diff --git a/AGENTS.md b/AGENTS.md index 38918fd..037099d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -226,6 +226,13 @@ ## Navigation and rendering performance +- Explicit user correction 2026-09-26: `Catalog references` starts collapsed for a current client, with a small green dot before its heading and before `Up to date` / `Update successful`. Pending work or a failed check/update opens it automatically and uses an orange heading dot; checking, processing and empty clients never get a green success signal. ATT&CK/D3FEND versions remain visible while collapsed. Keep the success message open after updating and retain manual disclosure and keyboard operation. Center the Timeslots heading and add action on the same horizontal line with equal top/bottom spacing. +- Explicit user extension 2026-09-26: Timeslot entries name Purple Knight scopes explicitly as `Purple Knight for Active Directory`, `Purple Knight for Entra ID`, or the existing combined name. Use canonical scope names first, otherwise already retained file metadata or run/file-local environment observations. Never guess from file names, finding titles, other scans or another scanner. This is a display projection only; stored scanner identity, Result DB disclosure and scoring remain unchanged. A historical scan without retained scope facts keeps its source name until reimport supplies them. + +- Explicit user correction 2026-09-26: `Catalog references` omits its generic explanation paragraph and states the next action plainly: `Please update` for pending work, `Up to date` with `No action needed.` for a current client, and `Update successful` only after successful execution and a fresh status check with no remaining work. Keep ATT&CK and D3FEND catalog versions visible. The action is now named `Update references`; this supersedes the earlier `Recognize references` caption while retaining its left-side placement and red-when-needed/yellow-otherwise color rule. Empty, checking and failure states must not claim success. + +- Explicit user correction 2026-09-26: `Catalog references` belongs in the Data Hub client navigation on the left, directly above `Timeslots`, including while client master data is being edited. The `Recognize references` button is red when recognition is pending or retry is needed, otherwise it uses the standard yellow action treatment. This is an explicit color exception for this reference action; other action and selection colors remain unchanged. Pending references also participate in the client card's processing status (yellow point and highlighted Manage); an actual recognition failure uses the existing red error state. Successful recognition refreshes the card without hiding unrelated import or GPO issues. + - Explicit user correction 2026-09-25: begin preloading Data Hub's six result summaries while the client overview metadata is loading, before a client is selected. Reuse completed and in-flight summaries across selections and Data Hub revisits. Keep speculative requests and retained values bounded, prioritize a selected scope, and key reuse by repository revision plus exact project/assessment/scan scope. Refresh on import/data/GPO changes; stale responses must never overwrite another selection. Load summaries only, not complete source models into the browser. - Treat area switches as a performance-sensitive path. Measure the first visit and repeated visits separately after the workspace has loaded; distinguish main-thread rendering from asynchronous API readiness. Use the local procedure in `docs/architecture/navigation-performance.md`. - Share expensive filtering, sorting and facet counts between their consumers. Component-local `useMemo` does not survive an area unmount. Use bounded, dataset/sheet-owned caches with immutable input identities and all semantic dependencies (profile, dataset, reviews, filters, search, sort and timeslot/path scope); never cache solely by a reusable entity ID. Verify invalidation as well as reuse. diff --git a/docs/IMPLEMENTATION_PLAN.md b/docs/IMPLEMENTATION_PLAN.md index 6461476..c86299e 100644 --- a/docs/IMPLEMENTATION_PLAN.md +++ b/docs/IMPLEMENTATION_PLAN.md @@ -1,7 +1,17 @@ # ASSESSOR – Umsetzungsplan +Referenzerkennung 2026-09-26 (Phase 13D, erster Umfang umgesetzt und verifiziert, Version 2.8.0): ATT&CK/D3FEND werden gemeinsam aus gespeicherten Originalfeldern erkannt und mit Quellen-/Katalogherkunft in eigenen Laeufen gespeichert. Normale Batchimports leiten automatisch ab; bestehende Scans werden ueber `Recognize references` im Clientbereich explizit nachverarbeitet. Pathfinder und Reader nutzen die gespeicherten Referenzen. PostgreSQL-Migration 023 mit vorherigem verifiziertem Backup; keine Client-Datenbanktrennung, Finding-Identitaets-, Scoring- oder Review-Aenderung. Siehe Phase 13D und `docs/REFERENCE_RECOGNITION.md`. + Status: lebendes Projektdokument +2026-09-26 - Phase 6/7 / Scanner-Einstieg im Report, CIS-Abschnitte und Work-Zusammenfuehrung (2.8.6, umgesetzt und verifiziert): Purple-Knight-Scanlaeufe mit Umfangsnamen (`for Active Directory`, `for Entra ID`, kombiniert) loesen ueber deklarierte Profil-`runNames` wieder auf das Purple-Knight-Profil auf; zuvor fielen sie in gemischtem Work auf generic zurueck (kein Problem/Next step, generische Status-, Facetten-, Result-Linker- und Graphlogik). Maester ohne Remediation-/HelpUrl-Feld zeigt den nativen Description-Abschnitt `#### Remediation action:` deklarativ (`firstRead.nextStepSection`) als Next step; der Text davor bleibt Hintergrund, jeder Text erscheint einmal. Eingefuehrte PowerShell-Befehle werden auch nach `script ...:` und bei Beginn mit Variablenzuweisung als Befehlsblock abgesetzt; exportbedingt flachgeklopfte Befehle erhalten nur in der Anzeige Zeilen an eindeutigen Grenzen (Anweisung nach schliessender Klammer, Pipeline), ausschliesslich Leerraum aendert sich. Purple-Knight-`Likelihood of compromise` endet vor dem angehaengten nativen `References`-Abschnitt (`firstRead.impactReferenceMarker`); die Referenztitel erscheinen an der Referenzposition, verlorene Absatzumbrueche werden angezeigt. CIS-Abschnittsnamen stammen ausschliesslich aus der gespeicherten Section-Score-Tabelle des eigenen Scanlaufs: `CIS Category` zeigt Nummer und Namen in numerischer Ordnung; Work-Ueberschriften ersetzen nach Nutzerkorrektur die fuehrende Regelnummer durch den Titel des umgebenden Abschnitts, die Nummer bleibt Source Rule ID, Plaketten zeigen Nummer plus Tooltip; widerspruechliche oder fehlende Titel lassen die Nummer stehen. Ursache fuer im Dummy nicht sichtbare Titel und Referenzen: Die Zusammenfuehrung von All Records mit GPO-Ergebnissen kopierte eine manuelle Feldliste. `withRebuiltLayout` uebernimmt jetzt alle Datensatzmetadaten und ersetzt nur Layoutfelder (id, index, title, fields, filled, meta, sourceFile, sourceSheet, highlighted); ein Schutztest mit synthetischem unbekanntem Zusatzfeld sichert kuenftige Metadaten. Dummy ueber den realen Work-Ladeweg (nur Zaehlungen): 411/411 CIS-Datensaetze mit Titeln und Referenzen, 160/160 benannte CIS-Kategorien, 92/92 getrennte Purple-Knight-Referenzabschnitte. Entscheidung: Patchversion 2.8.6 fuer rueckwaertskompatible Korrekturen und Verfeinerungen ueber gespeicherte Fakten; kein Reimport, keine Schema-, Import-, Scoring- oder Review-Aenderung. Verifikation: synthetische Regressionen fuer die tatsaechlichen Pfade (gemischtes Work mit und ohne GPO, Reader, Facetten, Kacheln, Zusammenfuehrung), Versionsvertragstests, beide Produktionsbuilds; Gesamtsuite 1.608 bestanden, 14 uebersprungen, dieselben sechs vorbestehenden fachfremden Fehler in GPO-/Security-Domain-/Result-DB-/Dashboard-Tests. Risiken/Grenzen: Security-Domain-Zuordnung bleibt stichwortbasiert (gesonderte Entscheidung offen); Pathfinder und Graphansichten zeigen CIS-Titel weiterhin mit Nummer; Purple-Knight-Referenztitel ohne Trennzeichen bleiben ein Textblock. Phasenstatus unveraendert. + +2026-09-26 - Phase 7 / Finding-Reader-Abstaende (2.8.4, umgesetzt und verifiziert): Die gemeinsame Abschnittsregel umfasst jetzt div und section, damit GPO-Quellen und Baseline-Vergleich denselben Tokenabstand verwenden: space-4 (16 px) vor/nach der Trennlinie, space-2 (8 px) zwischen Feldueberschrift und Text. Redundante Abschlusslinien am letzten Quellblock und letzten Reader-Feld entfernt; Problem-/Next-step-Sonderabstaende bleiben erhalten. Synthetischer permanenter Klicktest prueft den gerenderten GPO-Reader vor, nach und nach erneutem Schliessen des Baseline-Disclosures. 44 gezielte Reader-/UI-/API-Versionsvertragstests, beide Produktionsbuilds, Design-/Local-only- und Diffpruefung bestanden. Synthetische Light-/Dark-Sichtpruefung bestaetigt jeweils rund 16 px Abschnittsabstand. Patchversion fuer die gemeinsame Darstellungskorrektur; keine Daten-, Import-, Bewertungs- oder Persistenzaenderung. Risiko: Die gemeinsame Regel wirkt auch auf weitere native Reader-Abschnitte; fokussierte Reader-Regressionen decken die bestehenden Faelle ab. Phasenstatus unveraendert. + +MITRE-Onlineaktualisierung und Originaldownload 2026-09-26 (Phase 7, Nutzererweiterung, umgesetzt und verifiziert): Data Hub bietet `Update from MITRE`, `Download from MITRE` und den weiterhin vorhandenen manuellen `Import JSON file` als Fallback. Update holt das aktuelle offizielle Enterprise-STIX-Bundle serverseitig, prueft Format und Versionsnummer und aktiviert nur eine neuere Version als gemeinsam gespeicherten kompakten Katalog. Die Datei liegt atomar im privaten Artefaktverzeichnis; kein PostgreSQL-Schema und keine Assessment-Daten werden geaendert. Download liefert die unveraenderte originale MITRE-Datei mit Versionsnamen und aktiviert sie nicht. Der App-Start laedt den gemeinsamen Katalog auch bei direktem Pathfinder-Einstieg; ein aktiver Graph aktualisiert sich im aktuellen Browser sofort. Ein lokaler manueller Override bleibt bewusst browserlokal und wird durch einen erfolgreichen Update-Klick im selben Browser entfernt; andere Browser behalten ihren eigenen Override. Entscheidung: rueckwaertskompatible neue Faehigkeit, daher Minorversion 2.7.0. Risiken/Grenzen: Onlineaktionen benoetigen Erreichbarkeit des offiziellen MITRE-GitHub-Repositories; die bereits gebuendelte v19.2 und der manuelle Import bleiben offline verfuegbar. Ein fremder Browser mit lokalem Override sieht die gemeinsame neue Version erst nach dessen Entfernung. Synthetische Service-/HTTP-/UI-Regressionen, 16 fokussierte MITRE-/Versions-/Data-Hub-Tests, Local-only- und Designpruefung sowie beide Produktionsbuilds bestanden. Ein Live-Updateabruf bestaetigte v19.2 als aktuellen Stand (`updated=false`); der Live-Download antwortete mit HTTP 200, Originaldateiname `enterprise-attack-v19.2.json` und 53.835.637 Bytes. App/Backend laufen mit 2.7.0 und dem kanonischen PostgreSQL; Health `ok`, Repository-Revision 496. Die Gesamtsuite meldete vor Korrektur eines neuen Test-API-Mocks 1.550 bestandene, 13 uebersprungene und sieben fehlgeschlagene Tests; der Mock-Test wurde anschliessend fokussiert erfolgreich erneut geprueft. Sechs vorbestehende fachfremde Fehler in GPO-/Security-Domain-/Result-DB-/Dashboard-Tests bleiben. Der dokumentierte Phasenstatus bleibt unveraendert. + +MITRE-ATT&CK-Katalog 2026-09-26 (Phase 7, umgesetzt und verifiziert): Der versionierte Standardkatalog wurde aus MITREs offiziellem Enterprise-STIX-2.1-Bundle v19.2 reproduzierbar erzeugt (15 Taktiken, 697 aktive Techniken, 1.057 aktive Entitaeten). Der Data-Hub-Upload ist wieder sichtbar und akzeptiert offizielles Enterprise-STIX sowie das bisherige kompakte ASSESSOR-JSON; Reset und aktive Versionsanzeige bleiben erhalten. Der geoeffnete Pathfinder uebernimmt Upload und Reset ohne Remount. Die bisherige v18.1-Datei wurde als nicht mehr genutzter Standard entfernt. Entscheidung: rueckwaertskompatible Patchversion 2.6.47, keine Scanner-, API-, Schema-, Datenbank- oder Bestandsdatenmutation. Risiken/Grenzen: Individuelle Matrizen bleiben browserlokale Overrides; ein vorhandener Custom-Stand kann daher weiter aelter als der neue Standard sein, wird aber als `Custom` kenntlich. Im schmalen Codex-Browser war die Karte per Accessibility sichtbar; ein vollbreiter visueller Dark-/Light-Vergleich wurde dort nicht abgenommen. 21 fokussierte MITRE- und UI-/API-Versionsvertragstests, Data-Hub-Layouttest, Design-/Local-only-Pruefung und beide Produktionsbuilds bestanden; laufendes Backend meldet 2.6.47, `ok` und `postgresql`, App HTTP 200. Gesamtsuite: 1.548 bestanden, 13 uebersprungen, sechs fachfremde bestehende Fehler in GPO-/Security-Domain-/Result-DB-/Dashboard-Tests. Der dokumentierte Status von Phase 7 (`abgeschlossen`) bleibt unveraendert; dieser Nachtrag ist separat verifiziert. + Pathfinder-Details-Wertespalte 2026-09-25 (Phase 7, ausdrueckliche Nutzerkorrektur, umgesetzt und verifiziert): Die Faktenzeilen im rechten Detailsbereich nutzten eine automatische Wertespalte, die zusaetzlich auf 66 Prozent ihrer eigenen Breite begrenzt war und Woerter sowie Zahlen mit `overflow-wrap: anywhere` in einzelne Silben beziehungsweise Ziffern zerlegte. Die Werte erhalten jetzt eine feste flexible Spalte mit mehr Platz; mehrteilige Werte brechen nur an Wortgrenzen um, lange ungetrennte technische Kennungen bleiben in ihrem eigenen Bereich horizontal lesbar. Schriftrolle, Quellwerte und semantische Statusfarben bleiben unveraendert. Ein synthetischer Finding-Klicktest prueft die tatsaechlich angewandte Spalten- und Umbruchregel; 14 fokussierte Graph- und UI-/API-Versionsvertragstests, Design-/Local-only-Pruefung und beide Produktionsbuilds bestanden. Backend 2.6.46 am bestehenden kanonischen PostgreSQL gestartet; Health `ok`, App HTTP 200, Repository-Revision 496. Entscheidung: rueckwaertskompatible Patchversion 2.6.46 ohne Daten-, Import-, API-, Schema- oder Persistenzaenderung. Phase 7 bleibt offen. DB-Structure-Einfuehrung entfernt 2026-09-25 (Phase 7, ausdrueckliche Nutzerkorrektur, umgesetzt und verifiziert): Der redundante `Database dictionary`-/`Relational schema`-Textblock oberhalb der Kennzahlen und der erklaerende Satz unter `Data flow` sind entfernt. Schema-Status, `Refresh schema`, Kennzahlen, Ablaufueberschrift, Tabellenbuttons, Popups und Schichtenverzeichnis bleiben erreichbar. Unbenutzte CSS-Regeln fuer beide Texte sind entfallen; die Aktionszeile bleibt am rechten Rand. Der synthetische Klicktest bestaetigt das Fehlen beider Texte bei weiter bedienbarem Refresh-Button und Ablauf; die vorhandenen Popup- und Dictionary-Klickpfade bestehen weiter. 17 fokussierte UI-/API- und Versionsvertragstests, Design-/Local-only-Pruefung sowie beide Produktionsbuilds bestanden. Backend 2.6.45 am bestehenden kanonischen PostgreSQL gestartet; Health `ok`, App HTTP 200, Repository-Revision 496. Entscheidung: rueckwaertskompatible Patchversion 2.6.45 ohne Daten-, Import-, API-, Schema- oder Persistenzaenderung. Phase 7 bleibt offen. @@ -554,6 +564,8 @@ optionaler geschützter Originaldateispeicher Die heutige Tauri-Anwendung bleibt zunächst eine lokale Laufzeitumgebung. Das React-Frontend und die Fachlogik sollen so getrennt werden, dass dieselbe Oberfläche später über ein Backend im normalen Browser betrieben werden kann. +**Zielbild fuer autonome Client-Datenbanken (Nutzerentscheidung 2026-09-26; geplant, nicht umgesetzt):** Im spaeteren Mehrclientbetrieb erhaelt jeder Client eine eigene fachliche PostgreSQL-Datenbank. Das Backend loest den autorisierten Client auf und verwendet ausschliesslich dessen Datenbank und privaten Artefaktspeicher fuer Stammdaten, Timeslots, Scan- und GPO-Quellen, Analysen, Bewertungen, Reviews und Historie. Die Browsergrenze bleibt die Backend-API. Ein zentraler, versionierter Referenzkatalog verwaltet unveraenderliche offizielle MITRE-ATT&CK-Staende und Microsoft Security Baselines; er enthaelt keine Client-Ergebnisse. Die clientgebundene Auswahl und gegebenenfalls clientindividuelle Baselinepakete gehoeren zum Client. Jede Auswertung dokumentiert die exakt verwendeten Referenzversionen und ihren Hash; ein zentrales Update veraendert weder die Auswahl noch historische Ergebnisse stillschweigend. Fuer eine wirklich autarke Sicherung/Wiederherstellung enthaelt das Client-Backup auch die exakten verwendeten Referenzbytes oder unveraenderliche, mitgesicherte Artefakte und alle clientgebundenen Originale. Ein Restore muss ohne Zugriff auf den zentralen Katalog lesbare Historie und reproduzierbare Auswertungsgrundlagen liefern. Allgemeine Update-/Downloadaktionen bleiben in der Referenzverwaltung; der Client-Bereich zeigt und verwaltet seine verwendeten Versionen. Das ist eine Zielentscheidung fuer die spaetere Mandanten-/Betriebsarchitektur (Phase 14 mit Vorarbeiten an Repository-, Referenz- und Artefaktgrenzen aus Phasen 9-11/13B), keine Aussage ueber den aktuellen lokalen Speicher. Die kanonische lokale PostgreSQL-Datenbank und alle bestehenden Daten bleiben bis zu einer gesondert geplanten, gesicherten Migration unveraendert. + ## 5. Statusdefinitionen - `offen`: noch nicht begonnen @@ -583,6 +595,7 @@ Die heutige Tauri-Anwendung bleibt zunächst eine lokale Laufzeitumgebung. Das | 13A | Ingestion 2.0: Formatadapter, Source Extractors und Mappingprofile konsolidieren | abgeschlossen | | 13B | Deterministische GPO-Backup- und Microsoft-Baseline-Analyse | in Arbeit | | 13C | Scanner Context und Environment Inventory | in Arbeit | +| 13D | Referenzerkennung und katalogbasierte Einordnung (ATT&CK/D3FEND erster Umfang) | in Arbeit | | 14 | Mehrbenutzer- und Firmenbetrieb | offen | ## 7. Phasen im Detail @@ -1933,8 +1946,44 @@ Abnahmekriterien: - Betrieb, Wiederherstellung und Update sind dokumentiert und getestet. - Es findet keine Ãœbertragung an externe Dienste statt, sofern dies nicht später ausdrücklich beschlossen wird. +### Phase 13D - Referenzerkennung und katalogbasierte Einordnung + +2026-09-26 - Phase 13D / gemischte Work-Projektion (2.8.5, umgesetzt und verifiziert): Beim Anhaengen von GPO-Ergebnissen an All Records wird referenceRecognition jetzt vom jeweiligen Scannerbefund uebernommen. Zuvor blieben die Referenzlaeufe gespeichert, gingen aber beim Neuaufbau der Reader-Projektion verloren. Die Uebernahme bewahrt Referenzen, Quellenherkunft, Erkennerversion, Lauf und Katalogversion/-hash einschliesslich bewusst leerer Erkennung; GPOs und nicht indexierte Befunde erhalten keine fremden Referenzen. Synthetische Regression oeffnet Referenzdetails im echten FindingReader mit und ohne GPOs. 30 fokussierte Referenz-/GPO-/CIS-Tests und 9 UI-/API-Versionsvertragstests, beide Produktionsbuilds sowie Design-/Local-only- und Diffpruefung bestanden. Patchversion fuer rueckwaertskompatible Projektionskorrektur; keine Datenmutation und kein Reimport bzw. neuer Erkennungslauf erforderlich. Bereits geladene Workspaces muessen neu geladen werden. Phase 13D bleibt in Arbeit. + +Status: in Arbeit (erster Umfang am 2026-09-26 umgesetzt und verifiziert; weitere Frameworks und Folgeetappen offen). + +Ziel: gemeinsame, offline faehige Referenzerkennung aus behaltenen Originalfeldern mit unveraenderlicher Katalog- und Quellenherkunft. Erster Umfang: Enterprise ATT&CK und D3FEND; eigenstaendige Ableitung statt Finding-Identitaet oder Scoring-Eingriff. Einzelheiten und Grenzen: `docs/REFERENCE_RECOGNITION.md`. + +Abnahme erster Umfang: +- [x] Frameworkweite Erkenner fuer IDs und eindeutige exakte Titel; declared/mentioned, unknown/deprecated/revoked getrennt. +- [x] Quelle mit Feld, Position, UTF-16-Offsets, Originaltext, Datei-/Input-/Kataloghash und Erkennerversion behalten. +- [x] Normale Batchimports speichern Ableitung und Kataloge atomar; bestehende Scannerlaeufe koennen pro Client explizit nachverarbeitet werden. +- [x] Append-only Referenzlaeufe und gemeinsame unveraenderliche Kataloge in PostgreSQL/Repository und Projektexport; synthetisch gegen kanonische PostgreSQL verifiziert. +- [x] Pathfinder liest gespeicherte aktive Referenzen; Reader zeigt auch historische/unbekannte Treffer und Provenienz. Keine neue automatische Finding-Korrelation. +- [x] Client-/Server-Produktionsbuilds und Produktversionsvertrag bestanden; beide Themes mit ausschliesslich synthetischen Komponenten bei normaler und 480px Readerbreite geprueft. + +Entscheidungen 2026-09-26: Erkennerversion 1.0.0; gebuendelte Kataloge ATT&CK 19.2 und D3FEND 1.6.0. ATT&CK-Onlineupdate speichert den vollstaendigen Erkennungskatalog mit der Matrix, aendert aber keine frueheren Referenzlaeufe. D3FEND-Laufzeitupdate, weitere Frameworks, technische Identitaetsaufloesung und Korrelationsansicht gehoeren zu spaeteren Etappen. Eine Datenbank pro Client bleibt wie beauftragt ausschliesslich im Zielplan. + +Risiken/Grenzen: Nur behaltene Felder koennen ohne Reimport erkannt werden; mehrdeutige Namen werden nicht geraten. Der historische Text `Account Monitoring` ist kein exakter Eintrag des gebuendelten D3FEND-Technikkatalogs und erzeugt deshalb keine freie Graphrelation mehr; der Originaltext bleibt sichtbar. Die manuelle Browsermatrix ist ein Matrixfallback und waehlt keine serverseitige Erkennungsversion. Sehr grosse Client-Nachverarbeitungen koennen spaeter einen persistierten Hintergrundjob benoetigen. Niedrigstufige Staging-API-Imports erhalten Referenzen ueber die explizite Nachverarbeitung. Details im Funktionsdokument. + +Migration: 023 (021/022 in der kanonischen DB durch Timeslot-/Obligation-Arbeit belegt, unberuehrt). Vorheriger lokaler PostgreSQL-Backup verifiziert (Custom-Dump, TOC lesbar, SHA-256 dokumentiert in `.assessor-data/backups`; keine Kundendaten ausgegeben). Eigene synthetische Testdaten exakt geloescht. + +Versionsentscheidung: neue rueckwaertskompatible Faehigkeit, Minor-Version 2.8.0, Produktversionsvertrag und beide Builds verifiziert; 2.7.0 bleibt als historischer MITRE-Update-Meilenstein dokumentiert. Keine Reimportpflicht fuer vorhandene Felder. + +Nachpruefung 2026-09-26: Der Nutzer sah den Referenzbereich in einer bereits geoeffneten Clientansicht nicht. Frontend auf 5173 und Produktionsbundle auf 4173 enthielten die Funktion; nach Strg+F5 bestaetigte der Nutzer die Sichtbarkeit. Ergaenzter synthetischer Interaktionstest oeffnet den Client ueber Auswahl/Manage, prueft den Bereich unter den Stammdaten und verarbeitet per Button exakt den Client ueber alle Timeslots. Zusammen mit den zwei vorhandenen Referenz-UI-Tests bestanden (3/3). Kein Produktionscode geaendert, daher Version weiterhin 2.8.0. Bestehende Scans wurden bei dieser Pruefung nicht nachverarbeitet. + ## 8. Aktuell empfohlene Umsetzungsetappe +2026-09-26 - Phase 13D / Phase 13C Darstellung (2.8.3, umgesetzt und verifiziert): Catalog references startet bei aktuellem Client eingeklappt; gruen vor Ueberschrift und aktuellem/erfolgreichem Status, orange und automatisch offen bei Handlungsbedarf oder Fehler. Pruefung, Verarbeitung und leere Clients bleiben neutral. Katalogversionen bleiben eingeklappt sichtbar, Erfolg nach Update bleibt offen, manuelles Umschalten funktioniert per Maus und Tastatur. Timeslots-Zeile mit gleichem Abstand oben/unten und gemeinsam zentrierten Controls. Purple-Knight-Timeslots benennen Active Directory, Entra ID oder kombinierten Scope aus bestehenden kanonischen Namen bzw. exakt lauf-/dateigebundenen gespeicherten Metadaten/Umgebungsbeobachtungen. Ohne Scopebeleg bleibt der Originalname; keine Vermutung aus Dateinamen oder fremden Scans, keine Persistenz-/Importer-/Scoringaenderung und keine neue Reimportpflicht. 36 gezielte Interaktions-/Layout-/Versionsvertragstests, beide Produktionsbuilds, Local-only-/Designcheck und synthetische Dark-/Light-Sicht- und Tastaturpruefung bestanden. App und Backend gesund auf 2.8.3 mit kanonischer PostgreSQL. Patchversion fuer zusammengehoerige UI-Korrekturen; Phase 13D bleibt in Arbeit. Die bekannte Gesamtsuite-Baseline mit sechs fachfremden Fehlern wurde nicht erneut ausgefuehrt. + +2026-09-26 - Phase 13D Handlungstexte (2.8.2, umgesetzt und verifiziert): Allgemeiner Erklaerabsatz im linken Catalog-references-Bereich entfernt. Please update benennt Handlungsbedarf, Up to date / No action needed. den aktuellen Stand, Update successful den per erneutem Statusabruf bestaetigten Erfolg. Button heisst Update references; ATT&CK-/D3FEND-Versionen sowie Rot-bei-Bedarf/Gelb-sonst bleiben. Leere Clients, laufende Pruefung und Fehler erhalten eigene Texte; bei verbleibender Arbeit wird kein Erfolg behauptet. 25 gezielte UI-/Versionsvertragstests, beide Produktionsbuilds, Local-only-/Designcheck und synthetische Light-/Dark-Pruefung bestanden. Patchversion fuer reine UI-Korrektur, keine reale Nachverarbeitung oder Persistenzaenderung; Phase 13D bleibt in Arbeit. Die bekannte Gesamtsuite-Baseline mit sechs fachfremden Fehlern wurde fuer diese Textkorrektur nicht erneut ausgefuehrt. + +Nachtrag Phase 13D, 2026-09-26, Version 2.8.1 (Nutzerkorrekturen umgesetzt und verifiziert): Die Clientuebersicht beruecksichtigt jetzt ausstehende Referenzerkennung sowie veraltete Erkenner-/Katalogstaende mit gelbem Statuspunkt und hervorgehobenem Manage, auch ohne Clientauswahl. Echte Erkennungsfehler sind rot; unbekannter Status bleibt als Pruefhinweis sichtbar und bietet einen Status-Retry. Bestehende Import-/GPO-Fehler behalten Vorrang. Statusabrufe laufen unabhaengig von den Uebersichtsdaten mit maximal drei gleichzeitigen Anfragen und ohne neues Polling; Daten-/Import- und erfolgreiche Katalogupdates aktualisieren sie. Ein neuerer Panelstatus gewinnt gegen verspätete Uebersichtsantworten. + +Zusaetzliche explizite Nutzerentscheidung: Catalog references steht links direkt ueber Timeslots, auch bei Stammdatenbearbeitung. Recognize references ist bei Nachverarbeitungs- oder Wiederholungsbedarf rot, sonst standardgelb; dies ist eine begrenzte Ausnahme der allgemeinen Aktionsfarbe. Die linke Quellnavigation bleibt unterhalb des Clientkopfs scrollbar. Nach Erfolg aktualisieren sich Karte und Workspace. Risiken/Grenzen: Ausfuehrungsfehler sind aktueller UI-Zustand; nach erneutem Laden zeigt die persistierte Bereitschaft weiterhin den ausstehenden Lauf, ohne einen gespeicherten Hintergrundjob vorzutäuschen. Keine reale Client-Nachverarbeitung, Migration oder Scoring-/Importsemantikaenderung. + +Verifikation: 25 gezielte Status-/UI-/Readiness-Tests; nach der Platzierungskorrektur 23 UI-/Layout-/Versionsvertragstests bestanden, einschliesslich sieben Tests fuer den Clientstatus und den tatsaechlichen Manage-/Nachverarbeitungs-/Rueckkehrpfad. Vollsuite waehrend dieses Batches: 1582 bestanden, 14 uebersprungen, dieselben sechs bestehenden Fehler in fuenf Dateien. Finale Client-/Serverbuilds, Local-only-, Design- und Diffpruefung bestanden. Synthetische Dark-/Light-Sichtpruefung bestaetigt Statusfarben, linke Platzierung, roten/gelben Button und Scrollbarkeit bei kleiner Fensterhoehe. App/Backend melden 2.8.1, HTTP 200 und kanonische PostgreSQL. Versionsentscheidung: rueckwaertskompatible Korrektur als Patch; Phase 13D bleibt fuer ihren weiteren Umfang offen. + Ergaenzung 2026-09-11 fuer den Timeslotvergleich: Nach dem jetzt dokumentierten Planauftrag beginnt eine spaeter beauftragte Implementierung mit P0/P1 aus [TIMESLOT_COMPARISON_PLAN.md](TIMESLOT_COMPARISON_PLAN.md), danach folgen P2-P6 in Abhaengigkeitsreihenfolge. Zuerst Vergleichsidentitaet und Gegenpruefung absichern, dann offene Verpflichtungen und A/B-Scorebasis, zuletzt die Oberflaeche. Dieser Dokumentationsauftrag startet keine Umsetzung und unterbricht keine unabhaengigen Phase-13B-Arbeiten. Die folgenden aelteren Empfehlungen bleiben als Projektkontext erhalten. Die naechste Umsetzung fuehrt Phase 13B auf dem konsolidierten Import-, Policy-Analyse- und Orchestrierungsunterbau fort: @@ -2328,6 +2377,8 @@ Abnahme 2026-08-23: 677 Standardtests bestanden, 8 optionale PostgreSQL-Integrat ## 10. Offene Entscheidungen +Autonome Client-Datenbanken 2026-09-26: Das Zielbild "eine fachliche Datenbank pro Client" und die autarke Wiederherstellung einschliesslich verwendeter Referenzstaende sind entschieden; Implementierung und Migration sind nicht beauftragt. Vor einer Umsetzung sind Client-Routing und Autorisierung, Ort und Lebenszyklus des zentralen Katalogs, Bindung und Pruefsummen der Referenzartefakte, Backup-/Restore-Paketformat, Lizenz-/Bezugsgrenzen der Microsoft-Pakete, clientindividuelle Overrides, Update-/Rollback-Ablauf und Migration des bestehenden kanonischen Bestands zu spezifizieren und mit synthetischen Isolation-, Historien- und Offline-Restore-Tests abzusichern. Die genaue SSO-, Rollen- und Betriebsplattform bleibt offen. + Bericht A/B 2026-09-23: Die Nutzeranforderung beauftragt die HTML-Erzeugung direkt aus Client Info und ordnet die UI-Anbindung Phase 7 zu. Die veroeffentlichten Report-Inhalte bleiben durch `docs/REPORT_STRATEGY.md` gebunden. Offen ist die endgueltige Vollstaendigkeitsabnahme des Technical Reports ueber alle Quellformate und Reimport-/Diagnostic-Klassen; sie wird nicht aus dem Vorhandensein des Buttons abgeleitet. Timeslotvergleich 2026-09-11: P0/P1 muessen pro Scanner/Format/GPO die belastbaren Objekt-/Scopefelder, Vergleichsgranularitaet und Negativnachweisfaehigkeit sowie die konkrete Reimportbetroffenheit bestimmen. Speicher-/API-Vertrag und Uebergang fuer offene Verpflichtungen und auditierte Scopeentscheidungen sind vor Migration festzulegen. Native Teilpopulationen duerfen nur mit separat belegten Beitraegen verglichen werden; ein zusaetzlicher risikogewichteter Expositionsindex ist nicht freigegeben. Siehe Detailentscheidungen in [TIMESLOT_COMPARISON_PLAN.md](TIMESLOT_COMPARISON_PLAN.md). @@ -2345,7 +2396,7 @@ Festgelegte Fachentscheidung vom 2026-09-06: Ein GPO-Benchmark darf nur dann `Pa - Bezugs-, Lizenz- und Freigabeverfahren für versionierte Microsoft-Baselines und ADMX-/ADML-Metadatenkataloge - optionaler Import von `Get-GPOReport`-, Group-Policy-Results-, `gpresult`- oder anderer RSoP-Evidenz in einer späteren Ausbaustufe - genaue SSO-Integration im Unternehmensnetz -- Rollen- und Mandantenmodell +- SSO-gebundene Rollen, Berechtigungen und Client-Routing innerhalb des entschiedenen Eine-Datenbank-pro-Client-Zielbilds - Aufbewahrungs- und Löschfristen - betriebliche Anpassung der festgelegten Importgrenzen an die Firmeninfrastruktur - Umgang mit manuell bestätigten Mappings zwischen Projekten @@ -2355,6 +2406,8 @@ Diese Entscheidungen werden erst getroffen, wenn die jeweilige Phase ansteht ode ## 11. Risiken +- 2026-09-26, autonome Client-Datenbanken: Eine getrennte Datenbank allein garantiert keine Autarkie, wenn Baseline-/MITRE-Versionen oder GPO-/Baseline-Originale nur zentral verfuegbar sind. Backup, Restore und Loeschung muessen Datenbank und private Artefakte gemeinsam behandeln. Zentrale Referenzupdates duerfen historische Urteile nicht still neu berechnen und ein Clientwechsel darf keine Datenbank oder Artefakte eines anderen Clients erreichen. Die bisher globale Baseline-Liste und der serverweite MITRE-Katalog sind noch nicht clientgebunden; ihre blosse Verschiebung in der UI waere keine Isolation. Ein Migrationskonzept mit verifiziertem Backup ist vor jeder Bestandsaenderung erforderlich. Diese Risiken sind als Planungsaufgaben offen; keine Implementierung oder Abnahme wird behauptet. + - 2026-09-23, HTML-Reports: Die Management-Datei darf keine internen Source-IDs, Assets oder technischen Rohwerte enthalten, auch wenn beide Renderings dieselbe interne Projektion nutzen. Separate Dateien und ein synthetischer Leckagetest sichern die Grenze. Der Technical Report kann nur gespeicherte Originalfelder und GPO-Anweisungen zeigen; fehlende Ist-/Sollstruktur, Source-Evidence oder Parserdiagnose wird nicht erfunden. Ein umfassender Vollstaendigkeits- und Theme-Test im freigegebenen Dummy ist noch offen; bis dahin gilt die A/B-Abnahme nicht als abgeschlossen. - 2026-09-23, Environment-Unterabschnitte: Ein generischer Tabellenname und eine darueber stehende Abschnittsueberschrift beweisen nicht dieselbe fachliche Gruppe. Nur ein eindeutiger, exakt quellengebundener Unterabschnitt benennt die Tabelle neu; bei Konflikten bleibt ihr nativer Name stehen. Eine aus dem ersten Unterabschnitt uebernommene breite Abschnittsbeschriftung darf nicht andere Tabellen falsch vereinnahmen. Die synthetischen Regressionen sichern den Klickpfad, Dateiscope und Konfliktfall; realer Kundenscope wurde nicht gelesen. Schmale Fenster behalten interne horizontale Tabellenbewegung ohne Abschneiden von Spalten. @@ -2675,6 +2728,22 @@ Festgelegtes Betriebsrisiko vom 2026-09-06: Verzeichnisabhaengige Compose-Projek ## 12. Änderungsprotokoll +2026-09-26 - Phase 6/7 / Scanner-Einstieg, CIS-Abschnitte, Work-Zusammenfuehrung (2.8.6, umgesetzt und verifiziert): Purple-Knight-Umfangsnamen loesen ueber Profil-`runNames` auf; Maester-Abschnitt `Remediation action` als Next step; PowerShell-Skripte nach `script ...:` bzw. mit Variablenzuweisung als Befehlsblock mit Anzeige-Zeilenumbruechen; Purple-Knight-Likelihood ohne angehaengte Referenzen; CIS-Abschnittsnamen aus dem eigenen Scanlauf in `CIS Category`, Work-Ueberschriften und Plaketten-Tooltips; `withRebuiltLayout` erhaelt beim GPO-Anhang alle Datensatzmetadaten. Patchversion, kein Reimport; Details im Statusnachtrag oben. + +2026-09-26 - Phase 13D / gemischte Work-Projektion (2.8.5, umgesetzt und verifiziert): Beim Anhaengen von GPO-Ergebnissen an All Records wird referenceRecognition jetzt vom jeweiligen Scannerbefund uebernommen. Zuvor blieben die Referenzlaeufe gespeichert, gingen aber beim Neuaufbau der Reader-Projektion verloren. Die Uebernahme bewahrt Referenzen, Quellenherkunft, Erkennerversion, Lauf und Katalogversion/-hash einschliesslich bewusst leerer Erkennung; GPOs und nicht indexierte Befunde erhalten keine fremden Referenzen. Synthetische Regression oeffnet Referenzdetails im echten FindingReader mit und ohne GPOs. 30 fokussierte Referenz-/GPO-/CIS-Tests und 9 UI-/API-Versionsvertragstests, beide Produktionsbuilds sowie Design-/Local-only- und Diffpruefung bestanden. Patchversion fuer rueckwaertskompatible Projektionskorrektur; keine Datenmutation und kein Reimport bzw. neuer Erkennungslauf erforderlich. Bereits geladene Workspaces muessen neu geladen werden. Phase 13D bleibt in Arbeit. + +2026-09-26 - Phase 7 / Finding-Reader-Abstaende (2.8.4, umgesetzt und verifiziert): Die gemeinsame Abschnittsregel umfasst jetzt div und section, damit GPO-Quellen und Baseline-Vergleich denselben Tokenabstand verwenden: space-4 (16 px) vor/nach der Trennlinie, space-2 (8 px) zwischen Feldueberschrift und Text. Redundante Abschlusslinien am letzten Quellblock und letzten Reader-Feld entfernt; Problem-/Next-step-Sonderabstaende bleiben erhalten. Synthetischer permanenter Klicktest prueft den gerenderten GPO-Reader vor, nach und nach erneutem Schliessen des Baseline-Disclosures. 