103025Z",
|
|
"modified": "2022-07-02T04:22:03.103025Z",
|
|
"name": "Identify Trending Topics/Hashtags",
|
|
"description": "An influence operation may identify trending hashtags on social media platforms for later use in boosting operation content. A hashtag40 refers to a word or phrase preceded by the hash symbol (#) on social media used to identify messages and posts relating to a specific topic. All public posts that use the same hashtag are aggregated onto a centralized page dedicated to the word or phrase and sorted either chronologically or by popularity. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0080.003.md",
|
|
"external_id": "T0080.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b811773d-377a-4382-9cac-7a6108ce0155"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4699fa91-706b-4a8b-b253-fbbcf05f44c9",
|
|
"created_by_ref": "identity--bc415869-0cc0-47ef-9354-eb85469ffe10",
|
|
"created": "2022-07-02T04:22:03.103346Z",
|
|
"modified": "2022-07-02T04:22:03.103346Z",
|
|
"name": "Conduct Web Traffic Analysis",
|
|
"description": "An influence operation may conduct web traffic analysis to determine which search engines, keywords, websites, and advertisements gain the most traction with its target audience.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0080.004.md",
|
|
"external_id": "T0080.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d15b9bec-1b95-49cc-919b-118748be8bc9"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--fd7cbe84-0374-4656-a9e1-b8f41caf268c",
|
|
"created_by_ref": "identity--0db6c206-0eb4-44dc-9506-1c465dcf4f4b",
|
|
"created": "2022-07-02T04:22:03.103676Z",
|
|
"modified": "2022-07-02T04:22:03.103676Z",
|
|
"name": "Assess Degree/Type of Media Access",
|
|
"description": "An influence operation may survey a target audience\u2019s Internet availability and degree of media freedom to determine which target audience members will have access to operation content and on which platforms. An operation may face more difficulty targeting an information environment with heavy restrictions and media control than an environment with independent media, freedom of speech and of the press, and individual liberties. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0080.005.md",
|
|
"external_id": "T0080.005"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ef4438be-f102-45b9-a9d8-e55803be289b"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--7a43da5e-b3bc-4511-bc63-95af83289a29",
|
|
"created_by_ref": "identity--65a0c36b-5699-4b67-adc0-d59baaa67d86",
|
|
"created": "2022-07-02T04:22:03.103995Z",
|
|
"modified": "2022-07-02T04:22:03.103995Z",
|
|
"name": "Find Echo Chambers",
|
|
"description": "Find or plan to create areas (social media groups, search term groups, hashtag groups etc) where individuals only engage with people they agree with. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.001.md",
|
|
"external_id": "T0081.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--2e3bc03e-14c8-4352-a006-beb411c19dbf"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--ca7f3d9f-1f93-4eec-ad3e-0d8c7b9c1c78",
|
|
"created_by_ref": "identity--77e8f97b-8089-4a25-a94a-00baf03c42e8",
|
|
"created": "2022-07-02T04:22:03.10431Z",
|
|
"modified": "2022-07-02T04:22:03.10431Z",
|
|
"name": "Identify Data Voids",
|
|
"description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. \nA 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalizing on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.002.md",
|
|
"external_id": "T0081.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b2b327f5-8e93-40ea-a229-28aa24a30420"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1f7789b9-c923-4862-a21c-1bb797c9134e",
|
|
"created_by_ref": "identity--865694d3-ec33-4438-bacf-afa112f28f10",
|
|
"created": "2022-07-02T04:22:03.104625Z",
|
|
"modified": "2022-07-02T04:22:03.104625Z",
|
|
"name": "Identify Existing Prejudices",
|
|
"description": "An influence operation may exploit existing racial, religious, demographic, or social prejudices to further polarize its target audience from the rest of the public.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.003.md",
|
|
"external_id": "T0081.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--4e2ee680-ecec-454e-bce6-27b6cd7038ed"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--28674cbc-4d76-41f9-b764-6ded29ee44fd",
|
|
"created_by_ref": "identity--f82c73a3-9e7f-4350-88a7-78382de7dbe0",
|
|
"created": "2022-07-02T04:22:03.104941Z",
|
|
"modified": "2022-07-02T04:22:03.104941Z",
|
|
"name": "Identify Existing Fissures",
|
|
"description": "An influence operation may identify existing fissures to pit target populations against one another or facilitate a \u201cdivide-and-conquer\" approach to tailor operation narratives along the divides.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.004.md",
|
|
"external_id": "T0081.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b1be49f6-94f3-493f-91cf-85cf1a39428a"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--fc670bc5-fd66-4a50-896d-bf15b685e0b1",
|
|
"created_by_ref": "identity--9bbfe994-eff1-44e6-aec8-084ff9c18a86",
|
|
"created": "2022-07-02T04:22:03.105256Z",
|
|
"modified": "2022-07-02T04:22:03.105256Z",
|
|
"name": "Identify Existing Conspiracy Narratives/Suspicions",
|
|
"description": "An influence operation may assess preexisting conspiracy theories or suspicions in a population to identify existing narratives that support operational objectives. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.005.md",
|
|
"external_id": "T0081.005"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--4a1918b8-03e7-4fa5-80e6-64ca1245e45f"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--05b27309-f960-4bdb-8f7c-81a6d3df74fe",
|
|
"created_by_ref": "identity--3cdf67d3-7108-48de-b396-357a5cea96be",
|
|
"created": "2022-07-02T04:22:03.105577Z",
|
|
"modified": "2022-07-02T04:22:03.105577Z",
|
|
"name": "Identify Wedge Issues",
|
|
"description": "A wedge issue is a divisive political issue, usually concerning a social phenomenon, that divides individuals along a defined line. An influence operation may exploit wedge issues by intentionally polarizing the public along the wedge issue line and encouraging opposition between factions.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.006.md",
|
|
"external_id": "T0081.006"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--a0933792-0d21-4e92-81f0-9bf587950bc5"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8fe69eb0-7cfd-4cfe-b05d-37d439c487ae",
|
|
"created_by_ref": "identity--9fae867d-7af0-42b5-85dc-237220ad98a7",
|
|
"created": "2022-07-02T04:22:03.105893Z",
|
|
"modified": "2022-07-02T04:22:03.105893Z",
|
|
"name": "Identify Target Audience Adversaries",
|
|
"description": "An influence operation may identify or create a real or imaginary adversary to center operation narratives against. A real adversary may include certain politicians or political parties while imaginary adversaries may include falsified \u201cdeep state\u201d62 actors that, according to conspiracies, run the state behind public view. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.007.md",
|
|
"external_id": "T0081.007"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--54d6fd81-ed83-4d31-a155-7467bce5a3cd"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--2b6bd718-4225-4bbe-9444-183f90644c74",
|
|
"created_by_ref": "identity--e435d26e-0ecb-454b-9b09-17fd7ca15b75",
|
|
"created": "2022-07-02T04:22:03.106213Z",
|
|
"modified": "2022-07-02T04:22:03.106213Z",
|
|
"name": "Identify Media System Vulnerabilities",
|
|
"description": "An influence operation may exploit existing weaknesses in a target\u2019s media system. These weaknesses may include existing biases among media agencies, vulnerability to false news agencies on social media, or existing distrust of traditional media sources. An existing distrust among the public in the media system\u2019s credibility holds high potential for exploitation by an influence operation when establishing alternative news agencies to spread operation content. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0081.008.md",
|
|
"external_id": "T0081.008"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--2a74fdc4-aa04-4969-bb12-3b04ba5f7989"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--a7c9394d-d8b5-4bd2-868b-06af78391dce",
|
|
"created_by_ref": "identity--f2922191-41f4-4359-90bc-e971d94fc86f",
|
|
"created": "2022-07-02T04:22:03.106546Z",
|
|
"modified": "2022-07-02T04:22:03.106546Z",
|
|
"name": "Geographic Segmentation",
|
|
"description": "An influence operation may target populations in a specific geographic location, such as a region, state, or city. An influence operation may use geographic segmentation to Create Localized Content (see: Establish Legitimacy). ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0072.001.md",
|
|
"external_id": "T0072.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--dce391ac-f276-4e96-808d-f774d5494a72"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--386a6daa-c8f0-4670-bba9-032268352689",
|
|
"created_by_ref": "identity--1480f942-a431-436e-b271-62f6f3535a6d",
|
|
"created": "2022-07-02T04:22:03.106864Z",
|
|
"modified": "2022-07-02T04:22:03.106864Z",
|
|
"name": "Demographic Segmentation",
|
|
"description": "An influence operation may target populations based on demographic segmentation, including age, gender, and income. Demographic segmentation may be useful for influence operations aiming to change state policies that affect a specific population sector. For example, an influence operation attempting to influence Medicare funding in the United States would likely target U.S. voters over 65 years of age. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0072.002.md",
|
|
"external_id": "T0072.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5f49ef6e-0170-43b1-a860-f4f6de42a9ea"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--2c2dea9d-8fac-4c78-aded-3ffc8b689f14",
|
|
"created_by_ref": "identity--51fd2bb4-68fb-4f11-96fe-49ffd9017c3e",
|
|
"created": "2022-07-02T04:22:03.107184Z",
|
|
"modified": "2022-07-02T04:22:03.107184Z",
|
|
"name": "Economic Segmentation",
|
|
"description": "An influence operation may target populations based on their income bracket, wealth, or other financial or economic division. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0072.003.md",
|
|
"external_id": "T0072.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--97cd5dd6-b9fc-4d7d-add3-f620418b5cc9"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--ba35100d-28dc-4b91-b922-c7423591440c",
|
|
"created_by_ref": "identity--472b4055-df5c-412a-9cbf-dedae6459c8a",
|
|
"created": "2022-07-02T04:22:03.107541Z",
|
|
"modified": "2022-07-02T04:22:03.107541Z",
|
|
"name": "Psychographic Segmentation",
|
|
"description": "An influence operation may target populations based on psychographic segmentation, which uses audience values and decision-making processes. An operation may individually gather psychographic data with its own surveys or collection tools or externally purchase data from social media companies or online surveys, such as personality quizzes. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0072.004.md",
|
|
"external_id": "T0072.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0eee50bc-12e1-48cb-9657-b9943cc1a8ba"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0d705267-24bc-49d0-9cb8-db20ef0e4312",
|
|
"created_by_ref": "identity--20aa7572-2e93-461d-850d-b32ececde944",
|
|
"created": "2022-07-02T04:22:03.107865Z",
|
|
"modified": "2022-07-02T04:22:03.107865Z",
|
|
"name": "Political Segmentation",
|
|
"description": "An influence operation may target populations based on their political affiliations, especially when aiming to manipulate voting or change policy.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "target-audience-analysis"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0072.005.md",
|
|
"external_id": "T0072.005"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--9aa856d8-de84-4e6b-b348-1e5d8f5726e7"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--ea0eab44-d062-4634-a642-9915b8cee879",
|
|
"created_by_ref": "identity--22f605be-deb4-4c83-8bf4-9fe24efad91d",
|
|
"created": "2022-07-02T04:22:03.108184Z",
|
|
"modified": "2022-07-02T04:22:03.108184Z",
|
|
"name": "Amplify Existing Conspiracy Theory Narrative",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-narratives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0022.001.md",
|
|
"external_id": "T0022.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--eb5f54f9-3d63-430a-8dab-82bdd6ba54fb"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--3c485cd2-5a88-4fe4-81f2-3c3ae12de6ae",
|
|
"created_by_ref": "identity--da3dbbe7-fe6b-4c33-b191-31994dc43f5d",
|
|
"created": "2022-07-02T04:22:03.1085Z",
|
|
"modified": "2022-07-02T04:22:03.1085Z",
|
|
"name": "Develop Original Conspiracy Theory Narratives",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-narratives"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0022.002.md",
|
|
"external_id": "T0022.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--a78a19bb-f4d9-405b-806e-ab3feb97a228"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4ebcc4a4-ff0b-4275-963a-617cdd06a45a",
|
|
"created_by_ref": "identity--699b2544-556e-444e-8007-c73e4f7aa7a4",
|
|
"created": "2022-07-02T04:22:03.108816Z",
|
|
"modified": "2022-07-02T04:22:03.108816Z",
|
|
"name": "Use Copypasta",
|
|
"description": "Copypasta refers to a piece of text that has been copied and pasted multiple times across various online platforms. A copypasta\u2019s final form may differ from its original source text as users add, delete, or otherwise edit the content as they repost the text. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0084.001.md",
|
|
"external_id": "T0084.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d7055552-3041-4dc9-a230-e4e124f0846f"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--23b4bcfc-7362-440f-97ca-1094ad0abc1e",
|
|
"created_by_ref": "identity--909d618b-ed43-4566-a2ad-b744f772fca9",
|
|
"created": "2022-07-02T04:22:03.109147Z",
|
|
"modified": "2022-07-02T04:22:03.109147Z",
|
|
"name": "Plagiarize Content",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0084.002.md",
|
|
"external_id": "T0084.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--05037167-3060-45f9-af72-94d680be3593"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--a40d0704-c0ad-4e08-a8b3-a47366c904a0",
|
|
"created_by_ref": "identity--c19f6731-fa07-4661-bef7-56b06033a8ef",
|
|
"created": "2022-07-02T04:22:03.109467Z",
|
|
"modified": "2022-07-02T04:22:03.109467Z",
|
|
"name": "Deceptively Labeled or Translated",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0084.003.md",
|
|
"external_id": "T0084.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--9832e089-54d9-460a-ba2b-891684aee4a7"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--5b64ee4b-994b-4b93-8b1e-3bd71e96f934",
|
|
"created_by_ref": "identity--532070ad-c8ef-4a88-8c71-ab2525340193",
|
|
"created": "2022-07-02T04:22:03.109783Z",
|
|
"modified": "2022-07-02T04:22:03.109783Z",
|
|
"name": "Appropriate Content",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0084.004.md",
|
|
"external_id": "T0084.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ca708320-525c-4488-a373-95599962f4ea"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--2eb2f147-53d7-4fae-a711-13f0181630a0",
|
|
"created_by_ref": "identity--e6865b40-628d-4ac3-bff8-87dfa6a01831",
|
|
"created": "2022-07-02T04:22:03.1101Z",
|
|
"modified": "2022-07-02T04:22:03.1101Z",
|
|
"name": "Develop AI-Generated Text",
|
|
"description": "AI-generated texts refers to synthetic text composed by computers using text-generating AI technology. Autonomous generation refers to content created by a bot without human input, also known as bot-created content generation. Autonomous generation represents the next step in automation after language generation and may lead to automated journalism. An influence operation may use read fakes or autonomous generation to quickly develop and distribute content to the target audience.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0085.001.md",
|
|
"external_id": "T0085.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--567482ec-6057-4575-b352-7626f286ff2b"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1665bd77-075a-40e0-b344-76382fa64dc2",
|
|
"created_by_ref": "identity--320f2010-7f08-40ce-9681-b6bff1eb6016",
|
|
"created": "2022-07-02T04:22:03.110416Z",
|
|
"modified": "2022-07-02T04:22:03.110416Z",
|
|
"name": "Develop False or Altered Documents",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0085.002.md",
|
|
"external_id": "T0085.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--44c4223b-a542-4444-b697-76c5c0fc24b9"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f87843fc-a049-4664-a82d-6be77620dcac",
|
|
"created_by_ref": "identity--babb85bb-495d-47c5-b58d-4b4115c60b66",
|
|
"created": "2022-07-02T04:22:03.110733Z",
|
|
"modified": "2022-07-02T04:22:03.110733Z",
|
|
"name": "Develop Inauthentic News Articles",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0085.003.md",
|
|
"external_id": "T0085.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--a5738669-8f1a-42df-80f9-59091afddd3c"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--c8c9540a-aa0b-4f9b-8c94-95868daa7109",
|
|
"created_by_ref": "identity--9aaa8966-eafa-4f58-ae38-69ca091b2ca5",
|
|
"created": "2022-07-02T04:22:03.11105Z",
|
|
"modified": "2022-07-02T04:22:03.11105Z",
|
|
"name": "Develop Memes",
|
|
"description": "Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0086.001.md",
|
|
"external_id": "T0086.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--6bf017a3-cd4d-47af-bbba-48473138445e"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b6452a25-f3fc-4578-88fb-052719b04600",
|
|
"created_by_ref": "identity--02dc2dbb-67c1-4626-8e92-035390abd11e",
|
|
"created": "2022-07-02T04:22:03.111371Z",
|
|
"modified": "2022-07-02T04:22:03.111371Z",
|
|
"name": "Develop AI-Generated Images (Deepfakes)",
|
|
"description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0086.002.md",
|
|
"external_id": "T0086.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--eec493b4-7166-4348-9449-4e4e18ec7c72"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--cb89dcce-417a-4b63-a7bc-fce09c6e4909",
|
|
"created_by_ref": "identity--148cdbe8-b2b6-44b0-a50a-83a1bc32ba3a",
|
|
"created": "2022-07-02T04:22:03.1117Z",
|
|
"modified": "2022-07-02T04:22:03.1117Z",
|
|
"name": "Deceptively Edit Image (Cheap fakes)",
|
|
"description": "Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0086.003.md",
|
|
"external_id": "T0086.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3cb8d7df-1719-45ef-b83e-9993f5abd98f"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--cb49547c-16d2-4897-88c5-14015f132406",
|
|
"created_by_ref": "identity--6cc8f776-e280-4649-ac84-fda46451051d",
|
|
"created": "2022-07-02T04:22:03.112015Z",
|
|
"modified": "2022-07-02T04:22:03.112015Z",
|
|
"name": "Aggregate Information into Evidence Collages",
|
|
"description": "image files that aggregate positive evidence (Joan Donovan)",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0086.004.md",
|
|
"external_id": "T0086.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--28f060c2-b487-40fa-9ad5-162a994b87c5"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4bf72d47-faa4-400a-bfd2-653372a15612",
|
|
"created_by_ref": "identity--337090d5-2f61-44a0-bd0d-3efc7fe7f81e",
|
|
"created": "2022-07-02T04:22:03.112332Z",
|
|
"modified": "2022-07-02T04:22:03.112332Z",
|
|
"name": "Develop AI-Generated Videos (Deepfakes)",
|
|
"description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0087.001.md",
|
|
"external_id": "T0087.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--50c32158-242e-4de2-afde-dbc3be179189"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1cc04493-e157-40b6-8173-9848d6b87e58",
|
|
"created_by_ref": "identity--d9d1f747-25ae-408d-9d11-4ee40031fabc",
|
|
"created": "2022-07-02T04:22:03.112648Z",
|
|
"modified": "2022-07-02T04:22:03.112648Z",
|
|
"name": "Deceptively Edit Video (Cheap fakes)",
|
|
"description": "Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0087.002.md",
|
|
"external_id": "T0087.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5c412a6e-7cf1-4d89-a409-74306cad315d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--756c43ea-c03f-4905-9172-e9d31399729b",