44 gezielte Reader-/UI-/API-Versionsvertragstests, beide Produktionsbuilds, Design-/Local-only- und Diffpruefung bestanden. Synthetische Light-/Dark-Sichtpruefung bestaetigt jeweils rund 16 px Abschnittsabstand. Patchversion fuer die gemeinsame Darstellungskorrektur; keine Daten-, Import-, Bewertungs- oder Persistenzaenderung. Risiko: Die gemeinsame Regel wirkt auch auf weitere native Reader-Abschnitte; fokussierte Reader-Regressionen decken die bestehenden Faelle ab. Phasenstatus unveraendert. + +2026-09-26 - Phase 13D / Phase 13C Darstellung (2.8.3, umgesetzt und verifiziert): Catalog references startet bei aktuellem Client eingeklappt; gruen vor Ueberschrift und aktuellem/erfolgreichem Status, orange und automatisch offen bei Handlungsbedarf oder Fehler. Pruefung, Verarbeitung und leere Clients bleiben neutral. Katalogversionen bleiben eingeklappt sichtbar, Erfolg nach Update bleibt offen, manuelles Umschalten funktioniert per Maus und Tastatur. Timeslots-Zeile mit gleichem Abstand oben/unten und gemeinsam zentrierten Controls. Purple-Knight-Timeslots benennen Active Directory, Entra ID oder kombinierten Scope aus bestehenden kanonischen Namen bzw. exakt lauf-/dateigebundenen gespeicherten Metadaten/Umgebungsbeobachtungen. Ohne Scopebeleg bleibt der Originalname; keine Vermutung aus Dateinamen oder fremden Scans, keine Persistenz-/Importer-/Scoringaenderung und keine neue Reimportpflicht. 36 gezielte Interaktions-/Layout-/Versionsvertragstests, beide Produktionsbuilds, Local-only-/Designcheck und synthetische Dark-/Light-Sicht- und Tastaturpruefung bestanden. App und Backend gesund auf 2.8.3 mit kanonischer PostgreSQL. Patchversion fuer zusammengehoerige UI-Korrekturen; Phase 13D bleibt in Arbeit. Die bekannte Gesamtsuite-Baseline mit sechs fachfremden Fehlern wurde nicht erneut ausgefuehrt. + +2026-09-26 - Phase 13D Handlungstexte (2.8.2, umgesetzt und verifiziert): Allgemeiner Erklaerabsatz im linken Catalog-references-Bereich entfernt. Please update benennt Handlungsbedarf, Up to date / No action needed. den aktuellen Stand, Update successful den per erneutem Statusabruf bestaetigten Erfolg. Button heisst Update references; ATT&CK-/D3FEND-Versionen sowie Rot-bei-Bedarf/Gelb-sonst bleiben. Leere Clients, laufende Pruefung und Fehler erhalten eigene Texte; bei verbleibender Arbeit wird kein Erfolg behauptet. 25 gezielte UI-/Versionsvertragstests, beide Produktionsbuilds, Local-only-/Designcheck und synthetische Light-/Dark-Pruefung bestanden. Patchversion fuer reine UI-Korrektur, keine reale Nachverarbeitung oder Persistenzaenderung; Phase 13D bleibt in Arbeit. Die bekannte Gesamtsuite-Baseline mit sechs fachfremden Fehlern wurde fuer diese Textkorrektur nicht erneut ausgefuehrt. + +2026-09-26 - Phase 13D Status-/Bedienkorrektur (2.8.1): Referenzbereitschaft in Client-Punkt/Manage aufgenommen, asynchron begrenzt geladen und nach Katalog-/Datenupdates sowie Nachverarbeitung aktualisiert. Catalog references auf Nutzerwunsch links ueber Timeslots; Aktionsbutton rot bei Bedarf, sonst gelb. Synthetische Klickpfade, beide Themes und finales Buildpaar verifiziert; bekannte sechs Gesamtsuitefehler unveraendert. Keine echte Client-Nachverarbeitung. Siehe Nachtrag in Abschnitt 8. + +2026-09-26 - Phase 13D erster Umfang (2.8.0): ATT&CK 19.2/D3FEND 1.6.0, versionierter frameworkweiter Erkenner, append-only PostgreSQL-Referenzlaeufe und immutable Katalog-Snapshots samt Export, atomare Ableitung im normalen Batchimport, explizite Client-Nachverarbeitung, Pathfinder-/Reader-Anbindung. Migration 023 nach verifiziertem Backup. Historischer Projektexport ergaenzt auch ersetzte Scannerlaeufe und deren Originalfelder, damit alte Referenzlaeufe keine verwaisten Quellen erhalten; durch synthetischen Scanersatz gegen PostgreSQL verifiziert. 48 fokussierte Tests und separat PostgreSQL-Pruefung bestanden; anschliessende Versions-/API-/Reader-Verifikation ebenfalls bestanden. Gesamtsuite: 1569 bestanden, 14 uebersprungen, dieselben 6 vorherigen Fehlschlaege in 5 Dateien (GPO-Evaluation-Visibility 2, Security-Domain-Interaktion 1, AppLocker-HTML-Pruefung 1, Result-DB-Scope-Quelltextpruefung 1, Dashboard-Cache-Quelltextpruefung 1). Keine neu aufgetretenen Testfehler. Client-/Serverbuild, Local-only- und Designcheck bestanden; synthetische Light-/Dark-Sichtpruefung. Bestehende Kundenscans nicht automatisch nachverarbeitet. App/Backend wieder auf 5173/4173 mit kanonischer PostgreSQL gestartet. Die weitergehende Phase 13D und die geplante Client-Datenbanktrennung bleiben offen. + +2026-09-26: Nutzerentscheidung fuer das spaetere Zielbild autonomer Client-Datenbanken aufgenommen. Zentrale, unveraenderlich versionierte MITRE-/Microsoft-Referenzkataloge bleiben von clientgebundener Auswahl und Auswertung getrennt; verwendete Referenzbytes gehoeren zur autarken Client-Sicherung. Phase 14 mit Vorarbeiten an Repository-/Artefaktgrenzen, offene Detailentscheidungen und Risiken dokumentiert. Reine Planfortschreibung: keine Anwendungsaenderung, Datenbank-/Schema-/Artefaktmigration, Tests oder Produktversionsaenderung; bestehender Phasenstatus bleibt unveraendert. + 2026-09-23: Client Info erhielt Management Report und Technical Report als getrennte HTML-Downloadaktionen. Beide lesen den ausgewaehlten Timeslot vollstaendig ueber die API und ignorieren den momentanen Source-Filter. Report-Projektion 1.1.0 traegt interne technische Fakten nur fuer den Technical-Cut; der Management-Renderer gibt keine Assets aus. Der neue Technical-Renderer listet gespeicherte Originalfelder, GPO-Quellanweisungen, Ist-/Sollwerte, Provenienz, Inventory, Diagnostics und Result-Index; belegte Felddifferenzen bleiben feldspezifisch. Synthetische Klickpfad-/Renderer-Regressionen und beide Produktionsbuilds bestanden; Vollstaendigkeits-/Theme-Abnahme bleibt offen. Kein Kundendatenzugriff oder Bestandsmutation. Minorversion 2.6.0. 2026-09-23: Environment-Results-Tabellenkoepfe berichtigt (Phase 7/13C). Eindeutige Quell-Unterabschnittslabels werden tabellengenau aus behaltenen Beobachtungen derselben Lauf-/Datei-/Abschnittsidentitaet gelesen. `Honey Pot` steht nicht mehr als Sammelueberschrift ueber `Account analysis`; generische `Tabelle n`- und sichtbare `Source table index`-Zeilen entfallen. Zweispaltige Label-Wert-Metadaten und horizontal zusammenbleibende native Kopf-/Datenzellen verbessern die schmale Ansicht. 32 fokussierte synthetische Tests sowie beide Produktionsbuilds, Local-only- und Designcheck bestanden; keine Bestandsmutation oder Kundeninspektion. Patchversion 2.5.15. @@ -2798,6 +2867,8 @@ Verifiziert 2026-09-09 (Phase 7): Bereichswechsel beschleunigt und Performance-V Verifiziert 2026-09-08 (Phase 7/13B): GPO-Quellenkorrektur fuer Work und Client Info. Aktuelle Evaluationen aus dem vorhandenen autoritativen Readmodell statt ergebnisabhaengiger Backupgruppierung; Import- und Auswertungszeit getrennt, Source-Scan-Provenienz auch auf GPO-only-Blaettern. 1.014 Tests bestanden, acht optionale PostgreSQL-Tests uebersprungen; Local-only-/Designpruefung und beide Builds erfolgreich. Dummy lesend bestaetigt: eine statt drei GPO-Quellenoptionen, 3.805 aktuelle Zeilen, elf historische Evaluationen unveraendert. Keine Persistenzmutation oder Neuanalyse. | Datum | Änderung | +| 2026-09-26 | Phase 7: MITRE-Onlineaktualisierung aus offizieller Enterprise-STIX-Quelle, separater Download der originalen MITRE-Datei und weiterhin manueller JSON-Import. Gemeinsam gespeicherter privater Katalog, sofortige Graphaktualisierung, Same-Origin-API; keine Assessment-/DB-Migration. Minorversion 2.7.0; synthetische Service-/HTTP-/UI-Tests, Live-Update und Originaldownload, Design-/Local-only-Pruefung sowie beide Builds verifiziert. Sechs vorbestehende fachfremde Tests bleiben offen. | +| 2026-09-26 | Phase 7: MITRE-Standardkatalog v19.2 aus offiziellem STIX, sichtbarer STIX-/JSON-Upload im Data Hub und sofortige Pathfinder-Aktualisierung bei Upload/Reset. Reproduzierbare Quelle und Browser-Override-Grenze in `docs/MITRE_CATALOG.md`; Patchversion 2.6.47. 21 fokussierte Tests, Data-Hub-Layouttest, Design-/Local-only-Pruefung und beide Builds bestanden; Gesamtsuite mit sechs fachfremden bestehenden Fehlern. | | 2026-09-25 | Phase 7: Pathfinder-Detailswerte erhalten eine breite flexible Spalte ohne erzwungene Wort- und Ziffernumbrueche; lange technische IDs bleiben innerhalb ihres Bereichs scrollbar. 14 fokussierte Tests, Design-/Local-only-Pruefung und beide Builds bestanden; Patchversion 2.6.46 am kanonischen PostgreSQL bereitgestellt. | | 2026-09-25 | Phase 7: Redundanten DB-Structure-Einfuehrungsblock und den Erklaersatz unter `Data flow` entfernt. Schemaaktion, Kennzahlen, Ablauf und Popups bleiben erhalten. 17 fokussierte Tests, Design-/Local-only-Pruefung und beide Builds bestanden; Patchversion 2.6.45 am kanonischen PostgreSQL bereitgestellt. | | 2026-09-25 | Phase 7: DB-Structure-Datenflussbuttons oeffnen die ausgewaehlte Tabelle wieder im gemeinsamen Popup statt inline. Referenzierende Tabellen sind im Fenster navigierbar; Escape schliesst es. 16 fokussierte Tests, Design-/Local-only-Pruefung und beide Builds bestanden; Patchversion 2.6.44 am kanonischen PostgreSQL bereitgestellt. | diff --git a/docs/MITRE_CATALOG.md b/docs/MITRE_CATALOG.md new file mode 100644 index 0000000..4957ba2 --- /dev/null +++ b/docs/MITRE_CATALOG.md @@ -0,0 +1,27 @@ +# Enterprise ATT&CK catalog in ASSESSOR + +Pathfinder uses the compact, versioned default catalog at `src/assets/data/mitre-enterprise-v19.2.json`. It was generated from MITRE's official Enterprise ATT&CK STIX 2.1 bundle: + +- Source: https://github.com/mitre-attack/attack-stix-data/blob/master/enterprise-attack/enterprise-attack-19.2.json +- Source SHA-256: `DC1639CAA5501D720E280CF1CBD8FBE009884A0C9B3E6E9ED9D0C25166C3D8F4` +- Collection version: 19.2; 15 active tactics, 697 active techniques and subtechniques, 1,057 active groups, campaigns and software entries. + +To refresh the repo asset, download a **version-pinned** official Enterprise STIX bundle and run `node --experimental-strip-types scripts/update-mitre-asset.mts `. Review the generated version, counts and graph tests before changing the default import. The converter follows the STIX matrix tactic order and omits revoked or deprecated objects and relationships. + +The Data Hub has three actions: + +- **Update from MITRE** fetches the official latest Enterprise STIX bundle from MITRE's `attack-stix-data` repository, validates and converts it, and activates it only when its collection version is newer than the active shared catalog. The compact result is saved atomically at `/reference-data/mitre-enterprise.json`, outside the public web root. The backend serves that catalog after restart, and Pathfinder receives an immediate update event in the current browser. The browser's custom override is cleared after a successful update check. +- **Download from MITRE** fetches the original latest Enterprise STIX JSON from that same MITRE source and offers it as `enterprise-attack-v.json`. Downloading does not activate or persist it. The backend proxy keeps the browser same-origin and validates the source before sending it. The source is capped at 80 MiB and the request times out after 120 seconds. +- **Import JSON file** is the manual fallback. It accepts an official Enterprise STIX bundle or the compact ASSESSOR JSON format. A custom matrix is stored in browser `localStorage`, overrides the shared catalog only in that browser, and is shown as `Custom v`. **Use active catalog** removes this override. The open Pathfinder graph updates after either action. + +The shared catalog is read through `GET /api/v1/reference-data/mitre-attack`; the guarded `POST /api/v1/reference-data/mitre-attack/refresh` updates it, and `GET /api/v1/reference-data/mitre-attack/source` sends the latest validated original file. No PostgreSQL schema or existing assessment data is changed. MITRE availability is required for update and download; the bundled v19.2 catalog and manual import remain available offline. A shared catalog update does not remove another browser's deliberate local override. + +## Reference recognition (2.8.0) + +ATT&CK updates now also retain the complete versioned recognition catalog, including +historical entries, alongside the active graph in the same atomic file. Stored scanner +reference runs remain frozen until the explicit client action **Recognize references**. +The bundled D3FEND catalog and reference storage are documented in +`docs/REFERENCE_RECOGNITION.md`. Migration 023 adds this independent derived storage; +the update/download buttons themselves do not rewrite assessment data. Manual browser +matrix overrides remain graph fallbacks and do not select backend recognition catalogs. diff --git a/docs/REFERENCE_RECOGNITION.md b/docs/REFERENCE_RECOGNITION.md new file mode 100644 index 0000000..6fbcd75 --- /dev/null +++ b/docs/REFERENCE_RECOGNITION.md @@ -0,0 +1,133 @@ +# Phase 13D: ATT&CK and D3FEND references + +## Scope and semantics + +The initial implementation recognizes Enterprise ATT&CK technique/sub-technique IDs, +tactic IDs and unambiguous exact catalog titles, plus D3FEND defensive-technique IDs +and unambiguous exact titles. It processes retained `OriginalField` values using one +framework-specific engine, independently of the scanner. A framework-named header +declares its context; IDs in other fields are merely **mentioned**. Titles are only +matched in declared context. Whitespace and case normalization is allowed; fuzzy +matching, translations and LLM classification are not. + +`active`, `deprecated`, `revoked` and `not-in-catalog` describe the lookup result. +An unknown ID is not claimed to be invalid. Placeholder text creates no reference. +An ambiguous title (for example PowerShell in current and historical ATT&CK entries) +does not select either ID. Unmatched original content remains available in the source +fields. No ATT&CK-to-D3FEND defensive inference or automatic correlation is performed. + +The derived references never enter `FindingDefinition.frameworkReferences`, the +comparison identity engine, source guidance, severity, verdict, score, Security Domain, +review state or the external Result DB disclosure. Existing report-correlation semantics +remain separate. A shared reference describes a shared topic, not a proven common cause. + +## Catalogs and reproducibility + +- `attack-reference-v19.2.json`: 873 technique/tactic entries, including historical + deprecated and revoked entries. Source: MITRE's version-pinned Enterprise STIX 19.2. +- `d3fend-reference-v1.6.0.json`: 272 defensive technique entries (`D3-…`). + Source: . + D3A/D3E entities and inferred cross-framework relationships are outside this slice. +- Each asset contains its original download URL, source SHA-256 and MITRE copyright/ + license notice. Snapshot SHA-256 covers the complete canonical JSON catalog used by + recognition, including entries, version, provenance and notice. +- `scripts/update-reference-assets.mts` regenerates the compact assets from official + source files. Recognition and reprocessing require no external network. +- The existing **Update from MITRE** downloads ATT&CK and atomically stores both its + graph and complete recognition catalog. An equal-version refresh can fill in missing + recognition metadata from an older ASSESSOR installation. A central update makes a + new catalog available; it does not silently replace previous reference runs. +- D3FEND is bundled at 1.6.0 in this initial release; no D3FEND runtime update UI has + been added. **Download from MITRE** and manual **Import JSON file** remain ATT&CK + matrix actions. The manual browser override affects the displayed matrix and transient + previews; stored recognition always uses the backend's versioned catalogs. + +## Storage and execution + +Migration `023_reference_recognition` adds immutable public `assessor_reference_catalogs`, +append-only client/assessment/scan-bound `assessor_reference_runs` and their catalog +membership table. 021/022 are already reserved in the canonical local datastore by +timeslot-comparison and obligation work; those migrations are not modified here. +No separate client databases are created in this phase. + +The normal browser batch-import transaction includes its reference run and catalog +snapshots. A recognition failure therefore rolls back the batch instead of reporting a +partially completed import. The low-level staging API and pre-existing scans can be +indexed with the explicit client action below; the UI never silently fabricates a stored +run for them. + +**Data Hub → client → Catalog references → Update references** processes all current +scanner runs in that client across its timeslots, from their retained fields. The button +shows available catalog versions and pending scan count. Its guarded endpoint is +`POST /api/v1/projects/:projectId/references/recognize`; status is available through +`GET /api/v1/projects/:projectId/references`. Concurrent requests for one client share +one job; unchanged input, catalogs and recognizer version are idempotent and do not +bump repository revision. Individual scans are committed atomically; after interruption, +retry skips scans already completed. This initial synchronous route is not a background +job scheduler; very large clients can require a later queued implementation. + +Each result retains occurrence and file identity, source file hash if available, source +position, field key/label/path, JSON value pointer, exact matched substring and offsets. +Offsets are zero-based UTF-16 indices into the retained `rawValue`, when present, or the +individual string leaf of `value`; the end is exclusive. Each run retains recognizer +version, timestamp, source-input hash and exact catalog hashes. Older runs remain +exportable. Project export includes every referenced compact catalog snapshot, allowing +reference history to be read without the central catalog. Original full STIX/JSON-LD +downloads are not needed to replay recognition against these exact compact inputs. + +## Presentation and boundaries + +The Data Hub client overview includes reference readiness across every current timeslot. +Pending recognition or an outdated recognizer/catalog produces the existing yellow +update point and highlighted **Manage**, including before selecting the client. An +unavailable status remains a review notice; checking is neutral and never claims readiness. +An actual recognition failure is red. Existing scanner/GPO failures retain priority. +Status summaries load separately from overview metadata with at most three concurrent +requests, refresh on import/data changes and successful catalog updates, and reject stale +responses after a newer panel result. There is no added polling or persistent job state. + +**Catalog references** is in the left client navigation immediately above **Timeslots**, +including while editing client master data. By explicit user decision on 2026-09-26, +**Update references** is red when work or retry is needed and yellow otherwise. +The generic explanation is omitted. The first line says **Please update**, **Up to date** +with **No action needed.**, or **Update successful** after execution and a fresh status +check confirms no remaining work. ATT&CK and D3FEND versions stay visible. Empty clients, +loading and failures use explicit separate messages and never claim success. +The section starts collapsed for a current client and opens automatically for pending +work or a failed status/update. Small green dots precede the heading and confirmed +current/success state; required action uses orange and unknown/empty/processing states +stay neutral. Catalog versions remain outside the disclosure and visible while collapsed. +After updating, the success message remains open; manual and keyboard toggling is retained. +Successful recognition updates the client card and its loaded workspace. A failed status +request offers **Retry status**. The navigation scrolls as one area below the client header +so the added controls do not make timeslots inaccessible on short screens. + +Pathfinder consumes persisted active references and frozen tactic membership, with +declared ATT&CK mapped as native and mentioned ATT&CK mapped as derived. Unknown, +revoked and deprecated matches are visible in the Finding Reader but do not form active +graph relations. Unindexed stored occurrences remain unmapped until explicitly indexed. +Transient, unsaved previews use the same pure recognizer with their selected matrix. +Original raw references remain readable. The Finding Reader adds a provenance disclosure +after explanatory content; its Problem/Next step, Results and work tracking are unchanged. + +Broader 13D work (other frameworks, profile-declared ambiguous contexts, standalone +reference search/filtering, technical identity resolution, correlation UI, catalog-version +selection and per-client database migration) remains planned separately. + +## Verification + +Synthetic domain, full batch HTTP import, client-button/Reader interaction and Pathfinder +tests cover declared/mentioned evidence, unknown IDs, exact offsets, nested values, +historical/ambiguous entries, client isolation, idempotence, source immutability and +catalog updates without retrospective changes. The opt-in PostgreSQL test uses only +generated synthetic IDs in the canonical datastore and deletes that exact test project. +No tenant report contents are inspected. + +Verified release: **2.8.0**. Both production builds, UI/API version contract, local-only +and design checks pass. Synthetic Light/Dark checks include a 480px Reader. The full +suite has 1,569 passing and 14 skipped tests, with six pre-existing failures across +GPO evaluation visibility (2), Security Domain navigation (1), AppLocker markup (1), +Result DB scope source-text expectations (1) and dashboard cache source-text expectations +(1). Their root causes are not all resolved by this separate reference implementation. +The PostgreSQL integration check additionally verifies source-complete history export +after a synthetic scan replacement. No existing customer scans were reprocessed. diff --git a/docs/REIMPORT_POLICY.md b/docs/REIMPORT_POLICY.md index a634be6..53b0d83 100644 --- a/docs/REIMPORT_POLICY.md +++ b/docs/REIMPORT_POLICY.md @@ -67,3 +67,12 @@ Structured Accepted Risk decisions retain every original revision and its target When a match is absent or ambiguous, the old review remains on the retained previous scan. The replacement records an unresolved count and Data Hub shows a persistent review-required state. The reimport is still auditable and does not silently discard or guess customer data. Both direct reimport and adoption of an already imported byte-identical replacement execute review transfer and scan supersession in the same repository transaction. The exact source SHA-256 multiset, assessment, and scanner must match before replacement is accepted. +# Reference derivation (Phase 13D, 2026-09-26) + +ATT&CK/D3FEND recognition is an independent, versioned derivation over retained original +fields. It never alters canonical Finding identity, scanner outcome, source mapping or +reviews. Catalog or recognizer changes therefore use **Recognize references** in the +client's Data Hub and append a new derivation; they do not require reuploading source +files. Historical reference runs and their exact catalog snapshots remain retained. +If an extractor never retained a required source field, recognition cannot recover it; +the existing extractor-version/reimport policy still applies in that case. diff --git a/package-lock.json b/package-lock.json index 5014c59..cd5a3e2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "assessor", - "version": "2.6.46", + "version": "2.8.6", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "assessor", - "version": "2.6.46", + "version": "2.8.6", "dependencies": { "@fontsource-variable/inter": "^5.3.0", "jsdom": "^29.1.1", diff --git a/package.json b/package.json index d96562a..23f3265 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "assessor", - "version": "2.6.46", + "version": "2.8.6", "private": true, "type": "module", "scripts": { diff --git a/scripts/update-mitre-asset.mts b/scripts/update-mitre-asset.mts new file mode 100644 index 0000000..39e26cb --- /dev/null +++ b/scripts/update-mitre-asset.mts @@ -0,0 +1,10 @@ +import { readFile, writeFile } from 'node:fs/promises'; +import { resolve } from 'node:path'; +import { convertEnterpriseStix } from '../src/features/mitre-graph/mitre-stix.ts'; + +const input = process.argv[2]; +if (!input) throw new Error('Usage: node --experimental-strip-types scripts/update-mitre-asset.mts '); +const graph = convertEnterpriseStix(JSON.parse(await readFile(input, 'utf8'))); +const output = resolve(`src/assets/data/mitre-enterprise-v${graph.version}.json`); +await writeFile(output, JSON.stringify(graph) + '\n'); +console.log(`${output}: ${graph.tacticOrder.length} tactics, ${graph.techniques.length} techniques, ${graph.entities.length} entities`); diff --git a/scripts/update-reference-assets.mts b/scripts/update-reference-assets.mts new file mode 100644 index 0000000..1aa5d4a --- /dev/null +++ b/scripts/update-reference-assets.mts @@ -0,0 +1,15 @@ +import { readFile, writeFile } from 'node:fs/promises'; +import { createHash } from 'node:crypto'; +import { attackReferenceCatalog, d3fendReferenceCatalog } from '../src/references/catalog-converters.ts'; +const [attackPath, d3fendPath] = process.argv.slice(2); +if (!attackPath || !d3fendPath) throw new Error('Usage: node --experimental-strip-types scripts/update-reference-assets.mts '); +for (const [path, convert, sourceUrl, name] of [ + [attackPath, attackReferenceCatalog, 'https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack-19.2.json', 'attack-reference'], + [d3fendPath, d3fendReferenceCatalog, 'https://d3fend.mitre.org/ontologies/d3fend/1.6.0/d3fend.json', 'd3fend-reference'] +] as const) { + const bytes = await readFile(path); + const catalog = convert(JSON.parse(bytes.toString('utf8')), sourceUrl, createHash('sha256').update(bytes).digest('hex')); + const output = `src/assets/data/${name}-v${catalog.version}.json`; + await writeFile(output, JSON.stringify(catalog) + '\n'); + console.log(`${output}: ${catalog.entries.length} entries`); +} diff --git a/server/assessor-http-server.ts b/server/assessor-http-server.ts index a98bc5b..d37ea51 100644 --- a/server/assessor-http-server.ts +++ b/server/assessor-http-server.ts @@ -30,6 +30,8 @@ import type { GpoAutomaticAnalysisService } from './gpo/gpo-automatic-analysis-s import type { MicrosoftSecurityBaselineSelectionContext } from '../src/domain/microsoft-security-baseline'; import { listProjectGpoBackupStatus } from './gpo/gpo-backup-status-service'; import type { BackendArtifactStore } from './artifacts/backend-artifact-store'; +import { MitreCatalogError, type MitreCatalogService } from './reference-data/mitre-catalog-service'; +import { ReferenceRecognitionService, deriveReferenceRun } from './reference-data/reference-recognition-service'; import { directImportExecutor, type ImportExecutor } from './import-executor'; import { createCanonicalImportBatch } from '../src/importers/canonical-import'; import { processingScopeIssues } from '../src/domain/processing-compatibility'; @@ -124,6 +126,7 @@ export interface AuditEvent { export interface AssessorHttpServerOptions { artifactStore?: BackendArtifactStore; + mitreCatalogService?: MitreCatalogService; repository: AssessorRepository; staticRoot: string; releaseId?: string; @@ -343,6 +346,7 @@ function importFailureMessage(error: unknown): string { } function statusForError(error: unknown): { status: number; code: string; message: string } { if (error instanceof HttpError) return error; + if (error instanceof MitreCatalogError) return { status: 502, code: error.code, message: error.message }; if (error instanceof ImportError) return { status: 422, code: error.diagnostics[0]?.code ?? 'import_rejected', message: error.message }; if (error instanceof RepositoryNotFoundError) return { status: 404, code: 'repository_not_found', message: error.message }; if (error instanceof RepositoryConflictError || error instanceof ImportSessionStateError) return { status: 409, code: 'repository_conflict', message: error.message }; @@ -376,6 +380,8 @@ async function serveStatic(request: IncomingMessage, response: ServerResponse, s export function createAssessorHttpServer(options: AssessorHttpServerOptions): Server { const repository = options.repository; + const referenceRecognition = new ReferenceRecognitionService(repository, options.mitreCatalogService + ? () => options.mitreCatalogService!.recognitionCatalogs() : undefined); const maximumBodyBytes = options.maximumBodyBytes ?? DEFAULT_MAXIMUM_BODY_BYTES; const now = options.now ?? (() => new Date()); const importExecutor = options.importExecutor ?? directImportExecutor; @@ -411,6 +417,35 @@ export function createAssessorHttpServer(options: AssessorHttpServerOptions): Se }; status = 200; sendJson(response, status, result, requestId); return; } + if (segments.join('/') === 'reference-data/mitre-attack' && method === 'GET') { + if (!options.mitreCatalogService) throw new HttpError(503, 'mitre_catalog_unavailable', 'Der MITRE-Katalog ist nicht konfiguriert.'); + status = 200; sendJson(response, status, await options.mitreCatalogService.current(), requestId); return; + } + if (segments[0] === 'projects' && segments[1] && segments[2] === 'references' && segments.length === 3 && method === 'GET') { + status = 200; sendJson(response, status, await referenceRecognition.status(segments[1]), requestId); return; + } + if (segments[0] === 'projects' && segments[1] && segments[2] === 'references' && segments[3] === 'recognize' && segments.length === 4 && method === 'POST') { + await readJson(request, maximumBodyBytes); + status = 200; sendJson(response, status, await referenceRecognition.reprocess(segments[1]), requestId); return; + } + if (segments.join('/') === 'reference-data/mitre-attack/refresh' && method === 'POST') { + if (!options.mitreCatalogService) throw new HttpError(503, 'mitre_catalog_unavailable', 'Der MITRE-Katalog ist nicht konfiguriert.'); + await readJson>(request, maximumBodyBytes); + status = 200; sendJson(response, status, await options.mitreCatalogService.refresh(), requestId); return; + } + if (segments.join('/') === 'reference-data/mitre-attack/source' && method === 'GET') { + if (!options.mitreCatalogService) throw new HttpError(503, 'mitre_catalog_unavailable', 'Der MITRE-Katalog ist nicht konfiguriert.'); + const source = await options.mitreCatalogService.officialSource(); + status = 200; + response.statusCode = status; + response.setHeader('Content-Type', 'application/json; charset=utf-8'); + response.setHeader('Content-Disposition', `attachment; filename="enterprise-attack-v${source.catalog.version}.json"`); + response.setHeader('Content-Length', source.bytes.byteLength); + response.setHeader('Cache-Control', 'no-store'); + response.setHeader('X-Assessor-Request-Id', requestId); + response.end(source.bytes); + return; + } if (method === 'GET' && segments.length === 1 && segments[0] === 'audit-events') { status = 200; sendJson(response, status, auditEvents.slice().reverse(), requestId); return; } @@ -605,7 +640,9 @@ export function createAssessorHttpServer(options: AssessorHttpServerOptions): Se if (!body.replacesScanRunId && processingScopeIssues([...processingFiles, ...canonical.model.importFiles]).length) { throw new HttpError(409, 'incompatible_processing_versions', 'Der gewählte Timeslot enthält unbekannte oder semantisch inkompatible Verarbeitungsstände. Bitte alle betroffenen Dateien mit dem aktuellen Profil in einen neuen Timeslot reimportieren.'); } - const committed = await repository.commitCanonicalImport({ ...canonical, replacesScanRunId: body.replacesScanRunId }); + const referenceCatalogs = await referenceRecognition.catalogs(); + canonical.model.referenceRuns = canonical.model.scanRuns.map(scan => deriveReferenceRun(canonical.model, scan.id, referenceCatalogs, importedAt)); + const committed = await repository.commitCanonicalImport({ ...canonical, referenceCatalogs, replacesScanRunId: body.replacesScanRunId }); const fingerprints = await repository.findImportFingerprints(body.entries.map(entry => entry.sha256)); importBatchPreviews.delete(body.batchId); const result: ImportBatchCompleteResponse = { diff --git a/server/index.ts b/server/index.ts index 05d0186..7954283 100644 --- a/server/index.ts +++ b/server/index.ts @@ -1,5 +1,5 @@ import { randomUUID } from 'node:crypto'; -import { resolve } from 'node:path'; +import { join, resolve } from 'node:path'; import { defaultImportResourcePolicy } from '../src/importers/resource-policy'; import { createAssessorHttpServer } from './assessor-http-server'; import { NodeImportWorkerExecutor } from './import-worker-client'; @@ -17,6 +17,7 @@ import { GpoPolicyEvaluationService } from './gpo/gpo-policy-evaluation-service' import { GpoPolicyFindingService } from './gpo/gpo-policy-finding-service'; import { GpoPolicyAnalysisOverviewService } from './gpo/gpo-policy-analysis-overview-service'; import { loadPolicyEvaluationRuleCatalog } from './gpo/policy-evaluation-rule-catalog-loader'; +import { MitreCatalogService } from './reference-data/mitre-catalog-service'; function boundedInteger(value: string | undefined, fallback: number, minimum: number, maximum: number, name: string): number { if (value === undefined || value.trim() === '') return fallback; @@ -58,6 +59,7 @@ async function main(): Promise { }); const runtime = await createRepositoryRuntime(); const artifactStore = new FileSystemBackendArtifactStore(artifactRoot); + const mitreCatalogService = new MitreCatalogService(join(artifactRoot, 'reference-data', 'mitre-enterprise.json')); const gpoBackupSubmissionService = new GpoBackupSubmissionService( runtime.repository, artifactStore, @@ -101,6 +103,7 @@ async function main(): Promise { ); const server = createAssessorHttpServer({ artifactStore, + mitreCatalogService, repository: runtime.repository, persistence: runtime.persistence, staticRoot, diff --git a/server/postgres/migration-catalog.ts b/server/postgres/migration-catalog.ts index 659b6ad..7a014bd 100644 --- a/server/postgres/migration-catalog.ts +++ b/server/postgres/migration-catalog.ts @@ -18,6 +18,7 @@ import policyFindingFactory from './migrations/017_policy_finding_factory.sql?ra import scannerEnvironmentContext from './migrations/018_scanner_environment_context.sql?raw'; import nativePolicyTargets from './migrations/019_native_policy_targets.sql?raw'; import baselineDrivenPolicyEvaluation from './migrations/020_baseline_driven_policy_evaluation.sql?raw'; +import referenceRecognition from './migrations/023_reference_recognition.sql?raw'; export interface DatabaseMigration { version: string; @@ -45,5 +46,6 @@ export const databaseMigrations: readonly DatabaseMigration[] = [ { version: '017', name: 'policy-finding-factory', sql: policyFindingFactory }, { version: '018', name: 'scanner-environment-context', sql: scannerEnvironmentContext }, { version: '019', name: 'native-policy-targets', sql: nativePolicyTargets }, - { version: '020', name: 'baseline-driven-policy-evaluation', sql: baselineDrivenPolicyEvaluation } + { version: '020', name: 'baseline-driven-policy-evaluation', sql: baselineDrivenPolicyEvaluation }, + { version: '023', name: 'reference-recognition', sql: referenceRecognition } ]; diff --git a/server/postgres/migrations/023_reference_recognition.sql b/server/postgres/migrations/023_reference_recognition.sql new file mode 100644 index 0000000..12e13ea --- /dev/null +++ b/server/postgres/migrations/023_reference_recognition.sql @@ -0,0 +1,21 @@ +-- 021/022 are already reserved by timeslot comparison/obligation work in the canonical datastore. +-- Immutable public catalog snapshots; client runs reference their exact content hash. +CREATE TABLE assessor_reference_catalogs ( + sha256 text PRIMARY KEY CHECK (sha256 ~ '^[a-f0-9]{64}$'), + data jsonb NOT NULL CHECK (jsonb_typeof(data) = 'object') +); +CREATE TABLE assessor_reference_runs ( + id text PRIMARY KEY CHECK (btrim(id) <> ''), + project_id text NOT NULL REFERENCES assessor_projects(id) ON DELETE CASCADE, + assessment_id text NOT NULL REFERENCES assessor_assessments(id) ON DELETE CASCADE, + scan_run_id text NOT NULL REFERENCES assessor_scan_runs(id) ON DELETE CASCADE, + created_at timestamptz NOT NULL, + data jsonb NOT NULL CHECK (jsonb_typeof(data) = 'object') +); +CREATE INDEX assessor_reference_runs_scan_idx ON assessor_reference_runs(scan_run_id, created_at DESC, id DESC); +CREATE INDEX assessor_reference_runs_project_idx ON assessor_reference_runs(project_id); +CREATE TABLE assessor_reference_run_catalogs ( + run_id text NOT NULL REFERENCES assessor_reference_runs(id) ON DELETE CASCADE, + catalog_sha256 text NOT NULL REFERENCES assessor_reference_catalogs(sha256), + PRIMARY KEY (run_id, catalog_sha256) +); diff --git a/server/postgres/postgres-assessor-repository.ts b/server/postgres/postgres-assessor-repository.ts index 1f2986c..9d1fd78 100644 --- a/server/postgres/postgres-assessor-repository.ts +++ b/server/postgres/postgres-assessor-repository.ts @@ -26,6 +26,9 @@ import type { StoredPolicyFindingRun } from '../../src/domain/policy-finding'; import type { EnvironmentObservation, EnvironmentSnapshot, EnvironmentSnapshotQuery, ScannerReportSection } from '../../src/domain/environment-context'; import { environmentCoverage } from '../../src/domain/environment-context'; import { storedPolicyFindingRunValidationErrors } from '../../src/domain/policy-finding'; +import { latestReferenceRuns, type ReferenceRecognitionRun, type ReferenceCatalogSnapshot } from '../../src/domain/reference-recognition'; +import { validateReferenceRun } from '../../src/persistence/reference-run-validation'; +import { referenceHash } from '../reference-data/reference-catalogs'; import { environmentProfileValidationErrors, storedPolicySnapshotAggregationValidationErrors @@ -499,7 +502,7 @@ export class PostgresAssessorRepository implements AssessorRepository { }); } - private async assessmentModel(queryable: Queryable, assessmentId: string): Promise { + private async assessmentModel(queryable: Queryable, assessmentId: string, includeSuperseded = false): Promise { const assessment = dataRow(await queryable.query>( 'SELECT data FROM assessor_assessments WHERE id = $1', [assessmentId] )); @@ -510,49 +513,52 @@ export class PostgresAssessorRepository implements AssessorRepository { if (!project) return null; const runs = await queryable.query>( `SELECT data FROM assessor_scan_runs - WHERE assessment_id = $1 AND data->>'supersededByScanRunId' IS NULL ORDER BY id`, [assessmentId] + WHERE assessment_id = $1 AND ($2::boolean OR data->>'supersededByScanRunId' IS NULL) ORDER BY id`, [assessmentId, includeSuperseded] ); const files = await queryable.query>( `SELECT f.data FROM assessor_import_files f JOIN assessor_scan_runs r ON r.id = f.scan_run_id - WHERE r.assessment_id = $1 AND r.data->>'supersededByScanRunId' IS NULL ORDER BY f.id`, [assessmentId] + WHERE r.assessment_id = $1 AND ($2::boolean OR r.data->>'supersededByScanRunId' IS NULL) ORDER BY f.id`, [assessmentId, includeSuperseded] ); const tables = await queryable.query>( `SELECT t.data FROM assessor_source_tables t JOIN assessor_import_files f ON f.id = t.import_file_id JOIN assessor_scan_runs r ON r.id = f.scan_run_id - WHERE r.assessment_id = $1 AND r.data->>'supersededByScanRunId' IS NULL ORDER BY t.id`, [assessmentId] + WHERE r.assessment_id = $1 AND ($2::boolean OR r.data->>'supersededByScanRunId' IS NULL) ORDER BY t.id`, [assessmentId, includeSuperseded] ); const reportSections = await queryable.query>( `SELECT s.data FROM assessor_scanner_report_sections s JOIN assessor_scan_runs r ON r.id = s.scan_run_id - WHERE r.assessment_id = $1 AND r.data->>'supersededByScanRunId' IS NULL ORDER BY s.ordinal, s.id`, [assessmentId] + WHERE r.assessment_id = $1 AND ($2::boolean OR r.data->>'supersededByScanRunId' IS NULL) ORDER BY s.ordinal, s.id`, [assessmentId, includeSuperseded] ); const environmentObservations = await queryable.query>( `SELECT o.data FROM assessor_environment_observations o JOIN assessor_scan_runs r ON r.id = o.scan_run_id - WHERE r.assessment_id = $1 AND r.data->>'supersededByScanRunId' IS NULL ORDER BY o.property_key, o.id`, [assessmentId] + WHERE r.assessment_id = $1 AND ($2::boolean OR r.data->>'supersededByScanRunId' IS NULL) ORDER BY o.property_key, o.id`, [assessmentId, includeSuperseded] ); const definitions = await queryable.query>( `SELECT DISTINCT d.data, d.id FROM assessor_finding_definitions d JOIN assessor_finding_occurrences o ON o.definition_id = d.id JOIN assessor_scan_runs r ON r.id = o.scan_run_id - WHERE r.assessment_id = $1 AND r.data->>'supersededByScanRunId' IS NULL ORDER BY d.id`, [assessmentId] + WHERE r.assessment_id = $1 AND ($2::boolean OR r.data->>'supersededByScanRunId' IS NULL) ORDER BY d.id`, [assessmentId, includeSuperseded] ); const occurrences = await queryable.query>( `SELECT o.data FROM assessor_finding_occurrences o JOIN assessor_scan_runs r ON r.id = o.scan_run_id - WHERE r.assessment_id = $1 AND r.data->>'supersededByScanRunId' IS NULL ORDER BY o.id`, [assessmentId] + WHERE r.assessment_id = $1 AND ($2::boolean OR r.data->>'supersededByScanRunId' IS NULL) ORDER BY o.id`, [assessmentId, includeSuperseded] ); const evidence = await queryable.query>( `SELECT e.data FROM assessor_evidence e JOIN assessor_finding_occurrences o ON o.id = e.occurrence_id JOIN assessor_scan_runs r ON r.id = o.scan_run_id - WHERE r.assessment_id = $1 AND r.data->>'supersededByScanRunId' IS NULL ORDER BY e.id`, [assessmentId] + WHERE r.assessment_id = $1 AND ($2::boolean OR r.data->>'supersededByScanRunId' IS NULL) ORDER BY e.id`, [assessmentId, includeSuperseded] ); const reviews = await queryable.query>(` SELECT DISTINCT rv.data, rv.id FROM assessor_reviews rv WHERE EXISTS ( SELECT 1 FROM assessor_finding_occurrences o JOIN assessor_scan_runs r ON r.id = o.scan_run_id - WHERE r.assessment_id = $1 AND r.data->>'supersededByScanRunId' IS NULL AND (rv.occurrence_id = o.id OR rv.definition_id = o.definition_id) + WHERE r.assessment_id = $1 AND ($2::boolean OR r.data->>'supersededByScanRunId' IS NULL) AND (rv.occurrence_id = o.id OR rv.definition_id = o.definition_id) ) ORDER BY rv.id - `, [assessmentId]); + `, [assessmentId, includeSuperseded]); const diagnostics = await queryable.query>( `SELECT d.data FROM assessor_import_diagnostics d JOIN assessor_import_files f ON f.id = d.import_file_id JOIN assessor_scan_runs r ON r.id = f.scan_run_id - WHERE r.assessment_id = $1 AND r.data->>'supersededByScanRunId' IS NULL ORDER BY d.id`, [assessmentId] + WHERE r.assessment_id = $1 AND ($2::boolean OR r.data->>'supersededByScanRunId' IS NULL) ORDER BY d.id`, [assessmentId, includeSuperseded] ); return { schemaVersion: 1, project, assessment, + referenceRuns: latestReferenceRuns(dataRows(await queryable.query>( + 'SELECT DISTINCT ON (scan_run_id) data FROM assessor_reference_runs WHERE assessment_id = $1 ORDER BY scan_run_id, created_at DESC, id DESC', [assessmentId] + ))).filter(run => dataRows(runs).some(scan => scan.id === run.scanRunId)), scanRuns: dataRows(runs), importFiles: dataRows(files), sourceTables: dataRows(tables), reportSections: dataRows(reportSections), environmentObservations: dataRows(environmentObservations), findingDefinitions: dataRows(definitions), findingOccurrences: dataRows(occurrences), @@ -564,6 +570,40 @@ export class PostgresAssessorRepository implements AssessorRepository { return this.assessmentModel(this.pool, assessmentId); } + private async persistReferenceRun(client: PoolClient, run: ReferenceRecognitionRun, catalogs: ReferenceCatalogSnapshot[], model: CanonicalAssessmentModel | null): Promise { + const existing = dataRow(await client.query>('SELECT data FROM assessor_reference_runs WHERE id = $1', [run.id])); + if (existing) { + if (canonicalJson(existing) !== canonicalJson(run)) throw new RepositoryConflictError('Referenzläufe sind unveränderlich.'); + return false; + } + validateReferenceRun(run, catalogs, model); + for (const catalog of catalogs) { + const { sha256, ...content } = catalog; + if (referenceHash(content) !== sha256) throw new RepositoryValidationError('Katalog-Hash stimmt nicht überein.'); + const stored = dataRow(await client.query>('SELECT data FROM assessor_reference_catalogs WHERE sha256 = $1', [sha256])); + if (stored && canonicalJson(stored) !== canonicalJson(catalog)) throw new RepositoryConflictError('Katalog-Snapshot ist unveränderlich.'); + if (!stored) await client.query('INSERT INTO assessor_reference_catalogs (sha256, data) VALUES ($1, $2::jsonb)', [sha256, json(catalog)]); + } + await client.query('INSERT INTO assessor_reference_runs (id, project_id, assessment_id, scan_run_id, created_at, data) VALUES ($1, $2, $3, $4, $5, $6::jsonb)', + [run.id, run.projectId, run.assessmentId, run.scanRunId, run.createdAt, json(run)]); + for (const hash of run.catalogHashes) await client.query('INSERT INTO assessor_reference_run_catalogs (run_id, catalog_sha256) VALUES ($1, $2)', [run.id, hash]); + return true; + } + + async saveReferenceRun(run: ReferenceRecognitionRun, catalogs: ReferenceCatalogSnapshot[]): Promise { + await this.mutate(async client => this.persistReferenceRun(client, run, catalogs, await this.assessmentModel(client, run.assessmentId)), undefined, Boolean); + } + + async listReferenceRuns(projectId: string): Promise { + return dataRows(await this.pool.query>('SELECT data FROM assessor_reference_runs WHERE project_id = $1 ORDER BY created_at, id', [projectId])); + } + + async listReferenceCatalogs(projectId: string): Promise { + return dataRows(await this.pool.query>(`SELECT c.data FROM assessor_reference_catalogs c + WHERE EXISTS (SELECT 1 FROM assessor_reference_run_catalogs rc JOIN assessor_reference_runs r ON r.id = rc.run_id + WHERE r.project_id = $1 AND rc.catalog_sha256 = c.sha256) ORDER BY c.sha256`, [projectId])); + } + async beginImport(start: ImportSessionStart): Promise { if (!start.sessionId.trim()) throw new RepositoryValidationError('Eine Importsitzung benötigt eine ID.'); if (this.activeImportSessions.has(start.sessionId)) throw new RepositoryConflictError(`Importsitzung ${start.sessionId} ist bereits aktiv.`); @@ -836,6 +876,7 @@ export class PostgresAssessorRepository implements AssessorRepository { fingerprint.firstImportedAt, fingerprint.lastImportedAt, fingerprint.importCount, json(fingerprint)]); } const stored = await this.assessmentModel(client, model.assessment.id); + for (const referenceRun of model.referenceRuns ?? []) await this.persistReferenceRun(client, referenceRun, input.referenceCatalogs ?? [], stored); if (!stored) throw new RepositoryValidationError('Das importierte Assessment konnte nicht aufgebaut werden.'); try { assertCanonicalAssessmentModel(stored); } catch (error) { throw new RepositoryValidationError(error instanceof Error ? error.message : 'Importmodell ist ungültig.'); } @@ -2394,7 +2435,7 @@ export class PostgresAssessorRepository implements AssessorRepository { const project = await this.getProject(projectId); if (!project) throw new RepositoryNotFoundError(`Projekt ${projectId} ist nicht vorhanden.`); const assessments = await this.listAssessments(projectId); - const models = (await Promise.all(assessments.map(assessment => this.loadAssessmentModel(assessment.id)))) + const models = (await Promise.all(assessments.map(assessment => this.assessmentModel(this.pool, assessment.id, true)))) .filter((model): model is CanonicalAssessmentModel => model !== null); const policyFindingRuns = await this.listPolicyFindingRuns(projectId); const uniqueDefinitions = new Map([ @@ -2403,6 +2444,8 @@ export class PostgresAssessorRepository implements AssessorRepository { ].map(item => [item.id, item])); return { version: 1, project, assessments, + referenceRuns: await this.listReferenceRuns(projectId), + referenceCatalogs: await this.listReferenceCatalogs(projectId), scanRuns: models.flatMap(model => model.scanRuns), importFiles: models.flatMap(model => model.importFiles), sourceTables: models.flatMap(model => model.sourceTables), diff --git a/server/reference-data/mitre-catalog-service.ts b/server/reference-data/mitre-catalog-service.ts new file mode 100644 index 0000000..5b9d472 --- /dev/null +++ b/server/reference-data/mitre-catalog-service.ts @@ -0,0 +1,145 @@ +import { createHash, randomUUID } from 'node:crypto'; +import { attackReferenceCatalog } from '../../src/references/catalog-converters'; +import type { ReferenceCatalogSnapshot } from '../../src/domain/reference-recognition'; +import { bundledReferenceCatalogs, referenceHash, referenceSnapshot } from './reference-catalogs'; +import { lstat, mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'; +import { dirname, isAbsolute } from 'node:path'; +import { defaultMitreGraphData, validateMitreMatrixData, type MitreGraphData } from '../../src/features/mitre-graph/mitre-graph'; +import { convertEnterpriseStix } from '../../src/features/mitre-graph/mitre-stix'; + +const OFFICIAL_ENTERPRISE_STIX_URL = 'https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json'; +const MAXIMUM_SOURCE_BYTES = 80 * 1024 * 1024; +const MAXIMUM_CATALOG_BYTES = 5 * 1024 * 1024; + +export class MitreCatalogError extends Error { + constructor(readonly code: string, message: string) { + super(message); + this.name = 'MitreCatalogError'; + } +} + +export interface MitreCatalogState { + referenceCatalog?: ReferenceCatalogSnapshot; + version: 1; + catalog: MitreGraphData; + origin: 'bundled' | 'mitre'; +} + +function compareVersions(left: string, right: string): number { + const a = left.split('.').map(Number); + const b = right.split('.').map(Number); + return (a[0] - b[0]) || (a[1] - b[1]); +} + +export class MitreCatalogService { + private refreshInProgress?: Promise; + + constructor( + private readonly catalogPath: string, + private readonly fetcher: typeof fetch = globalThis.fetch.bind(globalThis) + ) { + if (!catalogPath || !isAbsolute(catalogPath)) throw new Error('An absolute MITRE catalog storage path is required.'); + } + + async current(): Promise { + try { + const information = await stat(this.catalogPath); + if (!information.isFile() || information.size > MAXIMUM_CATALOG_BYTES) throw new Error('Stored MITRE catalog is not a regular bounded file.'); + const stored = JSON.parse(await readFile(this.catalogPath, 'utf8')); + const catalog = validateMitreMatrixData(stored); + const referenceCatalog = stored.referenceCatalog as ReferenceCatalogSnapshot | undefined; + if (referenceCatalog) { + const { sha256, ...content } = referenceCatalog; + if (content.framework !== 'mitre-attack' || content.version !== catalog.version || referenceHash(content) !== sha256) throw new Error('Stored reference catalog is invalid.'); + } + return compareVersions(catalog.version, defaultMitreGraphData.version) >= 0 + ? { version: 1, catalog, origin: 'mitre', ...(referenceCatalog ? { referenceCatalog } : {}) } + : { version: 1, catalog: defaultMitreGraphData, origin: 'bundled' }; + } catch (error) { + if ((error as NodeJS.ErrnoException)?.code === 'ENOENT') { + return { version: 1, catalog: defaultMitreGraphData, origin: 'bundled' }; + } + throw error; + } + } + + async recognitionCatalogs(): Promise { + const state = await this.current(); + const attack = state.referenceCatalog ?? bundledReferenceCatalogs[0]; + if (attack.version !== state.catalog.version) throw new MitreCatalogError('mitre_reference_update_required', 'Bitte zuerst Update from MITRE ausführen, um den vollständigen Referenzkatalog zu laden.'); + return [attack, bundledReferenceCatalogs[1]]; + } + + async officialSource(): Promise<{ bytes: Buffer; catalog: MitreGraphData; referenceCatalog: ReferenceCatalogSnapshot }> { + let response: Response; + try { + response = await this.fetcher(OFFICIAL_ENTERPRISE_STIX_URL, { + headers: { Accept: 'application/json' }, cache: 'no-store', redirect: 'error', + signal: AbortSignal.timeout(120_000) + }); + } catch { + throw new MitreCatalogError('mitre_unreachable', 'MITRE konnte nicht erreicht werden. Bitte später erneut versuchen oder die Datei manuell importieren.'); + } + if (!response.ok || !response.body) throw new MitreCatalogError('mitre_unavailable', `MITRE lieferte keine nutzbare Datei (HTTP ${response.status}).`); + const declaredSize = Number(response.headers.get('content-length')); + if (Number.isFinite(declaredSize) && declaredSize > MAXIMUM_SOURCE_BYTES) { + await response.body.cancel(); + throw new MitreCatalogError('mitre_source_too_large', 'Die MITRE-Datei überschreitet das Größenlimit.'); + } + const chunks: Buffer[] = []; + const reader = response.body.getReader(); + let size = 0; + try { + for (;;) { + const { done, value } = await reader.read(); + if (done) break; + size += value.byteLength; + if (size > MAXIMUM_SOURCE_BYTES) throw new MitreCatalogError('mitre_source_too_large', 'Die MITRE-Datei überschreitet das Größenlimit.'); + chunks.push(Buffer.from(value)); + } + } catch (error) { + await reader.cancel().catch(() => undefined); + if (error instanceof MitreCatalogError) throw error; + throw new MitreCatalogError('mitre_download_failed', 'Der MITRE-Download wurde unterbrochen.'); + } + const bytes = Buffer.concat(chunks, size); + try { + const raw = JSON.parse(bytes.toString('utf8')); + return { bytes, catalog: validateMitreMatrixData(convertEnterpriseStix(raw)), + referenceCatalog: referenceSnapshot(attackReferenceCatalog(raw, OFFICIAL_ENTERPRISE_STIX_URL, createHash('sha256').update(bytes).digest('hex'))) }; + } catch { + throw new MitreCatalogError('mitre_source_invalid', 'Die MITRE-Datei enthält keinen gültigen Enterprise-ATT&CK-STIX-Katalog.'); + } + } + + refresh(): Promise { + if (this.refreshInProgress) return this.refreshInProgress; + this.refreshInProgress = this.performRefresh().finally(() => { this.refreshInProgress = undefined; }); + return this.refreshInProgress; + } + + private async performRefresh(): Promise { + const latest = await this.officialSource(); + const current = await this.current(); + const comparison = compareVersions(latest.catalog.version, current.catalog.version); + if (comparison < 0 || (comparison === 0 && current.referenceCatalog)) { + return { ...current, updated: false }; + } + const directory = dirname(this.catalogPath); + await mkdir(directory, { recursive: true, mode: 0o700 }); + const directoryInfo = await lstat(directory); + if (!directoryInfo.isDirectory() || directoryInfo.isSymbolicLink()) { + throw new MitreCatalogError('mitre_storage_unavailable', 'Der private MITRE-Speicher ist nicht verfügbar.'); + } + const temporaryPath = `${this.catalogPath}.${randomUUID()}.tmp`; + try { + await writeFile(temporaryPath, JSON.stringify({ ...latest.catalog, referenceCatalog: latest.referenceCatalog }), { mode: 0o600 }); + await rename(temporaryPath, this.catalogPath); + } finally { + await unlink(temporaryPath).catch(error => { + if ((error as NodeJS.ErrnoException)?.code !== 'ENOENT') throw error; + }); + } + return { version: 1, catalog: latest.catalog, referenceCatalog: latest.referenceCatalog, origin: 'mitre', updated: comparison > 0 }; + } +} diff --git a/server/reference-data/reference-catalogs.ts b/server/reference-data/reference-catalogs.ts new file mode 100644 index 0000000..6141f13 --- /dev/null +++ b/server/reference-data/reference-catalogs.ts @@ -0,0 +1,11 @@ +import { createHash } from 'node:crypto'; +import attack from '../../src/assets/data/attack-reference-v19.2.json'; +import d3fend from '../../src/assets/data/d3fend-reference-v1.6.0.json'; +import type { ReferenceCatalog, ReferenceCatalogSnapshot } from '../../src/domain/reference-recognition'; +import { canonicalJson } from '../../src/shared/canonical-json'; + +export const referenceHash = (value: unknown): string => createHash('sha256').update(canonicalJson(value)).digest('hex'); +export function referenceSnapshot(catalog: ReferenceCatalog): ReferenceCatalogSnapshot { + return { ...catalog, sha256: referenceHash(catalog) }; +} +export const bundledReferenceCatalogs = [attack, d3fend].map(catalog => referenceSnapshot(catalog as ReferenceCatalog)); diff --git a/server/reference-data/reference-recognition-service.ts b/server/reference-data/reference-recognition-service.ts new file mode 100644 index 0000000..3fd9055 --- /dev/null +++ b/server/reference-data/reference-recognition-service.ts @@ -0,0 +1,66 @@ +import type { CanonicalAssessmentModel } from '../../src/domain/canonical-model'; +import { createReferenceRecognizer, latestReferenceRuns, REFERENCE_RECOGNIZER_VERSION, type ReferenceCatalogSnapshot, type ReferenceRecognitionRun } from '../../src/domain/reference-recognition'; +import type { AssessorRepository } from '../../src/persistence/assessor-repository'; +import { RepositoryNotFoundError } from '../../src/persistence/repository-errors'; +import { bundledReferenceCatalogs, referenceHash } from './reference-catalogs'; + +export function deriveReferenceRun(model: CanonicalAssessmentModel, scanRunId: string, catalogs: ReferenceCatalogSnapshot[], createdAt: string): ReferenceRecognitionRun { + const occurrences = model.findingOccurrences.filter(item => item.scanRunId === scanRunId).sort((a, b) => a.id.localeCompare(b.id)); + const files = new Map(model.importFiles.map(file => [file.id, file])); + const inputSha256 = referenceHash(occurrences.map(item => ({ id: item.id, importFileId: item.importFileId, + sourceFileSha256: files.get(item.importFileId)?.sha256, sourcePosition: item.sourcePosition, fields: item.originalFields }))); + const catalogHashes = catalogs.map(catalog => catalog.sha256).sort(); + const id = 'references-' + referenceHash([model.project.id, model.assessment.id, scanRunId, REFERENCE_RECOGNIZER_VERSION, inputSha256, catalogHashes]); + const recognize = createReferenceRecognizer(catalogs); + return { schemaVersion: 1, id, projectId: model.project.id, assessmentId: model.assessment.id, scanRunId, + recognizerVersion: REFERENCE_RECOGNIZER_VERSION, inputSha256, catalogHashes, createdAt, + results: occurrences.map(item => ({ occurrenceId: item.id, importFileId: item.importFileId, + sourceFileSha256: files.get(item.importFileId)?.sha256, sourcePosition: item.sourcePosition, references: recognize(item.originalFields) })) }; +} + +export class ReferenceRecognitionService { + private active = new Map>(); + constructor(private readonly repository: AssessorRepository, + readonly catalogs: () => Promise = async () => bundledReferenceCatalogs) {} + + async status(projectId: string) { + if (!await this.repository.getProject(projectId)) throw new RepositoryNotFoundError('Client nicht vorhanden.'); + const scans = (await this.repository.listProjectScanRuns(projectId)).filter(scan => !scan.supersededByScanRunId); + const runs = latestReferenceRuns(await this.repository.listReferenceRuns(projectId)); + const catalogs = await this.catalogs(); + const hashes = catalogs.map(catalog => catalog.sha256).sort().join(':'); + const indexed = scans.filter(scan => runs.some(run => run.scanRunId === scan.id)); + return { totalScans: scans.length, indexedScans: indexed.length, + pendingScans: scans.filter(scan => !runs.some(run => run.scanRunId === scan.id && run.recognizerVersion === REFERENCE_RECOGNIZER_VERSION && [...run.catalogHashes].sort().join(':') === hashes)).length, + catalogs: catalogs.map(({ framework, version, sha256 }) => ({ framework, version, sha256 })) }; + } + + reprocess(projectId: string) { + let task = this.active.get(projectId); + if (!task) { + task = this.performReprocess(projectId).finally(() => this.active.delete(projectId)); + this.active.set(projectId, task); + } + return task; + } + + private async performReprocess(projectId: string) { + if (!await this.repository.getProject(projectId)) throw new RepositoryNotFoundError('Client nicht vorhanden.'); + const catalogs = await this.catalogs(); + const existing = new Map((await this.repository.listReferenceRuns(projectId)).map(run => [run.id, run])); + let processedScans = 0, unchangedScans = 0, references = 0; + for (const assessment of await this.repository.listAssessments(projectId)) { + const model = await this.repository.loadAssessmentModel(assessment.id); + if (!model) continue; + for (const scan of model.scanRuns.filter(item => !item.supersededByScanRunId)) { + const latestTimestamp = Math.max(0, ...[...existing.values()].filter(run => run.scanRunId === scan.id).map(run => Date.parse(run.createdAt))); + const run = deriveReferenceRun(model, scan.id, catalogs, new Date(Math.max(Date.now(), latestTimestamp + 1)).toISOString()); + references += run.results.reduce((sum, item) => sum + item.references.length, 0); + if (existing.has(run.id)) { unchangedScans++; continue; } + await this.repository.saveReferenceRun(run, catalogs); + processedScans++; + } + } + return { processedScans, unchangedScans, references }; + } +} diff --git a/src/api/assessor-api-client.ts b/src/api/assessor-api-client.ts index 6386a6b..3085e55 100644 --- a/src/api/assessor-api-client.ts +++ b/src/api/assessor-api-client.ts @@ -19,6 +19,7 @@ import { ASSESSOR_MUTATION_HEADER, type AssessorApiErrorBody, type AssessorHealthResponse, + type MitreCatalogResponse, type GpoBackupSubmissionResponse, type GpoBackupStatusResponse, type GpoBackupRetryResponse, @@ -130,6 +131,36 @@ export class AssessorApiClient { return this.request('/health'); } + getReferenceRecognitionStatus(projectId: string): Promise { + return this.request(`/projects/${encodeURIComponent(projectId)}/references`); + } + + recognizeReferences(projectId: string): Promise { + return this.request(`/projects/${encodeURIComponent(projectId)}/references/recognize`, { method: 'POST', body: '{}' }); + } + + getMitreCatalog(): Promise { + return this.request('/reference-data/mitre-attack'); + } + + refreshMitreCatalog(): Promise { + return this.request('/reference-data/mitre-attack/refresh', { method: 'POST', body: '{}' }); + } + + async downloadLatestMitreSource(): Promise<{ blob: Blob; fileName: string }> { + const response = await this.fetcher(`${this.baseUrl}/reference-data/mitre-attack/source`, { + headers: { Accept: 'application/json' } + }); + if (!response.ok) { + const body = await response.json().catch(() => null) as AssessorApiErrorBody | null; + throw new AssessorApiError(body?.error?.message ?? `MITRE-Download fehlgeschlagen (${response.status}).