|
|
"created_by_ref": "identity--444be8ac-33b1-4db8-82b6-cb38606affd6",
|
|
"created": "2022-07-02T04:22:03.112965Z",
|
|
"modified": "2022-07-02T04:22:03.112965Z",
|
|
"name": "Develop AI-Generated Audio (Deepfakes)",
|
|
"description": "Deepfakes refer to AI-generated falsified photos, videos, or soundbites. An influence operation may use deepfakes to depict an inauthentic situation by synthetically recreating an individual\u2019s face, body, voice, and physical gestures.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0088.001.md",
|
|
"external_id": "T0088.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0c673b56-8315-4698-80b3-2ff4a689b79d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--838d59b3-91ed-4d6a-908e-c7e94cb9cd60",
|
|
"created_by_ref": "identity--19613e19-8729-487d-9536-d1d06379bff3",
|
|
"created": "2022-07-02T04:22:03.113278Z",
|
|
"modified": "2022-07-02T04:22:03.113278Z",
|
|
"name": "Deceptively Edit Audio (Cheap fakes)",
|
|
"description": "Cheap fakes utilize less sophisticated measures of altering an image, video, or audio for example, slowing, speeding, or cutting footage to create a false context surrounding an image or event.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0088.002.md",
|
|
"external_id": "T0088.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--cada69f8-79f3-414b-997b-43356c99402d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4c65eec8-13a3-4c89-8088-41db6e9e6381",
|
|
"created_by_ref": "identity--e809d292-a9fa-437f-9e53-ac020dae9fb9",
|
|
"created": "2022-07-02T04:22:03.113596Z",
|
|
"modified": "2022-07-02T04:22:03.113596Z",
|
|
"name": "Create fake research",
|
|
"description": "Create fake academic research. Example: fake social science research is often aimed at hot-button social issues such as gender, race and sexuality. Fake science research can target Climate Science debate or pseudoscience like anti-vaxx",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0019.001.md",
|
|
"external_id": "T0019.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--941585e5-62fe-4586-a9de-558edbd9247e"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--6a6e74ba-2941-4780-a855-b058b644697f",
|
|
"created_by_ref": "identity--40c6397b-361b-499d-9547-ed891dd760bf",
|
|
"created": "2022-07-02T04:22:03.113915Z",
|
|
"modified": "2022-07-02T04:22:03.113915Z",
|
|
"name": "Hijack Hashtags",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0019.002.md",
|
|
"external_id": "T0019.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--27a2921a-1f2a-4f50-8b2f-aa7b396b4964"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--7a558db1-eb42-4b98-90fd-12b96c35e75a",
|
|
"created_by_ref": "identity--f1cf7fa9-b18a-4f55-b972-fb9ad6d19851",
|
|
"created": "2022-07-02T04:22:03.114236Z",
|
|
"modified": "2022-07-02T04:22:03.114236Z",
|
|
"name": "Reframe Context",
|
|
"description": "Reframing context refers to removing an event from its surrounding context to distort its intended meaning. Rather than deny that an event occurred, reframing context frames an event in a manner that may lead the target audience to draw a different conclusion about its intentions. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0023.001.md",
|
|
"external_id": "T0023.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--dfa8f985-620d-463d-b5d9-8c36cc0951be"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--5b8e3448-2dee-4e2d-bbd8-f346ea298102",
|
|
"created_by_ref": "identity--2ec47513-51cf-421c-8b1f-2748d9b553d0",
|
|
"created": "2022-07-02T04:22:03.114564Z",
|
|
"modified": "2022-07-02T04:22:03.114564Z",
|
|
"name": "Edit Open-Source Content",
|
|
"description": "An influence operation may edit open-source content, such as collaborative blogs or encyclopedias, to promote its narratives on outlets with existing credibility and audiences. Editing open-source content may allow an operation to post content on platforms without dedicating resources to the creation and maintenance of its own assets. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0023.002.md",
|
|
"external_id": "T0023.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3db2e2bb-917c-4ea3-b041-aa55b1103dce"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8f28ec38-0448-4189-9ec5-2d026cbe0af9",
|
|
"created_by_ref": "identity--f0897e83-4815-45a9-9549-baf0ba350ad7",
|
|
"created": "2022-07-02T04:22:03.114879Z",
|
|
"modified": "2022-07-02T04:22:03.114879Z",
|
|
"name": "Leak Authentic Documents",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0089.001.md",
|
|
"external_id": "T0089.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--770373d4-4520-4bc2-802c-fad7ecc7a8a2"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--2eb2d8bf-774e-44dd-942b-11302d6defc2",
|
|
"created_by_ref": "identity--048ac8e8-6785-4993-9eb7-8d80999da439",
|
|
"created": "2022-07-02T04:22:03.1152Z",
|
|
"modified": "2022-07-02T04:22:03.1152Z",
|
|
"name": "Leak False Documents",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0089.002.md",
|
|
"external_id": "T0089.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--032397fc-9948-420a-af54-11f30f1f7f76"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b310bf67-7dfb-4bb9-ba46-5525721a522a",
|
|
"created_by_ref": "identity--91881ec2-270c-4130-b353-b25919c202c1",
|
|
"created": "2022-07-02T04:22:03.115515Z",
|
|
"modified": "2022-07-02T04:22:03.115515Z",
|
|
"name": "Leak Altered Documents",
|
|
"description": "Obtain documents (eg by theft or leak), then alter and release, possibly among factual documents/sources.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "develop-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0089.003.md",
|
|
"external_id": "T0089.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e849a47c-55fb-4d6b-bf6c-89bb98bef560"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f3937d9d-e853-48e0-a8a3-54b4e2031cd1",
|
|
"created_by_ref": "identity--30e6a20f-377e-4ce8-82bd-07b78df48f7a",
|
|
"created": "2022-07-02T04:22:03.115834Z",
|
|
"modified": "2022-07-02T04:22:03.115834Z",
|
|
"name": "Create Anonymous Accounts",
|
|
"description": "Anonymous accounts or anonymous users refer to users that access network resources without providing a username or password. An influence operation may use anonymous accounts to spread content without direct attribution to the operation. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0090.001.md",
|
|
"external_id": "T0090.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--edd36372-439a-429a-b96a-a9dfadbb9935"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b014207f-ecc1-4fa4-a393-4ec96d809aa8",
|
|
"created_by_ref": "identity--c9465a11-c7dc-444b-a1a2-dc2ec3397ef1",
|
|
"created": "2022-07-02T04:22:03.116195Z",
|
|
"modified": "2022-07-02T04:22:03.116195Z",
|
|
"name": "Create Cyborg Accounts",
|
|
"description": "Cyborg accounts refer to partly manned, partly automated social media accounts. Cyborg accounts primarily act as bots, but a human operator periodically takes control of the account to engage with real social media users by responding to comments and posting original content. Influence operations may use cyborg accounts to reduce the amount of direct human input required to maintain a regular account but increase the apparent legitimacy of the cyborg account by occasionally breaking its bot-like behavior with human interaction. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0090.002.md",
|
|
"external_id": "T0090.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--48f44a8e-01a0-4f11-b31f-af6d00394a5b"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--289c80c1-36af-4d61-b7f1-046161422e37",
|
|
"created_by_ref": "identity--6bba4400-5505-422e-b988-ab6b04cb0bfe",
|
|
"created": "2022-07-02T04:22:03.116529Z",
|
|
"modified": "2022-07-02T04:22:03.116529Z",
|
|
"name": "Create Bot Accounts",
|
|
"description": "Bots refer to autonomous internet users that interact with systems or other users while imitating traditional human behavior. Bots use a variety of tools to stay active without direct human operation, including artificial intelligence and big data analytics. For example, an individual may program a Twitter bot to retweet a tweet every time it contains a certain keyword or hashtag. An influence operation may use bots to increase its exposure and artificially promote its content across the internet without dedicating additional time or human resources. \nAmplifier bots promote operation content through reposts, shares, and likes to increase the content\u2019s online popularity. Hacker bots are traditionally covert bots running on computer scripts that rarely engage with users and work primarily as agents of larger cyberattacks, such as a Distributed Denial of Service attacks. Spammer bots are programmed to post content on social media or in comment sections, usually as a supplementary tool. Impersonator bots102 pose as real people by mimicking human behavior, complicating their detection. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0090.003.md",
|
|
"external_id": "T0090.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ed106a38-1213-4f41-9cd9-64bdbeaea56b"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--3f7ef990-a068-4591-bb39-374ba03e488e",
|
|
"created_by_ref": "identity--d7a9f0ab-41f5-4fa8-8e45-b1252a91fb6e",
|
|
"created": "2022-07-02T04:22:03.116872Z",
|
|
"modified": "2022-07-02T04:22:03.116872Z",
|
|
"name": "Create Sockpuppet Accounts",
|
|
"description": "Sockpuppet accounts refer to falsified accounts that either promote the influence operation\u2019s own material or attack critics of the material online. Individuals who control sockpuppet accounts also man at least one other user account.67 Sockpuppet accounts help legitimize operation narratives by providing an appearance of external support for the material and discrediting opponents of the operation. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0090.004.md",
|
|
"external_id": "T0090.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d0cf236d-6895-4ff5-9462-4a81418b78c0"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--7d78b975-8732-4fe4-9bf8-4b8e7d24f06d",
|
|
"created_by_ref": "identity--74aa7e66-eb96-4655-98f8-3000b7fb985a",
|
|
"created": "2022-07-02T04:22:03.11725Z",
|
|
"modified": "2022-07-02T04:22:03.11725Z",
|
|
"name": "Recruit Contractors",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0091.001.md",
|
|
"external_id": "T0091.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0663ff73-d1f1-41b6-a639-209e240a5646"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--41c46ffe-b2fe-49ef-9b93-3b92bcdb8dcd",
|
|
"created_by_ref": "identity--500f0990-9baf-4b31-b824-b014a6165a7b",
|
|
"created": "2022-07-02T04:22:03.117581Z",
|
|
"modified": "2022-07-02T04:22:03.117581Z",
|
|
"name": "Recruit Partisans",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0091.002.md",
|
|
"external_id": "T0091.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b6be45fc-aba1-4087-a9f9-8d20be5c950a"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b4a5c74f-61ed-4c56-a4ce-729e96996243",
|
|
"created_by_ref": "identity--3fb98da3-fd84-4ca2-9b9a-520556561f52",
|
|
"created": "2022-07-02T04:22:03.117902Z",
|
|
"modified": "2022-07-02T04:22:03.117902Z",
|
|
"name": "Enlist Troll Accounts",
|
|
"description": "An influence operation may hire trolls, or human operators of fake accounts that aim to provoke others by posting and amplifying content about controversial issues. Trolls can serve to discredit an influence operation\u2019s opposition or bring attention to the operation\u2019s cause through debate. \nClassic trolls refer to regular people who troll for personal reasons, such as attention-seeking or boredom. Classic trolls may advance operation narratives by coincidence but are not directly affiliated with any larger operation. Conversely, hybrid trolls act on behalf of another institution, such as a state or financial organization, and post content with a specific ideological goal. Hybrid trolls may be highly advanced and institutionalized or less organized and work for a single individual. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0091.003.md",
|
|
"external_id": "T0091.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e91cdeaf-e821-453f-be03-9d6378578e64"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--a98e1eaa-488f-47df-a571-75e3f5623941",
|
|
"created_by_ref": "identity--9afda4cf-f27d-4d48-a3c6-e80af9c1fc6f",
|
|
"created": "2022-07-02T04:22:03.118218Z",
|
|
"modified": "2022-07-02T04:22:03.118218Z",
|
|
"name": "Create Organizations",
|
|
"description": "Influence operations may establish organizations with legitimate or falsified hierarchies, staff, and content to structure operation assets, provide a sense of legitimacy to the operation, or provide institutional backing to operation activities.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0092.001.md",
|
|
"external_id": "T0092.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--532f12af-0b93-4392-92a7-bce44f85595a"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9658db3b-1bea-4d30-ae7e-75f6b2b2724f",
|
|
"created_by_ref": "identity--a188b3d4-17ab-42d3-832d-fa7ab769e993",
|
|
"created": "2022-07-02T04:22:03.118536Z",
|
|
"modified": "2022-07-02T04:22:03.118536Z",
|
|
"name": "Follow Trains",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0092.002.md",
|
|
"external_id": "T0092.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--f50c147a-5c0d-4c3b-bf63-cace64ddd8bb"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f9dfde42-f51e-4d57-8693-61b533e43218",
|
|
"created_by_ref": "identity--a9f26954-74fc-44d8-9c1e-242a134ee100",
|
|
"created": "2022-07-02T04:22:03.118853Z",
|
|
"modified": "2022-07-02T04:22:03.118853Z",
|
|
"name": "Create Community or Sub-group",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0092.003.md",
|
|
"external_id": "T0092.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5d126bc3-2463-48f1-8d67-2924e508e7af"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--64ac5ec9-0b22-4878-8255-5705af4f7673",
|
|
"created_by_ref": "identity--4c87c68e-956b-4251-8aa1-2a2abdd2d06e",
|
|
"created": "2022-07-02T04:22:03.119174Z",
|
|
"modified": "2022-07-02T04:22:03.119174Z",
|
|
"name": "Fund Proxies",
|
|
"description": "An influence operation may fund proxies, or external entities that work for the operation. An operation may recruit/train users with existing sympathies towards the operation\u2019s narratives and/or goals as proxies. Funding proxies serves various purposes including: \n- Diversifying operation locations to complicate attribution \n- Reducing the workload for direct operation assets ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0093.001.md",
|
|
"external_id": "T0093.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--f807acd4-7e0c-4c06-aec7-57cfec7668c1"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b9ea3db7-a728-4e2b-a669-5add311f0254",
|
|
"created_by_ref": "identity--11df62cd-6a08-4de3-a85a-95e2393bc460",
|
|
"created": "2022-07-02T04:22:03.119493Z",
|
|
"modified": "2022-07-02T04:22:03.119493Z",
|
|
"name": "Botnets",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0093.002.md",
|
|
"external_id": "T0093.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--64ee02f0-4606-4e05-a9fb-135cb2dddf6c"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--713ebd36-242f-4e83-aea8-cc4cc83ea8b3",
|
|
"created_by_ref": "identity--43b851d5-df92-49d4-9850-fc9a411c3545",
|
|
"created": "2022-07-02T04:22:03.119823Z",
|
|
"modified": "2022-07-02T04:22:03.119823Z",
|
|
"name": "Identify susceptible targets in networks",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0094.001.md",
|
|
"external_id": "T0094.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--7e38ef10-0010-45ab-b004-e96b6f0b2f85"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--6c0a687d-cdf0-4bbd-8987-5a9f1175e3be",
|
|
"created_by_ref": "identity--484b6afd-8f87-4e7a-a62d-7167b77ae832",
|
|
"created": "2022-07-02T04:22:03.120137Z",
|
|
"modified": "2022-07-02T04:22:03.120137Z",
|
|
"name": "Utilize Butterfly Attack",
|
|
"description": "Butterfly attacks occur when operators pretend to be members of a certain social group, usually a group that struggles for representation. An influence operation may mimic a group to insert controversial statements into the discourse, encourage the spread of operation content, or promote harassment among group members. Unlike astroturfing, butterfly attacks aim to infiltrate and discredit existing grassroots movements, organizations, and media campaigns. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0094.002.md",
|
|
"external_id": "T0094.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ae0d4237-65b6-470a-9f83-47376ae12cfe"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--a03a748d-983f-4ef6-82ec-4c5c69973cc6",
|
|
"created_by_ref": "identity--9548aa16-8337-4f58-b26d-ecdd657b5287",
|
|
"created": "2022-07-02T04:22:03.120452Z",
|
|
"modified": "2022-07-02T04:22:03.120452Z",
|
|
"name": "From bad actors",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0014.001.md",
|
|
"external_id": "T0014.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--2b497558-90d0-4176-a387-df86189be5b1"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f9f5a444-93a7-46c4-9154-2009e540512d",
|
|
"created_by_ref": "identity--94104d7c-e804-42cd-aac4-f5a78afa8dac",
|
|
"created": "2022-07-02T04:22:03.120766Z",
|
|
"modified": "2022-07-02T04:22:03.120766Z",
|
|
"name": "From ignorant agents",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0014.002.md",
|
|
"external_id": "T0014.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--05785852-397f-4a65-aade-4ae4fa40fb42"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--37cc79df-c35b-4702-9ebf-1db6f6878df3",
|
|
"created_by_ref": "identity--ec0571bd-a615-4fec-bf8f-46d89505fdc4",
|
|
"created": "2022-07-02T04:22:03.121082Z",
|
|
"modified": "2022-07-02T04:22:03.121082Z",
|
|
"name": "Create a Content Farm",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0096.001.md",
|
|
"external_id": "T0096.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--edc9e49f-bf53-4265-917c-be718b95e7f8"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--e796dcfa-1968-46f5-a5d8-43e5f065c11f",
|
|
"created_by_ref": "identity--28970bce-f74e-482e-bd1d-cbe58f742efa",
|
|
"created": "2022-07-02T04:22:03.121402Z",
|
|
"modified": "2022-07-02T04:22:03.121402Z",
|
|
"name": "Outsource Content Creation to External Organizations",
|
|
"description": "An influence operation may outsource content creation to external companies to avoid attribution, increase the rate of content creation, or improve content quality, i.e., by employing an organization that can create content in the target audience\u2019s native language. Employed organizations may include marketing companies for tailored advertisements or external content farms for high volumes of targeted media. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-social-assets"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0096.002.md",
|
|
"external_id": "T0096.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--a6e16889-dcb3-48ed-9479-28f71e9ec6f6"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--79431801-be7e-4f13-bb41-e0dce8d12039",
|
|
"created_by_ref": "identity--28e136e7-63f0-4464-8a99-aa1e14bbc80c",
|
|
"created": "2022-07-02T04:22:03.121721Z",
|
|
"modified": "2022-07-02T04:22:03.121721Z",
|
|
"name": "Utilize Academic/Pseudoscientific Justifications",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0009.001.md",
|
|
"external_id": "T0009.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--464fa755-91e6-4a76-982d-5cd32b54f0f5"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--342d7f1b-2864-4daf-b3df-b25d0f9db021",
|
|
"created_by_ref": "identity--a527dee3-824e-4e2b-8c19-53d888588b5d",
|
|
"created": "2022-07-02T04:22:03.122044Z",
|
|
"modified": "2022-07-02T04:22:03.122044Z",
|
|
"name": "Backstop personas ",
|
|
"description": "Create other assets/dossier/cover/fake relationships and/or connections or documents, sites, bylines, attributions, to establish/augment/inflate crediblity/believability",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0097.001.md",
|
|
"external_id": "T0097.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--21d3146c-d134-47e3-8efd-e6008bfb3ca9"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1baa6985-10f2-4917-83d7-c005c2c6eb0c",
|
|