`, + response.status, body?.error?.code ?? 'mitre_download_failed', body?.error?.requestId); + } + const fileName = response.headers.get('content-disposition')?.match(/filename="(enterprise-attack-v\d+\.\d+\.json)"/)?.[1] + ?? 'enterprise-attack.json'; + return { blob: await response.blob(), fileName }; + } + getDatabaseStructure(): Promise { return this.request('/db-structure'); } diff --git a/src/api/assessor-api-contract.ts b/src/api/assessor-api-contract.ts index 16c7e02..0a8a31b 100644 --- a/src/api/assessor-api-contract.ts +++ b/src/api/assessor-api-contract.ts @@ -15,9 +15,17 @@ import type { CreatePolicyEvaluationRequest, StoredPolicyEvaluation } from '../d import type { CreatePolicyFindingRunRequest, StoredPolicyFindingRun } from '../domain/policy-finding'; import type { PolicyEvaluationRuleCatalog } from '../domain/policy-evaluation-rules'; import type { PolicyAnalysisOverview } from '../domain/policy-analysis-overview'; +import type { MitreGraphData } from '../features/mitre-graph/mitre-graph'; export const ASSESSOR_API_PREFIX = '/api/v1'; export const ASSESSOR_MUTATION_HEADER = 'X-Assessor-Request'; +export interface MitreCatalogResponse { + version: 1; + catalog: MitreGraphData; + origin: 'bundled' | 'mitre'; + updated?: boolean; +} + export interface AssessorHealthResponse { status: 'ok'; application: 'ASSESSOR'; @@ -198,3 +206,14 @@ export interface PolicySnapshotAggregationListResponse { version: 1; projectId: export type MicrosoftSecurityBaselineSelectionResponse = MicrosoftSecurityBaselineSelection; export type ImportBatchPreviewResponse = ImportBatchPreview; +export interface ReferenceRecognitionStatus { + totalScans: number; + indexedScans: number; + pendingScans: number; + catalogs: Array<{ framework: import('../domain/reference-recognition').ReferenceFramework; version: string; sha256: string }>; +} +export interface ReferenceRecognitionResponse { + processedScans: number; + unchangedScans: number; + references: number; +} diff --git a/src/app/AppProvider.tsx b/src/app/AppProvider.tsx index ec46442..1a99361 100644 --- a/src/app/AppProvider.tsx +++ b/src/app/AppProvider.tsx @@ -15,6 +15,7 @@ import { genericProfile } from '../profiles/generic/generic-profile'; import { importProfiles } from '../profiles/profile-catalog'; import { stableProjectId } from '../shared/identifiers'; import { combineDatasets } from '../features/project-import/project-import'; +import { setServerMitreMatrix } from '../features/mitre-graph/mitre-graph'; import { loadCanonicalProjectWorkspace } from '../features/project-import/load-canonical-project-workspace'; import { profileForDataset, profileForSheet } from '../features/project-import/workspace-profile'; export { profileForSheet } from '../features/project-import/workspace-profile'; @@ -107,6 +108,13 @@ export function AppProvider({ children }: PropsWithChildren) { return { ...initialAppState, theme: stored }; }); + useEffect(() => { + let active = true; + void assessorApi.getMitreCatalog().then(state => { + if (active) setServerMitreMatrix(state.catalog); + }).catch(() => undefined); + return () => { active = false; }; + }, []); useEffect(() => { if (!workScopeId) return; const persist = () => { void reviewRepository.save(workScopeId, state.reviews); }; diff --git a/src/assets/data/attack-reference-v19.2.json b/src/assets/data/attack-reference-v19.2.json new file mode 100644 index 0000000..b606579 --- /dev/null +++ b/src/assets/data/attack-reference-v19.2.json @@ -0,0 +1 @@ +{"schemaVersion":1,"framework":"mitre-attack","version":"19.2","sourceUrl":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack-19.2.json","sourceSha256":"dc1639caa5501d720e280cf1cbd8fbe009884a0c9b3e6e9ed9d0c25166c3d8f4","license":"© The MITRE Corporation. The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy. https://attack.mitre.org/resources/legal-and-branding/terms-of-use/","entries":[{"id":"T1001","title":"Data Obfuscation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1001/","tactics":["Command and Control"]},{"id":"T1001.001","title":"Junk Data","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1001/001/","tactics":["Command and Control"]},{"id":"T1001.002","title":"Steganography","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1001/002/","tactics":["Command and Control"]},{"id":"T1001.003","title":"Protocol or Service Impersonation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1001/003/","tactics":["Command and Control"]},{"id":"T1002","title":"Data Compressed","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1002/","tactics":["Exfiltration"]},{"id":"T1003","title":"OS Credential Dumping","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1003/","tactics":["Credential Access"]},{"id":"T1003.001","title":"LSASS Memory","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1003/001/","tactics":["Credential Access"]},{"id":"T1003.002","title":"Security Account Manager","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1003/002/","tactics":["Credential Access"]},{"id":"T1003.003","title":"NTDS","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1003/003/","tactics":["Credential Access"]},{"id":"T1003.004","title":"LSA Secrets","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1003/004/","tactics":["Credential Access"]},{"id":"T1003.005","title":"Cached Domain Credentials","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1003/005/","tactics":["Credential Access"]},{"id":"T1003.006","title":"DCSync","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1003/006/","tactics":["Credential Access"]},{"id":"T1003.007","title":"Proc Filesystem","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1003/007/","tactics":["Credential Access"]},{"id":"T1003.008","title":"/etc/passwd and /etc/shadow","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1003/008/","tactics":["Credential Access"]},{"id":"T1004","title":"Winlogon Helper DLL","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1004/","tactics":["Persistence"]},{"id":"T1005","title":"Data from Local System","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1005/","tactics":["Collection"]},{"id":"T1006","title":"Direct Volume Access","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1006/","tactics":["Stealth"]},{"id":"T1007","title":"System Service Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1007/","tactics":["Discovery"]},{"id":"T1008","title":"Fallback Channels","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1008/","tactics":["Command and Control"]},{"id":"T1009","title":"Binary Padding","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1009/","tactics":["Stealth"]},{"id":"T1010","title":"Application Window Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1010/","tactics":["Discovery"]},{"id":"T1011","title":"Exfiltration Over Other Network Medium","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1011/","tactics":["Exfiltration"]},{"id":"T1011.001","title":"Exfiltration Over Bluetooth","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1011/001/","tactics":["Exfiltration"]},{"id":"T1012","title":"Query Registry","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1012/","tactics":["Discovery"]},{"id":"T1013","title":"Port Monitors","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1013/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1014","title":"Rootkit","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1014/","tactics":["Stealth"]},{"id":"T1015","title":"Accessibility Features","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1015/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1016","title":"System Network Configuration Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1016/","tactics":["Discovery"]},{"id":"T1016.001","title":"Internet Connection Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1016/001/","tactics":["Discovery"]},{"id":"T1016.002","title":"Wi-Fi Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1016/002/","tactics":["Discovery"]},{"id":"T1017","title":"Application Deployment Software","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1017/","tactics":["Lateral Movement"]},{"id":"T1018","title":"Remote System Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1018/","tactics":["Discovery"]},{"id":"T1019","title":"System Firmware","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1019/","tactics":["Persistence"]},{"id":"T1020","title":"Automated Exfiltration","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1020/","tactics":["Exfiltration"]},{"id":"T1020.001","title":"Traffic Duplication","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1020/001/","tactics":["Exfiltration"]},{"id":"T1021","title":"Remote Services","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1021/","tactics":["Lateral Movement"]},{"id":"T1021.001","title":"Remote Desktop Protocol","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1021/001/","tactics":["Lateral Movement"]},{"id":"T1021.002","title":"SMB/Windows Admin Shares","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1021/002/","tactics":["Lateral Movement"]},{"id":"T1021.003","title":"Distributed Component Object Model","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1021/003/","tactics":["Lateral Movement"]},{"id":"T1021.004","title":"SSH","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1021/004/","tactics":["Lateral Movement"]},{"id":"T1021.005","title":"VNC","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1021/005/","tactics":["Lateral Movement"]},{"id":"T1021.006","title":"Windows Remote Management","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1021/006/","tactics":["Lateral Movement"]},{"id":"T1021.007","title":"Cloud Services","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1021/007/","tactics":["Lateral Movement"]},{"id":"T1021.008","title":"Direct Cloud VM Connections","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1021/008/","tactics":["Lateral Movement"]},{"id":"T1022","title":"Data Encrypted","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1022/","tactics":["Exfiltration"]},{"id":"T1023","title":"Shortcut Modification","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1023/","tactics":["Persistence"]},{"id":"T1024","title":"Custom Cryptographic Protocol","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1024/","tactics":["Command and Control"]},{"id":"T1025","title":"Data from Removable Media","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1025/","tactics":["Collection"]},{"id":"T1026","title":"Multiband Communication","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1026/","tactics":["Command and Control"]},{"id":"T1027","title":"Obfuscated Files or Information","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/","tactics":["Stealth"]},{"id":"T1027.001","title":"Binary Padding","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/001/","tactics":["Stealth"]},{"id":"T1027.002","title":"Software Packing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/002/","tactics":["Stealth"]},{"id":"T1027.003","title":"Steganography","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/003/","tactics":["Stealth"]},{"id":"T1027.004","title":"Compile After Delivery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/004/","tactics":["Stealth"]},{"id":"T1027.005","title":"Indicator Removal from Tools","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/005/","tactics":["Stealth"]},{"id":"T1027.006","title":"HTML Smuggling","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/006/","tactics":["Stealth"]},{"id":"T1027.007","title":"Dynamic API Resolution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/007/","tactics":["Stealth"]},{"id":"T1027.008","title":"Stripped Payloads","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/008/","tactics":["Stealth"]},{"id":"T1027.009","title":"Embedded Payloads","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/009/","tactics":["Stealth"]},{"id":"T1027.010","title":"Command Obfuscation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/010/","tactics":["Stealth"]},{"id":"T1027.011","title":"Fileless Storage","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/011/","tactics":["Stealth"]},{"id":"T1027.012","title":"LNK Icon Smuggling","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/012/","tactics":["Stealth"]},{"id":"T1027.013","title":"Encrypted/Encoded File","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/013/","tactics":["Stealth"]},{"id":"T1027.014","title":"Polymorphic Code","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/014/","tactics":["Stealth"]},{"id":"T1027.015","title":"Compression","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/015/","tactics":["Stealth"]},{"id":"T1027.016","title":"Junk Code Insertion","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/016/","tactics":["Stealth"]},{"id":"T1027.017","title":"SVG Smuggling","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/017/","tactics":["Stealth"]},{"id":"T1027.018","title":"Invisible Unicode","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1027/018/","tactics":["Stealth"]},{"id":"T1028","title":"Windows Remote Management","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1028/","tactics":["Execution","Lateral Movement"]},{"id":"T1029","title":"Scheduled Transfer","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1029/","tactics":["Exfiltration"]},{"id":"T1030","title":"Data Transfer Size Limits","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1030/","tactics":["Exfiltration"]},{"id":"T1031","title":"Modify Existing Service","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1031/","tactics":["Persistence"]},{"id":"T1032","title":"Standard Cryptographic Protocol","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1032/","tactics":["Command and Control"]},{"id":"T1033","title":"System Owner/User Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1033/","tactics":["Discovery"]},{"id":"T1034","title":"Path Interception","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1034/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1035","title":"Service Execution","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1035/","tactics":["Execution"]},{"id":"T1036","title":"Masquerading","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/","tactics":["Stealth"]},{"id":"T1036.001","title":"Invalid Code Signature","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/001/","tactics":["Stealth"]},{"id":"T1036.002","title":"Right-to-Left Override","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/002/","tactics":["Stealth"]},{"id":"T1036.003","title":"Rename Legitimate Utilities","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/003/","tactics":["Stealth"]},{"id":"T1036.004","title":"Masquerade Task or Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/004/","tactics":["Stealth"]},{"id":"T1036.005","title":"Match Legitimate Resource Name or Location","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/005/","tactics":["Stealth"]},{"id":"T1036.006","title":"Space after Filename","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/006/","tactics":["Stealth"]},{"id":"T1036.007","title":"Double File Extension","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/007/","tactics":["Stealth"]},{"id":"T1036.008","title":"Masquerade File Type","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/008/","tactics":["Stealth"]},{"id":"T1036.009","title":"Break Process Trees","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/009/","tactics":["Stealth"]},{"id":"T1036.010","title":"Masquerade Account Name","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/010/","tactics":["Stealth"]},{"id":"T1036.011","title":"Overwrite Process Arguments","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/011/","tactics":["Stealth"]},{"id":"T1036.012","title":"Browser Fingerprint","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1036/012/","tactics":["Stealth"]},{"id":"T1037","title":"Boot or Logon Initialization Scripts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1037/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1037.001","title":"Logon Script (Windows)","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1037/001/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1037.002","title":"Login Hook","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1037/002/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1037.003","title":"Network Logon Script","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1037/003/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1037.004","title":"RC Scripts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1037/004/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1037.005","title":"Startup Items","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1037/005/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1038","title":"DLL Search Order Hijacking","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1038/","tactics":["Persistence","Privilege Escalation","Stealth"]},{"id":"T1039","title":"Data from Network Shared Drive","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1039/","tactics":["Collection"]},{"id":"T1040","title":"Network Sniffing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1040/","tactics":["Credential Access","Discovery"]},{"id":"T1041","title":"Exfiltration Over C2 Channel","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1041/","tactics":["Exfiltration"]},{"id":"T1042","title":"Change Default File Association","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1042/","tactics":["Persistence"]},{"id":"T1043","title":"Commonly Used Port","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1043/","tactics":["Command and Control"]},{"id":"T1044","title":"File System Permissions Weakness","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1044/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1045","title":"Software Packing","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1045/","tactics":["Stealth"]},{"id":"T1046","title":"Network Service Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1046/","tactics":["Discovery"]},{"id":"T1047","title":"Windows Management Instrumentation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1047/","tactics":["Execution"]},{"id":"T1048","title":"Exfiltration Over Alternative Protocol","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1048/","tactics":["Exfiltration"]},{"id":"T1048.001","title":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1048/001/","tactics":["Exfiltration"]},{"id":"T1048.002","title":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1048/002/","tactics":["Exfiltration"]},{"id":"T1048.003","title":"Exfiltration Over Unencrypted Non-C2 Protocol","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1048/003/","tactics":["Exfiltration"]},{"id":"T1049","title":"System Network Connections Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1049/","tactics":["Discovery"]},{"id":"T1050","title":"New Service","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1050/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1051","title":"Shared Webroot","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1051/","tactics":["Lateral Movement"]},{"id":"T1052","title":"Exfiltration Over Physical Medium","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1052/","tactics":["Exfiltration"]},{"id":"T1052.001","title":"Exfiltration over USB","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1052/001/","tactics":["Exfiltration"]},{"id":"T1053","title":"Scheduled Task/Job","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1053/","tactics":["Execution","Persistence","Privilege Escalation"]},{"id":"T1053.001","title":"At (Linux)","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1053/001/","tactics":["Execution","Persistence","Privilege Escalation"]},{"id":"T1053.002","title":"At","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1053/002/","tactics":["Execution","Persistence","Privilege Escalation"]},{"id":"T1053.003","title":"Cron","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1053/003/","tactics":["Execution","Persistence","Privilege Escalation"]},{"id":"T1053.004","title":"Launchd","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1053/004/","tactics":["Execution","Persistence","Privilege Escalation"]},{"id":"T1053.005","title":"Scheduled Task","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1053/005/","tactics":["Execution","Persistence","Privilege Escalation"]},{"id":"T1053.006","title":"Systemd Timers","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1053/006/","tactics":["Execution","Persistence","Privilege Escalation"]},{"id":"T1053.007","title":"Container Orchestration Job","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1053/007/","tactics":["Execution","Persistence","Privilege Escalation"]},{"id":"T1054","title":"Indicator Blocking","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1054/","tactics":["Stealth"]},{"id":"T1055","title":"Process Injection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.001","title":"Dynamic-link Library Injection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/001/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.002","title":"Portable Executable Injection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/002/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.003","title":"Thread Execution Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/003/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.004","title":"Asynchronous Procedure Call","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/004/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.005","title":"Thread Local Storage","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/005/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.008","title":"Ptrace System Calls","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/008/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.009","title":"Proc Memory","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/009/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.011","title":"Extra Window Memory Injection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/011/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.012","title":"Process Hollowing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/012/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.013","title":"Process Doppelgänging","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/013/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.014","title":"VDSO Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/014/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1055.015","title":"ListPlanting","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1055/015/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1056","title":"Input Capture","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1056/","tactics":["Collection","Credential Access"]},{"id":"T1056.001","title":"Keylogging","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1056/001/","tactics":["Collection","Credential Access"]},{"id":"T1056.002","title":"GUI Input Capture","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1056/002/","tactics":["Collection","Credential Access"]},{"id":"T1056.003","title":"Web Portal Capture","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1056/003/","tactics":["Collection","Credential Access"]},{"id":"T1056.004","title":"Credential API Hooking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1056/004/","tactics":["Collection","Credential Access"]},{"id":"T1057","title":"Process Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1057/","tactics":["Discovery"]},{"id":"T1058","title":"Service Registry Permissions Weakness","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1058/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1059","title":"Command and Scripting Interpreter","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/","tactics":["Execution"]},{"id":"T1059.001","title":"PowerShell","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/001/","tactics":["Execution"]},{"id":"T1059.002","title":"AppleScript","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/002/","tactics":["Execution"]},{"id":"T1059.003","title":"Windows Command Shell","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/003/","tactics":["Execution"]},{"id":"T1059.004","title":"Unix Shell","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/004/","tactics":["Execution"]},{"id":"T1059.005","title":"Visual Basic","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/005/","tactics":["Execution"]},{"id":"T1059.006","title":"Python","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/006/","tactics":["Execution"]},{"id":"T1059.007","title":"JavaScript","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/007/","tactics":["Execution"]},{"id":"T1059.008","title":"Network Device CLI","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/008/","tactics":["Execution"]},{"id":"T1059.009","title":"Cloud API","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/009/","tactics":["Execution"]},{"id":"T1059.010","title":"AutoHotKey & AutoIT","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/010/","tactics":["Execution"]},{"id":"T1059.011","title":"Lua","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/011/","tactics":["Execution"]},{"id":"T1059.012","title":"Hypervisor CLI","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/012/","tactics":["Execution"]},{"id":"T1059.013","title":"Container CLI/API","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1059/013/","tactics":["Execution"]},{"id":"T1060","title":"Registry Run Keys / Startup Folder","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1060/","tactics":["Persistence"]},{"id":"T1061","title":"Graphical User Interface","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1061/","tactics":["Execution"]},{"id":"T1062","title":"Hypervisor","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1062/","tactics":["Persistence"]},{"id":"T1063","title":"Security Software Discovery","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1063/","tactics":["Discovery"]},{"id":"T1064","title":"Scripting","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1064/","tactics":["Stealth","Execution"]},{"id":"T1065","title":"Uncommonly Used Port","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1065/","tactics":["Command and Control"]},{"id":"T1066","title":"Indicator Removal from Tools","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1066/","tactics":["Stealth"]},{"id":"T1067","title":"Bootkit","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1067/","tactics":["Persistence"]},{"id":"T1068","title":"Exploitation for Privilege Escalation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1068/","tactics":["Privilege Escalation"]},{"id":"T1069","title":"Permission Groups Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1069/","tactics":["Discovery"]},{"id":"T1069.001","title":"Local Groups","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1069/001/","tactics":["Discovery"]},{"id":"T1069.002","title":"Domain Groups","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1069/002/","tactics":["Discovery"]},{"id":"T1069.003","title":"Cloud Groups","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1069/003/","tactics":["Discovery"]},{"id":"T1070","title":"Indicator Removal","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1070/","tactics":["Stealth"]},{"id":"T1070.001","title":"Clear Windows Event Logs","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1070/001/","tactics":["Stealth"]},{"id":"T1070.002","title":"Clear Linux or Mac System Logs","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1070/002/","tactics":["Stealth"]},{"id":"T1070.003","title":"Clear Command History","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1070/003/","tactics":["Stealth"]},{"id":"T1070.004","title":"File Deletion","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1070/004/","tactics":["Stealth"]},{"id":"T1070.005","title":"Network Share Connection Removal","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1070/005/","tactics":["Stealth"]},{"id":"T1070.006","title":"Timestomp","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1070/006/","tactics":["Stealth"]},{"id":"T1070.007","title":"Clear Network Connection History and Configurations","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1070/007/","tactics":["Stealth"]},{"id":"T1070.008","title":"Clear Mailbox Data","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1070/008/","tactics":["Stealth"]},{"id":"T1070.009","title":"Clear Persistence","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1070/009/","tactics":["Stealth"]},{"id":"T1070.010","title":"Relocate Malware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1070/010/","tactics":["Stealth"]},{"id":"T1071","title":"Application Layer Protocol","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1071/","tactics":["Command and Control"]},{"id":"T1071.001","title":"Web Protocols","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1071/001/","tactics":["Command and Control"]},{"id":"T1071.002","title":"File Transfer Protocols","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1071/002/","tactics":["Command and Control"]},{"id":"T1071.003","title":"Mail Protocols","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1071/003/","tactics":["Command and Control"]},{"id":"T1071.004","title":"DNS","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1071/004/","tactics":["Command and Control"]},{"id":"T1071.005","title":"Publish/Subscribe Protocols","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1071/005/","tactics":["Command and Control"]},{"id":"T1072","title":"Software Deployment Tools","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1072/","tactics":["Execution","Lateral Movement"]},{"id":"T1073","title":"DLL Side-Loading","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1073/","tactics":["Stealth"]},{"id":"T1074","title":"Data Staged","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1074/","tactics":["Collection"]},{"id":"T1074.001","title":"Local Data Staging","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1074/001/","tactics":["Collection"]},{"id":"T1074.002","title":"Remote Data Staging","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1074/002/","tactics":["Collection"]},{"id":"T1075","title":"Pass the Hash","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1075/","tactics":["Lateral Movement"]},{"id":"T1076","title":"Remote Desktop Protocol","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1076/","tactics":["Lateral Movement"]},{"id":"T1077","title":"Windows Admin Shares","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1077/","tactics":["Lateral Movement"]},{"id":"T1078","title":"Valid Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1078/","tactics":["Stealth","Persistence","Privilege Escalation","Initial Access"]},{"id":"T1078.001","title":"Default Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1078/001/","tactics":["Stealth","Persistence","Privilege Escalation","Initial Access"]},{"id":"T1078.002","title":"Domain Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1078/002/","tactics":["Stealth","Persistence","Privilege Escalation","Initial Access"]},{"id":"T1078.003","title":"Local Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1078/003/","tactics":["Stealth","Persistence","Privilege Escalation","Initial Access"]},{"id":"T1078.004","title":"Cloud Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1078/004/","tactics":["Stealth","Persistence","Privilege