"created_by_ref": "identity--ab73a551-6769-4a81-b62f-e69a89c20bd9",
|
|
"created": "2022-07-02T04:22:03.122377Z",
|
|
"modified": "2022-07-02T04:22:03.122377Z",
|
|
"name": "Create Inauthentic News Sites",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0098.001.md",
|
|
"external_id": "T0098.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c5753eb8-1685-4869-8fea-b5e350bbe86a"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0c63bf4d-fa02-4b40-8683-2a0994e3895e",
|
|
"created_by_ref": "identity--c069cbb5-940d-487b-a145-5b1c124a2104",
|
|
"created": "2022-07-02T04:22:03.122694Z",
|
|
"modified": "2022-07-02T04:22:03.122694Z",
|
|
"name": "Leverage Existing Inauthentic News Sites",
|
|
"description": "An influence operation may prepare assets impersonating legitimate entities to further conceal its network identity and add a layer of legitimacy to its operation content. Users will more likely believe and less likely fact-check news from recognizable sources rather than unknown sites. Legitimate entities may include authentic news outlets, public figures, organizations, or state entities. \nAn influence operation may use a wide variety of cyber techniques to impersonate a legitimate entity\u2019s website or social media account. Typosquatting87 is the international registration of a domain name with purposeful variations of the impersonated domain name through intentional typos, top-level domain (TLD) manipulation, or punycode. Typosquatting facilitates the creation of falsified websites by creating similar domain names in the URL box, leaving it to the user to confirm that the URL is correct. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0098.002.md",
|
|
"external_id": "T0098.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--cb63418c-7066-4b07-8733-094849c1e160"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0d3726bc-bf0e-4357-b2b3-96b41aa856a3",
|
|
"created_by_ref": "identity--ff63eba0-3e4a-4b47-a402-3caaea15c330",
|
|
"created": "2022-07-02T04:22:03.123012Z",
|
|
"modified": "2022-07-02T04:22:03.123012Z",
|
|
"name": "Astroturfing",
|
|
"description": "Astroturfing occurs when an influence operation disguises itself as grassroots movement or organization that supports operation narratives. Unlike butterfly attacks, astroturfing aims to increase the appearance of popular support for the operation cause and does not infiltrate existing groups to discredit their objectives. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0099.001.md",
|
|
"external_id": "T0099.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--dc890fe2-240a-4bac-8bce-566a3eac16be"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--ec47a70a-3821-4f0e-9e10-f2bb7e836116",
|
|
"created_by_ref": "identity--6c054e9d-12db-4d94-8a78-874c2de1e6eb",
|
|
"created": "2022-07-02T04:22:03.123323Z",
|
|
"modified": "2022-07-02T04:22:03.123323Z",
|
|
"name": "Spoof/parody account/site",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0099.002.md",
|
|
"external_id": "T0099.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ee36e8ff-7aa7-4c31-aa6d-9e3c5f05edb1"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--17ae8352-79ab-4160-b192-cd70463fdba0",
|
|
"created_by_ref": "identity--4f14919c-6b5b-4c17-a196-d221bbe9c5fb",
|
|
"created": "2022-07-02T04:22:03.123637Z",
|
|
"modified": "2022-07-02T04:22:03.123637Z",
|
|
"name": "Co-Opt Trusted Individuals",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0100.001.md",
|
|
"external_id": "T0100.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--15123be0-5444-4596-837d-2a145f419356"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--ab6e9b70-4b9e-414c-93ea-405058270218",
|
|
"created_by_ref": "identity--38f55dd2-91b3-4ceb-8598-9f9c492e522a",
|
|
"created": "2022-07-02T04:22:03.123956Z",
|
|
"modified": "2022-07-02T04:22:03.123956Z",
|
|
"name": "Co-Opt Grassroots Groups",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0100.002.md",
|
|
"external_id": "T0100.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d498617c-36fd-41c6-aeb3-4209cff0913d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--2dd166eb-2830-4440-8f7e-16ae78cbffce",
|
|
"created_by_ref": "identity--bb91794f-6a67-4113-a342-317140133c51",
|
|
"created": "2022-07-02T04:22:03.124276Z",
|
|
"modified": "2022-07-02T04:22:03.124276Z",
|
|
"name": "Co-opt Influencers",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "establish-legitimacy"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0100.003.md",
|
|
"external_id": "T0100.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--a38b765b-cb0e-4740-a322-1d25f04e9a7a"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--08148393-fc91-438a-95c6-c67caafd3f66",
|
|
"created_by_ref": "identity--437d5bfb-26b4-4574-a665-5bfb482aea0d",
|
|
"created": "2022-07-02T04:22:03.124593Z",
|
|
"modified": "2022-07-02T04:22:03.124593Z",
|
|
"name": "Use existing Echo Chambers/Filter Bubbles",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "microtarget"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0102.001.md",
|
|
"external_id": "T0102.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--66247d10-aeed-4da1-b681-7367f7501519"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--2db4ca1d-31be-4012-899d-d15362afe682",
|
|
"created_by_ref": "identity--0861ee99-12fe-462b-9743-4cb6532c3595",
|
|
"created": "2022-07-02T04:22:03.124946Z",
|
|
"modified": "2022-07-02T04:22:03.124946Z",
|
|
"name": "Create Echo Chambers/Filter Bubbles",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "microtarget"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0102.002.md",
|
|
"external_id": "T0102.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5bec0b82-17ab-44a2-a539-2e37e0588d63"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--c681159d-51ba-4aa9-b578-0ce88459bbfc",
|
|
"created_by_ref": "identity--865275c7-53d1-4a31-834c-583ce81898e7",
|
|
"created": "2022-07-02T04:22:03.125272Z",
|
|
"modified": "2022-07-02T04:22:03.125272Z",
|
|
"name": "Exploit Data Voids",
|
|
"description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search engine data. Data voids are hard to detect and relatively harmless until exploited by an entity aiming to quickly proliferate false or misleading information during a phenomenon that causes a high number of individuals to query the term or phrase. In the Plan phase, an influence operation may identify data voids for later exploitation in the operation. \nA 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d data voids occur when a keyword gains popularity during a short period of time, allowing an influence operation to publish false content before legitimate news outlets have an opportunity to publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data void by creating their own terms and publishing information online before promoting their keyword to the target audience. (3) An influence operation may publish content on \u201coutdated terms\u201d that have decreased in popularity, capitalizing on most search engines\u2019 preferences for recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas, isolating segment queries to distinct search engine results. (5) An influence operation may use \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote messaging until mainstream media recontextualizes the term. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "microtarget"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0102.003.md",
|
|
"external_id": "T0102.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d7c7fb04-3628-4c3f-bd62-55a4a290522b"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f7fe9685-502a-4ec2-aba8-afe17db3dc0a",
|
|
"created_by_ref": "identity--084da815-95d9-4383-a517-d41ba7520303",
|
|
"created": "2022-07-02T04:22:03.125591Z",
|
|
"modified": "2022-07-02T04:22:03.125591Z",
|
|
"name": "Use Encrypted Chat Apps",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0043.001.md",
|
|
"external_id": "T0043.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--90aefb07-7dd8-45f4-b74d-b741ea78ea8c"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--2025e8cd-69d0-48df-b8f7-d945860a0034",
|
|
"created_by_ref": "identity--a9f26548-18ad-408b-a602-5c6cb0d52008",
|
|
"created": "2022-07-02T04:22:03.125907Z",
|
|
"modified": "2022-07-02T04:22:03.125907Z",
|
|
"name": "Use Unencrypted Chats Apps",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0043.002.md",
|
|
"external_id": "T0043.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--d5edaffd-54c8-407e-8df9-8d08328a4e8b"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--a4724a3a-2bb8-4dbc-8cb4-0288d2edc682",
|
|
"created_by_ref": "identity--3fd8b88e-f03f-4639-bb4d-ada4302cd8b5",
|
|
"created": "2022-07-02T04:22:03.126229Z",
|
|
"modified": "2022-07-02T04:22:03.126229Z",
|
|
"name": "Video Livestream",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0103.001.md",
|
|
"external_id": "T0103.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--6ab7cd35-e742-4107-9615-4421902dd4fd"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--db7161b6-5231-407f-b54e-c6c94c80a65c",
|
|
"created_by_ref": "identity--27c0048f-3732-4437-b563-3d48ce512741",
|
|
"created": "2022-07-02T04:22:03.126553Z",
|
|
"modified": "2022-07-02T04:22:03.126553Z",
|
|
"name": "Audio Livestream",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0103.002.md",
|
|
"external_id": "T0103.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--43770d40-30f6-4bf1-a5f8-e8875c151a0e"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b98e170b-d59e-436d-9cb8-dc98723966e7",
|
|
"created_by_ref": "identity--11cf62c9-26ab-417f-b2dc-94f03d8a7930",
|
|
"created": "2022-07-02T04:22:03.126891Z",
|
|
"modified": "2022-07-02T04:22:03.126891Z",
|
|
"name": "Mainstream Social Networks",
|
|
"description": "Examples include Facebook, Twitter, LinkedIn, VK, ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.001.md",
|
|
"external_id": "T0104.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--7fb9ac6d-382e-45b6-b10f-5e9d8181b90b"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--38ef9ff3-506f-4ce3-9653-475a20961d1a",
|
|
"created_by_ref": "identity--81be91a7-49ff-4930-9206-5cf038594821",
|
|
"created": "2022-07-02T04:22:03.127228Z",
|
|
"modified": "2022-07-02T04:22:03.127228Z",
|
|
"name": "Dating Apps",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.002.md",
|
|
"external_id": "T0104.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--75a5ef95-4487-405f-bb19-d9b9391e4dfd"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--be195a87-6081-4525-9199-44ae23c74b38",
|
|
"created_by_ref": "identity--fb84efc2-7a2b-4e70-95f0-3e1372d6fc5b",
|
|
"created": "2022-07-02T04:22:03.127557Z",
|
|
"modified": "2022-07-02T04:22:03.127557Z",
|
|
"name": "Private/Closed Social Networks",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.003.md",
|
|
"external_id": "T0104.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--46d0534c-1c88-467b-872e-8cac5d286558"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f6c8dde2-9957-47df-843c-3d0760995351",
|
|
"created_by_ref": "identity--fddfbe8c-294a-495f-966a-7b3907af02ba",
|
|
"created": "2022-07-02T04:22:03.127886Z",
|
|
"modified": "2022-07-02T04:22:03.127886Z",
|
|
"name": "Interest-Based Networks",
|
|
"description": "Examples include smaller and niche networks including Gettr, Truth Social, Parler, etc.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.004.md",
|
|
"external_id": "T0104.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--dfa954bb-1a8f-4947-830a-4dee5e9d6dae"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0f4c0dce-c14e-4f9c-999e-6a9654f074f0",
|
|
"created_by_ref": "identity--ecb6c677-bbae-4fb2-b41e-105023a06352",
|
|
"created": "2022-07-02T04:22:03.128201Z",
|
|
"modified": "2022-07-02T04:22:03.128201Z",
|
|
"name": "Use hashtags",
|
|
"description": "Use a dedicated, existing hashtag for the campaign/incident.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.005.md",
|
|
"external_id": "T0104.005"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--93130825-a391-4641-9628-9d9d345640b2"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0148f9dd-21af-4cd1-a317-4bbefc2d3dbf",
|
|
"created_by_ref": "identity--09940f92-b071-4771-954b-fc892ada6863",
|
|
"created": "2022-07-02T04:22:03.128513Z",
|
|
"modified": "2022-07-02T04:22:03.128513Z",
|
|
"name": "Create dedicated hashtag",
|
|
"description": "Create a campaign/incident specific hashtag.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0104.006.md",
|
|
"external_id": "T0104.006"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--302f59a3-bc17-4905-86f7-be4530cdcfe1"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--73bd1cae-ad4d-416b-8752-0fefdda8beb9",
|
|
"created_by_ref": "identity--4e104e85-64c0-4001-a483-de2e781e4dd7",
|
|
"created": "2022-07-02T04:22:03.128834Z",
|
|
"modified": "2022-07-02T04:22:03.128834Z",
|
|
"name": "Photo Sharing",
|
|
"description": "Examples include Instagram, Snapchat, Flickr, etc",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0105.001.md",
|
|
"external_id": "T0105.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b67c0a0d-0c27-474c-a080-f4d1ea370570"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9be08cf5-8b9e-469f-8d45-40afaf29aec4",
|
|
"created_by_ref": "identity--bca2e702-4da8-49ee-b3c5-b54bc52de544",
|
|
"created": "2022-07-02T04:22:03.12915Z",
|
|
"modified": "2022-07-02T04:22:03.12915Z",
|
|
"name": "Video Sharing",
|
|
"description": "Examples include Youtube, TikTok, ShareChat, Rumble, etc",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0105.002.md",
|
|
"external_id": "T0105.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--4b4f4304-5490-48fc-b30a-9c6314c9bd04"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--07cdf656-71ef-44ee-b307-1a66439a2870",
|
|
"created_by_ref": "identity--c6997c26-67e6-426d-aefa-8646e8c9d00f",
|
|
"created": "2022-07-02T04:22:03.129467Z",
|
|
"modified": "2022-07-02T04:22:03.129467Z",
|
|
"name": "Audio sharing",
|
|
"description": "Examples include podcasting apps, Soundcloud, etc.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0105.003.md",
|
|
"external_id": "T0105.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--6f5ca75f-347a-429e-8d04-01822e52277d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f6cced10-fcf6-4922-9b75-573a9e3df2ff",
|
|
"created_by_ref": "identity--7015aabf-4558-40f4-9864-5c776f7d6503",
|
|
"created": "2022-07-02T04:22:03.129784Z",
|
|
"modified": "2022-07-02T04:22:03.129784Z",
|
|
"name": "Anonymous Message Boards",
|
|
"description": "Examples include the Chans",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0106.001.md",
|
|
"external_id": "T0106.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--11aad034-a94b-41a6-b528-2cda3523257d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--784801bd-41e1-4a81-b670-78bfb5b866b1",
|
|
"created_by_ref": "identity--82c3ac8f-480f-485a-8d09-4dccb97452be",
|
|
"created": "2022-07-02T04:22:03.130101Z",
|
|
"modified": "2022-07-02T04:22:03.130101Z",
|
|
"name": "TV",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0111.001.md",
|
|
"external_id": "T0111.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--4f5ffdf6-29f3-4ef1-8af4-2ceb099d1612"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1118e422-bcff-403f-9e8b-e5934b16d432",
|
|
"created_by_ref": "identity--4de17c2a-872b-4b49-bedd-4edaa92b0ffb",
|
|
"created": "2022-07-02T04:22:03.130435Z",
|
|
"modified": "2022-07-02T04:22:03.130435Z",
|
|
"name": "Newspaper",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0111.002.md",
|
|
"external_id": "T0111.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ee2e77f1-43fa-4886-baa8-9d0e83ebbe86"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--c685f14e-96b8-4cde-8ff3-0f6bca8ea1c5",
|
|
"created_by_ref": "identity--6d149da0-b24b-40fc-95d6-8cc6d2da43f0",
|
|
"created": "2022-07-02T04:22:03.130754Z",
|
|
"modified": "2022-07-02T04:22:03.130754Z",
|
|
"name": "Radio",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "select-channels-and-affordances"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0111.003.md",
|
|
"external_id": "T0111.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--477fc188-90a4-4be9-8f57-968492876826"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9814e8c1-6928-42c1-a64d-1f7bee4cb632",
|
|
"created_by_ref": "identity--481c67a1-5f2d-4d66-a0d7-f8f2a6186526",
|
|
"created": "2022-07-02T04:22:03.131073Z",
|
|
"modified": "2022-07-02T04:22:03.131073Z",
|
|
"name": "Social media",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0114.001.md",
|
|
"external_id": "T0114.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b2674001-3c3f-4443-83e1-9d6427a06150"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--71c39f24-2b5c-4a38-ac10-2b52cf803c50",
|
|
"created_by_ref": "identity--b8a379ce-f928-4018-a87d-8991eca40940",
|
|
"created": "2022-07-02T04:22:03.131391Z",
|
|
"modified": "2022-07-02T04:22:03.131391Z",
|
|
"name": "Traditional Media",
|
|
"description": "Examples include TV, Radio, Newspaper, billboards",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0114.002.md",
|
|
"external_id": "T0114.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--bec08240-e29d-4eff-8de9-9ace5e25ea6e"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9aea5087-dc89-440a-9057-1bef7713db24",
|
|
"created_by_ref": "identity--12919178-375f-4c2c-b90d-9b08b4804c0c",
|
|
"created": "2022-07-02T04:22:03.131707Z",
|
|
"modified": "2022-07-02T04:22:03.131707Z",
|
|
"name": "Share Memes",
|
|
"description": "Memes are one of the most important single artefact types in all of computational propaganda. Memes in this framework denotes the narrow image-based definition. But that naming is no accident, as these items have most of the important properties of Dawkins' original conception as a self-replicating unit of culture. Memes pull together reference and commentary; image and narrative; emotion and message. Memes are a powerful tool and the heart of modern influence campaigns.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0115.001.md",
|
|
"external_id": "T0115.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--e0ee79bf-ebe0-4308-acb3-fb8207b50d3e"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d6c19675-7055-4e3d-af50-9a168b578b41",
|
|
"created_by_ref": "identity--27e660b7-4139-4cba-a37b-e76f91f0a855",
|
|
"created": "2022-07-02T04:22:03.13202Z",
|
|
"modified": "2022-07-02T04:22:03.13202Z",
|
|
"name": "Post Violative Content to Provoke Takedown and Backlash",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0115.002.md",
|
|
"external_id": "T0115.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ab20613d-22c0-4424-9946-8d33ae942289"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--c745bb3a-348d-4b3a-87be-f2b70acd0186",
|
|
"created_by_ref": "identity--820a4a25-9f97-4d85-9f01-fe6e1fbbfb13",
|
|
"created": "2022-07-02T04:22:03.132335Z",
|
|
"modified": "2022-07-02T04:22:03.132335Z",
|
|
"name": "One-Way Direct Posting",
|
|
"description": "Direct posting refers to a method of posting content via a one-way messaging service, where the recipient cannot directly respond to the poster\u2019s messaging. An influence operation may post directly to promote operation narratives to the target audience without allowing opportunities for fact-checking or disagreement, creating a false sense of support for the narrative. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0115.003.md",
|
|
"external_id": "T0115.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--212a823f-0986-47c8-96fe-4e257561ace9"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--9db0dca3-1313-4a7e-8f77-0d4417710dc8",
|
|
"created_by_ref": "identity--e69adbcf-af5e-4a37-96bb-1a8cbefb9d74",
|
|
"created": "2022-07-02T04:22:03.132653Z",
|
|
"modified": "2022-07-02T04:22:03.132653Z",
|
|
"name": "Post inauthentic social media comment",
|
|
"description": "Use government-paid social media commenters, astroturfers, chat bots (programmed to reply to specific key words/hashtags) influence online conversations, product reviews, web-site comment forums.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "deliver-content"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0116.001.md",
|
|
"external_id": "T0116.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--1d91d248-0547-431e-9d07-1918356fbccb"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b5f3fb77-ed85-438c-9984-317601eb35be",
|
|
"created_by_ref": "identity--b8d83583-cea0-4566-a4ae-b20f82a08a56",
|
|
"created": "2022-07-02T04:22:03.132982Z",
|
|
"modified": "2022-07-02T04:22:03.132982Z",
|
|
"name": "Trolls amplify and manipulate",
|
|
"description": "Use trolls to amplify narratives and/or manipulate narratives. Fake profiles/sockpuppets operating to support individuals/narratives from the entire political spectrum (left/right binary). Operating with increased emphasis on promoting local content and promoting real Twitter users generating their own, often divisive political content, as it's easier to amplify existing content than create new/original content. Trolls operate where ever there's a socially divisive issue (issues that can/are be politicized).",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.001.md",
|
|
"external_id": "T0049.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5d26ac32-5214-4aa5-8dda-f18e471546b3"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d4017599-a949-4dea-a709-9e38e6ec1010",
|
|
"created_by_ref": "identity--887106a6-8f37-4ac3-aaba-053ebbf32a4d",
|
|
"created": "2022-07-02T04:22:03.133297Z",
|
|
"modified": "2022-07-02T04:22:03.133297Z",
|
|
"name": "Hijack existing hashtag",
|
|
"description": "Take over an existing hashtag to drive exposure.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.002.md",
|
|
"external_id": "T0049.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5eacc3c6-8d66-4a87-ab13-9c37974b2b78"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8a255985-c27e-491f-84e3-b1b1fc94a0a8",
|
|
"created_by_ref": "identity--5947d80e-e005-4e46-a5d0-104bc1011740",
|
|
"created": "2022-07-02T04:22:03.133637Z",
|
|
"modified": "2022-07-02T04:22:03.133637Z",
|
|
"name": "Bots Amplify via Automated Forwarding and Reposting",
|
|
"description": "Automated forwarding and reposting refer to the proliferation of operation content using automated means, such as artificial intelligence or social media bots. An influence operation may use automated activity to increase content exposure without dedicating the resources, including personnel and time, traditionally required to forward and repost content. \nUse bots to amplify narratives above algorithm thresholds. Bots are automated/programmed profiles designed to amplify content (ie: automatically retweet or like) and give appearance it's more \"popular\" than it is. They can operate as a network, to function in a coordinated/orchestrated manner. In some cases (more so now) they are an inexpensive/disposable assets used for minimal deployment as bot detection tools improve and platforms are more responsive.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.003.md",
|
|
"external_id": "T0049.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--932d239b-8d88-45fc-8665-2b03e8843857"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--90ef8d98-5329-46fb-be8a-cdeb612e12b6",
|
|
"created_by_ref": "identity--44972925-55f9-4321-afa5-54bfd65b55ab",
|
|
"created": "2022-07-02T04:22:03.133953Z",
|
|
"modified": "2022-07-02T04:22:03.133953Z",
|
|
"name": "Utilize Spamoflauge",
|
|
"description": "Spamoflauge refers to the practice of disguising spam messages as legitimate. Spam refers to the use of electronic messaging systems to send out unrequested or unwanted messages in bulk. Simple methods of spamoflauge include replacing letters with numbers to fool keyword-based email spam filters, for example, \"you've w0n our jackp0t!\". Spamoflauge may extend to more complex techniques such as modifying the grammar or word choice of the language, casting messages as images which spam detectors cannot automatically read, or encapsulating messages in password protected attachments, such as .pdf or .zip files. Influence operations may use spamoflauge to avoid spam filtering systems and increase the likelihood of the target audience receiving operation messaging. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.004.md",
|
|
"external_id": "T0049.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ae894403-0a44-465c-8b39-c33c59edffeb"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--15e37fa3-0927-4cda-a91b-b2fcf1de0e2a",
|
|
"created_by_ref": "identity--776c20f1-07f5-4a99-a802-b8ba5dac7cd1",
|
|
"created": "2022-07-02T04:22:03.134269Z",
|
|
"modified": "2022-07-02T04:22:03.134269Z",
|
|
"name": "Conduct Swarming",
|
|
"description": "Swarming refers to the coordinated use of accounts to overwhelm the information space with operation content. Unlike information flooding, swarming centers exclusively around a specific event or actor rather than a general narrative. Swarming relies on \u201chorizontal communication\u201d between information assets rather than a top-down, vertical command-and-control approach. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.005.md",
|
|
"external_id": "T0049.005"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--8ff428d8-fa13-4d36-ac32-a89aa0e17273"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--86bd2330-523a-48e1-8299-02055951a8d2",
|
|
"created_by_ref": "identity--59b13091-2f47-44ef-bf28-dcf04c223205",
|
|
"created": "2022-07-02T04:22:03.134594Z",
|
|
"modified": "2022-07-02T04:22:03.134594Z",
|
|
"name": "Conduct Keyword Squatting",
|
|
"description": "Keyword squatting refers to the creation of online content, such as websites, articles, or social media accounts, around a specific search engine-optimized term to overwhelm the search results of that term. An influence may keyword squat to increase content exposure to target audience members who query the exploited term in a search engine and manipulate the narrative around the term. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.006.md",
|
|
"external_id": "T0049.006"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--6fb9d176-06ef-4c49-83a4-7f1bab5121dd"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--6bcaa950-ef27-403c-93aa-a4186a747541",
|
|
"created_by_ref": "identity--c7c9dfdb-111b-4100-b451-c94ef6b44a4b",
|
|
"created": "2022-07-02T04:22:03.134914Z",
|
|
"modified": "2022-07-02T04:22:03.134914Z",
|
|
"name": "Inauthentic Sites Amplify News and Narratives",
|
|
"description": "Inauthentic sites circulate cross-post stories and amplify narratives. Often these sites have no masthead, bylines or attribution.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0049.007.md",
|
|
"external_id": "T0049.007"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--cf8be334-592f-4d1b-8927-939ae84fafdc"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b7228c09-0f9c-4c97-8b02-fc0eca17ac87",
|
|
"created_by_ref": "identity--0101a7ee-5f09-4b74-bf37-5584282cfc66",
|
|
"created": "2022-07-02T04:22:03.13523Z",
|
|
"modified": "2022-07-02T04:22:03.13523Z",
|
|
"name": "Post Across Groups",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0119.001.md",
|
|
"external_id": "T0119.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--9bd1b657-3b2c-4345-8c87-979429233864"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--44b60b3c-afea-40c5-8faa-afd31269e6da",
|
|
"created_by_ref": "identity--e172348d-34a8-40cc-9021-8d4ca61cd324",
|
|
"created": "2022-07-02T04:22:03.135547Z",
|
|
"modified": "2022-07-02T04:22:03.135547Z",
|
|
"name": "Post Across Platform",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0119.002.md",
|
|
"external_id": "T0119.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--cab23df0-ef15-4651-b45e-d33a729f692c"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--ec488891-e56b-4c62-8f15-2cb21a46287a",
|
|
"created_by_ref": "identity--2428474b-be3b-4854-8ec7-924702c342b8",
|
|
"created": "2022-07-02T04:22:03.135873Z",
|
|
"modified": "2022-07-02T04:22:03.135873Z",
|
|
"name": "Post Across Disciplines",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0119.003.md",
|
|
"external_id": "T0119.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--65966b07-13ec-4488-a3cc-ee69c59e908e"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--2a372db3-69c5-42bb-b257-c43684bede04",
|
|
"created_by_ref": "identity--3826a366-a12c-4ab2-979b-0f2759cccabe",
|
|
"created": "2022-07-02T04:22:03.136189Z",
|
|
"modified": "2022-07-02T04:22:03.136189Z",
|
|
"name": "Use Affiliate Marketing Programs",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0120.001.md",
|
|
"external_id": "T0120.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--6d3ba371-d32d-4521-825a-0ea65e443523"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--3b38d150-4130-419c-9f99-24367d2b0483",
|
|
"created_by_ref": "identity--750a5055-5e07-43de-8ec0-0434758babab",
|
|
"created": "2022-07-02T04:22:03.136508Z",
|
|
"modified": "2022-07-02T04:22:03.136508Z",
|
|
"name": "Use Contests and Prizes",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0120.002.md",
|
|
"external_id": "T0120.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--61b25d73-7627-4990-b947-d80c371a1e95"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--cf4bfcec-2850-4d70-9a4c-618940a68b05",
|
|
"created_by_ref": "identity--808b97c2-aa10-4996-ab2f-1dd417b9fe8c",
|
|
"created": "2022-07-02T04:22:03.136824Z",
|
|
"modified": "2022-07-02T04:22:03.136824Z",
|
|
"name": "Bypass Content Blocking",
|
|
"description": "Bypassing content blocking refers to actions taken to circumvent network security measures that prevent users from accessing certain servers, resources, or other online spheres. An influence operation may bypass content blocking to proliferate its content on restricted areas of the internet. Common strategies for bypassing content blocking include:\n- Altering IP addresses to avoid IP filtering \n- Using a Virtual Private Network (VPN) to avoid IP filtering \n- Using a Content Delivery Network (CDN) to avoid IP filtering \n- Enabling encryption to bypass packet inspection blocking \n- Manipulating text to avoid filtering by keywords \n- Posting content on multiple platforms to avoid platform-specific removals - Using local facilities or modified DNS servers to avoid DNS filtering ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "maximize-exposure"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0121.001.md",
|
|
"external_id": "T0121.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--dbdd84cc-979f-43ed-8091-68b41d27ddf6"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--fa50dba7-db6c-4c37-9864-a9ba37eda147",
|
|
"created_by_ref": "identity--f2d773e0-cccc-477f-8c2a-ba2295ad8b2d",
|
|
"created": "2022-07-02T04:22:03.137139Z",
|
|
"modified": "2022-07-02T04:22:03.137139Z",
|
|
"name": "Boycott/\"Cancel\" Opponents",
|
|
"description": "Cancel culture refers to the phenomenon in which individuals collectively refrain from supporting an individual, organization, business, or other entity, usually following a real or falsified controversy. An influence operation may exploit cancel culture by emphasizing an adversary\u2019s problematic or disputed behavior and presenting its own content as an alternative. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0048.001.md",
|
|
"external_id": "T0048.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c201d69d-f206-4380-ae9d-458555ea5f23"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--ff94a50e-964e-4f7e-b6fd-781319cc6268",
|
|
"created_by_ref": "identity--22ddf033-449a-4adb-aa8f-d660d3c3425a",
|
|
"created": "2022-07-02T04:22:03.137457Z",
|
|
"modified": "2022-07-02T04:22:03.137457Z",
|
|
"name": "Harass People Based on Identities",
|
|
"description": "Examples include social identities like gender, sexuality, race, ethnicity, religion, ability, nationality, etc. as well as roles and occupations like journalist or activist.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0048.002.md",
|
|
"external_id": "T0048.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0b542708-f829-464e-9461-cbc3641052f6"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--7268bde3-3d04-490a-b6ae-c041f1f606e2",
|
|
"created_by_ref": "identity--acb32175-2422-4fa5-92bf-8d70cacd58df",
|
|
"created": "2022-07-02T04:22:03.137774Z",
|
|
"modified": "2022-07-02T04:22:03.137774Z",
|
|
"name": "Threaten to Dox",
|
|
"description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0048.003.md",
|
|
"external_id": "T0048.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--edb9eee5-0eb1-4a69-bf65-89dbc3d5c059"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0ac0d78a-4949-4687-a7bd-0008178680cd",
|
|
"created_by_ref": "identity--f4fa225a-6169-4d38-8476-9dc249aeca76",
|
|
"created": "2022-07-02T04:22:03.138087Z",
|
|
"modified": "2022-07-02T04:22:03.138087Z",
|
|
"name": "Dox",
|
|
"description": "Doxing refers to online harassment in which individuals publicly release private information about another individual, including names, addresses, employment information, pictures, family members, and other sensitive information. An influence operation may dox its opposition to encourage individuals aligned with operation narratives to harass the doxed individuals themselves or otherwise discourage the doxed individuals from posting or proliferating conflicting content. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0048.004.md",
|
|
"external_id": "T0048.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--6ab22ce0-cafc-46f5-b607-b19b5ce8a129"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--affcfb9a-652e-4409-a428-f9768f5fb1cb",
|
|
"created_by_ref": "identity--bba13b35-716b-4f53-9808-4fc40d49a743",
|
|
"created": "2022-07-02T04:22:03.138416Z",
|
|
"modified": "2022-07-02T04:22:03.138416Z",
|
|
"name": "Delete Opposing Content",
|
|
"description": "Deleting opposing content refers to the removal of content that conflicts with operational narratives from selected platforms. An influence operation may delete opposing content to censor contradictory information from the target audience, allowing operation narratives to take priority in the information space.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0123.001.md",
|
|
"external_id": "T0123.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--80020b93-aad4-4429-b5cd-0a8f4d5b02c4"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--2ac3960b-813b-4722-ba29-9e692d88341b",
|
|
"created_by_ref": "identity--88f2a537-1478-489d-9cf1-6281cd09fe3a",
|
|
"created": "2022-07-02T04:22:03.138733Z",
|
|
"modified": "2022-07-02T04:22:03.138733Z",
|
|
"name": "Block Content",
|
|
"description": "Content blocking refers to actions taken to restrict internet access or render certain areas of the internet inaccessible. An influence operation may restrict content based on both network and content attributes. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0123.002.md",
|
|
"external_id": "T0123.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--16a459ec-0f6b-4501-8308-a1b5fb1c17f9"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--197d83f1-5d84-407d-9867-0c369fff8209",
|
|
"created_by_ref": "identity--bf19cf8a-3634-4a53-ac80-4ee6c1014deb",
|
|
"created": "2022-07-02T04:22:03.139046Z",
|
|
"modified": "2022-07-02T04:22:03.139046Z",
|
|
"name": "Destroy Information Generation Capabilities",
|
|
"description": "Destroying information generation capabilities refers to actions taken to limit, degrade, or otherwise incapacitate an actor\u2019s ability to generate conflicting information. An influence operation may destroy an actor\u2019s information generation capabilities by physically dismantling the information infrastructure, disconnecting resources needed for information generation, or redirecting information generation personnel. An operation may destroy an adversary\u2019s information generation capabilities to limit conflicting content exposure to the target audience and crowd the information space with its own narratives. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0123.003.md",
|
|
"external_id": "T0123.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--4b33bd1e-c2a6-45c3-9eb7-cf6557197dbb"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--5e234e83-1364-4d37-9317-d3a776326925",
|
|
"created_by_ref": "identity--0c619dba-235d-4855-b11f-fef65d94737a",
|
|
"created": "2022-07-02T04:22:03.13936Z",
|
|
"modified": "2022-07-02T04:22:03.13936Z",
|
|
"name": "Conduct Server Redirect",
|
|
"description": "A server redirect, also known as a URL redirect, occurs when a server automatically forwards a user from one URL to another using server-side scripting languages. An influence operation may conduct a server redirect to divert target audience members from one website to another without their knowledge. The redirected website may pose as a legitimate source, host malware, or otherwise aid operation objectives.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0123.004.md",
|
|
"external_id": "T0123.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--94898a32-b0c1-432b-92b2-71c000a339c3"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--07693c90-df6d-43ae-9d0e-66119aeb3d7b",
|
|
"created_by_ref": "identity--be50a8f9-f947-44d5-8e14-c6ebb7849ad2",
|
|
"created": "2022-07-02T04:22:03.139675Z",
|
|
"modified": "2022-07-02T04:22:03.139675Z",
|
|
"name": "Report Non-Violative Opposing Content",
|
|
"description": "Reporting opposing content refers to notifying and providing an instance of a violation of a platform\u2019s guidelines and policies for conduct on the platform. In addition to simply reporting the content, an operation may leverage copyright regulations to trick social media and web platforms into removing opposing content by manipulating the content to appear in violation of copyright laws. Reporting opposing content facilitates the suppression of contradictory information and allows operation narratives to take priority in the information space. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0124.001.md",
|
|
"external_id": "T0124.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5211c49d-112d-4121-bb1e-9e8c3914935a"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--facb999a-4e3a-42f2-be54-407617aa89a3",
|
|
"created_by_ref": "identity--001ffe24-2214-4685-ae2d-3beea5ad56c7",
|
|
"created": "2022-07-02T04:22:03.13999Z",
|
|
"modified": "2022-07-02T04:22:03.13999Z",
|
|
"name": "Goad People into Harmful Action (Stop Hitting Yourself)",
|
|
"description": "Goad people into actions that violate terms of service or will lead to having their content or accounts taken down. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0124.002.md",
|
|
"external_id": "T0124.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--54b52b84-205a-4cf0-8fed-30a073afb8de"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8df70f5d-5132-447c-9989-5178c365a90a",
|
|
"created_by_ref": "identity--b42274ef-31f4-4211-805a-5072aef54657",
|
|
"created": "2022-07-02T04:22:03.140303Z",
|
|
"modified": "2022-07-02T04:22:03.140303Z",
|
|
"name": "Exploit Platform TOS/Content Moderation",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-online-harms"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0124.003.md",
|
|
"external_id": "T0124.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--766ca61f-2664-4480-be85-6a874505a33e"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--e2391d69-d0b3-488e-97b4-2ad3b3fff7b7",
|
|
"created_by_ref": "identity--fdf09d4a-eb4e-4c9b-9dd3-618a2e71ed66",
|
|
"created": "2022-07-02T04:22:03.140618Z",
|
|
"modified": "2022-07-02T04:22:03.140618Z",
|
|
"name": "Call to action to attend ",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0126.001.md",
|
|
"external_id": "T0126.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ab1042f8-73e8-479c-9d71-7eb8c93f5fc8"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1e917de4-6ee5-44e3-a3e8-1bdd5b20d38b",
|
|
"created_by_ref": "identity--21744e1f-0f4f-40c0-9e22-09c3335cfb50",
|
|
"created": "2022-07-02T04:22:03.140956Z",
|
|
"modified": "2022-07-02T04:22:03.140956Z",
|
|
"name": "Facilitate logistics or support for attendance",
|
|
"description": "Facilitate logistics or support for travel, food, housing, etc.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0126.002.md",
|
|
"external_id": "T0126.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3b36cee1-a9b6-4614-9a79-3482bdc2fdb4"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4f6ea3bf-7423-4e21-a07f-8dbcc94cb3da",
|
|
"created_by_ref": "identity--e351e54d-bd4a-43e3-823c-c27f8f392a01",
|
|
"created": "2022-07-02T04:22:03.141303Z",
|
|
"modified": "2022-07-02T04:22:03.141303Z",
|
|
"name": "Pay for Physical Action",
|
|