Escalation","Initial Access"]},{"id":"T1079","title":"Multilayer Encryption","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1079/","tactics":["Command and Control"]},{"id":"T1080","title":"Taint Shared Content","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1080/","tactics":["Lateral Movement"]},{"id":"T1081","title":"Credentials in Files","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1081/","tactics":["Credential Access"]},{"id":"T1082","title":"System Information Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1082/","tactics":["Discovery"]},{"id":"T1083","title":"File and Directory Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1083/","tactics":["Discovery"]},{"id":"T1084","title":"Windows Management Instrumentation Event Subscription","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1084/","tactics":["Persistence"]},{"id":"T1085","title":"Rundll32","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1085/","tactics":["Stealth","Execution"]},{"id":"T1086","title":"PowerShell","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1086/","tactics":["Execution"]},{"id":"T1087","title":"Account Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1087/","tactics":["Discovery"]},{"id":"T1087.001","title":"Local Account","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1087/001/","tactics":["Discovery"]},{"id":"T1087.002","title":"Domain Account","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1087/002/","tactics":["Discovery"]},{"id":"T1087.003","title":"Email Account","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1087/003/","tactics":["Discovery"]},{"id":"T1087.004","title":"Cloud Account","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1087/004/","tactics":["Discovery"]},{"id":"T1088","title":"Bypass User Account Control","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1088/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1089","title":"Disabling Security Tools","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1089/","tactics":["Stealth"]},{"id":"T1090","title":"Proxy","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1090/","tactics":["Command and Control"]},{"id":"T1090.001","title":"Internal Proxy","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1090/001/","tactics":["Command and Control"]},{"id":"T1090.002","title":"External Proxy","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1090/002/","tactics":["Command and Control"]},{"id":"T1090.003","title":"Multi-hop Proxy","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1090/003/","tactics":["Command and Control"]},{"id":"T1090.004","title":"Domain Fronting","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1090/004/","tactics":["Command and Control"]},{"id":"T1091","title":"Replication Through Removable Media","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1091/","tactics":["Lateral Movement","Initial Access"]},{"id":"T1092","title":"Communication Through Removable Media","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1092/","tactics":["Command and Control"]},{"id":"T1093","title":"Process Hollowing","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1093/","tactics":["Stealth"]},{"id":"T1094","title":"Custom Command and Control Protocol","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1094/","tactics":["Command and Control"]},{"id":"T1095","title":"Non-Application Layer Protocol","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1095/","tactics":["Command and Control"]},{"id":"T1096","title":"NTFS File Attributes","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1096/","tactics":["Stealth"]},{"id":"T1097","title":"Pass the Ticket","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1097/","tactics":["Lateral Movement"]},{"id":"T1098","title":"Account Manipulation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1098/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1098.001","title":"Additional Cloud Credentials","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1098/001/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1098.002","title":"Additional Email Delegate Permissions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1098/002/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1098.003","title":"Additional Cloud Roles","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1098/003/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1098.004","title":"SSH Authorized Keys","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1098/004/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1098.005","title":"Device Registration","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1098/005/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1098.006","title":"Additional Container Cluster Roles","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1098/006/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1098.007","title":"Additional Local or Domain Groups","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1098/007/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1099","title":"Timestomp","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1099/","tactics":["Stealth"]},{"id":"T1100","title":"Web Shell","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1100/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1101","title":"Security Support Provider","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1101/","tactics":["Persistence"]},{"id":"T1102","title":"Web Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1102/","tactics":["Command and Control"]},{"id":"T1102.001","title":"Dead Drop Resolver","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1102/001/","tactics":["Command and Control"]},{"id":"T1102.002","title":"Bidirectional Communication","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1102/002/","tactics":["Command and Control"]},{"id":"T1102.003","title":"One-Way Communication","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1102/003/","tactics":["Command and Control"]},{"id":"T1103","title":"AppInit DLLs","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1103/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1104","title":"Multi-Stage Channels","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1104/","tactics":["Command and Control"]},{"id":"T1105","title":"Ingress Tool Transfer","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1105/","tactics":["Command and Control"]},{"id":"T1106","title":"Native API","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1106/","tactics":["Execution"]},{"id":"T1107","title":"File Deletion","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1107/","tactics":["Stealth"]},{"id":"T1108","title":"Redundant Access","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1108/","tactics":["Stealth","Persistence"]},{"id":"T1109","title":"Component Firmware","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1109/","tactics":["Stealth","Persistence"]},{"id":"T1110","title":"Brute Force","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1110/","tactics":["Credential Access"]},{"id":"T1110.001","title":"Password Guessing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1110/001/","tactics":["Credential Access"]},{"id":"T1110.002","title":"Password Cracking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1110/002/","tactics":["Credential Access"]},{"id":"T1110.003","title":"Password Spraying","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1110/003/","tactics":["Credential Access"]},{"id":"T1110.004","title":"Credential Stuffing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1110/004/","tactics":["Credential Access"]},{"id":"T1111","title":"Multi-Factor Authentication Interception","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1111/","tactics":["Credential Access"]},{"id":"T1112","title":"Modify Registry","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1112/","tactics":["Defense Impairment","Persistence"]},{"id":"T1113","title":"Screen Capture","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1113/","tactics":["Collection"]},{"id":"T1114","title":"Email Collection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1114/","tactics":["Collection"]},{"id":"T1114.001","title":"Local Email Collection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1114/001/","tactics":["Collection"]},{"id":"T1114.002","title":"Remote Email Collection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1114/002/","tactics":["Collection"]},{"id":"T1114.003","title":"Email Forwarding Rule","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1114/003/","tactics":["Collection"]},{"id":"T1115","title":"Clipboard Data","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1115/","tactics":["Collection"]},{"id":"T1116","title":"Code Signing","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1116/","tactics":["Stealth"]},{"id":"T1117","title":"Regsvr32","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1117/","tactics":["Stealth","Execution"]},{"id":"T1118","title":"InstallUtil","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1118/","tactics":["Stealth","Execution"]},{"id":"T1119","title":"Automated Collection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1119/","tactics":["Collection"]},{"id":"T1120","title":"Peripheral Device Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1120/","tactics":["Discovery"]},{"id":"T1121","title":"Regsvcs/Regasm","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1121/","tactics":["Stealth","Execution"]},{"id":"T1122","title":"Component Object Model Hijacking","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1122/","tactics":["Stealth","Persistence"]},{"id":"T1123","title":"Audio Capture","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1123/","tactics":["Collection"]},{"id":"T1124","title":"System Time Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1124/","tactics":["Discovery"]},{"id":"T1125","title":"Video Capture","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1125/","tactics":["Collection"]},{"id":"T1126","title":"Network Share Connection Removal","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1126/","tactics":["Stealth"]},{"id":"T1127","title":"Trusted Developer Utilities Proxy Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1127/","tactics":["Stealth","Execution"]},{"id":"T1127.001","title":"MSBuild","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1127/001/","tactics":["Stealth","Execution"]},{"id":"T1127.002","title":"ClickOnce","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1127/002/","tactics":["Stealth","Execution"]},{"id":"T1127.003","title":"JamPlus","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1127/003/","tactics":["Stealth","Execution"]},{"id":"T1128","title":"Netsh Helper DLL","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1128/","tactics":["Persistence"]},{"id":"T1129","title":"Shared Modules","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1129/","tactics":["Execution"]},{"id":"T1130","title":"Install Root Certificate","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1130/","tactics":["Stealth"]},{"id":"T1131","title":"Authentication Package","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1131/","tactics":["Persistence"]},{"id":"T1132","title":"Data Encoding","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1132/","tactics":["Command and Control"]},{"id":"T1132.001","title":"Standard Encoding","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1132/001/","tactics":["Command and Control"]},{"id":"T1132.002","title":"Non-Standard Encoding","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1132/002/","tactics":["Command and Control"]},{"id":"T1133","title":"External Remote Services","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1133/","tactics":["Persistence","Initial Access"]},{"id":"T1134","title":"Access Token Manipulation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1134/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1134.001","title":"Token Impersonation/Theft","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1134/001/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1134.002","title":"Create Process with Token","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1134/002/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1134.003","title":"Make and Impersonate Token","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1134/003/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1134.004","title":"Parent PID Spoofing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1134/004/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1134.005","title":"SID-History Injection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1134/005/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1135","title":"Network Share Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1135/","tactics":["Discovery"]},{"id":"T1136","title":"Create Account","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1136/","tactics":["Persistence"]},{"id":"T1136.001","title":"Local Account","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1136/001/","tactics":["Persistence"]},{"id":"T1136.002","title":"Domain Account","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1136/002/","tactics":["Persistence"]},{"id":"T1136.003","title":"Cloud Account","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1136/003/","tactics":["Persistence"]},{"id":"T1137","title":"Office Application Startup","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1137/","tactics":["Persistence"]},{"id":"T1137.001","title":"Office Template Macros","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1137/001/","tactics":["Persistence"]},{"id":"T1137.002","title":"Office Test","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1137/002/","tactics":["Persistence"]},{"id":"T1137.003","title":"Outlook Forms","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1137/003/","tactics":["Persistence"]},{"id":"T1137.004","title":"Outlook Home Page","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1137/004/","tactics":["Persistence"]},{"id":"T1137.005","title":"Outlook Rules","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1137/005/","tactics":["Persistence"]},{"id":"T1137.006","title":"Add-ins","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1137/006/","tactics":["Persistence"]},{"id":"T1138","title":"Application Shimming","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1138/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1139","title":"Bash History","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1139/","tactics":["Credential Access"]},{"id":"T1140","title":"Deobfuscate/Decode Files or Information","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1140/","tactics":["Stealth"]},{"id":"T1141","title":"Input Prompt","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1141/","tactics":["Credential Access"]},{"id":"T1142","title":"Keychain","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1142/","tactics":["Credential Access"]},{"id":"T1143","title":"Hidden Window","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1143/","tactics":["Stealth"]},{"id":"T1144","title":"Gatekeeper Bypass","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1144/","tactics":["Stealth"]},{"id":"T1145","title":"Private Keys","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1145/","tactics":["Credential Access"]},{"id":"T1146","title":"Clear Command History","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1146/","tactics":["Stealth"]},{"id":"T1147","title":"Hidden Users","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1147/","tactics":["Stealth"]},{"id":"T1148","title":"HISTCONTROL","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1148/","tactics":["Stealth"]},{"id":"T1149","title":"LC_MAIN Hijacking","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1149/","tactics":["Stealth"]},{"id":"T1150","title":"Plist Modification","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1150/","tactics":["Stealth","Persistence","Privilege Escalation"]},{"id":"T1151","title":"Space after Filename","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1151/","tactics":["Stealth","Execution"]},{"id":"T1152","title":"Launchctl","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1152/","tactics":["Stealth","Execution","Persistence"]},{"id":"T1153","title":"Source","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1153/","tactics":["Execution"]},{"id":"T1154","title":"Trap","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1154/","tactics":["Execution","Persistence"]},{"id":"T1155","title":"AppleScript","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1155/","tactics":["Execution"]},{"id":"T1156","title":"Malicious Shell Modification","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1156/","tactics":["Persistence"]},{"id":"T1157","title":"Dylib Hijacking","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1157/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1158","title":"Hidden Files and Directories","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1158/","tactics":["Stealth","Persistence"]},{"id":"T1159","title":"Launch Agent","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1159/","tactics":["Persistence"]},{"id":"T1160","title":"Launch Daemon","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1160/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1161","title":"LC_LOAD_DYLIB Addition","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1161/","tactics":["Persistence"]},{"id":"T1162","title":"Login Item","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1162/","tactics":["Persistence"]},{"id":"T1163","title":"Rc.common","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1163/","tactics":["Persistence"]},{"id":"T1164","title":"Re-opened Applications","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1164/","tactics":["Persistence"]},{"id":"T1165","title":"Startup Items","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1165/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1166","title":"Setuid and Setgid","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1166/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1167","title":"Securityd Memory","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1167/","tactics":["Credential Access"]},{"id":"T1168","title":"Local Job Scheduling","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1168/","tactics":["Persistence","Execution"]},{"id":"T1169","title":"Sudo","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1169/","tactics":["Privilege Escalation"]},{"id":"T1170","title":"Mshta","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1170/","tactics":["Stealth","Execution"]},{"id":"T1171","title":"LLMNR/NBT-NS Poisoning and Relay","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1171/","tactics":["Credential Access"]},{"id":"T1172","title":"Domain Fronting","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1172/","tactics":["Command and Control"]},{"id":"T1173","title":"Dynamic Data Exchange","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1173/","tactics":["Execution"]},{"id":"T1174","title":"Password Filter DLL","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1174/","tactics":["Credential Access"]},{"id":"T1175","title":"Component Object Model and Distributed COM","kind":"technique","state":"deprecated","url":"https://attack.mitre.org/techniques/T1175/","tactics":["Lateral Movement","Execution"]},{"id":"T1176","title":"Software Extensions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1176/","tactics":["Persistence"]},{"id":"T1176.001","title":"Browser Extensions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1176/001/","tactics":["Persistence"]},{"id":"T1176.002","title":"IDE Extensions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1176/002/","tactics":["Persistence"]},{"id":"T1177","title":"LSASS Driver","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1177/","tactics":["Execution","Persistence"]},{"id":"T1178","title":"SID-History Injection","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1178/","tactics":["Privilege Escalation"]},{"id":"T1179","title":"Hooking","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1179/","tactics":["Persistence","Privilege Escalation","Credential Access"]},{"id":"T1180","title":"Screensaver","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1180/","tactics":["Persistence"]},{"id":"T1181","title":"Extra Window Memory Injection","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1181/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1182","title":"AppCert DLLs","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1182/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1183","title":"Image File Execution Options Injection","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1183/","tactics":["Privilege Escalation","Persistence","Stealth"]},{"id":"T1184","title":"SSH Hijacking","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1184/","tactics":["Lateral Movement"]},{"id":"T1185","title":"Browser Session Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1185/","tactics":["Collection"]},{"id":"T1186","title":"Process Doppelgänging","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1186/","tactics":["Stealth"]},{"id":"T1187","title":"Forced Authentication","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1187/","tactics":["Credential Access"]},{"id":"T1188","title":"Multi-hop Proxy","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1188/","tactics":["Command and Control"]},{"id":"T1189","title":"Drive-by Compromise","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1189/","tactics":["Initial Access"]},{"id":"T1190","title":"Exploit Public-Facing Application","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1190/","tactics":["Initial Access"]},{"id":"T1191","title":"CMSTP","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1191/","tactics":["Stealth","Execution"]},{"id":"T1192","title":"Spearphishing Link","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1192/","tactics":["Initial Access"]},{"id":"T1193","title":"Spearphishing Attachment","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1193/","tactics":["Initial Access"]},{"id":"T1194","title":"Spearphishing via Service","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1194/","tactics":["Initial Access"]},{"id":"T1195","title":"Supply Chain Compromise","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1195/","tactics":["Initial Access"]},{"id":"T1195.001","title":"Compromise Software Dependencies and Development Tools","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1195/001/","tactics":["Initial Access"]},{"id":"T1195.002","title":"Compromise Software Supply Chain","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1195/002/","tactics":["Initial Access"]},{"id":"T1195.003","title":"Compromise Hardware Supply Chain","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1195/003/","tactics":["Initial Access"]},{"id":"T1196","title":"Control Panel Items","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1196/","tactics":["Stealth","Execution"]},{"id":"T1197","title":"BITS Jobs","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1197/","tactics":["Stealth","Persistence","Execution"]},{"id":"T1198","title":"SIP and Trust Provider Hijacking","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1198/","tactics":["Stealth","Persistence"]},{"id":"T1199","title":"Trusted Relationship","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1199/","tactics":["Initial Access"]},{"id":"T1200","title":"Hardware Additions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1200/","tactics":["Initial Access"]},{"id":"T1201","title":"Password Policy Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1201/","tactics":["Discovery"]},{"id":"T1202","title":"Indirect Command Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1202/","tactics":["Stealth"]},{"id":"T1203","title":"Exploitation for Client Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1203/","tactics":["Execution"]},{"id":"T1204","title":"User Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1204/","tactics":["Execution"]},{"id":"T1204.001","title":"Malicious Link","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1204/001/","tactics":["Execution"]},{"id":"T1204.002","title":"Malicious File","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1204/002/","tactics":["Execution"]},{"id":"T1204.003","title":"Malicious Image","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1204/003/","tactics":["Execution"]},{"id":"T1204.004","title":"Malicious Copy and Paste","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1204/004/","tactics":["Execution"]},{"id":"T1204.005","title":"Malicious Library","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1204/005/","tactics":["Execution"]},{"id":"T1205","title":"Traffic Signaling","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1205/","tactics":["Stealth","Persistence","Command and Control"]},{"id":"T1205.001","title":"Port Knocking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1205/001/","tactics":["Stealth","Persistence","Command and Control"]},{"id":"T1205.002","title":"Socket Filters","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1205/002/","tactics":["Stealth","Persistence","Command and Control"]},{"id":"T1206","title":"Sudo Caching","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1206/","tactics":["Privilege Escalation"]},{"id":"T1207","title":"Rogue Domain Controller","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1207/","tactics":["Defense Impairment"]},{"id":"T1208","title":"Kerberoasting","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1208/","tactics":["Credential Access"]},{"id":"T1209","title":"Time Providers","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1209/","tactics":["Persistence"]},{"id":"T1210","title":"Exploitation of Remote Services","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1210/","tactics":["Lateral Movement"]},{"id":"T1211","title":"Exploitation for Stealth","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1211/","tactics":["Stealth"]},{"id":"T1212","title":"Exploitation for Credential Access","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1212/","tactics":["Credential Access"]},{"id":"T1213","title":"Data from Information Repositories","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1213/","tactics":["Collection"]},{"id":"T1213.001","title":"Confluence","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1213/001/","tactics":["Collection"]},{"id":"T1213.002","title":"Sharepoint","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1213/002/","tactics":["Collection"]},{"id":"T1213.003","title":"Code Repositories","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1213/003/","tactics":["Collection"]},{"id":"T1213.004","title":"Customer Relationship Management Software","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1213/004/","tactics":["Collection"]},{"id":"T1213.005","title":"Messaging Applications","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1213/005/","tactics":["Collection"]},{"id":"T1213.006","title":"Databases","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1213/006/","tactics":["Collection"]},{"id":"T1214","title":"Credentials in Registry","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1214/","tactics":["Credential Access"]},{"id":"T1215","title":"Kernel Modules and Extensions","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1215/","tactics":["Persistence"]},{"id":"T1216","title":"System Script Proxy Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1216/","tactics":["Stealth"]},{"id":"T1216.001","title":"PubPrn","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1216/001/","tactics":["Stealth"]},{"id":"T1216.002","title":"SyncAppvPublishingServer","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1216/002/","tactics":["Stealth"]},{"id":"T1217","title":"Browser Information Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1217/","tactics":["Discovery"]},{"id":"T1218","title":"System Binary Proxy Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/","tactics":["Stealth"]},{"id":"T1218.001","title":"Compiled HTML File","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/001/","tactics":["Stealth"]},{"id":"T1218.002","title":"Control Panel","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/002/","tactics":["Stealth"]},{"id":"T1218.003","title":"CMSTP","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/003/","tactics":["Stealth"]},{"id":"T1218.004","title":"InstallUtil","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/004/","tactics":["Stealth"]},{"id":"T1218.005","title":"Mshta","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/005/","tactics":["Stealth"]},{"id":"T1218.007","title":"Msiexec","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/007/","tactics":["Stealth"]},{"id":"T1218.008","title":"Odbcconf","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/008/","tactics":["Stealth"]},{"id":"T1218.009","title":"Regsvcs/Regasm","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/009/","tactics":["Stealth"]},{"id":"T1218.010","title":"Regsvr32","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/010/","tactics":["Stealth"]},{"id":"T1218.011","title":"Rundll32","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/011/","tactics":["Stealth"]},{"id":"T1218.012","title":"Verclsid","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/012/","tactics":["Stealth"]},{"id":"T1218.013","title":"Mavinject","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/013/","tactics":["Stealth"]},{"id":"T1218.014","title":"MMC","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/014/","tactics":["Stealth"]},{"id":"T1218.015","title":"Electron Applications","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1218/015/","tactics":["Stealth"]},{"id":"T1219","title":"Remote Access Tools","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1219/","tactics":["Command and Control"]},{"id":"T1219.001","title":"IDE Tunneling","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1219/001/","tactics":["Command and Control"]},{"id":"T1219.002","title":"Remote Desktop Software","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1219/002/","tactics":["Command and Control"]},{"id":"T1219.003","title":"Remote Access Hardware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1219/003/","tactics":["Command and Control"]},{"id":"T1220","title":"XSL Script Processing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1220/","tactics":["Stealth"]},{"id":"T1221","title":"Template Injection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1221/","tactics":["Stealth"]},{"id":"T1222","title":"File and Directory Permissions Modification","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1222/","tactics":["Defense Impairment"]},{"id":"T1222.001","title":"Windows Permissions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1222/001/","tactics":["Defense Impairment"]},{"id":"T1222.002","title":"Linux and Mac Permissions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1222/002/","tactics":["Defense Impairment"]},{"id":"T1223","title":"Compiled HTML File","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1223/","tactics":["Stealth","Execution"]},{"id":"T1480","title":"Execution Guardrails","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1480/","tactics":["Stealth"]},{"id":"T1480.001","title":"Environmental Keying","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1480/001/","tactics":["Stealth"]},{"id":"T1480.002","title":"Mutual Exclusion","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1480/002/","tactics":["Stealth"]},{"id":"T1482","title":"Domain Trust Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1482/","tactics":["Discovery"]},{"id":"T1483","title":"Domain Generation Algorithms","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1483/","tactics":["Command