"description": "Paying for physical action occurs when an influence operation pays individuals to act in the physical realm. An influence operation may pay for physical action to create specific situations and frame them in a way that supports operation narratives, for example, paying a group of people to burn a car to later post an image of the burning car and frame it as an act of protest. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0057.001.md",
|
|
"external_id": "T0057.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--86d83fcc-efd8-4453-851a-375e5a73022a"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--092de9b1-422f-4359-a11a-5910713c78ae",
|
|
"created_by_ref": "identity--98a1ed58-fe31-4e4e-b134-4b08416b2262",
|
|
"created": "2022-07-02T04:22:03.141619Z",
|
|
"modified": "2022-07-02T04:22:03.141619Z",
|
|
"name": "Conduct Symbolic Action",
|
|
"description": "Symbolic action refers to activities specifically intended to advance an operation\u2019s narrative by signaling something to the audience, for example, a military parade supporting a state\u2019s narrative of military superiority. An influence operation may use symbolic action to create falsified evidence supporting operation narratives in the physical information space. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0057.002.md",
|
|
"external_id": "T0057.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--8d6cfbf8-6eb3-4a92-b640-dc53c04d1611"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--ba35db8a-577a-40e5-bda4-7ba3728cc28b",
|
|
"created_by_ref": "identity--426d623e-0d80-493d-b386-8cdf51a1c615",
|
|
"created": "2022-07-02T04:22:03.141932Z",
|
|
"modified": "2022-07-02T04:22:03.141932Z",
|
|
"name": "Conduct Crowdfunding Campaigns",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0017.001.md",
|
|
"external_id": "T0017.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--eec41a30-1fee-47c0-9d0f-d6473941de91"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--78655b7b-356a-4b4a-8de6-c88991347241",
|
|
"created_by_ref": "identity--60e2acb8-0e8b-4a28-b440-8e8bdafbf599",
|
|
"created": "2022-07-02T04:22:03.142273Z",
|
|
"modified": "2022-07-02T04:22:03.142273Z",
|
|
"name": "Conduct Physical Violence",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0127.001.md",
|
|
"external_id": "T0127.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c7f22c25-31fb-4568-bbee-9a7d41099468"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--3942dc6a-1632-404a-ac65-e8c6b18a944b",
|
|
"created_by_ref": "identity--5cfcaf48-cfd4-48ef-8f20-224be4f6b04e",
|
|
"created": "2022-07-02T04:22:03.142594Z",
|
|
"modified": "2022-07-02T04:22:03.142594Z",
|
|
"name": "Encourage Physical Violence",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0127.002.md",
|
|
"external_id": "T0127.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--cf763ecf-6930-4b34-8e34-e5a3fa489016"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--cfdb3bba-4349-4734-933f-b41f513b9cad",
|
|
"created_by_ref": "identity--9a1770cf-ce10-42f3-bad9-7cbc829557d4",
|
|
"created": "2022-07-02T04:22:03.142911Z",
|
|
"modified": "2022-07-02T04:22:03.142911Z",
|
|
"name": "Sell Merchandise",
|
|
"description": "Selling merchandise refers to the sale of often branded items to the target audience. An influence operation may sell merchandise to raise funds and promote its messaging in the physical information space, for example, by selling t-shirts with operational messaging displayed on the clothing. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "drive-offline-activity"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0061.001.md",
|
|
"external_id": "T0061.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--188e7339-c50b-4c41-92fc-91b7a9ad662d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--92a43cb3-7817-4bb9-a7ed-f0ec95e7d3d5",
|
|
"created_by_ref": "identity--ec029077-ec9a-4b8a-9189-bfc63b951439",
|
|
"created": "2022-07-02T04:22:03.143233Z",
|
|
"modified": "2022-07-02T04:22:03.143233Z",
|
|
"name": "Use Pseudonyms",
|
|
"description": "An operation may use pseudonyms, or fake names, to mask the identity of operation accounts, publish anonymous content, or otherwise use falsified personas to conceal identity of the operation. An operation may coordinate pseudonyms across multiple platforms, for example, by writing an article under a pseudonym and then posting a link to the article on social media on an account with the same falsified name. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0128.001.md",
|
|
"external_id": "T0128.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5f6d2ae4-12f9-4f25-bd96-245d805be611"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--4787da40-8dc0-4a00-97a8-421e299b34bd",
|
|
"created_by_ref": "identity--c9d3ac87-ca0e-4703-b581-793934ff6cd1",
|
|
"created": "2022-07-02T04:22:03.143552Z",
|
|
"modified": "2022-07-02T04:22:03.143552Z",
|
|
"name": "Conceal Network Identity",
|
|
"description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organization. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0128.002.md",
|
|
"external_id": "T0128.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--565c628f-7851-4055-948a-df0d594a08bc"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--29750664-9ed2-4c58-b10b-68ab1eb02dc6",
|
|
"created_by_ref": "identity--38878c6f-1db3-4eae-bd7a-07b36bcc2f3c",
|
|
"created": "2022-07-02T04:22:03.143879Z",
|
|
"modified": "2022-07-02T04:22:03.143879Z",
|
|
"name": "Distance Reputable Individuals from Operation",
|
|
"description": "Distancing reputable individuals from the operation occurs when enlisted individuals, such as celebrities or subject matter experts, actively disengage themselves from operation activities and messaging. Individuals may distance themselves from the operation by deleting old posts or statements, unfollowing operation information assets, or otherwise detaching themselves from the operation\u2019s timeline. An influence operation may want reputable individuals to distance themselves from the operation to reduce operation exposure, particularly if the operation aims to remove all evidence.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0128.003.md",
|
|
"external_id": "T0128.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--11441662-c80b-435d-bfb2-b925624fe053"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--572ac69e-825a-4287-be22-3faae6f2a454",
|
|
"created_by_ref": "identity--7c43dff9-e2d2-47b2-b1d7-4bc2fd008660",
|
|
"created": "2022-07-02T04:22:03.144195Z",
|
|
"modified": "2022-07-02T04:22:03.144195Z",
|
|
"name": "Launder Accounts",
|
|
"description": "Account laundering occurs when an influence operation acquires control of previously legitimate online accounts from third parties through sale or exchange and often in contravention of terms of use. Influence operations use laundered accounts to reach target audience members from an existing information channel and complicate attribution. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0128.004.md",
|
|
"external_id": "T0128.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--0b073b28-dc75-4408-83cb-bb6cf10cfce8"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--48eedefd-139c-40f7-aa22-ba1cb4309929",
|
|
"created_by_ref": "identity--215ae8be-cd5c-423e-8544-77754395d4a9",
|
|
"created": "2022-07-02T04:22:03.144511Z",
|
|
"modified": "2022-07-02T04:22:03.144511Z",
|
|
"name": "Change Names of Accounts",
|
|
"description": "Changing names of accounts occurs when an operation changes the name of an existing social media account. An operation may change the names of its accounts throughout an operation to avoid detection or alter the names of newly acquired or repurposed accounts to fit operational narratives. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0128.005.md",
|
|
"external_id": "T0128.005"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--341d5c91-8a26-4003-b588-db1cc4290d08"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--235693bd-a099-438a-9532-bcf2f7cf618d",
|
|
"created_by_ref": "identity--aae35d3f-7f70-4faf-91eb-571d576b143c",
|
|
"created": "2022-07-02T04:22:03.144827Z",
|
|
"modified": "2022-07-02T04:22:03.144827Z",
|
|
"name": "Conceal Network Identity",
|
|
"description": "Concealing network identity aims to hide the existence an influence operation\u2019s network completely. Unlike concealing sponsorship, concealing network identity denies the existence of any sort of organization. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.001.md",
|
|
"external_id": "T0129.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--8ca6d0a3-4ddc-4cfd-a021-09fc8948d721"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b9a03f89-367c-4c38-a4c9-b19a00eb3b80",
|
|
"created_by_ref": "identity--fc4f7a8e-b2e6-47b1-a421-14db73413293",
|
|
"created": "2022-07-02T04:22:03.145146Z",
|
|
"modified": "2022-07-02T04:22:03.145146Z",
|
|
"name": "Generate Content Unrelated to Narrative",
|
|
"description": "An influence operation may mix its own operation content with legitimate news or external unrelated content to disguise operational objectives, narratives, or existence. For example, an operation may generate \"lifestyle\" or \"cuisine\" content alongside regular operation content. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.002.md",
|
|
"external_id": "T0129.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--f71f6f3f-f48c-4d52-8054-598c10fb827d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d1d56da8-9b78-47dc-82a1-81a8487cbd21",
|
|
"created_by_ref": "identity--0d5a72d8-a69f-42d3-bde4-b744e9c2df13",
|
|
"created": "2022-07-02T04:22:03.145462Z",
|
|
"modified": "2022-07-02T04:22:03.145462Z",
|
|
"name": "Break Association with Content",
|
|
"description": "Breaking association with content occurs when an influence operation actively separates itself from its own content. An influence operation may break association with content by unfollowing, unliking, or unsharing its content, removing attribution from its content, or otherwise taking actions that distance the operation from its messaging. An influence operation may break association with its content to complicate attribution or regain credibility for a new operation. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.003.md",
|
|
"external_id": "T0129.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--20f09c64-6b96-4f52-8905-45cfadff60c2"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--90c84906-a8c2-45c4-855b-f7e367dc1598",
|
|
"created_by_ref": "identity--093ed0f0-3efc-4fa5-a138-bce6a019e24a",
|
|
"created": "2022-07-02T04:22:03.145778Z",
|
|
"modified": "2022-07-02T04:22:03.145778Z",
|
|
"name": "Delete URLs",
|
|
"description": "URL deletion occurs when an influence operation completely removes its website registration, rendering the URL inaccessible. An influence operation may delete its URLs to complicate attribution or remove online documentation that the operation ever occurred.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.004.md",
|
|
"external_id": "T0129.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--07e632f4-3df8-431e-b528-2daafa36c5e9"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--94750170-6206-4f82-96ec-a65d8506a417",
|
|
"created_by_ref": "identity--b28d8314-b827-4668-9cf4-a38863eec05b",
|
|
"created": "2022-07-02T04:22:03.146095Z",
|
|
"modified": "2022-07-02T04:22:03.146095Z",
|
|
"name": "Coordinate on encrypted/ closed networks",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.005.md",
|
|
"external_id": "T0129.005"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3a021622-880a-4132-a9a8-5a7638b956a2"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--61ad606e-bea5-4e0b-84b5-7f1bd493471f",
|
|
"created_by_ref": "identity--464d10e8-e663-4c4a-ab1e-179c6a5e7751",
|
|
"created": "2022-07-02T04:22:03.146424Z",
|
|
"modified": "2022-07-02T04:22:03.146424Z",
|
|
"name": "Deny involvement",
|
|
"description": "Without \"smoking gun\" proof (and even with proof), incident creator can or will deny involvement. This technique also leverages the attacker advantages outlined in \"Demand insurmountable proof\", specifically the asymmetric disadvantage for truth-tellers in a \"firehose of misinformation\" environment.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.006.md",
|
|
"external_id": "T0129.006"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c0aee444-9b78-4dd4-8d34-3c6f85382f1c"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8477f465-0683-415e-b33a-59e637535fa5",
|
|
"created_by_ref": "identity--aca6b114-a3c8-426e-937d-c78203948f59",
|
|
"created": "2022-07-02T04:22:03.146747Z",
|
|
"modified": "2022-07-02T04:22:03.146747Z",
|
|
"name": "Delete Accounts/Account Activity",
|
|
"description": "Deleting accounts and account activity occurs when an influence operation removes its online social media assets, including social media accounts, posts, likes, comments, and other online artifacts. An influence operation may delete its accounts and account activity to complicate attribution or remove online documentation that the operation ever occurred. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.007.md",
|
|
"external_id": "T0129.007"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--bc03b2cf-f025-4e16-8879-0b2d66a73ce7"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b1a5d55c-7b70-4c26-bee1-0e0e29f39335",
|
|
"created_by_ref": "identity--57208eff-b54b-45f6-a949-f260dbf3a7da",
|
|
"created": "2022-07-02T04:22:03.147063Z",
|
|
"modified": "2022-07-02T04:22:03.147063Z",
|
|
"name": "Redirect URLs",
|
|
"description": "An influence operation may redirect its falsified or typosquatted URLs to legitimate websites to increase the operation's appearance of legitimacy, complicate attribution, and avoid detection. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.008.md",
|
|
"external_id": "T0129.008"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--22a46e22-466d-4415-a7bd-a651845b26df"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--a85fff88-8feb-437d-9e73-79514660889e",
|
|
"created_by_ref": "identity--03bcc1df-f854-4c47-a15e-55e197f259af",
|
|
"created": "2022-07-02T04:22:03.14738Z",
|
|
"modified": "2022-07-02T04:22:03.14738Z",
|
|
"name": "Remove Post Origins",
|
|
"description": "Removing post origins refers to the elimination of evidence that indicates the initial source of operation content, often to complicate attribution. An influence operation may remove post origins by deleting watermarks, renaming files, or removing embedded links in its content. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.009.md",
|
|
"external_id": "T0129.009"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c016e151-d220-45ad-b5cd-a5961a0c074d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b7c5ba69-657e-4f7d-90b3-25cc76dd3dbf",
|
|
"created_by_ref": "identity--d510840a-1fc9-4c51-abc8-11889eb2a52e",
|
|
"created": "2022-07-02T04:22:03.147694Z",
|
|
"modified": "2022-07-02T04:22:03.147694Z",
|
|
"name": "Misattribute Activity",
|
|
"description": "Misattributed activity refers to incorrectly attributed operation activity. For example, a state sponsored influence operation may conduct operation activity in a way that mimics another state so that external entities misattribute activity to the incorrect state. An operation may misattribute their activities to complicate attribution, avoid detection, or frame an adversary for negative behavior. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0129.010.md",
|
|
"external_id": "T0129.010"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--64f6bf57-08bf-4488-ac7c-a41ac370a151"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--fec44019-d2d5-4393-81ac-d2592019b607",
|
|
"created_by_ref": "identity--018da3c9-9f21-427a-9f39-031e427e5698",
|
|
"created": "2022-07-02T04:22:03.148009Z",
|
|
"modified": "2022-07-02T04:22:03.148009Z",
|
|
"name": "Conceal Sponsorship",
|
|
"description": "Concealing sponsorship aims to mislead or obscure the identity of the hidden sponsor behind an operation rather than entity publicly running the operation. Operations that conceal sponsorship may maintain visible falsified groups, news outlets, non-profits, or other organizations, but seek to mislead or obscure the identity sponsoring, funding, or otherwise supporting these entities. \nInfluence operations may use a variety of techniques to mask the location of their social media accounts to complicate attribution and conceal evidence of foreign interference. Operation accounts may set their location to a false place, often the location of the operation\u2019s target audience, and post in the region\u2019s language",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0130.001.md",
|
|
"external_id": "T0130.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--cc5be8d6-4c38-415d-add0-9e010a80e455"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--161aa4a2-a59f-4d55-90b5-cb117b99a9e7",
|
|
"created_by_ref": "identity--1013b66b-4ed9-4546-b259-1042a0a728a8",
|
|
"created": "2022-07-02T04:22:03.148334Z",
|
|
"modified": "2022-07-02T04:22:03.148334Z",
|
|
"name": "Utilize Bulletproof Hosting",
|
|
"description": "Hosting refers to services through which storage and computing resources are provided to an individual or organization for the accommodation and maintenance of one or more websites and related services. Services may include web hosting, file sharing, and email distribution. Bulletproof hosting refers to services provided by an entity, such as a domain hosting or web hosting firm, that allows its customer considerable leniency in use of the service. An influence operation may utilize bulletproof hosting to maintain continuity of service for suspicious, illegal, or disruptive operation activities that stricter hosting services would limit, report, or suspend. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0130.002.md",
|
|
"external_id": "T0130.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--c7f71c91-9cb4-4fe7-8ea9-4f389026de49"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--407e28ba-d6d3-45eb-9c24-a7141b3e2155",
|
|
"created_by_ref": "identity--9f6c49e4-e237-4e30-b643-d8d3a2ac89f1",
|
|
"created": "2022-07-02T04:22:03.14865Z",
|
|
"modified": "2022-07-02T04:22:03.14865Z",
|
|
"name": "Use Shell Organizations",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0130.003.md",
|
|
"external_id": "T0130.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--7e9edd4d-f64f-458c-8aab-a833859dc00e"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--7ca965d4-1440-49ad-90bb-c97f5f7ad91b",
|
|
"created_by_ref": "identity--70f23066-b1d8-462f-923e-f14ed4519b54",
|
|
"created": "2022-07-02T04:22:03.148984Z",
|
|
"modified": "2022-07-02T04:22:03.148984Z",
|
|
"name": "Use Cryptocurrency",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0130.004.md",
|
|
"external_id": "T0130.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--830ade56-6097-43a8-a8ad-0bcd69fb69dd"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--86cf3f2d-3b85-4e5d-95b7-c0141e9e83fc",
|
|
"created_by_ref": "identity--830e95b9-2b6b-44f5-aa11-427b8990e9b6",
|
|
"created": "2022-07-02T04:22:03.149301Z",
|
|
"modified": "2022-07-02T04:22:03.149301Z",
|
|
"name": "Obfuscate Payment",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0130.005.md",
|
|
"external_id": "T0130.005"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--bb1adc73-a4af-46c8-b53f-9b382d25e8ec"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--76c16f1e-f6ab-48d0-9775-b4d6d73adbaa",
|
|
"created_by_ref": "identity--c8b56e60-e5c4-4d6c-b778-bde23a60665e",
|
|
"created": "2022-07-02T04:22:03.149613Z",
|
|
"modified": "2022-07-02T04:22:03.149613Z",
|
|
"name": "Legacy web content",
|
|
"description": "Make incident content visible for a long time, e.g. by exploiting platform terms of service, or placing it where it's hard to remove or unlikely to be removed.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0131.001.md",
|
|
"external_id": "T0131.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b7b13058-e7c6-4d5d-8604-99f17a56e73b"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--0b5f4f5c-7a93-458b-9ed5-a441ab539b33",
|
|
"created_by_ref": "identity--be72c048-88ce-441d-b668-6d0f143cefc4",
|
|
"created": "2022-07-02T04:22:03.149928Z",
|
|
"modified": "2022-07-02T04:22:03.149928Z",
|
|
"name": "Post Borderline Content",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persist-in-the-information-environment"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0131.002.md",
|
|
"external_id": "T0131.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--69039388-8ab9-45e3-8ce4-c30291fd8faf"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--8e658bb0-7758-491e-a550-0105161baf10",
|
|
"created_by_ref": "identity--e1c62e0a-9d18-4f8d-ba86-4aa0993ce209",
|
|
"created": "2022-07-02T04:22:03.150242Z",
|
|
"modified": "2022-07-02T04:22:03.150242Z",
|
|
"name": "People Focused",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0132.001.md",
|
|
"external_id": "T0132.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3541e30c-0246-47de-91a3-23dbf21003cf"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--73b955a0-14ff-4cc7-918c-92e66962aed8",
|
|
"created_by_ref": "identity--e7a142d1-8231-483a-b86f-5657f686e0a1",
|
|
"created": "2022-07-02T04:22:03.150567Z",
|
|
"modified": "2022-07-02T04:22:03.150567Z",
|
|
"name": "Content Focused",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0132.002.md",
|
|
"external_id": "T0132.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--5e1bfdf0-8f7e-4d28-a780-015769b5ac92"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--08d5a3b5-6a73-4994-8124-f918b0a24652",
|
|
"created_by_ref": "identity--2461e501-b6a8-4476-b30a-943fd5c52682",
|
|
"created": "2022-07-02T04:22:03.151159Z",
|
|
"modified": "2022-07-02T04:22:03.151159Z",
|
|
"name": "View Focused",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0132.003.md",
|
|
"external_id": "T0132.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--02f1c0de-dd3e-47b5-8651-0d33b8e3ee0d"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--5751bd23-edbd-4fff-a99e-af117e8040cd",
|
|
"created_by_ref": "identity--2b4cae19-f314-4f1c-a12b-d0edfad00d4a",
|
|
"created": "2022-07-02T04:22:03.151477Z",
|
|
"modified": "2022-07-02T04:22:03.151477Z",
|
|
"name": "Behavior changes",
|
|
"description": "Monitor and evaluate behaviour changes from misinformation incidents. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0133.001.md",
|
|
"external_id": "T0133.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--ef1b1173-c303-402c-bbfd-77bfd129be46"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--33e1fede-238e-44d8-8a11-922687bb9e73",
|
|
"created_by_ref": "identity--a662f918-cc53-4251-b33c-ddf17b2470de",
|
|
"created": "2022-07-02T04:22:03.151809Z",
|
|
"modified": "2022-07-02T04:22:03.151809Z",
|
|
"name": "Content",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0133.002.md",
|
|
"external_id": "T0133.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--b85c8a28-f2b7-4a6a-b4cb-ce6c048c1aae"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--f494796f-6825-4dc7-a694-8ca3a6a2ccd8",
|
|
"created_by_ref": "identity--3d761e07-514e-456c-838f-70a303e58086",
|
|
"created": "2022-07-02T04:22:03.152124Z",
|
|
"modified": "2022-07-02T04:22:03.152124Z",
|
|
"name": "Awareness",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0133.003.md",
|
|
"external_id": "T0133.003"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--24a0009c-bcd8-4555-920b-090b52592f26"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--b25860ce-cdfb-421c-834b-8aba556a8360",
|
|
"created_by_ref": "identity--1e193e06-0044-42ed-83b8-d9ea5a6918bf",
|
|
"created": "2022-07-02T04:22:03.152441Z",
|
|
"modified": "2022-07-02T04:22:03.152441Z",
|
|
"name": "Knowledge",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0133.004.md",
|
|
"external_id": "T0133.004"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--7c8823af-c373-4327-9dc8-080278de2ee5"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--1cdd3983-14a0-4d1a-a65e-4a066047ba86",
|
|
"created_by_ref": "identity--630f859f-d91b-442f-a9c0-0514b948c0ad",
|
|
"created": "2022-07-02T04:22:03.152756Z",
|
|
"modified": "2022-07-02T04:22:03.152756Z",
|
|
"name": "Action/attitude",
|
|
"description": "nan",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0133.005.md",
|
|
"external_id": "T0133.005"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--3998fe1d-9e44-4bb5-a106-031dea8fbe54"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--d72802a3-6238-45a5-9130-31887538d27e",
|
|
"created_by_ref": "identity--c4dd4425-c85d-4b7e-8b80-27a9caa28160",
|
|
"created": "2022-07-02T04:22:03.153068Z",
|
|
"modified": "2022-07-02T04:22:03.153068Z",
|
|
"name": "Message reach",
|
|
"description": "Monitor and evaluate message reach in misinformation incidents. ",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0134.001.md",
|
|
"external_id": "T0134.001"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--eca1298c-bd18-432b-8947-4439f00717bb"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "attack-pattern",
|
|
"spec_version": "2.1",
|
|
"id": "attack-pattern--546ca620-e626-4a82-8e4d-74f4f99115a9",
|
|
"created_by_ref": "identity--e6003b7e-b5ad-4631-90fc-4e2d5c731ea1",
|
|
"created": "2022-07-02T04:22:03.153388Z",
|
|
"modified": "2022-07-02T04:22:03.153388Z",
|
|
"name": "Social media engagement",
|
|
"description": "Monitor and evaluate social media engagement in misinformation incidents.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "assess-effectiveness"
|
|
}
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0134.002.md",
|
|
"external_id": "T0134.002"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--60fcd5b8-9847-4f12-af20-2975c86fc2ae"
|
|
],
|
|
"x_mitre_is_subtechnique": true,
|
|
"x_mitre_platforms": [
|
|
"Windows",
|
|
"Linux",
|
|
"Mac"
|
|
],
|
|
"x_mitre_version": "1.0"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c0a0333a-bfd3-4fcb-be3f-f52ba766fac8",
|
|
"created": "2022-07-02T04:22:03.153555Z",
|
|
"modified": "2022-07-02T04:22:03.153555Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--540e2d0d-4de2-4331-a130-ccbd14945e57",
|
|
"target_ref": "attack-pattern--0e463661-3676-4344-82a7-f5358aeae31d"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a5ca9921-a7d5-4825-a554-efafadd5804c",
|
|
"created": "2022-07-02T04:22:03.153636Z",
|
|
"modified": "2022-07-02T04:22:03.153636Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--68ab5cae-ca42-46fd-bd2f-9d614e0654aa",
|
|
"target_ref": "attack-pattern--d197bfce-4b71-4637-b192-58e93a5c3cbf"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--af5c002f-a62a-4dcb-bdde-cfc1544033b5",
|
|
"created": "2022-07-02T04:22:03.153715Z",
|
|
"modified": "2022-07-02T04:22:03.153715Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--23706f91-ddc8-4978-b008-9a8996489615",
|
|
"target_ref": "attack-pattern--d197bfce-4b71-4637-b192-58e93a5c3cbf"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2c392104-c253-4238-90ed-3569f0dd7fae",
|
|
"created": "2022-07-02T04:22:03.153786Z",
|
|
"modified": "2022-07-02T04:22:03.153786Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--cfc651f7-ade6-4ede-aa80-8f03bb34e605",
|
|
"target_ref": "attack-pattern--d197bfce-4b71-4637-b192-58e93a5c3cbf"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c4b00912-ca8b-4ef7-9136-e788a298fd37",
|
|
"created": "2022-07-02T04:22:03.153873Z",
|
|
"modified": "2022-07-02T04:22:03.153873Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--4699fa91-706b-4a8b-b253-fbbcf05f44c9",
|
|
"target_ref": "attack-pattern--d197bfce-4b71-4637-b192-58e93a5c3cbf"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f1c3ba4a-511c-4c15-8324-b9406033ef50",
|
|
"created": "2022-07-02T04:22:03.153944Z",
|
|
"modified": "2022-07-02T04:22:03.153944Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--fd7cbe84-0374-4656-a9e1-b8f41caf268c",
|
|
"target_ref": "attack-pattern--d197bfce-4b71-4637-b192-58e93a5c3cbf"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c914929a-1808-4c74-b882-40233b8140c5",
|
|
"created": "2022-07-02T04:22:03.154015Z",
|
|
"modified": "2022-07-02T04:22:03.154015Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--7a43da5e-b3bc-4511-bc63-95af83289a29",
|
|
"target_ref": "attack-pattern--fb4e9ccf-951c-4a0c-b496-8a694bf68463"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--abf5410a-bc4e-4c1b-a44d-42929b51d3a7",
|
|
"created": "2022-07-02T04:22:03.154085Z",
|
|
"modified": "2022-07-02T04:22:03.154085Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--ca7f3d9f-1f93-4eec-ad3e-0d8c7b9c1c78",
|
|
"target_ref": "attack-pattern--fb4e9ccf-951c-4a0c-b496-8a694bf68463"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6628a3f2-ea1c-402c-9d8f-aa3fd6c54e6e",
|
|
"created": "2022-07-02T04:22:03.154155Z",
|
|
"modified": "2022-07-02T04:22:03.154155Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--1f7789b9-c923-4862-a21c-1bb797c9134e",
|
|
"target_ref": "attack-pattern--fb4e9ccf-951c-4a0c-b496-8a694bf68463"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8c906d51-6cb8-42ea-acf7-0f949f759c3f",
|
|
"created": "2022-07-02T04:22:03.154231Z",
|
|
"modified": "2022-07-02T04:22:03.154231Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--28674cbc-4d76-41f9-b764-6ded29ee44fd",
|
|
"target_ref": "attack-pattern--fb4e9ccf-951c-4a0c-b496-8a694bf68463"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1fba7418-a90e-4eeb-8c82-b48e909a6ad0",
|
|
"created": "2022-07-02T04:22:03.154311Z",
|
|
"modified": "2022-07-02T04:22:03.154311Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--fc670bc5-fd66-4a50-896d-bf15b685e0b1",
|
|
"target_ref": "attack-pattern--fb4e9ccf-951c-4a0c-b496-8a694bf68463"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8e32625d-afb6-4f01-861d-5b73d58a2be2",
|
|
"created": "2022-07-02T04:22:03.154383Z",
|
|
"modified": "2022-07-02T04:22:03.154383Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--05b27309-f960-4bdb-8f7c-81a6d3df74fe",
|
|
"target_ref": "attack-pattern--fb4e9ccf-951c-4a0c-b496-8a694bf68463"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--bbba0134-a0ef-4045-afb3-7a559d2ad38a",
|
|
"created": "2022-07-02T04:22:03.154453Z",
|
|
"modified": "2022-07-02T04:22:03.154453Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--8fe69eb0-7cfd-4cfe-b05d-37d439c487ae",
|
|
"target_ref": "attack-pattern--fb4e9ccf-951c-4a0c-b496-8a694bf68463"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e866077d-dbd6-417e-8bfc-65b07c8682eb",
|
|
"created": "2022-07-02T04:22:03.154523Z",
|
|
"modified": "2022-07-02T04:22:03.154523Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--2b6bd718-4225-4bbe-9444-183f90644c74",
|
|
"target_ref": "attack-pattern--fb4e9ccf-951c-4a0c-b496-8a694bf68463"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d6446be5-48bc-4e84-a11b-e7362651462a",
|
|
"created": "2022-07-02T04:22:03.154594Z",
|
|
"modified": "2022-07-02T04:22:03.154594Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--a7c9394d-d8b5-4bd2-868b-06af78391dce",
|
|
"target_ref": "attack-pattern--36291e89-6ea2-40d3-a50c-3908a5c0bc99"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6f9d1214-7011-448c-9776-d3aec38c59fc",
|
|
"created": "2022-07-02T04:22:03.154665Z",
|
|
"modified": "2022-07-02T04:22:03.154665Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--386a6daa-c8f0-4670-bba9-032268352689",
|
|
"target_ref": "attack-pattern--36291e89-6ea2-40d3-a50c-3908a5c0bc99"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ef901676-315e-47a6-9203-f2b45919c2df",
|
|
"created": "2022-07-02T04:22:03.154735Z",
|
|
"modified": "2022-07-02T04:22:03.154735Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--2c2dea9d-8fac-4c78-aded-3ffc8b689f14",
|
|
"target_ref": "attack-pattern--36291e89-6ea2-40d3-a50c-3908a5c0bc99"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6ea13bd1-5720-489a-b6af-4dc447bfe746",
|
|
"created": "2022-07-02T04:22:03.154811Z",
|
|
"modified": "2022-07-02T04:22:03.154811Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--ba35100d-28dc-4b91-b922-c7423591440c",
|
|
"target_ref": "attack-pattern--36291e89-6ea2-40d3-a50c-3908a5c0bc99"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--95510205-1f7f-44ed-ac37-b0499e0e3506",
|
|
"created": "2022-07-02T04:22:03.154884Z",
|
|
"modified": "2022-07-02T04:22:03.154884Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--0d705267-24bc-49d0-9cb8-db20ef0e4312",
|
|
"target_ref": "attack-pattern--36291e89-6ea2-40d3-a50c-3908a5c0bc99"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--fb7c50de-7ca9-4abd-924a-efc2f2b26ed0",
|
|
"created": "2022-07-02T04:22:03.154953Z",
|
|
"modified": "2022-07-02T04:22:03.154953Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--ea0eab44-d062-4634-a642-9915b8cee879",
|
|
"target_ref": "attack-pattern--cb5ef19d-1eec-4159-a195-429daecc6648"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ba1bff1e-4200-4573-afaf-0376bccff62d",
|
|
"created": "2022-07-02T04:22:03.155021Z",
|
|
"modified": "2022-07-02T04:22:03.155021Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--3c485cd2-5a88-4fe4-81f2-3c3ae12de6ae",
|
|
"target_ref": "attack-pattern--cb5ef19d-1eec-4159-a195-429daecc6648"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--273a116d-8f08-451f-9fd1-57fc8e60df23",
|
|
"created": "2022-07-02T04:22:03.15509Z",
|
|
"modified": "2022-07-02T04:22:03.15509Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--4ebcc4a4-ff0b-4275-963a-617cdd06a45a",
|
|
"target_ref": "attack-pattern--bb391ff6-c66b-4bd7-ae94-4606e06a5c41"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--5f1a61fb-df8f-4f7e-985b-c09be0aa6e75",
|
|
"created": "2022-07-02T04:22:03.15516Z",
|
|
"modified": "2022-07-02T04:22:03.15516Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--23b4bcfc-7362-440f-97ca-1094ad0abc1e",
|
|
"target_ref": "attack-pattern--bb391ff6-c66b-4bd7-ae94-4606e06a5c41"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--83c1a89f-a67f-4148-894f-1260e1ce88f2",
|
|
"created": "2022-07-02T04:22:03.155229Z",
|
|
"modified": "2022-07-02T04:22:03.155229Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--a40d0704-c0ad-4e08-a8b3-a47366c904a0",
|
|
"target_ref": "attack-pattern--bb391ff6-c66b-4bd7-ae94-4606e06a5c41"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8dde7943-750c-4b91-beb0-c2f87b11761c",
|
|
"created": "2022-07-02T04:22:03.155298Z",
|
|
"modified": "2022-07-02T04:22:03.155298Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--5b64ee4b-994b-4b93-8b1e-3bd71e96f934",
|
|
"target_ref": "attack-pattern--bb391ff6-c66b-4bd7-ae94-4606e06a5c41"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f6bdb7f3-0fdb-4698-a268-d338775dccef",
|
|
"created": "2022-07-02T04:22:03.155367Z",
|
|
"modified": "2022-07-02T04:22:03.155367Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--2eb2f147-53d7-4fae-a711-13f0181630a0",
|
|
"target_ref": "attack-pattern--c21486c6-11d4-4491-a39a-8ab54256065a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1e1d2653-7a18-4b01-8494-a8d3164f3851",
|
|
"created": "2022-07-02T04:22:03.155436Z",
|
|
"modified": "2022-07-02T04:22:03.155436Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--1665bd77-075a-40e0-b344-76382fa64dc2",
|
|
"target_ref": "attack-pattern--c21486c6-11d4-4491-a39a-8ab54256065a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1f30f795-e1f6-4406-9d3b-79b21fb7ade8",
|
|
"created": "2022-07-02T04:22:03.155505Z",
|
|
"modified": "2022-07-02T04:22:03.155505Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--f87843fc-a049-4664-a82d-6be77620dcac",
|
|
"target_ref": "attack-pattern--c21486c6-11d4-4491-a39a-8ab54256065a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--306dcb3e-8827-4c55-80c7-97a2d2e3e1b9",
|
|
"created": "2022-07-02T04:22:03.155574Z",
|
|
"modified": "2022-07-02T04:22:03.155574Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--c8c9540a-aa0b-4f9b-8c94-95868daa7109",
|
|
"target_ref": "attack-pattern--134fb9f0-ca77-4e1f-af85-2a7b49382224"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--dd587e8c-f82f-4fe5-80f4-8783fb4f07d6",
|
|
"created": "2022-07-02T04:22:03.155644Z",
|
|
"modified": "2022-07-02T04:22:03.155644Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b6452a25-f3fc-4578-88fb-052719b04600",
|
|
"target_ref": "attack-pattern--134fb9f0-ca77-4e1f-af85-2a7b49382224"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--b87f3f8f-4184-4080-9d7e-93f0fd36548b",
|
|
"created": "2022-07-02T04:22:03.155713Z",
|
|
"modified": "2022-07-02T04:22:03.155713Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--cb89dcce-417a-4b63-a7bc-fce09c6e4909",
|
|
"target_ref": "attack-pattern--134fb9f0-ca77-4e1f-af85-2a7b49382224"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f485740c-420d-4510-bd30-89889721d33b",
|
|
"created": "2022-07-02T04:22:03.155784Z",
|
|
"modified": "2022-07-02T04:22:03.155784Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--cb49547c-16d2-4897-88c5-14015f132406",
|
|
"target_ref": "attack-pattern--134fb9f0-ca77-4e1f-af85-2a7b49382224"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a31f2f1a-323a-414b-8903-74fea163128b",
|
|
"created": "2022-07-02T04:22:03.155853Z",
|
|
"modified": "2022-07-02T04:22:03.155853Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--4bf72d47-faa4-400a-bfd2-653372a15612",
|
|
"target_ref": "attack-pattern--0a2d5ebd-0296-45e3-9575-a14b2a1e9dc8"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8c60e789-c642-4f56-a1d7-3c2d57576155",
|
|
"created": "2022-07-02T04:22:03.155923Z",
|
|
"modified": "2022-07-02T04:22:03.155923Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--1cc04493-e157-40b6-8173-9848d6b87e58",
|
|
"target_ref": "attack-pattern--0a2d5ebd-0296-45e3-9575-a14b2a1e9dc8"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--70ff82fb-d1fd-468e-b587-3f9fc445815d",
|
|
"created": "2022-07-02T04:22:03.155992Z",
|
|
"modified": "2022-07-02T04:22:03.155992Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--756c43ea-c03f-4905-9172-e9d31399729b",
|
|
"target_ref": "attack-pattern--66474820-fb28-45b1-814a-4a0599fe448f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--b4be5a40-41c2-4ad2-88f6-e564732917d6",
|
|
"created": "2022-07-02T04:22:03.156061Z",
|
|
"modified": "2022-07-02T04:22:03.156061Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--838d59b3-91ed-4d6a-908e-c7e94cb9cd60",
|
|
"target_ref": "attack-pattern--66474820-fb28-45b1-814a-4a0599fe448f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--5294607a-17f0-4ef6-937c-9f43a6e677e0",
|
|
"created": "2022-07-02T04:22:03.15613Z",
|
|
"modified": "2022-07-02T04:22:03.15613Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--4c65eec8-13a3-4c89-8088-41db6e9e6381",
|
|
"target_ref": "attack-pattern--4b08d625-9526-4617-bfb1-fb169298ee81"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--aa5dfda8-8b13-436e-8b91-72da204a358a",
|
|
"created": "2022-07-02T04:22:03.156201Z",
|
|
"modified": "2022-07-02T04:22:03.156201Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--6a6e74ba-2941-4780-a855-b058b644697f",
|
|
"target_ref": "attack-pattern--4b08d625-9526-4617-bfb1-fb169298ee81"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--cd2b90ea-0a07-4e82-a1df-5916f0031b78",
|
|
"created": "2022-07-02T04:22:03.15627Z",
|
|
"modified": "2022-07-02T04:22:03.15627Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--7a558db1-eb42-4b98-90fd-12b96c35e75a",
|
|
"target_ref": "attack-pattern--8395fe52-b162-4e30-9477-2107d1b38e84"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d0881b29-4dbf-479f-b7ed-05fcb3c0d8c8",
|
|
"created": "2022-07-02T04:22:03.156338Z",
|
|
"modified": "2022-07-02T04:22:03.156338Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--5b8e3448-2dee-4e2d-bbd8-f346ea298102",
|
|
"target_ref": "attack-pattern--8395fe52-b162-4e30-9477-2107d1b38e84"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--83d21484-3692-4e30-aabe-0caf34187dcd",
|
|
"created": "2022-07-02T04:22:03.156408Z",
|
|
"modified": "2022-07-02T04:22:03.156408Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--8f28ec38-0448-4189-9ec5-2d026cbe0af9",
|
|
"target_ref": "attack-pattern--01a0834b-c185-4ab4-811e-3a3ecd234f71"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8fe30b8d-3e50-49c5-a433-071866ee3a8a",
|
|
"created": "2022-07-02T04:22:03.156482Z",
|
|
"modified": "2022-07-02T04:22:03.156482Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--2eb2d8bf-774e-44dd-942b-11302d6defc2",
|
|
"target_ref": "attack-pattern--01a0834b-c185-4ab4-811e-3a3ecd234f71"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--dcb49cf0-9168-4911-b20d-b23ca323c129",
|
|
"created": "2022-07-02T04:22:03.15655Z",
|
|
"modified": "2022-07-02T04:22:03.15655Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b310bf67-7dfb-4bb9-ba46-5525721a522a",
|
|
"target_ref": "attack-pattern--01a0834b-c185-4ab4-811e-3a3ecd234f71"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9377ee96-2016-480e-93f3-e5c29cfe7a2a",
|
|
"created": "2022-07-02T04:22:03.15662Z",
|
|
"modified": "2022-07-02T04:22:03.15662Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--f3937d9d-e853-48e0-a8a3-54b4e2031cd1",
|
|