and Control"]},{"id":"T1484","title":"Domain or Tenant Policy Modification","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1484/","tactics":["Defense Impairment","Privilege Escalation"]},{"id":"T1484.001","title":"Group Policy Modification","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1484/001/","tactics":["Defense Impairment","Privilege Escalation"]},{"id":"T1484.002","title":"Trust Modification","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1484/002/","tactics":["Defense Impairment","Privilege Escalation"]},{"id":"T1485","title":"Data Destruction","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1485/","tactics":["Impact"]},{"id":"T1485.001","title":"Lifecycle-Triggered Deletion","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1485/001/","tactics":["Impact"]},{"id":"T1486","title":"Data Encrypted for Impact","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1486/","tactics":["Impact"]},{"id":"T1487","title":"Disk Structure Wipe","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1487/","tactics":["Impact"]},{"id":"T1488","title":"Disk Content Wipe","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1488/","tactics":["Impact"]},{"id":"T1489","title":"Service Stop","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1489/","tactics":["Impact"]},{"id":"T1490","title":"Inhibit System Recovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1490/","tactics":["Impact"]},{"id":"T1491","title":"Defacement","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1491/","tactics":["Impact"]},{"id":"T1491.001","title":"Internal Defacement","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1491/001/","tactics":["Impact"]},{"id":"T1491.002","title":"External Defacement","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1491/002/","tactics":["Impact"]},{"id":"T1492","title":"Stored Data Manipulation","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1492/","tactics":["Impact"]},{"id":"T1493","title":"Transmitted Data Manipulation","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1493/","tactics":["Impact"]},{"id":"T1494","title":"Runtime Data Manipulation","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1494/","tactics":["Impact"]},{"id":"T1495","title":"Firmware Corruption","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1495/","tactics":["Impact"]},{"id":"T1496","title":"Resource Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1496/","tactics":["Impact"]},{"id":"T1496.001","title":"Compute Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1496/001/","tactics":["Impact"]},{"id":"T1496.002","title":"Bandwidth Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1496/002/","tactics":["Impact"]},{"id":"T1496.003","title":"SMS Pumping","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1496/003/","tactics":["Impact"]},{"id":"T1496.004","title":"Cloud Service Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1496/004/","tactics":["Impact"]},{"id":"T1497","title":"Virtualization/Sandbox Evasion","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1497/","tactics":["Stealth","Discovery"]},{"id":"T1497.001","title":"System Checks","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1497/001/","tactics":["Stealth","Discovery"]},{"id":"T1497.002","title":"User Activity Based Checks","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1497/002/","tactics":["Stealth","Discovery"]},{"id":"T1497.003","title":"Time Based Checks","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1497/003/","tactics":["Stealth","Discovery"]},{"id":"T1498","title":"Network Denial of Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1498/","tactics":["Impact"]},{"id":"T1498.001","title":"Direct Network Flood","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1498/001/","tactics":["Impact"]},{"id":"T1498.002","title":"Reflection Amplification","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1498/002/","tactics":["Impact"]},{"id":"T1499","title":"Endpoint Denial of Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1499/","tactics":["Impact"]},{"id":"T1499.001","title":"OS Exhaustion Flood","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1499/001/","tactics":["Impact"]},{"id":"T1499.002","title":"Service Exhaustion Flood","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1499/002/","tactics":["Impact"]},{"id":"T1499.003","title":"Application Exhaustion Flood","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1499/003/","tactics":["Impact"]},{"id":"T1499.004","title":"Application or System Exploitation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1499/004/","tactics":["Impact"]},{"id":"T1500","title":"Compile After Delivery","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1500/","tactics":["Stealth"]},{"id":"T1501","title":"Systemd Service","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1501/","tactics":["Persistence"]},{"id":"T1502","title":"Parent PID Spoofing","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1502/","tactics":["Stealth","Privilege Escalation"]},{"id":"T1503","title":"Credentials from Web Browsers","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1503/","tactics":["Credential Access"]},{"id":"T1504","title":"PowerShell Profile","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1504/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1505","title":"Server Software Component","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1505/","tactics":["Persistence"]},{"id":"T1505.001","title":"SQL Stored Procedures","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1505/001/","tactics":["Persistence"]},{"id":"T1505.002","title":"Transport Agent","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1505/002/","tactics":["Persistence"]},{"id":"T1505.003","title":"Web Shell","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1505/003/","tactics":["Persistence"]},{"id":"T1505.004","title":"IIS Components","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1505/004/","tactics":["Persistence"]},{"id":"T1505.005","title":"Terminal Services DLL","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1505/005/","tactics":["Persistence"]},{"id":"T1505.006","title":"vSphere Installation Bundles","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1505/006/","tactics":["Persistence"]},{"id":"T1506","title":"Web Session Cookie","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1506/","tactics":["Stealth","Lateral Movement"]},{"id":"T1514","title":"Elevated Execution with Prompt","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1514/","tactics":["Privilege Escalation"]},{"id":"T1518","title":"Software Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1518/","tactics":["Discovery"]},{"id":"T1518.001","title":"Security Software Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1518/001/","tactics":["Discovery"]},{"id":"T1518.002","title":"Backup Software Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1518/002/","tactics":["Discovery"]},{"id":"T1519","title":"Emond","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1519/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1522","title":"Cloud Instance Metadata API","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1522/","tactics":["Credential Access"]},{"id":"T1525","title":"Implant Internal Image","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1525/","tactics":["Persistence"]},{"id":"T1526","title":"Cloud Service Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1526/","tactics":["Discovery"]},{"id":"T1527","title":"Application Access Token","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1527/","tactics":["Stealth","Lateral Movement"]},{"id":"T1528","title":"Steal Application Access Token","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1528/","tactics":["Credential Access"]},{"id":"T1529","title":"System Shutdown/Reboot","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1529/","tactics":["Impact"]},{"id":"T1530","title":"Data from Cloud Storage","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1530/","tactics":["Collection"]},{"id":"T1531","title":"Account Access Removal","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1531/","tactics":["Impact"]},{"id":"T1534","title":"Internal Spearphishing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1534/","tactics":["Lateral Movement"]},{"id":"T1535","title":"Unused/Unsupported Cloud Regions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1535/","tactics":["Stealth"]},{"id":"T1536","title":"Revert Cloud Instance","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1536/","tactics":["Stealth"]},{"id":"T1537","title":"Transfer Data to Cloud Account","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1537/","tactics":["Exfiltration"]},{"id":"T1538","title":"Cloud Service Dashboard","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1538/","tactics":["Discovery"]},{"id":"T1539","title":"Steal Web Session Cookie","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1539/","tactics":["Credential Access"]},{"id":"T1542","title":"Pre-OS Boot","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1542/","tactics":["Stealth","Persistence"]},{"id":"T1542.001","title":"System Firmware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1542/001/","tactics":["Stealth","Persistence"]},{"id":"T1542.002","title":"Component Firmware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1542/002/","tactics":["Stealth","Persistence"]},{"id":"T1542.003","title":"Bootkit","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1542/003/","tactics":["Stealth","Persistence"]},{"id":"T1542.004","title":"ROMMONkit","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1542/004/","tactics":["Stealth","Persistence"]},{"id":"T1542.005","title":"TFTP Boot","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1542/005/","tactics":["Stealth","Persistence"]},{"id":"T1543","title":"Create or Modify System Process","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1543/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1543.001","title":"Launch Agent","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1543/001/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1543.002","title":"Systemd Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1543/002/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1543.003","title":"Windows Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1543/003/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1543.004","title":"Launch Daemon","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1543/004/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1543.005","title":"Container Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1543/005/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1546","title":"Event Triggered Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.001","title":"Change Default File Association","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/001/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.002","title":"Screensaver","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/002/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.003","title":"Windows Management Instrumentation Event Subscription","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/003/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.004","title":"Unix Shell Configuration Modification","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/004/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.005","title":"Trap","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/005/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.006","title":"LC_LOAD_DYLIB Addition","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/006/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.007","title":"Netsh Helper DLL","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/007/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.008","title":"Accessibility Features","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/008/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.009","title":"AppCert DLLs","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/009/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.010","title":"AppInit DLLs","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/010/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.011","title":"Application Shimming","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/011/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.012","title":"Image File Execution Options Injection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/012/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.013","title":"PowerShell Profile","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/013/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.014","title":"Emond","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/014/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.015","title":"Component Object Model Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/015/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.016","title":"Installer Packages","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/016/","tactics":["Privilege Escalation","Persistence"]},{"id":"T1546.017","title":"Udev Rules","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/017/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1546.018","title":"Python Startup Hooks","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1546/018/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547","title":"Boot or Logon Autostart Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.001","title":"Registry Run Keys / Startup Folder","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/001/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.002","title":"Authentication Package","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/002/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.003","title":"Time Providers","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/003/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.004","title":"Winlogon Helper DLL","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/004/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.005","title":"Security Support Provider","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/005/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.006","title":"Kernel Modules and Extensions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/006/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.007","title":"Re-opened Applications","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/007/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.008","title":"LSASS Driver","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/008/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.009","title":"Shortcut Modification","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/009/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.010","title":"Port Monitors","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/010/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.011","title":"Plist Modification","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1547/011/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.012","title":"Print Processors","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/012/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.013","title":"XDG Autostart Entries","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/013/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.014","title":"Active Setup","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/014/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1547.015","title":"Login Items","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1547/015/","tactics":["Persistence","Privilege Escalation"]},{"id":"T1548","title":"Abuse Elevation Control Mechanism","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1548/","tactics":["Privilege Escalation"]},{"id":"T1548.001","title":"Setuid and Setgid","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1548/001/","tactics":["Privilege Escalation"]},{"id":"T1548.002","title":"Bypass User Account Control","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1548/002/","tactics":["Privilege Escalation"]},{"id":"T1548.003","title":"Sudo and Sudo Caching","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1548/003/","tactics":["Privilege Escalation"]},{"id":"T1548.004","title":"Elevated Execution with Prompt","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1548/004/","tactics":["Privilege Escalation"]},{"id":"T1548.005","title":"Temporary Elevated Cloud Access","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1548/005/","tactics":["Privilege Escalation"]},{"id":"T1548.006","title":"TCC Manipulation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1548/006/","tactics":["Privilege Escalation"]},{"id":"T1550","title":"Use Alternate Authentication Material","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1550/","tactics":["Lateral Movement"]},{"id":"T1550.001","title":"Application Access Token","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1550/001/","tactics":["Lateral Movement"]},{"id":"T1550.002","title":"Pass the Hash","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1550/002/","tactics":["Lateral Movement"]},{"id":"T1550.003","title":"Pass the Ticket","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1550/003/","tactics":["Lateral Movement"]},{"id":"T1550.004","title":"Web Session Cookie","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1550/004/","tactics":["Lateral Movement"]},{"id":"T1552","title":"Unsecured Credentials","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1552/","tactics":["Credential Access"]},{"id":"T1552.001","title":"Credentials In Files","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1552/001/","tactics":["Credential Access"]},{"id":"T1552.002","title":"Credentials in Registry","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1552/002/","tactics":["Credential Access"]},{"id":"T1552.003","title":"Shell History","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1552/003/","tactics":["Credential Access"]},{"id":"T1552.004","title":"Private Keys","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1552/004/","tactics":["Credential Access"]},{"id":"T1552.005","title":"Cloud Instance Metadata API","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1552/005/","tactics":["Credential Access"]},{"id":"T1552.006","title":"Group Policy Preferences","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1552/006/","tactics":["Credential Access"]},{"id":"T1552.007","title":"Container API","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1552/007/","tactics":["Credential Access"]},{"id":"T1552.008","title":"Chat Messages","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1552/008/","tactics":["Credential Access"]},{"id":"T1553","title":"Subvert Trust Controls","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1553/","tactics":["Defense Impairment"]},{"id":"T1553.001","title":"Gatekeeper Bypass","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1553/001/","tactics":["Defense Impairment"]},{"id":"T1553.002","title":"Code Signing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1553/002/","tactics":["Defense Impairment"]},{"id":"T1553.003","title":"SIP and Trust Provider Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1553/003/","tactics":["Defense Impairment"]},{"id":"T1553.004","title":"Install Root Certificate","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1553/004/","tactics":["Defense Impairment"]},{"id":"T1553.005","title":"Mark-of-the-Web Bypass","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1553/005/","tactics":["Defense Impairment"]},{"id":"T1553.006","title":"Code Signing Policy Modification","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1553/006/","tactics":["Defense Impairment"]},{"id":"T1554","title":"Compromise Host Software Binary","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1554/","tactics":["Persistence"]},{"id":"T1555","title":"Credentials from Password Stores","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1555/","tactics":["Credential Access"]},{"id":"T1555.001","title":"Keychain","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1555/001/","tactics":["Credential Access"]},{"id":"T1555.002","title":"Securityd Memory","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1555/002/","tactics":["Credential Access"]},{"id":"T1555.003","title":"Credentials from Web Browsers","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1555/003/","tactics":["Credential Access"]},{"id":"T1555.004","title":"Windows Credential Manager","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1555/004/","tactics":["Credential Access"]},{"id":"T1555.005","title":"Password Managers","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1555/005/","tactics":["Credential Access"]},{"id":"T1555.006","title":"Cloud Secrets Management Stores","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1555/006/","tactics":["Credential Access"]},{"id":"T1556","title":"Modify Authentication Process","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1556.001","title":"Domain Controller Authentication","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/001/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1556.002","title":"Password Filter DLL","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/002/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1556.003","title":"Pluggable Authentication Modules","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/003/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1556.004","title":"Network Device Authentication","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/004/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1556.005","title":"Reversible Encryption","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/005/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1556.006","title":"Multi-Factor Authentication","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/006/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1556.007","title":"Hybrid Identity","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/007/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1556.008","title":"Network Provider DLL","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/008/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1556.009","title":"Conditional Access Policies","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1556/009/","tactics":["Defense Impairment","Persistence","Credential Access"]},{"id":"T1557","title":"Adversary-in-the-Middle","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1557/","tactics":["Credential Access","Collection"]},{"id":"T1557.001","title":"Name Resolution Poisoning and SMB Relay","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1557/001/","tactics":["Credential Access","Collection"]},{"id":"T1557.002","title":"ARP Cache Poisoning","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1557/002/","tactics":["Credential Access","Collection"]},{"id":"T1557.003","title":"DHCP Spoofing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1557/003/","tactics":["Credential Access","Collection"]},{"id":"T1557.004","title":"Evil Twin","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1557/004/","tactics":["Credential Access","Collection"]},{"id":"T1558","title":"Steal or Forge Kerberos Tickets","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1558/","tactics":["Credential Access"]},{"id":"T1558.001","title":"Golden Ticket","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1558/001/","tactics":["Credential Access"]},{"id":"T1558.002","title":"Silver Ticket","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1558/002/","tactics":["Credential Access"]},{"id":"T1558.003","title":"Kerberoasting","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1558/003/","tactics":["Credential Access"]},{"id":"T1558.004","title":"AS-REP Roasting","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1558/004/","tactics":["Credential Access"]},{"id":"T1558.005","title":"Ccache Files","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1558/005/","tactics":["Credential Access"]},{"id":"T1559","title":"Inter-Process Communication","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1559/","tactics":["Execution"]},{"id":"T1559.001","title":"Component Object Model","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1559/001/","tactics":["Execution"]},{"id":"T1559.002","title":"Dynamic Data Exchange","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1559/002/","tactics":["Execution"]},{"id":"T1559.003","title":"XPC Services","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1559/003/","tactics":["Execution"]},{"id":"T1560","title":"Archive Collected Data","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1560/","tactics":["Collection"]},{"id":"T1560.001","title":"Archive via Utility","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1560/001/","tactics":["Collection"]},{"id":"T1560.002","title":"Archive via Library","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1560/002/","tactics":["Collection"]},{"id":"T1560.003","title":"Archive via Custom Method","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1560/003/","tactics":["Collection"]},{"id":"T1561","title":"Disk Wipe","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1561/","tactics":["Impact"]},{"id":"T1561.001","title":"Disk Content Wipe","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1561/001/","tactics":["Impact"]},{"id":"T1561.002","title":"Disk Structure Wipe","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1561/002/","tactics":["Impact"]},{"id":"T1562","title":"Impair Defenses","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/","tactics":["Stealth"]},{"id":"T1562.001","title":"Disable or Modify Tools","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/001/","tactics":["Stealth"]},{"id":"T1562.002","title":"Disable Windows Event Logging","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/002/","tactics":["Stealth"]},{"id":"T1562.003","title":"Impair Command History Logging","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/003/","tactics":["Stealth"]},{"id":"T1562.004","title":"Disable or Modify System Firewall","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/004/","tactics":["Stealth"]},{"id":"T1562.006","title":"Indicator Blocking","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/006/","tactics":["Stealth"]},{"id":"T1562.007","title":"Disable or Modify Cloud Firewall","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/007/","tactics":["Stealth"]},{"id":"T1562.008","title":"Disable or Modify Cloud Logs","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/008/","tactics":["Stealth"]},{"id":"T1562.009","title":"Safe Mode Boot","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/009/","tactics":["Stealth"]},{"id":"T1562.010","title":"Downgrade Attack","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/010/","tactics":["Stealth"]},{"id":"T1562.011","title":"Spoof Security Alerting","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/011/","tactics":["Stealth"]},{"id":"T1562.012","title":"Disable or Modify Linux Audit System","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/012/","tactics":["Stealth"]},{"id":"T1562.013","title":"Disable or Modify Network Device Firewall","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1562/013/","tactics":["Stealth"]},{"id":"T1563","title":"Remote Service Session Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1563/","tactics":["Lateral Movement"]},{"id":"T1563.001","title":"SSH Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1563/001/","tactics":["Lateral Movement"]},{"id":"T1563.002","title":"RDP Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1563/002/","tactics":["Lateral Movement"]},{"id":"T1564","title":"Hide Artifacts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/","tactics":["Stealth"]},{"id":"T1564.001","title":"Hidden Files and Directories","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/001/","tactics":["Stealth"]},{"id":"T1564.002","title":"Hidden Users","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/002/","tactics":["Stealth"]},{"id":"T1564.003","title":"Hidden Window","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/003/","tactics":["Stealth"]},{"id":"T1564.004","title":"NTFS File Attributes","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/004/","tactics":["Stealth"]},{"id":"T1564.005","title":"Hidden File System","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/005/","tactics":["Stealth"]},{"id":"T1564.006","title":"Run Virtual Instance","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/006/","tactics":["Stealth"]},{"id":"T1564.007","title":"VBA Stomping","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/007/","tactics":["Stealth"]},{"id":"T1564.008","title":"Email Hiding Rules","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/008/","tactics":["Stealth"]},{"id":"T1564.009","title":"Resource Forking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/009/","tactics":["Stealth"]},{"id":"T1564.010","title":"Process Argument Spoofing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/010/","tactics":["Stealth"]},{"id":"T1564.011","title":"Ignore Process Interrupts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/011/","tactics":["Stealth"]},{"id":"T1564.012","title":"File/Path Exclusions","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/012/","tactics":["Stealth"]},{"id":"T1564.013","title":"Bind Mounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/013/","tactics":["Stealth"]},{"id":"T1564.014","title":"Extended Attributes","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1564/014/","tactics":["Stealth"]},{"id":"T1565","title":"Data Manipulation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1565/","tactics":["Impact"]},{"id":"T1565.001","title":"Stored Data Manipulation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1565/001/","tactics":["Impact"]},{"id":"T1565.002","title":"Transmitted Data Manipulation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1565/002/","tactics":["Impact"]},{"id":"T1565.003","title":"Runtime Data Manipulation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1565/003/","tactics":["Impact"]},{"id":"T1566","title":"Phishing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1566/","tactics":["Initial Access"]},{"id":"T1566.001","title":"Spearphishing Attachment","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1566/001/","tactics":["Initial Access"]},{"id":"T1566.002","title":"Spearphishing Link","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1566/002/","tactics":["Initial Access"]},{"id":"T1566.003","title":"Spearphishing via Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1566/003/","tactics":["Initial Access"]},{"id":"T1566.004","title":"Spearphishing Voice","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1566/004/","tactics":["Initial Access"]},{"id":"T1567","title":"Exfiltration Over Web Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1567/","tactics":["Exfiltration"]},{"id":"T1567.001","title":"Exfiltration to Code Repository","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1567/001/","tactics":["Exfiltration"]},{"id":"T1567.002","title":"Exfiltration to Cloud Storage","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1567/002/","tactics":["Exfiltration"]},{"id":"T1567.003","title":"Exfiltration to Text Storage Sites","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1567/003/","tactics":["Exfiltration"]},{"id":"T1567.004","title":"Exfiltration Over Webhook","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1567/004/","tactics":["Exfiltration"]},{"id":"T1568","title":"Dynamic Resolution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1568/","tactics":["Command and Control"]},{"id":"T1568.001","title":"Fast Flux DNS","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1568/001/","tactics":["Command and Control"]},{"id":"T1568.002","title":"Domain Generation Algorithms","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1568/002/","tactics":["Command and Control"]},{"id":"T1568.003","title":"DNS Calculation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1568/003/","tactics":["Command and Control"]},{"id":"T1569","title":"System Services","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1569/","tactics":["Execution"]},{"id":"T1569.001","title":"Launchctl","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1569/001/","tactics":["Execution"]},{"id":"T1569.002","title":"Service Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1569/002/","tactics":["Execution"]},{"id":"T1569.003","title":"Systemctl","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1569/003/","tactics":["Execution"]},{"id":"T1570","title":"Lateral Tool Transfer","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1570/","tactics":["Lateral Movement"]},{"id":"T1571","title":"Non-Standard Port","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1571/","tactics":["Command and Control"]},{"id":"T1572","title":"Protocol Tunneling","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1572/","tactics":["Command and Control"]},{"id":"T1573","title":"Encrypted Channel","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1573/","tactics":["Command and Control"]},{"id":"T1573.001","title":"Symmetric Cryptography","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1573/001/","tactics":["Command and Control"]},{"id":"T1573.002","title":"Asymmetric Cryptography","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1573/002/","tactics":["Command and Control"]},{"id":"T1574","title":"Hijack Execution Flow","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/","tactics":["Stealth","Execution"]},{"id":"T1574.001","title":"DLL","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/001/","tactics":["Stealth","Execution"]},{"id":"T1574.002","title":"DLL Side-Loading","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1574/002/","tactics":["Stealth","Execution"]},{"id":"T1574.004","title":"Dylib Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/004/","tactics":["Stealth","Execution"]},{"id":"T1574.005","title":"Executable Installer File Permissions Weakness","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/005/","tactics":["Stealth","Execution"]},{"id":"T1574.006","title":"Dynamic Linker Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/006/","tactics":["Stealth","Execution"]},{"id":"T1574.007","title":"Path Interception by PATH Environment Variable","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/007/","tactics":["Stealth","Execution"]},{"id":"T1574.008","title":"Path Interception by Search Order Hijacking","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/008/","tactics":["Stealth","Execution"]},{"id":"T1574.009","title":"Path Interception by Unquoted Path","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/009/","tactics":["Stealth","Execution"]},{"id":"T1574.010","title":"Services File Permissions Weakness","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/010/","tactics":["Stealth","Execution"]},{"id":"T1574.011","title":"Services Registry Permissions Weakness","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/011/","tactics":["Stealth","Execution"]},{"id":"T1574.012","title":"COR_PROFILER","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/012/","tactics":["Stealth","Execution"]},{"id":"T1574.013","title":"KernelCallbackTable","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/013/","tactics":["Stealth","Execution"]},{"id":"T1574.014","title":"AppDomainManager","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1574/014/","tactics":["Stealth","Execution"]},{"id":"T1578","title":"Modify Cloud Compute Infrastructure","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1578/","tactics":["Defense Impairment"]},{"id":"T1578.001","title":"Create Snapshot","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1578/001/","tactics":["Defense Impairment"]},{"id":"T1578.002","title":"Create Cloud Instance","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1578/002/","tactics":["Defense Impairment"]},{"id":"T1578.003","title":"Delete Cloud Instance","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1578/003/","tactics":["Defense Impairment"]},{"id":"T1578.004","title":"Revert Cloud Instance","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1578/004/","tactics":["Defense Impairment"]},{"id":"T1578.005","title":"Modify Cloud Compute Configurations","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1578/005/","tactics":["Defense Impairment"]},{"id":"T1580","title":"Cloud Infrastructure Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1580/","tactics":["Discovery"]},{"id":"T1583","title":"Acquire Infrastructure","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1583/","tactics":["Resource Development"]},{"id":"T1583.001","title":"Domains","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1583/001/","tactics":["Resource Development"]},{"id":"T1583.002","title":"DNS Server","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1583/002/","tactics":["Resource Development"]},{"id":"T1583.003","title":"Virtual Private Server","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1583/003/","tactics":["Resource Development"]},{"id":"T1583.004","title":"Server","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1583/004/","tactics":["Resource Development"]},{"id":"T1583.005","title":"Botnet","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1583/005/","tactics":["Resource Development"]},{"id":"T1583.006","title":"Web Services","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1583/006/","tactics":["Resource Development"]},{"id":"T1583.007","title":"Serverless","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1583/007/","tactics":["Resource Development"]},{"id":"T1583.008","title":"Malvertising","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1583/008/","tactics":["Resource Development"]},{"id":"T1584","title":"Compromise Infrastructure","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1584/","tactics":["Resource Development"]},{"id":"T1584.001","title":"Domains","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1584/001/","tactics":["Resource Development"]},{"id":"T1584.002","title":"DNS Server","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1584/002/","tactics":["Resource Development"]},{"id":"T1584.003","title":"Virtual Private Server","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1584/003/","tactics":["Resource Development"]},{"id":"T1584.004","title":"Server","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1584/004/","tactics":["Resource Development"]},{"id":"T1584.005","title":"Botnet","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1584/005/","tactics":["Resource Development"]},{"id":"T1584.006","title":"Web Services","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1584/006/","tactics":["Resource Development"]},{"id":"T1584.007","title":"Serverless","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1584/007/","tactics":["Resource Development"]},{"id":"T1584.008","title":"Network Devices","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1584/008/","tactics":["Resource Development"]},{"id":"T1585","title":"Establish Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1585/","tactics":["Resource Development"]},{"id":"T1585.001","title":"Social Media Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1585/001/","tactics":["Resource Development"]},{"id":"T1585.002","title":"Email Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1585/002/","tactics":["Resource Development"]},{"id":"T1585.003","title":"Cloud Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1585/003/","tactics":["Resource Development"]},{"id":"T1586","title":"Compromise Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1586/","tactics":["Resource Development"]},{"id":"T1586.001","title":"Social Media Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1586/001/","tactics":["Resource Development"]},{"id":"T1586.002","title":"Email Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1586/002/","tactics":["Resource Development"]},{"id":"T1586.003","title":"Cloud Accounts","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1586/003/","tactics":["Resource Development"]},{"id":"T1587","title":"Develop Capabilities","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1587/","tactics":["Resource Development"]},{"id":"T1587.001","title":"Malware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1587/001/","tactics":["Resource Development"]},{"id":"T1587.002","title":"Code Signing Certificates","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1587/002/","tactics":["Resource Development"]},{"id":"T1587.003","title":"Digital Certificates","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1587/003/","tactics":["Resource Development"]},{"id":"T1587.004","title":"Exploits","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1587/004/","tactics":["Resource Development"]},{"id":"T1588","title":"Obtain Capabilities","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1588/","tactics":["Resource Development"]},{"id":"T1588.001","title":"Malware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1588/001/","tactics":["Resource Development"]},{"id":"T1588.002","title":"Tool","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1588/002/","tactics":["Resource Development"]},{"id":"T1588.003","title":"Code Signing Certificates","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1588/003/","tactics":["Resource Development"]},{"id":"T1588.004","title":"Digital Certificates","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1588/004/","tactics":["Resource Development"]},{"id":"T1588.005","title":"Exploits","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1588/005/","tactics":["Resource Development"]},{"id":"T1588.006","title":"Vulnerabilities","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1588/006/","tactics":["Resource Development"]},{"id":"T1588.007","title":"Artificial Intelligence","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1588/007/","tactics":["Resource Development"]},{"id":"T1589","title":"Gather Victim Identity Information","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1589/","tactics":["Reconnaissance"]},{"id":"T1589.001","title":"Credentials","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1589/001/","tactics":["Reconnaissance"]},{"id":"T1589.002","title":"Email Addresses","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1589/002/","tactics":["Reconnaissance"]},{"id":"T1589.003","title":"Employee Names","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1589/003/","tactics":["Reconnaissance"]},{"id":"T1590","title":"Gather Victim Network Information","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1590/","tactics":["Reconnaissance"]},{"id":"T1590.001","title":"Domain Properties","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1590/001/","tactics":["Reconnaissance"]},{"id":"T1590.002","title":"DNS","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1590/002/","tactics":["Reconnaissance"]},{"id":"T1590.003","title":"Network Trust Dependencies","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1590/003/","tactics":["Reconnaissance"]},{"id":"T1590.004","title":"Network Topology","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1590/004/","tactics":["Reconnaissance"]},{"id":"T1590.005","title":"IP Addresses","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1590/005/","tactics":["Reconnaissance"]},{"id":"T1590.006","title":"Network Security Appliances","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1590/006/","tactics":["Reconnaissance"]},{"id":"T1591","title":"Gather Victim Org Information","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1591/","tactics":["Reconnaissance"]},{"id":"T1591.001","title":"Determine Physical Locations","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1591/001/","tactics":["Reconnaissance"]},{"id":"T1591.002","title":"Business Relationships","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1591/002/","tactics":["Reconnaissance"]},{"id":"T1591.003","title":"Identify Business Tempo","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1591/003/","tactics":["Reconnaissance"]},{"id":"T1591.004","title":"Identify Roles","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1591/004/","tactics":["Reconnaissance"]},{"id":"T1592","title":"Gather Victim Host Information","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1592/","tactics":["Reconnaissance"]},{"id":"T1592.001","title":"Hardware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1592/001/","tactics":["Reconnaissance"]},{"id":"T1592.002","title":"Software","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1592/002/","tactics":["Reconnaissance"]},{"id":"T1592.003","title":"Firmware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1592/003/","tactics":["Reconnaissance"]},{"id":"T1592.004","title":"Client Configurations","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1592/004/","tactics":["Reconnaissance"]},{"id":"T1593","title":"Search Open Websites/Domains","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1593/","tactics":["Reconnaissance"]},{"id":"T1593.001","title":"Social Media","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1593/001/","tactics":["Reconnaissance"]},{"id":"T1593.002","title":"Search Engines","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1593/002/","tactics":["Reconnaissance"]},{"id":"T1593.003","title":"Code Repositories","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1593/003/","tactics":["Reconnaissance"]},{"id":"T1594","title":"Search Victim-Owned Websites","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1594/","tactics":["Reconnaissance"]},{"id":"T1595","title":"Active Scanning","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1595/","tactics":["Reconnaissance"]},{"id":"T1595.001","title":"Scanning IP Blocks","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1595/001/","tactics":["Reconnaissance"]},{"id":"T1595.002","title":"Vulnerability Scanning","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1595/002/","tactics":["Reconnaissance"]},{"id":"T1595.003","title":"Wordlist Scanning","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1595/003/","tactics":["Reconnaissance"]},{"id":"T1596","title":"Search Open Technical Databases","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1596/","tactics":["Reconnaissance"]},{"id":"T1596.001","title":"DNS/Passive DNS","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1596/001/","tactics":["Reconnaissance"]},{"id":"T1596.002","title":"WHOIS","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1596/002/","tactics":["Reconnaissance"]},{"id":"T1596.003","title":"Digital Certificates","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1596/003/","tactics":["Reconnaissance"]},{"id":"T1596.004","title":"CDNs","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1596/004/","tactics":["Reconnaissance"]},{"id":"T1596.005","title":"Scan Databases","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1596/005/","tactics":["Reconnaissance"]},{"id":"T1597","title":"Search Closed Sources","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1597/","tactics":["Reconnaissance"]},{"id":"T1597.001","title":"Threat Intel Vendors","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1597/001/","tactics":["Reconnaissance"]},{"id":"T1597.002","title":"Purchase Technical Data","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1597/002/","tactics":["Reconnaissance"]},{"id":"T1598","title":"Phishing for Information","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1598/","tactics":["Reconnaissance"]},{"id":"T1598.001","title":"Spearphishing Service","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1598/001/","tactics":["Reconnaissance"]},{"id":"T1598.002","title":"Spearphishing Attachment","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1598/002/","tactics":["Reconnaissance"]},{"id":"T1598.003","title":"Spearphishing Link","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1598/003/","tactics":["Reconnaissance"]},{"id":"T1598.004","title":"Spearphishing Voice","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1598/004/","tactics":["Reconnaissance"]},{"id":"T1599","title":"Network Boundary Bridging","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1599/","tactics":["Defense Impairment"]},{"id":"T1599.001","title":"Network Address Translation Traversal","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1599/001/","tactics":["Defense Impairment"]},{"id":"T1600","title":"Weaken Encryption","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1600/","tactics":["Defense Impairment"]},{"id":"T1600.001","title":"Reduce Key Space","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1600/001/","tactics":["Defense Impairment"]},{"id":"T1600.002","title":"Disable Crypto Hardware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1600/002/","tactics":["Defense Impairment"]},{"id":"T1601","title":"Modify System Image","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1601/","tactics":["Defense Impairment"]},{"id":"T1601.001","title":"Patch System Image","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1601/001/","tactics":["Defense Impairment"]},{"id":"T1601.002","title":"Downgrade System Image","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1601/002/","tactics":["Defense Impairment"]},{"id":"T1602","title":"Data from Configuration Repository","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1602/","tactics":["Collection"]},{"id":"T1602.001","title":"SNMP (MIB Dump)","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1602/001/","tactics":["Collection"]},{"id":"T1602.002","title":"Network Device Configuration Dump","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1602/002/","tactics":["Collection"]},{"id":"T1606","title":"Forge Web Credentials","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1606/","tactics":["Credential Access"]},{"id":"T1606.001","title":"Web Cookies","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1606/001/","tactics":["Credential Access"]},{"id":"T1606.002","title":"SAML Tokens","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1606/002/","tactics":["Credential Access"]},{"id":"T1608","title":"Stage Capabilities","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1608/","tactics":["Resource Development"]},{"id":"T1608.001","title":"Upload Malware","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1608/001/","tactics":["Resource Development"]},{"id":"T1608.002","title":"Upload Tool","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1608/002/","tactics":["Resource Development"]},{"id":"T1608.003","title":"Install Digital Certificate","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1608/003/","tactics":["Resource Development"]},{"id":"T1608.004","title":"Drive-by Target","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1608/004/","tactics":["Resource Development"]},{"id":"T1608.005","title":"Link Target","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1608/005/","tactics":["Resource Development"]},{"id":"T1608.006","title":"SEO Poisoning","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1608/006/","tactics":["Resource Development"]},{"id":"T1609","title":"Container Administration Command","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1609/","tactics":["Execution"]},{"id":"T1610","title":"Deploy Container","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1610/","tactics":["Execution"]},{"id":"T1611","title":"Escape to Host","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1611/","tactics":["Privilege Escalation"]},{"id":"T1612","title":"Build Image on Host","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1612/","tactics":["Stealth"]},{"id":"T1613","title":"Container and Resource Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1613/","tactics":["Discovery"]},{"id":"T1614","title":"System Location Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1614/","tactics":["Discovery"]},{"id":"T1614.001","title":"System Language Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1614/001/","tactics":["Discovery"]},{"id":"T1615","title":"Group Policy Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1615/","tactics":["Discovery"]},{"id":"T1619","title":"Cloud Storage Object Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1619/","tactics":["Discovery"]},{"id":"T1620","title":"Reflective Code Loading","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1620/","tactics":["Stealth"]},{"id":"T1621","title":"Multi-Factor Authentication Request Generation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1621/","tactics":["Credential Access"]},{"id":"T1622","title":"Debugger Evasion","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1622/","tactics":["Stealth","Discovery"]},{"id":"T1647","title":"Plist File Modification","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1647/","tactics":["Defense Impairment"]},{"id":"T1648","title":"Serverless Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1648/","tactics":["Execution"]},{"id":"T1649","title":"Steal or Forge Authentication Certificates","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1649/","tactics":["Credential Access"]},{"id":"T1650","title":"Acquire Access","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1650/","tactics":["Resource Development"]},{"id":"T1651","title":"Cloud Administration Command","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1651/","tactics":["Execution"]},{"id":"T1652","title":"Device Driver Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1652/","tactics":["Discovery"]},{"id":"T1653","title":"Power Settings","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1653/","tactics":["Persistence"]},{"id":"T1654","title":"Log Enumeration","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1654/","tactics":["Discovery"]},{"id":"T1656","title":"Impersonation","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1656/","tactics":["Stealth"]},{"id":"T1657","title":"Financial Theft","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1657/","tactics":["Impact"]},{"id":"T1659","title":"Content Injection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1659/","tactics":["Initial Access","Command and Control"]},{"id":"T1665","title":"Hide Infrastructure","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1665/","tactics":["Command and Control"]},{"id":"T1666","title":"Modify Cloud Resource Hierarchy","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1666/","tactics":["Defense Impairment"]},{"id":"T1667","title":"Email Bombing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1667/","tactics":["Impact"]},{"id":"T1668","title":"Exclusive Control","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1668/","tactics":["Persistence"]},{"id":"T1669","title":"Wi-Fi Networks","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1669/","tactics":["Initial Access"]},{"id":"T1671","title":"Cloud Application Integration","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1671/","tactics":["Persistence"]},{"id":"T1672","title":"Email Spoofing","kind":"technique","state":"revoked","url":"https://attack.mitre.org/techniques/T1672/","tactics":["Stealth"]},{"id":"T1673","title":"Virtual Machine Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1673/","tactics":["Discovery"]},{"id":"T1674","title":"Input Injection","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1674/","tactics":["Execution"]},{"id":"T1675","title":"ESXi Administration Command","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1675/","tactics":["Execution"]},{"id":"T1677","title":"Poisoned Pipeline Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1677/","tactics":["Execution"]},{"id":"T1678","title":"Delay Execution","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1678/","tactics":["Stealth"]},{"id":"T1679","title":"Selective Exclusion","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1679/","tactics":["Stealth"]},{"id":"T1680","title":"Local Storage Discovery","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1680/","tactics":["Discovery"]},{"id":"T1681","title":"Search Threat Vendor Data","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1681/","tactics":["Reconnaissance"]},{"id":"T1682","title":"Query Public AI Services","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1682/","tactics":["Reconnaissance"]},{"id":"T1683","title":"Generate Content","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1683/","tactics":["Resource Development"]},{"id":"T1683.001","title":"Written Content","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1683/001/","tactics":["Resource Development"]},{"id":"T1683.002","title":"Audio-Visual Content","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1683/002/","tactics":["Resource Development"]},{"id":"T1684","title":"Social Engineering","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1684/","tactics":["Stealth"]},{"id":"T1684.001","title":"Impersonation","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1684/001/","tactics":["Stealth"]},{"id":"T1684.002","title":"Email Spoofing","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1684/002/","tactics":["Stealth"]},{"id":"T1685","title":"Disable or Modify Tools","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1685/","tactics":["Defense Impairment"]},{"id":"T1685.001","title":"Disable or Modify Windows Event Log","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1685/001/","tactics":["Defense Impairment"]},{"id":"T1685.002","title":"Disable or Modify Cloud Log","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1685/002/","tactics":["Defense Impairment"]},{"id":"T1685.003","title":"Modify or Spoof Tool UI","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1685/003/","tactics":["Defense Impairment"]},{"id":"T1685.004","title":"Disable or Modify Linux Audit System Log","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1685/004/","tactics":["Defense Impairment"]},{"id":"T1685.005","title":"Clear Windows Event Logs","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1685/005/","tactics":["Defense Impairment"]},{"id":"T1685.006","title":"Clear Linux or Mac System Logs","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1685/006/","tactics":["Defense Impairment"]},{"id":"T1686","title":"Disable or Modify System Firewall","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1686/","tactics":["Defense Impairment"]},{"id":"T1686.001","title":"Cloud Firewall","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1686/001/","tactics":["Defense Impairment"]},{"id":"T1686.002","title":"Network Device Firewall","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1686/002/","tactics":["Defense Impairment"]},{"id":"T1686.003","title":"Windows Host Firewall","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1686/003/","tactics":["Defense Impairment"]},{"id":"T1687","title":"Exploitation for Defense Impairment","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1687/","tactics":["Defense Impairment"]},{"id":"T1688","title":"Safe Mode Boot","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1688/","tactics":["Defense Impairment"]},{"id":"T1689","title":"Downgrade Attack","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1689/","tactics":["Defense Impairment"]},{"id":"T1690","title":"Prevent Command History Logging","kind":"technique","state":"active","url":"https://attack.mitre.org/techniques/T1690/","tactics":["Defense Impairment"]},{"id":"TA0001","title":"Initial Access","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0001/","tactics":["Initial Access"]},{"id":"TA0002","title":"Execution","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0002/","tactics":["Execution"]},{"id":"TA0003","title":"Persistence","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0003/","tactics":["Persistence"]},{"id":"TA0004","title":"Privilege Escalation","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0004/","tactics":["Privilege Escalation"]},{"id":"TA0005","title":"Stealth","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0005/","tactics":["Stealth"]},{"id":"TA0006","title":"Credential Access","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0006/","tactics":["Credential Access"]},{"id":"TA0007","title":"Discovery","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0007/","tactics":["Discovery"]},{"id":"TA0008","title":"Lateral Movement","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0008/","tactics":["Lateral Movement"]},{"id":"TA0009","title":"Collection","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0009/","tactics":["Collection"]},{"id":"TA0010","title":"Exfiltration","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0010/","tactics":["Exfiltration"]},{"id":"TA0011","title":"Command and Control","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0011/","tactics":["Command and Control"]},{"id":"TA0040","title":"Impact","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0040/","tactics":["Impact"]},{"id":"TA0042","title":"Resource Development","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0042/","tactics":["Resource Development"]},{"id":"TA0043","title":"Reconnaissance","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0043/","tactics":["Reconnaissance"]},{"id":"TA0112","title":"Defense Impairment","kind":"tactic","state":"active","url":"https://attack.mitre.org/tactics/TA0112/","tactics":["Defense Impairment"]}]} diff --git a/src/assets/data/d3fend-reference-v1.6.0.json b/src/assets/data/d3fend-reference-v1.6.0.json new file mode 100644 index 0000000..46bfada --- /dev/null +++ b/src/assets/data/d3fend-reference-v1.6.0.json @@ -0,0 +1 @@ +{"schemaVersion":1,"framework":"mitre-d3fend","version":"1.6.0","sourceUrl":"https://d3fend.mitre.org/ontologies/d3fend/1.6.0/d3fend.json","sourceSha256":"e1546d432c6aa64d45b62dd9e9484b0774ae84de7ff3605ff9dd4e20278957bf","license":"© The MITRE Corporation. The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. https://d3fend.mitre.org/tou/","entries":[{"id":"D3-AA","title":"Agent Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-AA/","tactics":[]},{"id":"D3-ABPI","title":"Application-based Process Isolation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ABPI/","tactics":[]},{"id":"D3-ACA","title":"Active Certificate Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ACA/","tactics":[]},{"id":"D3-ACH","title":"Application Configuration Hardening","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ACH/","tactics":[]},{"id":"D3-AEM","title":"Application Exception Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-AEM/","tactics":[]},{"id":"D3-AH","title":"Application Hardening","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-AH/","tactics":[]},{"id":"D3-AI","title":"Asset Inventory","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-AI/","tactics":[]},{"id":"D3-AL","title":"Account Locking","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-AL/","tactics":[]},{"id":"D3-ALLM","title":"Active Logical Link Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ALLM/","tactics":[]},{"id":"D3-AM","title":"Access Modeling","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-AM/","tactics":[]},{"id":"D3-AMED","title":"Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-AMED/","tactics":[]},{"id":"D3-ANAA","title":"Administrative Network Activity Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ANAA/","tactics":[]},{"id":"D3-ANCI","title":"Authentication Cache Invalidation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ANCI/","tactics":[]},{"id":"D3-ANET","title":"Authentication Event Thresholding","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ANET/","tactics":[]},{"id":"D3-APA","title":"Access Policy Administration","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-APA/","tactics":[]},{"id":"D3-APCA","title":"Application Protocol