"target_ref": "attack-pattern--c33b08b4-0ad0-4589-9b67-9dbe5697e945"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c45b040a-dbf1-4f50-818c-514084112f4e",
|
|
"created": "2022-07-02T04:22:03.156688Z",
|
|
"modified": "2022-07-02T04:22:03.156688Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b014207f-ecc1-4fa4-a393-4ec96d809aa8",
|
|
"target_ref": "attack-pattern--c33b08b4-0ad0-4589-9b67-9dbe5697e945"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d4b581ed-c079-4299-96fb-73eb5f7df83b",
|
|
"created": "2022-07-02T04:22:03.156758Z",
|
|
"modified": "2022-07-02T04:22:03.156758Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--289c80c1-36af-4d61-b7f1-046161422e37",
|
|
"target_ref": "attack-pattern--c33b08b4-0ad0-4589-9b67-9dbe5697e945"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--4fc4713e-1a2d-4c21-a193-6abbe6af202c",
|
|
"created": "2022-07-02T04:22:03.156827Z",
|
|
"modified": "2022-07-02T04:22:03.156827Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--3f7ef990-a068-4591-bb39-374ba03e488e",
|
|
"target_ref": "attack-pattern--c33b08b4-0ad0-4589-9b67-9dbe5697e945"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--3b11926b-aef8-48bb-a012-a8f4d7216c41",
|
|
"created": "2022-07-02T04:22:03.1569Z",
|
|
"modified": "2022-07-02T04:22:03.1569Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--7d78b975-8732-4fe4-9bf8-4b8e7d24f06d",
|
|
"target_ref": "attack-pattern--9723320e-e9d1-44dc-8ee9-4fb3174c44e4"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ac66cae7-0caf-4c79-ac61-d058c7bbe30b",
|
|
"created": "2022-07-02T04:22:03.157002Z",
|
|
"modified": "2022-07-02T04:22:03.157002Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--41c46ffe-b2fe-49ef-9b93-3b92bcdb8dcd",
|
|
"target_ref": "attack-pattern--9723320e-e9d1-44dc-8ee9-4fb3174c44e4"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--0e6c3a37-ea4f-4661-8e54-3ef841f1517e",
|
|
"created": "2022-07-02T04:22:03.157078Z",
|
|
"modified": "2022-07-02T04:22:03.157078Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b4a5c74f-61ed-4c56-a4ce-729e96996243",
|
|
"target_ref": "attack-pattern--9723320e-e9d1-44dc-8ee9-4fb3174c44e4"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c857e8c2-c494-47fb-9a5f-830916e3d0c6",
|
|
"created": "2022-07-02T04:22:03.157152Z",
|
|
"modified": "2022-07-02T04:22:03.157152Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--a98e1eaa-488f-47df-a571-75e3f5623941",
|
|
"target_ref": "attack-pattern--ca9c2c2a-da40-4acc-b032-9df2fa13405d"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ffd7acd5-fa53-4c5d-9a48-fea875106669",
|
|
"created": "2022-07-02T04:22:03.157223Z",
|
|
"modified": "2022-07-02T04:22:03.157223Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--9658db3b-1bea-4d30-ae7e-75f6b2b2724f",
|
|
"target_ref": "attack-pattern--ca9c2c2a-da40-4acc-b032-9df2fa13405d"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--98c461ec-5258-40cb-9b5a-b9f7287a2083",
|
|
"created": "2022-07-02T04:22:03.157292Z",
|
|
"modified": "2022-07-02T04:22:03.157292Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--f9dfde42-f51e-4d57-8693-61b533e43218",
|
|
"target_ref": "attack-pattern--ca9c2c2a-da40-4acc-b032-9df2fa13405d"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--43979cc4-ad6b-4d1e-a91b-367a5443abbc",
|
|
"created": "2022-07-02T04:22:03.157363Z",
|
|
"modified": "2022-07-02T04:22:03.157363Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--64ac5ec9-0b22-4878-8255-5705af4f7673",
|
|
"target_ref": "attack-pattern--8911a837-749f-47d2-a07d-9c05cef6b87b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--4485042a-3aef-4631-a4f2-63b1db41869c",
|
|
"created": "2022-07-02T04:22:03.157439Z",
|
|
"modified": "2022-07-02T04:22:03.157439Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b9ea3db7-a728-4e2b-a669-5add311f0254",
|
|
"target_ref": "attack-pattern--8911a837-749f-47d2-a07d-9c05cef6b87b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--fcd63d3f-037e-4d78-86e2-04d5521f6268",
|
|
"created": "2022-07-02T04:22:03.157509Z",
|
|
"modified": "2022-07-02T04:22:03.157509Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--713ebd36-242f-4e83-aea8-cc4cc83ea8b3",
|
|
"target_ref": "attack-pattern--c92deaef-cf61-4e75-ada2-a75e3c11afe6"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--3dbfd76d-f1c3-4b25-84a4-934bf26d00a6",
|
|
"created": "2022-07-02T04:22:03.157579Z",
|
|
"modified": "2022-07-02T04:22:03.157579Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--6c0a687d-cdf0-4bbd-8987-5a9f1175e3be",
|
|
"target_ref": "attack-pattern--c92deaef-cf61-4e75-ada2-a75e3c11afe6"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--cf38b806-3b3b-442f-b975-8a38142a9aed",
|
|
"created": "2022-07-02T04:22:03.157648Z",
|
|
"modified": "2022-07-02T04:22:03.157648Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--a03a748d-983f-4ef6-82ec-4c5c69973cc6",
|
|
"target_ref": "attack-pattern--70ae7415-b668-419e-8978-38176f101a67"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c4b31c01-5528-46a4-b5d0-b715209da197",
|
|
"created": "2022-07-02T04:22:03.157717Z",
|
|
"modified": "2022-07-02T04:22:03.157717Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--f9f5a444-93a7-46c4-9154-2009e540512d",
|
|
"target_ref": "attack-pattern--70ae7415-b668-419e-8978-38176f101a67"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1300d9f0-d06f-4282-8ab4-d6ea1720c41c",
|
|
"created": "2022-07-02T04:22:03.157787Z",
|
|
"modified": "2022-07-02T04:22:03.157787Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--37cc79df-c35b-4702-9ebf-1db6f6878df3",
|
|
"target_ref": "attack-pattern--60545e2c-e9f6-48b2-a2e2-8bda93434e64"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--dcd60406-62a3-4499-8c64-4df1dce2391b",
|
|
"created": "2022-07-02T04:22:03.157856Z",
|
|
"modified": "2022-07-02T04:22:03.157856Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--e796dcfa-1968-46f5-a5d8-43e5f065c11f",
|
|
"target_ref": "attack-pattern--60545e2c-e9f6-48b2-a2e2-8bda93434e64"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--4a437b90-d7b5-4d33-8083-b879b747ec23",
|
|
"created": "2022-07-02T04:22:03.157926Z",
|
|
"modified": "2022-07-02T04:22:03.157926Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--79431801-be7e-4f13-bb41-e0dce8d12039",
|
|
"target_ref": "attack-pattern--cf7766aa-f234-4e7b-9c9a-f3ae82b94555"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8228422c-dd74-4544-9ed4-40ff5ce524d2",
|
|
"created": "2022-07-02T04:22:03.157995Z",
|
|
"modified": "2022-07-02T04:22:03.157995Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--342d7f1b-2864-4daf-b3df-b25d0f9db021",
|
|
"target_ref": "attack-pattern--89d40adf-6f6e-418f-8e27-1dd214995c1d"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--bf410315-0df5-4e28-afd9-ac4e09e49a2f",
|
|
"created": "2022-07-02T04:22:03.158064Z",
|
|
"modified": "2022-07-02T04:22:03.158064Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--1baa6985-10f2-4917-83d7-c005c2c6eb0c",
|
|
"target_ref": "attack-pattern--e03d047c-ab58-40e6-944c-6bc1eab12559"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ab67e8d8-bea3-4901-b7d6-cda3bf092220",
|
|
"created": "2022-07-02T04:22:03.158133Z",
|
|
"modified": "2022-07-02T04:22:03.158133Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--0c63bf4d-fa02-4b40-8683-2a0994e3895e",
|
|
"target_ref": "attack-pattern--e03d047c-ab58-40e6-944c-6bc1eab12559"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c94e6d09-7209-4f73-b939-a503c28af250",
|
|
"created": "2022-07-02T04:22:03.158205Z",
|
|
"modified": "2022-07-02T04:22:03.158205Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--0d3726bc-bf0e-4357-b2b3-96b41aa856a3",
|
|
"target_ref": "attack-pattern--de48f162-abb1-440e-b264-04ba0a9e6881"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e827fcd4-88f3-401c-98c9-bf8c3c0351c7",
|
|
"created": "2022-07-02T04:22:03.158275Z",
|
|
"modified": "2022-07-02T04:22:03.158275Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--ec47a70a-3821-4f0e-9e10-f2bb7e836116",
|
|
"target_ref": "attack-pattern--de48f162-abb1-440e-b264-04ba0a9e6881"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--fed44a42-71f2-43c1-8d9e-ccb73a72bbb1",
|
|
"created": "2022-07-02T04:22:03.158374Z",
|
|
"modified": "2022-07-02T04:22:03.158374Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--17ae8352-79ab-4160-b192-cd70463fdba0",
|
|
"target_ref": "attack-pattern--d9c6cb8b-122f-4ff9-ae38-4aa693068bf8"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--cd547940-ade6-415b-bb6e-d338ef0dd7dd",
|
|
"created": "2022-07-02T04:22:03.15845Z",
|
|
"modified": "2022-07-02T04:22:03.15845Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--ab6e9b70-4b9e-414c-93ea-405058270218",
|
|
"target_ref": "attack-pattern--d9c6cb8b-122f-4ff9-ae38-4aa693068bf8"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--456375cc-ba59-4fe0-be9f-f7e771d032d1",
|
|
"created": "2022-07-02T04:22:03.15852Z",
|
|
"modified": "2022-07-02T04:22:03.15852Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--2dd166eb-2830-4440-8f7e-16ae78cbffce",
|
|
"target_ref": "attack-pattern--d9c6cb8b-122f-4ff9-ae38-4aa693068bf8"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a89645aa-d8c5-46d8-94c4-886b17c2d07b",
|
|
"created": "2022-07-02T04:22:03.158589Z",
|
|
"modified": "2022-07-02T04:22:03.158589Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--08148393-fc91-438a-95c6-c67caafd3f66",
|
|
"target_ref": "attack-pattern--b569654a-48b9-403a-ad02-5c0520f24c2a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c7a540af-256e-438c-b8a2-082caf681753",
|
|
"created": "2022-07-02T04:22:03.158657Z",
|
|
"modified": "2022-07-02T04:22:03.158657Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--2db4ca1d-31be-4012-899d-d15362afe682",
|
|
"target_ref": "attack-pattern--b569654a-48b9-403a-ad02-5c0520f24c2a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a00ecbd3-3cc3-4cbd-beae-21f6471fee15",
|
|
"created": "2022-07-02T04:22:03.158726Z",
|
|
"modified": "2022-07-02T04:22:03.158726Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--c681159d-51ba-4aa9-b578-0ce88459bbfc",
|
|
"target_ref": "attack-pattern--b569654a-48b9-403a-ad02-5c0520f24c2a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ebc7425a-5745-40af-8894-22f049f85b60",
|
|
"created": "2022-07-02T04:22:03.158795Z",
|
|
"modified": "2022-07-02T04:22:03.158795Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--f7fe9685-502a-4ec2-aba8-afe17db3dc0a",
|
|
"target_ref": "attack-pattern--abd82758-c4a7-402e-b511-eb6205b46810"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--14d27274-1bfb-4d0e-a207-2f54c798ea43",
|
|
"created": "2022-07-02T04:22:03.158865Z",
|
|
"modified": "2022-07-02T04:22:03.158865Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--2025e8cd-69d0-48df-b8f7-d945860a0034",
|
|
"target_ref": "attack-pattern--abd82758-c4a7-402e-b511-eb6205b46810"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1b564028-1442-4d52-bb7c-cbc941577999",
|
|
"created": "2022-07-02T04:22:03.158934Z",
|
|
"modified": "2022-07-02T04:22:03.158934Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--a4724a3a-2bb8-4dbc-8cb4-0288d2edc682",
|
|
"target_ref": "attack-pattern--187e3391-9355-412c-94bd-3aa951359917"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--027ed706-1556-4325-9433-f0a413b2dfe9",
|
|
"created": "2022-07-02T04:22:03.159004Z",
|
|
"modified": "2022-07-02T04:22:03.159004Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--db7161b6-5231-407f-b54e-c6c94c80a65c",
|
|
"target_ref": "attack-pattern--187e3391-9355-412c-94bd-3aa951359917"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d6d4395b-60c7-41ac-8b4a-321caed81aee",
|
|
"created": "2022-07-02T04:22:03.159075Z",
|
|
"modified": "2022-07-02T04:22:03.159075Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b98e170b-d59e-436d-9cb8-dc98723966e7",
|
|
"target_ref": "attack-pattern--92f696dc-5a56-4768-a6d2-1a69c6642c7a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9201a4b5-bc3d-47bf-b995-dda6598ac6f8",
|
|
"created": "2022-07-02T04:22:03.159144Z",
|
|
"modified": "2022-07-02T04:22:03.159144Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--38ef9ff3-506f-4ce3-9653-475a20961d1a",
|
|
"target_ref": "attack-pattern--92f696dc-5a56-4768-a6d2-1a69c6642c7a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f044fa8e-19e5-43ab-9ff4-ae4e9b01448c",
|
|
"created": "2022-07-02T04:22:03.159213Z",
|
|
"modified": "2022-07-02T04:22:03.159213Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--be195a87-6081-4525-9199-44ae23c74b38",
|
|
"target_ref": "attack-pattern--92f696dc-5a56-4768-a6d2-1a69c6642c7a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2f1adef0-0cba-4a88-a45a-0f346fb4a272",
|
|
"created": "2022-07-02T04:22:03.159281Z",
|
|
"modified": "2022-07-02T04:22:03.159281Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--f6c8dde2-9957-47df-843c-3d0760995351",
|
|
"target_ref": "attack-pattern--92f696dc-5a56-4768-a6d2-1a69c6642c7a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--b8d95791-0a67-41b9-b8f2-e37540710741",
|
|
"created": "2022-07-02T04:22:03.15935Z",
|
|
"modified": "2022-07-02T04:22:03.15935Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--0f4c0dce-c14e-4f9c-999e-6a9654f074f0",
|
|
"target_ref": "attack-pattern--92f696dc-5a56-4768-a6d2-1a69c6642c7a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c2eed905-88a1-4487-bc8d-f7e8b310d5f7",
|
|
"created": "2022-07-02T04:22:03.159421Z",
|
|
"modified": "2022-07-02T04:22:03.159421Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--0148f9dd-21af-4cd1-a317-4bbefc2d3dbf",
|
|
"target_ref": "attack-pattern--92f696dc-5a56-4768-a6d2-1a69c6642c7a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ad2526dc-caa3-48d4-92c9-5ff5657fd7e4",
|
|
"created": "2022-07-02T04:22:03.159491Z",
|
|
"modified": "2022-07-02T04:22:03.159491Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--73bd1cae-ad4d-416b-8752-0fefdda8beb9",
|
|
"target_ref": "attack-pattern--1e3fe580-e721-43ae-b231-6a1ffa7c7427"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--745cfb23-8a0d-417d-a99c-5e59be811a13",
|
|
"created": "2022-07-02T04:22:03.159567Z",
|
|
"modified": "2022-07-02T04:22:03.159567Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--9be08cf5-8b9e-469f-8d45-40afaf29aec4",
|
|
"target_ref": "attack-pattern--1e3fe580-e721-43ae-b231-6a1ffa7c7427"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7ed641ff-c55d-408b-a54a-2e4509552b41",
|
|
"created": "2022-07-02T04:22:03.159642Z",
|
|
"modified": "2022-07-02T04:22:03.159642Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--07cdf656-71ef-44ee-b307-1a66439a2870",
|
|
"target_ref": "attack-pattern--1e3fe580-e721-43ae-b231-6a1ffa7c7427"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a8202b8c-46ab-4eb3-bd44-28629198e4d2",
|
|
"created": "2022-07-02T04:22:03.159711Z",
|
|
"modified": "2022-07-02T04:22:03.159711Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--f6cced10-fcf6-4922-9b75-573a9e3df2ff",
|
|
"target_ref": "attack-pattern--d004bc13-8282-46b2-9793-5a0b62f2dffa"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--582f81ab-e0b7-440c-997e-88de5bd7e7f3",
|
|
"created": "2022-07-02T04:22:03.15978Z",
|
|
"modified": "2022-07-02T04:22:03.15978Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--784801bd-41e1-4a81-b670-78bfb5b866b1",
|
|
"target_ref": "attack-pattern--8a8eea1e-0bb0-45d1-8e03-62bf0203158f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--41ed3a4a-d9d0-4772-9271-342b3c9706ed",
|
|
"created": "2022-07-02T04:22:03.159848Z",
|
|
"modified": "2022-07-02T04:22:03.159848Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--1118e422-bcff-403f-9e8b-e5934b16d432",
|
|
"target_ref": "attack-pattern--8a8eea1e-0bb0-45d1-8e03-62bf0203158f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--78335cd0-12de-42c8-8c27-73bc9e732ab9",
|
|
"created": "2022-07-02T04:22:03.159917Z",
|
|
"modified": "2022-07-02T04:22:03.159917Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--c685f14e-96b8-4cde-8ff3-0f6bca8ea1c5",
|
|
"target_ref": "attack-pattern--8a8eea1e-0bb0-45d1-8e03-62bf0203158f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2f5d8a01-0cdd-4052-8d78-744b0faea174",
|
|
"created": "2022-07-02T04:22:03.159986Z",
|
|
"modified": "2022-07-02T04:22:03.159986Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--9814e8c1-6928-42c1-a64d-1f7bee4cb632",
|
|
"target_ref": "attack-pattern--5279ebe3-f902-4f0b-a1ae-34a647b99df1"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--cd3a368d-211e-4081-ae75-291cb5c929d5",
|
|
"created": "2022-07-02T04:22:03.160055Z",
|
|
"modified": "2022-07-02T04:22:03.160055Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--71c39f24-2b5c-4a38-ac10-2b52cf803c50",
|
|
"target_ref": "attack-pattern--5279ebe3-f902-4f0b-a1ae-34a647b99df1"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--33658309-27ee-4d94-b2b1-3137cb3991a4",
|
|
"created": "2022-07-02T04:22:03.160124Z",
|
|
"modified": "2022-07-02T04:22:03.160124Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--9aea5087-dc89-440a-9057-1bef7713db24",
|
|
"target_ref": "attack-pattern--08a11627-de00-4ac2-b6ee-b11ad36b309b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e08a6dc2-59e7-43a6-a44a-209793972e16",
|
|
"created": "2022-07-02T04:22:03.160193Z",
|
|
"modified": "2022-07-02T04:22:03.160193Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--d6c19675-7055-4e3d-af50-9a168b578b41",
|
|
"target_ref": "attack-pattern--08a11627-de00-4ac2-b6ee-b11ad36b309b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2c5cfea2-4ae4-4604-a6ca-b92023781917",
|
|
"created": "2022-07-02T04:22:03.160262Z",
|
|
"modified": "2022-07-02T04:22:03.160262Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--c745bb3a-348d-4b3a-87be-f2b70acd0186",
|
|
"target_ref": "attack-pattern--08a11627-de00-4ac2-b6ee-b11ad36b309b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c9f29db2-1a13-4c4d-82e4-fa6977966105",
|
|
"created": "2022-07-02T04:22:03.160331Z",
|
|
"modified": "2022-07-02T04:22:03.160331Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--9db0dca3-1313-4a7e-8f77-0d4417710dc8",
|
|
"target_ref": "attack-pattern--875c2147-5059-4bb5-ae60-7c307222c222"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--30e4907f-10f5-43fb-91ed-a174aaa18d70",
|
|
"created": "2022-07-02T04:22:03.160403Z",
|
|
"modified": "2022-07-02T04:22:03.160403Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b5f3fb77-ed85-438c-9984-317601eb35be",
|
|
"target_ref": "attack-pattern--6cb2b1b5-5a51-4f19-a6f2-08d6bc238121"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7b15ba4d-a391-4c7e-9f63-b53dcdf64ed0",
|
|
"created": "2022-07-02T04:22:03.160472Z",
|
|
"modified": "2022-07-02T04:22:03.160472Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--d4017599-a949-4dea-a709-9e38e6ec1010",
|
|
"target_ref": "attack-pattern--6cb2b1b5-5a51-4f19-a6f2-08d6bc238121"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--5d12ac4a-f1d4-425e-a259-02699e1088e6",
|
|
"created": "2022-07-02T04:22:03.16054Z",
|
|
"modified": "2022-07-02T04:22:03.16054Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--8a255985-c27e-491f-84e3-b1b1fc94a0a8",
|
|
"target_ref": "attack-pattern--6cb2b1b5-5a51-4f19-a6f2-08d6bc238121"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--83e1994b-6bec-4884-a92e-396a42c1db14",
|
|
"created": "2022-07-02T04:22:03.16061Z",
|
|
"modified": "2022-07-02T04:22:03.16061Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--90ef8d98-5329-46fb-be8a-cdeb612e12b6",
|
|
"target_ref": "attack-pattern--6cb2b1b5-5a51-4f19-a6f2-08d6bc238121"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6adfb47d-6216-46b5-beff-272205deae14",
|
|
"created": "2022-07-02T04:22:03.160679Z",
|
|
"modified": "2022-07-02T04:22:03.160679Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--15e37fa3-0927-4cda-a91b-b2fcf1de0e2a",
|
|
"target_ref": "attack-pattern--6cb2b1b5-5a51-4f19-a6f2-08d6bc238121"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ca91270b-3122-4f86-8a59-c1030bb26098",
|
|
"created": "2022-07-02T04:22:03.160752Z",
|
|
"modified": "2022-07-02T04:22:03.160752Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--86bd2330-523a-48e1-8299-02055951a8d2",
|
|
"target_ref": "attack-pattern--6cb2b1b5-5a51-4f19-a6f2-08d6bc238121"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--bc753c2a-a7bc-4f12-8480-716db06a996c",
|
|
"created": "2022-07-02T04:22:03.16082Z",
|
|
"modified": "2022-07-02T04:22:03.16082Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--6bcaa950-ef27-403c-93aa-a4186a747541",
|
|
"target_ref": "attack-pattern--6cb2b1b5-5a51-4f19-a6f2-08d6bc238121"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--5f1efb7d-3db8-4983-b92c-0cf82e3c56e9",
|
|
"created": "2022-07-02T04:22:03.160889Z",
|
|
"modified": "2022-07-02T04:22:03.160889Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b7228c09-0f9c-4c97-8b02-fc0eca17ac87",
|
|
"target_ref": "attack-pattern--9f08f8be-e32a-401b-b4e0-3a3735249d90"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--3afcc88c-3aae-48ee-b471-3857e55e0cac",
|
|
"created": "2022-07-02T04:22:03.160957Z",
|
|
"modified": "2022-07-02T04:22:03.160957Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--44b60b3c-afea-40c5-8faa-afd31269e6da",
|
|
"target_ref": "attack-pattern--9f08f8be-e32a-401b-b4e0-3a3735249d90"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d85e5121-145b-474e-9f19-4ad9049df17e",
|
|
"created": "2022-07-02T04:22:03.161026Z",
|
|
"modified": "2022-07-02T04:22:03.161026Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--ec488891-e56b-4c62-8f15-2cb21a46287a",
|
|
"target_ref": "attack-pattern--9f08f8be-e32a-401b-b4e0-3a3735249d90"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2c944937-53fa-4156-956c-df712ab09755",
|
|
"created": "2022-07-02T04:22:03.161095Z",
|
|
"modified": "2022-07-02T04:22:03.161095Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--2a372db3-69c5-42bb-b257-c43684bede04",
|
|
"target_ref": "attack-pattern--9cdae3e8-394c-4244-91b6-ed5d2dfd5d5b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ad22eb62-69a7-4b20-8ac1-9423ad71fd6c",
|
|
"created": "2022-07-02T04:22:03.161164Z",
|
|
"modified": "2022-07-02T04:22:03.161164Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--3b38d150-4130-419c-9f99-24367d2b0483",
|
|
"target_ref": "attack-pattern--9cdae3e8-394c-4244-91b6-ed5d2dfd5d5b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--23eba85d-d7a4-4d53-a428-6243c7e304e6",
|
|
"created": "2022-07-02T04:22:03.161233Z",
|
|
"modified": "2022-07-02T04:22:03.161233Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--cf4bfcec-2850-4d70-9a4c-618940a68b05",
|
|
"target_ref": "attack-pattern--58a8d163-c0f8-4bf5-b960-b95460c39dd3"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e80ec6c1-1b27-410c-ac0f-1b4a98b00389",
|
|
"created": "2022-07-02T04:22:03.161303Z",
|
|
"modified": "2022-07-02T04:22:03.161303Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--fa50dba7-db6c-4c37-9864-a9ba37eda147",
|
|
"target_ref": "attack-pattern--6a0ec15e-b628-4d9b-97f9-a593c036eb39"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--577bd1fb-b428-4432-beb1-4720483bace4",
|
|
"created": "2022-07-02T04:22:03.161371Z",
|
|
"modified": "2022-07-02T04:22:03.161371Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--ff94a50e-964e-4f7e-b6fd-781319cc6268",
|
|
"target_ref": "attack-pattern--6a0ec15e-b628-4d9b-97f9-a593c036eb39"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--0106fc43-1a51-4bf8-803f-6d61d016d142",
|
|
"created": "2022-07-02T04:22:03.16144Z",
|
|
"modified": "2022-07-02T04:22:03.16144Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--7268bde3-3d04-490a-b6ae-c041f1f606e2",
|
|
"target_ref": "attack-pattern--6a0ec15e-b628-4d9b-97f9-a593c036eb39"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9dbe126e-b25e-441e-abb6-e3478a72288a",
|
|
"created": "2022-07-02T04:22:03.161509Z",
|
|
"modified": "2022-07-02T04:22:03.161509Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--0ac0d78a-4949-4687-a7bd-0008178680cd",
|
|
"target_ref": "attack-pattern--6a0ec15e-b628-4d9b-97f9-a593c036eb39"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--922d9fcd-04b1-4ab6-9d3b-476b4ebfe358",
|
|
"created": "2022-07-02T04:22:03.161578Z",
|
|
"modified": "2022-07-02T04:22:03.161578Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--affcfb9a-652e-4409-a428-f9768f5fb1cb",
|
|
"target_ref": "attack-pattern--7d95c5b8-c76f-4761-800c-e91e60988af2"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--daefe962-3f3d-4f51-850f-2ea5c406d06d",
|
|
"created": "2022-07-02T04:22:03.161647Z",
|
|
"modified": "2022-07-02T04:22:03.161647Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--2ac3960b-813b-4722-ba29-9e692d88341b",
|
|
"target_ref": "attack-pattern--7d95c5b8-c76f-4761-800c-e91e60988af2"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9fc457ae-8c57-4373-9ae9-cf6c4c125613",
|
|
"created": "2022-07-02T04:22:03.161716Z",
|
|
"modified": "2022-07-02T04:22:03.161716Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--197d83f1-5d84-407d-9867-0c369fff8209",
|
|
"target_ref": "attack-pattern--7d95c5b8-c76f-4761-800c-e91e60988af2"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--68c91379-6d72-416e-bd2f-cb6897a8b323",
|
|
"created": "2022-07-02T04:22:03.161785Z",
|
|
"modified": "2022-07-02T04:22:03.161785Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--5e234e83-1364-4d37-9317-d3a776326925",
|
|
"target_ref": "attack-pattern--7d95c5b8-c76f-4761-800c-e91e60988af2"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--915d44cc-1e15-4a19-bc8a-bcaafadf7c9a",
|
|
"created": "2022-07-02T04:22:03.161861Z",
|
|
"modified": "2022-07-02T04:22:03.161861Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--07693c90-df6d-43ae-9d0e-66119aeb3d7b",
|
|
"target_ref": "attack-pattern--5eee1595-4d0e-4ee9-9591-982ce7ec9b84"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--eb044d95-ec5b-4fac-839d-02a328e27705",
|
|
"created": "2022-07-02T04:22:03.161935Z",
|
|
"modified": "2022-07-02T04:22:03.161935Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--facb999a-4e3a-42f2-be54-407617aa89a3",
|
|
"target_ref": "attack-pattern--5eee1595-4d0e-4ee9-9591-982ce7ec9b84"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--27f4d4be-e2d5-4183-9186-0d8531010008",
|
|
"created": "2022-07-02T04:22:03.162008Z",
|
|
"modified": "2022-07-02T04:22:03.162008Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--8df70f5d-5132-447c-9989-5178c365a90a",
|
|
"target_ref": "attack-pattern--5eee1595-4d0e-4ee9-9591-982ce7ec9b84"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--fbe19bba-9179-46fc-a818-84525491c811",
|
|
"created": "2022-07-02T04:22:03.162082Z",
|
|
"modified": "2022-07-02T04:22:03.162082Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--e2391d69-d0b3-488e-97b4-2ad3b3fff7b7",
|
|
"target_ref": "attack-pattern--8f377c72-c924-402b-af87-eaaf96d9d0a3"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e836e514-bdf4-4acc-b4c5-61a37a07d13b",
|
|
"created": "2022-07-02T04:22:03.162151Z",
|
|
"modified": "2022-07-02T04:22:03.162151Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--1e917de4-6ee5-44e3-a3e8-1bdd5b20d38b",
|
|
"target_ref": "attack-pattern--8f377c72-c924-402b-af87-eaaf96d9d0a3"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2f8ff6cd-c475-4f7c-89c8-38c4ebcfe0dc",
|
|
"created": "2022-07-02T04:22:03.162225Z",
|
|
"modified": "2022-07-02T04:22:03.162225Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--4f6ea3bf-7423-4e21-a07f-8dbcc94cb3da",
|
|
"target_ref": "attack-pattern--41e751ac-d098-48a5-b9a6-2f671ff9c035"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--315565c0-f963-43cf-a4f4-83c6177211ac",
|
|
"created": "2022-07-02T04:22:03.162302Z",
|
|
"modified": "2022-07-02T04:22:03.162302Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--092de9b1-422f-4359-a11a-5910713c78ae",
|
|
"target_ref": "attack-pattern--41e751ac-d098-48a5-b9a6-2f671ff9c035"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--76f7d08b-009e-4bf6-888b-e57633959131",
|
|
"created": "2022-07-02T04:22:03.162377Z",
|
|
"modified": "2022-07-02T04:22:03.162377Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--ba35db8a-577a-40e5-bda4-7ba3728cc28b",
|
|
"target_ref": "attack-pattern--6876b9ed-bbce-4362-ab1b-f6c638ab5f66"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a63bcee2-c991-4cae-8502-cdef5b19394f",
|
|
"created": "2022-07-02T04:22:03.162457Z",
|
|
"modified": "2022-07-02T04:22:03.162457Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--78655b7b-356a-4b4a-8de6-c88991347241",
|
|
"target_ref": "attack-pattern--3cbdc5fc-976d-4264-9b9f-3657f6d81121"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--423bc1ba-99ca-47bc-9df3-c1cdf77527f0",
|
|
"created": "2022-07-02T04:22:03.16253Z",
|
|
"modified": "2022-07-02T04:22:03.16253Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--3942dc6a-1632-404a-ac65-e8c6b18a944b",
|
|
"target_ref": "attack-pattern--3cbdc5fc-976d-4264-9b9f-3657f6d81121"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7edcef25-25ae-41b5-b00e-1354d43b1cde",
|
|
"created": "2022-07-02T04:22:03.162603Z",
|
|
"modified": "2022-07-02T04:22:03.162603Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--cfdb3bba-4349-4734-933f-b41f513b9cad",
|
|
"target_ref": "attack-pattern--d8f74235-8217-4681-8bb5-1784e0b43789"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7aacda2e-9a27-4653-a0a4-31e08cda44a7",
|
|
"created": "2022-07-02T04:22:03.162675Z",
|
|
"modified": "2022-07-02T04:22:03.162675Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--92a43cb3-7817-4bb9-a7ed-f0ec95e7d3d5",
|
|
"target_ref": "attack-pattern--1cb5bd52-aed3-4c59-a5ac-7fca75c22ae6"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--0e53367a-87ea-445d-88cb-7a8609d0a0f9",
|
|
"created": "2022-07-02T04:22:03.162749Z",
|
|
"modified": "2022-07-02T04:22:03.162749Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--4787da40-8dc0-4a00-97a8-421e299b34bd",
|
|
"target_ref": "attack-pattern--1cb5bd52-aed3-4c59-a5ac-7fca75c22ae6"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f4af202e-7db2-43b9-b27e-1c64d048b83d",
|
|
"created": "2022-07-02T04:22:03.162824Z",
|
|
"modified": "2022-07-02T04:22:03.162824Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--29750664-9ed2-4c58-b10b-68ab1eb02dc6",
|
|
"target_ref": "attack-pattern--1cb5bd52-aed3-4c59-a5ac-7fca75c22ae6"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9132cba4-c834-46a6-868d-65f07321f762",
|
|
"created": "2022-07-02T04:22:03.162894Z",
|
|
"modified": "2022-07-02T04:22:03.162894Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--572ac69e-825a-4287-be22-3faae6f2a454",
|
|
"target_ref": "attack-pattern--1cb5bd52-aed3-4c59-a5ac-7fca75c22ae6"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8010b273-0601-4f86-b048-06f40e9144a3",
|
|
"created": "2022-07-02T04:22:03.162965Z",
|
|
"modified": "2022-07-02T04:22:03.162965Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--48eedefd-139c-40f7-aa22-ba1cb4309929",
|
|
"target_ref": "attack-pattern--1cb5bd52-aed3-4c59-a5ac-7fca75c22ae6"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7a066a34-c363-427f-a659-c630861d10bf",
|
|
"created": "2022-07-02T04:22:03.163038Z",
|
|
"modified": "2022-07-02T04:22:03.163038Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--235693bd-a099-438a-9532-bcf2f7cf618d",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9324f788-2578-46af-b9b4-4efbd2a455ca",
|
|
"created": "2022-07-02T04:22:03.163112Z",
|
|
"modified": "2022-07-02T04:22:03.163112Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b9a03f89-367c-4c38-a4c9-b19a00eb3b80",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1f935d21-c755-41b7-b736-fbe70ecbb1f4",
|
|
"created": "2022-07-02T04:22:03.163186Z",
|
|
"modified": "2022-07-02T04:22:03.163186Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--d1d56da8-9b78-47dc-82a1-81a8487cbd21",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6b7f3c61-bd42-4a99-8659-ae11366bc4af",
|
|
"created": "2022-07-02T04:22:03.163284Z",
|
|
"modified": "2022-07-02T04:22:03.163284Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--90c84906-a8c2-45c4-855b-f7e367dc1598",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--cb2d8d98-608c-4649-8043-ece61ae43304",
|
|
"created": "2022-07-02T04:22:03.163353Z",
|
|
"modified": "2022-07-02T04:22:03.163353Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--94750170-6206-4f82-96ec-a65d8506a417",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c610b95b-caaf-4c51-810e-e3c65ca7b447",
|
|
"created": "2022-07-02T04:22:03.163422Z",
|
|
"modified": "2022-07-02T04:22:03.163422Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--61ad606e-bea5-4e0b-84b5-7f1bd493471f",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9132532a-5e2f-4a87-9be6-1dd0bf680047",
|
|
"created": "2022-07-02T04:22:03.163491Z",
|
|
"modified": "2022-07-02T04:22:03.163491Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--8477f465-0683-415e-b33a-59e637535fa5",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--af2fb22e-3197-4c42-b20d-01fb584746c9",
|
|
"created": "2022-07-02T04:22:03.163559Z",
|
|
"modified": "2022-07-02T04:22:03.163559Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b1a5d55c-7b70-4c26-bee1-0e0e29f39335",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--257e66ff-4e34-44f0-9821-c1ac402ccb30",
|
|
"created": "2022-07-02T04:22:03.163629Z",
|
|
"modified": "2022-07-02T04:22:03.163629Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--a85fff88-8feb-437d-9e73-79514660889e",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--49f42060-2bd1-41cb-a8c8-3a404b73c818",
|
|
"created": "2022-07-02T04:22:03.163697Z",
|
|
"modified": "2022-07-02T04:22:03.163697Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b7c5ba69-657e-4f7d-90b3-25cc76dd3dbf",
|
|
"target_ref": "attack-pattern--6b842384-99b0-4110-a491-590332fd22ce"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f3c78183-946e-45b9-942b-a2b2667534af",
|
|
"created": "2022-07-02T04:22:03.163766Z",
|
|
"modified": "2022-07-02T04:22:03.163766Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--fec44019-d2d5-4393-81ac-d2592019b607",
|
|
"target_ref": "attack-pattern--4063b46c-b959-4944-a569-37e88e497999"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--74768e48-34e8-4d02-a049-3cfe06afab25",
|
|
"created": "2022-07-02T04:22:03.163834Z",
|
|
"modified": "2022-07-02T04:22:03.163834Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--161aa4a2-a59f-4d55-90b5-cb117b99a9e7",
|
|
"target_ref": "attack-pattern--4063b46c-b959-4944-a569-37e88e497999"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--eab4186a-c3c3-46d7-ab78-f4175e20295d",
|
|
"created": "2022-07-02T04:22:03.163903Z",
|
|
"modified": "2022-07-02T04:22:03.163903Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--407e28ba-d6d3-45eb-9c24-a7141b3e2155",
|
|
"target_ref": "attack-pattern--4063b46c-b959-4944-a569-37e88e497999"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7265b874-e926-4596-b88e-09d6c8b9291b",
|
|
"created": "2022-07-02T04:22:03.163972Z",
|
|
"modified": "2022-07-02T04:22:03.163972Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--7ca965d4-1440-49ad-90bb-c97f5f7ad91b",
|
|
"target_ref": "attack-pattern--4063b46c-b959-4944-a569-37e88e497999"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--5f7585ab-86a5-4e2d-94f7-b634ef283bc0",
|
|
"created": "2022-07-02T04:22:03.164041Z",
|
|
"modified": "2022-07-02T04:22:03.164041Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--86cf3f2d-3b85-4e5d-95b7-c0141e9e83fc",
|
|
"target_ref": "attack-pattern--4063b46c-b959-4944-a569-37e88e497999"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--297854c1-d504-4d02-a6bd-32dd7851f606",
|
|
"created": "2022-07-02T04:22:03.164109Z",
|
|
"modified": "2022-07-02T04:22:03.164109Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--76c16f1e-f6ab-48d0-9775-b4d6d73adbaa",
|
|
"target_ref": "attack-pattern--910f7a34-979d-44a8-a6d3-cfadb7172039"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2fa32ab7-9e9f-4a22-8806-2a59a3e0084a",
|
|
"created": "2022-07-02T04:22:03.164182Z",
|
|
"modified": "2022-07-02T04:22:03.164182Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--0b5f4f5c-7a93-458b-9ed5-a441ab539b33",
|
|
"target_ref": "attack-pattern--910f7a34-979d-44a8-a6d3-cfadb7172039"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--14859178-3e5c-41d6-9649-4da05bfd7249",
|
|
"created": "2022-07-02T04:22:03.164252Z",
|
|
"modified": "2022-07-02T04:22:03.164252Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--8e658bb0-7758-491e-a550-0105161baf10",
|
|
"target_ref": "attack-pattern--48d17a8e-898e-45fe-9d05-3f264445c63c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--bee79794-b480-4b13-993d-94a6bd256935",
|
|
"created": "2022-07-02T04:22:03.164322Z",
|
|
"modified": "2022-07-02T04:22:03.164322Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--73b955a0-14ff-4cc7-918c-92e66962aed8",
|
|
"target_ref": "attack-pattern--48d17a8e-898e-45fe-9d05-3f264445c63c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a881fe24-6850-4e96-b46d-ccda7039296b",
|
|
"created": "2022-07-02T04:22:03.164392Z",
|
|
"modified": "2022-07-02T04:22:03.164392Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--08d5a3b5-6a73-4994-8124-f918b0a24652",
|
|
"target_ref": "attack-pattern--48d17a8e-898e-45fe-9d05-3f264445c63c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--23a89732-6fdd-45d1-9f1f-13289a44d838",
|
|
"created": "2022-07-02T04:22:03.164461Z",
|
|
"modified": "2022-07-02T04:22:03.164461Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--5751bd23-edbd-4fff-a99e-af117e8040cd",
|
|
"target_ref": "attack-pattern--d68ff2dd-a826-4465-a5f8-64368a42145c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--0520141e-f559-45f6-8887-bf6791299c39",
|
|
"created": "2022-07-02T04:22:03.16453Z",
|
|
"modified": "2022-07-02T04:22:03.16453Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--33e1fede-238e-44d8-8a11-922687bb9e73",
|
|
"target_ref": "attack-pattern--d68ff2dd-a826-4465-a5f8-64368a42145c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9b2eac81-bb41-42e6-8a2e-dc7cb1a7ed33",
|
|
"created": "2022-07-02T04:22:03.164599Z",
|
|
"modified": "2022-07-02T04:22:03.164599Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--f494796f-6825-4dc7-a694-8ca3a6a2ccd8",
|
|
"target_ref": "attack-pattern--d68ff2dd-a826-4465-a5f8-64368a42145c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--757ea761-7c9f-4f20-a961-19ec17a9832a",
|
|
"created": "2022-07-02T04:22:03.164667Z",
|
|
"modified": "2022-07-02T04:22:03.164667Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--b25860ce-cdfb-421c-834b-8aba556a8360",
|
|
"target_ref": "attack-pattern--d68ff2dd-a826-4465-a5f8-64368a42145c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1a0db509-5a2f-4dfd-aad7-3014989799fd",
|
|
"created": "2022-07-02T04:22:03.164737Z",
|
|
"modified": "2022-07-02T04:22:03.164737Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--1cdd3983-14a0-4d1a-a65e-4a066047ba86",
|
|
"target_ref": "attack-pattern--d68ff2dd-a826-4465-a5f8-64368a42145c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--b822834f-1c92-461c-91f2-89edda43444c",
|
|
"created": "2022-07-02T04:22:03.164805Z",
|
|
"modified": "2022-07-02T04:22:03.164805Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--d72802a3-6238-45a5-9130-31887538d27e",
|
|
"target_ref": "attack-pattern--63b39e10-ced2-467d-8441-7d43754d2ce8"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c77753e3-9c03-428d-a6af-dac61373b512",
|
|
"created": "2022-07-02T04:22:03.164876Z",
|
|
"modified": "2022-07-02T04:22:03.164876Z",
|
|
"relationship_type": "subtechnique-of",
|
|
"source_ref": "attack-pattern--546ca620-e626-4a82-8e4d-74f4f99115a9",
|
|
"target_ref": "attack-pattern--63b39e10-ced2-467d-8441-7d43754d2ce8"
|
|
},
|
|
{
|
|
"type": "x-mitre-matrix",
|
|
"spec_version": "2.1",
|
|
"id": "x-mitre-matrix--cf06f5c6-69b7-4d6d-b405-628dfe9ca9ec",
|
|
"created": "2022-07-02T04:22:03.16497Z",
|
|
"modified": "2022-07-02T04:22:03.16497Z",
|
|
"name": "DISARM Framework",
|
|
"description": "DISARM is a framework designed for describing and understanding disinformation incidents.",
|
|
"tactic_refs": [
|
|
"x-mitre-tactic--971d5c66-5172-47fd-9e20-d07b4ef95d40",
|
|
"x-mitre-tactic--86279474-6d7a-4378-9cd1-7e7e633fc4a1",
|
|
"x-mitre-tactic--a5db682a-f248-488f-ba6e-7233f82206ea",
|
|
"x-mitre-tactic--9d14f85f-5b05-4210-bc58-89988839305d",
|
|
"x-mitre-tactic--d292d576-14ed-4061-a551-fb5efd0e3562",
|
|
"x-mitre-tactic--f17e1c66-7c06-47ac-af31-ec31507a50a3",
|
|
"x-mitre-tactic--2c0d561c-0791-4d32-bf3b-43db96e8fee6",
|
|
"x-mitre-tactic--e99560eb-0686-4ab0-b382-bdfaefbbfa0a",
|
|
"x-mitre-tactic--7f52e944-3c82-4820-9eb9-0529ca7814a6",
|
|
"x-mitre-tactic--3b95c4d5-3f0a-4616-be55-170cfb0ce7e4",
|
|
"x-mitre-tactic--cf99f34a-d95b-48a0-9d46-fe920bbb3d30",
|
|
"x-mitre-tactic--407782d0-915e-4d60-911b-12d991b06375",
|
|
"x-mitre-tactic--683505ce-6a91-4c8c-bd0d-1dc046b31a43",
|
|
"x-mitre-tactic--584bd613-05a9-4ac7-9e45-085bd5404935",
|
|
"x-mitre-tactic--20dc8fc1-f9ea-4b3d-8fc7-0121ce4c5077",
|
|
"x-mitre-tactic--80615355-3450-4f18-8de3-3ba289da460d"
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "DISARM",
|
|
"url": "https://github.com/DISARMFoundation",
|
|
"external_id": "DISARM"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|