Command Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-APCA/","tactics":[]},{"id":"D3-APLM","title":"Active Physical Link Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-APLM/","tactics":[]},{"id":"D3-APM","title":"Application Performance Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-APM/","tactics":[]},{"id":"D3-ARMA","title":"ARMA Model","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ARMA/","tactics":[]},{"id":"D3-AVE","title":"Asset Vulnerability Enumeration","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-AVE/","tactics":[]},{"id":"D3-AZET","title":"Authorization Event Thresholding","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-AZET/","tactics":[]},{"id":"D3-BA","title":"Bootloader Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-BA/","tactics":[]},{"id":"D3-BAN","title":"Biometric Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-BAN/","tactics":[]},{"id":"D3-BDI","title":"Broadcast Domain Isolation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-BDI/","tactics":[]},{"id":"D3-BMA","title":"Bus Message Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-BMA/","tactics":[]},{"id":"D3-BSE","title":"Byte Sequence Emulation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-BSE/","tactics":[]},{"id":"D3-CA","title":"Certificate Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CA/","tactics":[]},{"id":"D3-CAA","title":"Connection Attempt Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CAA/","tactics":[]},{"id":"D3-CBAN","title":"Certificate-based Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CBAN/","tactics":[]},{"id":"D3-CCSA","title":"Credential Compromise Scope Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CCSA/","tactics":[]},{"id":"D3-CDP","title":"Change Default Password","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CDP/","tactics":[]},{"id":"D3-CE","title":"Credential Eviction","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CE/","tactics":[]},{"id":"D3-CERO","title":"Certificate Rotation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CERO/","tactics":[]},{"id":"D3-CF","title":"Content Filtering","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CF/","tactics":[]},{"id":"D3-CFC","title":"Content Format Conversion","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CFC/","tactics":[]},{"id":"D3-CFI","title":"Control Flow Integrity","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CFI/","tactics":[]},{"id":"D3-CH","title":"Credential Hardening","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CH/","tactics":[]},{"id":"D3-CHN","title":"Connected Honeynet","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CHN/","tactics":[]},{"id":"D3-CI","title":"Configuration Inventory","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CI/","tactics":[]},{"id":"D3-CIA","title":"Container Image Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CIA/","tactics":[]},{"id":"D3-CM","title":"Content Modification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CM/","tactics":[]},{"id":"D3-CNE","title":"Content Excision","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CNE/","tactics":[]},{"id":"D3-CNR","title":"Content Rebuild","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CNR/","tactics":[]},{"id":"D3-CNS","title":"Content Substitution","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CNS/","tactics":[]},{"id":"D3-CP","title":"Certificate Pinning","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CP/","tactics":[]},{"id":"D3-CQ","title":"Content Quarantine","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CQ/","tactics":[]},{"id":"D3-CR","title":"Credential Revocation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CR/","tactics":[]},{"id":"D3-CRO","title":"Credential Rotation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CRO/","tactics":[]},{"id":"D3-CS","title":"Credential Scrubbing","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CS/","tactics":[]},{"id":"D3-CSPP","title":"Client-server Payload Profiling","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CSPP/","tactics":[]},{"id":"D3-CTS","title":"Credential Transmission Scoping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CTS/","tactics":[]},{"id":"D3-CV","title":"Content Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-CV/","tactics":[]},{"id":"D3-DA","title":"Dynamic Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DA/","tactics":[]},{"id":"D3-DAM","title":"Domain Account Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DAM/","tactics":[]},{"id":"D3-DCE","title":"Dead Code Elimination","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DCE/","tactics":[]},{"id":"D3-DE","title":"Decoy Environment","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DE/","tactics":[]},{"id":"D3-DEM","title":"Data Exchange Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DEM/","tactics":[]},{"id":"D3-DENCR","title":"Disk Encryption","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DENCR/","tactics":[]},{"id":"D3-DF","title":"Decoy File","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DF/","tactics":[]},{"id":"D3-DI","title":"Data Inventory","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DI/","tactics":[]},{"id":"D3-DKE","title":"Disk Erasure","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DKE/","tactics":[]},{"id":"D3-DKF","title":"Disk Formatting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DKF/","tactics":[]},{"id":"D3-DKP","title":"Disk Partitioning","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DKP/","tactics":[]},{"id":"D3-DLIC","title":"Driver Load Integrity Checking","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DLIC/","tactics":[]},{"id":"D3-DLV","title":"Domain Logic Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DLV/","tactics":[]},{"id":"D3-DNL","title":"Directional Network Link","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DNL/","tactics":[]},{"id":"D3-DNR","title":"Decoy Network Resource","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DNR/","tactics":[]},{"id":"D3-DNRA","title":"Domain Name Reputation Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DNRA/","tactics":[]},{"id":"D3-DNSAL","title":"DNS Allowlisting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DNSAL/","tactics":[]},{"id":"D3-DNSCE","title":"DNS Cache Eviction","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DNSCE/","tactics":[]},{"id":"D3-DNSDL","title":"DNS Denylisting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DNSDL/","tactics":[]},{"id":"D3-DNSTA","title":"DNS Traffic Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DNSTA/","tactics":[]},{"id":"D3-DO","title":"Decoy Object","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DO/","tactics":[]},{"id":"D3-DP","title":"Decoy Persona","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DP/","tactics":[]},{"id":"D3-DPLM","title":"Direct Physical Link Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DPLM/","tactics":[]},{"id":"D3-DPR","title":"Decoy Public Release","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DPR/","tactics":[]},{"id":"D3-DQSA","title":"Database Query String Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DQSA/","tactics":[]},{"id":"D3-DRA","title":"Disable Remote Access","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DRA/","tactics":[]},{"id":"D3-DRT","title":"Domain Registration Takedown","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DRT/","tactics":[]},{"id":"D3-DST","title":"Decoy Session Token","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DST/","tactics":[]},{"id":"D3-DTP","title":"Domain Trust Policy","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DTP/","tactics":[]},{"id":"D3-DUC","title":"Decoy User Credential","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-DUC/","tactics":[]},{"id":"D3-EAL","title":"Executable Allowlisting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EAL/","tactics":[]},{"id":"D3-EBWSAM","title":"Endpoint-based Web Server Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EBWSAM/","tactics":[]},{"id":"D3-EDL","title":"Executable Denylisting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EDL/","tactics":[]},{"id":"D3-EF","title":"Email Filtering","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EF/","tactics":[]},{"id":"D3-EFA","title":"Emulated File Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EFA/","tactics":[]},{"id":"D3-EHB","title":"Endpoint Health Beacon","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EHB/","tactics":[]},{"id":"D3-EHPV","title":"Exception Handler Pointer Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EHPV/","tactics":[]},{"id":"D3-EI","title":"Execution Isolation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EI/","tactics":[]},{"id":"D3-ELM","title":"Electronic Lock Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ELM/","tactics":[]},{"id":"D3-EMH","title":"Electromagnetic Radiation Hardening","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EMH/","tactics":[]},{"id":"D3-EPL","title":"Physical Locking","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-EPL/","tactics":[]},{"id":"D3-ER","title":"Email Removal","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ER/","tactics":[]},{"id":"D3-ET","title":"Encrypted Tunnels","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ET/","tactics":[]},{"id":"D3-FA","title":"File Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FA/","tactics":[]},{"id":"D3-FAPA","title":"File Access Pattern Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FAPA/","tactics":[]},{"id":"D3-FBA","title":"Firmware Behavior Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FBA/","tactics":[]},{"id":"D3-FC","title":"File Carving","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FC/","tactics":[]},{"id":"D3-FCA","title":"File Creation Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FCA/","tactics":[]},{"id":"D3-FCDC","title":"File Content Decompression Checking","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FCDC/","tactics":[]},{"id":"D3-FCOA","title":"File Content Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FCOA/","tactics":[]},{"id":"D3-FCR","title":"File Content Rules","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FCR/","tactics":[]},{"id":"D3-FE","title":"File Encryption","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FE/","tactics":[]},{"id":"D3-FEMC","title":"Firmware Embedded Monitoring Code","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FEMC/","tactics":[]},{"id":"D3-FEV","title":"File Eviction","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FEV/","tactics":[]},{"id":"D3-FFV","title":"File Format Verification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FFV/","tactics":[]},{"id":"D3-FH","title":"File Hashing","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FH/","tactics":[]},{"id":"D3-FHRA","title":"File Hash Reputation Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FHRA/","tactics":[]},{"id":"D3-FIM","title":"File Integrity Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FIM/","tactics":[]},{"id":"D3-FISV","title":"File Internal Structure Verification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FISV/","tactics":[]},{"id":"D3-FMBV","title":"File Magic Byte Verification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FMBV/","tactics":[]},{"id":"D3-FMCV","title":"File Metadata Consistency Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FMCV/","tactics":[]},{"id":"D3-FMVV","title":"File Metadata Value Verification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FMVV/","tactics":[]},{"id":"D3-FRDDL","title":"Forward Resolution Domain Denylisting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FRDDL/","tactics":[]},{"id":"D3-FRIDL","title":"Forward Resolution IP Denylisting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FRIDL/","tactics":[]},{"id":"D3-FV","title":"Firmware Verification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-FV/","tactics":[]},{"id":"D3-HBPI","title":"Hardware-based Process Isolation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-HBPI/","tactics":[]},{"id":"D3-HBWP","title":"Hardware-based Write Protection","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-HBWP/","tactics":[]},{"id":"D3-HCI","title":"Hardware Component Inventory","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-HCI/","tactics":[]},{"id":"D3-HD","title":"Homoglyph Detection","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-HD/","tactics":[]},{"id":"D3-HDDL","title":"Hierarchical Domain Denylisting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-HDDL/","tactics":[]},{"id":"D3-HDL","title":"Homoglyph Denylisting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-HDL/","tactics":[]},{"id":"D3-HR","title":"Host Reboot","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-HR/","tactics":[]},{"id":"D3-HS","title":"Host Shutdown","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-HS/","tactics":[]},{"id":"D3-IAA","title":"Identifier Activity Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-IAA/","tactics":[]},{"id":"D3-IBCA","title":"Indirect Branch Call Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-IBCA/","tactics":[]},{"id":"D3-ID","title":"Identifier Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ID/","tactics":[]},{"id":"D3-IDA","title":"Input Device Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-IDA/","tactics":[]},{"id":"D3-IHN","title":"Integrated Honeynet","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-IHN/","tactics":[]},{"id":"D3-IOPR","title":"IO Port Restriction","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-IOPR/","tactics":[]},{"id":"D3-IPCTA","title":"IPC Traffic Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-IPCTA/","tactics":[]},{"id":"D3-IPRA","title":"IP Reputation Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-IPRA/","tactics":[]},{"id":"D3-IRA","title":"Identifier Reputation Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-IRA/","tactics":[]},{"id":"D3-IRV","title":"Integer Range Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-IRV/","tactics":[]},{"id":"D3-ISVA","title":"Inbound Session Volume Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ISVA/","tactics":[]},{"id":"D3-ITF","title":"Inbound Traffic Filtering","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ITF/","tactics":[]},{"id":"D3-JFAPA","title":"Job Function Access Pattern Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-JFAPA/","tactics":[]},{"id":"D3-KBPI","title":"Kernel-based Process Isolation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-KBPI/","tactics":[]},{"id":"D3-LAM","title":"Local Account Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-LAM/","tactics":[]},{"id":"D3-LAMED","title":"LAN Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-LAMED/","tactics":[]},{"id":"D3-LFAM","title":"Local File Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-LFAM/","tactics":[]},{"id":"D3-LFP","title":"Local File Permissions","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-LFP/","tactics":[]},{"id":"D3-LLM","title":"Logical Link Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-LLM/","tactics":[]},{"id":"D3-MA","title":"Message Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-MA/","tactics":[]},{"id":"D3-MAN","title":"Message Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-MAN/","tactics":[]},{"id":"D3-MBSV","title":"Memory Block Start Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-MBSV/","tactics":[]},{"id":"D3-MBT","title":"Memory Boundary Tracking","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-MBT/","tactics":[]},{"id":"D3-MENCR","title":"Message Encryption","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-MENCR/","tactics":[]},{"id":"D3-MFA","title":"Multi-factor Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-MFA/","tactics":[]},{"id":"D3-MH","title":"Message Hardening","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-MH/","tactics":[]},{"id":"D3-MSM","title":"Motion Sensor Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-MSM/","tactics":[]},{"id":"D3-NAM","title":"Network Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NAM/","tactics":[]},{"id":"D3-NI","title":"Network Isolation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NI/","tactics":[]},{"id":"D3-NM","title":"Network Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NM/","tactics":[]},{"id":"D3-NNI","title":"Network Node Inventory","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NNI/","tactics":[]},{"id":"D3-NPC","title":"Null Pointer Checking","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NPC/","tactics":[]},{"id":"D3-NRAM","title":"Network Resource Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NRAM/","tactics":[]},{"id":"D3-NTA","title":"Network Traffic Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NTA/","tactics":[]},{"id":"D3-NTCD","title":"Network Traffic Community Deviation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NTCD/","tactics":[]},{"id":"D3-NTF","title":"Network Traffic Filtering","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NTF/","tactics":[]},{"id":"D3-NTPM","title":"Network Traffic Policy Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NTPM/","tactics":[]},{"id":"D3-NTSA","title":"Network Traffic Signature Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NTSA/","tactics":[]},{"id":"D3-NVA","title":"Network Vulnerability Assessment","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-NVA/","tactics":[]},{"id":"D3-OAM","title":"Operational Activity Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OAM/","tactics":[]},{"id":"D3-ODM","title":"Operational Dependency Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ODM/","tactics":[]},{"id":"D3-OE","title":"Object Eviction","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OE/","tactics":[]},{"id":"D3-OLV","title":"Operational Logic Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OLV/","tactics":[]},{"id":"D3-OM","title":"Organization Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OM/","tactics":[]},{"id":"D3-OMM","title":"Operating Mode Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OMM/","tactics":[]},{"id":"D3-OPM","title":"Operational Process Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OPM/","tactics":[]},{"id":"D3-OPR","title":"Operating Mode Restriction","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OPR/","tactics":[]},{"id":"D3-ORA","title":"Operational Risk Assessment","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ORA/","tactics":[]},{"id":"D3-OSM","title":"Operating System Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OSM/","tactics":[]},{"id":"D3-OTF","title":"Outbound Traffic Filtering","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OTF/","tactics":[]},{"id":"D3-OTP","title":"One-time Password","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OTP/","tactics":[]},{"id":"D3-OVAR","title":"OT Variable Access Restriction","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-OVAR/","tactics":[]},{"id":"D3-PA","title":"Process Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PA/","tactics":[]},{"id":"D3-PAM","title":"Physical Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PAM/","tactics":[]},{"id":"D3-PAN","title":"Pointer Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PAN/","tactics":[]},{"id":"D3-PBWSAM","title":"Proxy-based Web Server Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PBWSAM/","tactics":[]},{"id":"D3-PCA","title":"Passive Certificate Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PCA/","tactics":[]},{"id":"D3-PCSV","title":"Process Code Segment Verification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PCSV/","tactics":[]},{"id":"D3-PE","title":"Process Eviction","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PE/","tactics":[]},{"id":"D3-PEH","title":"Physical Enclosure Hardening","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PEH/","tactics":[]},{"id":"D3-PFV","title":"Peripheral Firmware Verification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PFV/","tactics":[]},{"id":"D3-PH","title":"Platform Hardening","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PH/","tactics":[]},{"id":"D3-PHAM","title":"Physical Access Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PHAM/","tactics":[]},{"id":"D3-PHDURA","title":"Per Host Download-Upload Ratio Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PHDURA/","tactics":[]},{"id":"D3-PLA","title":"Process Lineage Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PLA/","tactics":[]},{"id":"D3-PLLM","title":"Passive Logical Link Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PLLM/","tactics":[]},{"id":"D3-PLM","title":"Physical Link Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PLM/","tactics":[]},{"id":"D3-PM","title":"Platform Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PM/","tactics":[]},{"id":"D3-PMAD","title":"Protocol Metadata Anomaly Detection","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PMAD/","tactics":[]},{"id":"D3-PR","title":"Password Rotation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PR/","tactics":[]},{"id":"D3-PS","title":"Process Suspension","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PS/","tactics":[]},{"id":"D3-PSA","title":"Process Spawn Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PSA/","tactics":[]},{"id":"D3-PSEP","title":"Process Segment Execution Prevention","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PSEP/","tactics":[]},{"id":"D3-PSM","title":"Proximity Sensor Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PSM/","tactics":[]},{"id":"D3-PSMD","title":"Process Self-Modification Detection","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PSMD/","tactics":[]},{"id":"D3-PT","title":"Process Termination","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PT/","tactics":[]},{"id":"D3-PUM","title":"Platform Uptime Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PUM/","tactics":[]},{"id":"D3-PV","title":"Pointer Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PV/","tactics":[]},{"id":"D3-PWA","title":"Password Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-PWA/","tactics":[]},{"id":"D3-RA","title":"Restore Access","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RA/","tactics":[]},{"id":"D3-RAM","title":"Routing Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RAM/","tactics":[]},{"id":"D3-RAPA","title":"Resource Access Pattern Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RAPA/","tactics":[]},{"id":"D3-RC","title":"Restore Configuration","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RC/","tactics":[]},{"id":"D3-RD","title":"Restore Database","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RD/","tactics":[]},{"id":"D3-RDI","title":"Restore Disk Image","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RDI/","tactics":[]},{"id":"D3-RE","title":"Restore Email","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RE/","tactics":[]},{"id":"D3-RF","title":"Restore File","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RF/","tactics":[]},{"id":"D3-RFAM","title":"Remote File Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RFAM/","tactics":[]},{"id":"D3-RFS","title":"RF Shielding","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RFS/","tactics":[]},{"id":"D3-RFUM","title":"Remote Firmware Update Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RFUM/","tactics":[]},{"id":"D3-RH","title":"Radiation Hardening","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RH/","tactics":[]},{"id":"D3-RIC","title":"Reissue Credential","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RIC/","tactics":[]},{"id":"D3-RKD","title":"Registry Key Deletion","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RKD/","tactics":[]},{"id":"D3-RN","title":"Reference Nullification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RN/","tactics":[]},{"id":"D3-RNA","title":"Restore Network Access","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RNA/","tactics":[]},{"id":"D3-RO","title":"Restore Object","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RO/","tactics":[]},{"id":"D3-RPA","title":"Relay Pattern Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RPA/","tactics":[]},{"id":"D3-RRID","title":"Reverse Resolution IP Denylisting","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RRID/","tactics":[]},{"id":"D3-RS","title":"Restore Software","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RS/","tactics":[]},{"id":"D3-RTA","title":"RPC Traffic Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RTA/","tactics":[]},{"id":"D3-RTSD","title":"Remote Terminal Session Detection","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RTSD/","tactics":[]},{"id":"D3-RUAA","title":"Restore User Account Access","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-RUAA/","tactics":[]},{"id":"D3-SAOR","title":"Segment Address Offset Randomization","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SAOR/","tactics":[]},{"id":"D3-SBV","title":"Service Binary Verification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SBV/","tactics":[]},{"id":"D3-SCA","title":"System Call Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SCA/","tactics":[]},{"id":"D3-SCF","title":"System Call Filtering","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SCF/","tactics":[]},{"id":"D3-SCH","title":"Source Code Hardening","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SCH/","tactics":[]},{"id":"D3-SCP","title":"System Configuration Permissions","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SCP/","tactics":[]},{"id":"D3-SDA","title":"Session Duration Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SDA/","tactics":[]},{"id":"D3-SDM","title":"System Daemon Monitoring","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SDM/","tactics":[]},{"id":"D3-SEA","title":"Script Execution Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SEA/","tactics":[]},{"id":"D3-SFA","title":"System File Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SFA/","tactics":[]},{"id":"D3-SFCV","title":"Stack Frame Canary Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SFCV/","tactics":[]},{"id":"D3-SFV","title":"System Firmware Verification","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SFV/","tactics":[]},{"id":"D3-SHN","title":"Standalone Honeynet","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SHN/","tactics":[]},{"id":"D3-SICA","title":"System Init Config Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SICA/","tactics":[]},{"id":"D3-SJA","title":"Scheduled Job Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SJA/","tactics":[]},{"id":"D3-SMRA","title":"Sender MTA Reputation Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SMRA/","tactics":[]},{"id":"D3-SPP","title":"Strong Password Policy","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SPP/","tactics":[]},{"id":"D3-SRA","title":"Sender Reputation Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SRA/","tactics":[]},{"id":"D3-SSC","title":"Shadow Stack Comparisons","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SSC/","tactics":[]},{"id":"D3-ST","title":"Session Termination","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ST/","tactics":[]},{"id":"D3-SU","title":"Software Update","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SU/","tactics":[]},{"id":"D3-SVCDM","title":"Service Dependency Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SVCDM/","tactics":[]},{"id":"D3-SWI","title":"Software Inventory","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SWI/","tactics":[]},{"id":"D3-SYSDM","title":"System Dependency Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SYSDM/","tactics":[]},{"id":"D3-SYSM","title":"System Mapping","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SYSM/","tactics":[]},{"id":"D3-SYSVA","title":"System Vulnerability Assessment","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-SYSVA/","tactics":[]},{"id":"D3-TAAN","title":"Transfer Agent Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-TAAN/","tactics":[]},{"id":"D3-TB","title":"Token Binding","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-TB/","tactics":[]},{"id":"D3-TBA","title":"Token-based Authentication","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-TBA/","tactics":[]},{"id":"D3-TBI","title":"TPM Boot Integrity","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-TBI/","tactics":[]},{"id":"D3-TL","title":"Trusted Library","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-TL/","tactics":[]},{"id":"D3-UA","title":"URL Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-UA/","tactics":[]},{"id":"D3-UAP","title":"User Account Permissions","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-UAP/","tactics":[]},{"id":"D3-UBA","title":"User Behavior Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-UBA/","tactics":[]},{"id":"D3-UDTA","title":"User Data Transfer Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-UDTA/","tactics":[]},{"id":"D3-UGLPA","title":"User Geolocation Logon Pattern Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-UGLPA/","tactics":[]},{"id":"D3-UGPH","title":"User Group Permissions","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-UGPH/","tactics":[]},{"id":"D3-ULA","title":"Unlock Account","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-ULA/","tactics":[]},{"id":"D3-URA","title":"URL Reputation Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-URA/","tactics":[]},{"id":"D3-USICA","title":"User Session Init Config Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-USICA/","tactics":[]},{"id":"D3-VI","title":"Variable Initialization","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-VI/","tactics":[]},{"id":"D3-VS","title":"Video Surveillance","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-VS/","tactics":[]},{"id":"D3-VTV","title":"Variable Type Validation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-VTV/","tactics":[]},{"id":"D3-WSAA","title":"Web Session Activity Analysis","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-WSAA/","tactics":[]},{"id":"D3-WSAM","title":"Web Session Access Mediation","kind":"technique","state":"active","url":"https://d3fend.mitre.org/technique/D3-WSAM/","tactics":[]}]} diff --git a/src/assets/data/mitre-enterprise-v18.1.json b/src/assets/data/mitre-enterprise-v18.1.json deleted file mode 100644 index f20d00c..0000000 --- a/src/assets/data/mitre-enterprise-v18.1.json +++ /dev/null @@ -1 +0,0 @@ -{"version":"18.1","tacticOrder":["Reconnaissance","Resource Development","Initial Access","Execution","Persistence","Privilege Escalation","Defense Evasion","Credential Access","Discovery","Lateral Movement","Collection","Command and Control","Exfiltration","Impact"],"techniques":[{"id":"T1001","name":"Data Obfuscation","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1001","sourceCount":13},{"id":"T1001.001","name":"Data Obfuscation: Junk Data","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1001","url":"https://attack.mitre.org/techniques/T1001/001","sourceCount":17},{"id":"T1001.002","name":"Data Obfuscation: Steganography","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1001","url":"https://attack.mitre.org/techniques/T1001/002","sourceCount":13},{"id":"T1001.003","name":"Data Obfuscation: Protocol or Service Impersonation","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1001","url":"https://attack.mitre.org/techniques/T1001/003","sourceCount":22},{"id":"T1003","name":"OS Credential Dumping","tactics":["Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1003","sourceCount":20},{"id":"T1003.001","name":"OS Credential Dumping: LSASS Memory","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/001","sourceCount":75},{"id":"T1003.002","name":"OS Credential Dumping: Security Account Manager","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/002","sourceCount":33},{"id":"T1003.003","name":"OS Credential Dumping: NTDS","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/003","sourceCount":24},{"id":"T1003.004","name":"OS Credential Dumping: LSA Secrets","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/004","sourceCount":19},{"id":"T1003.005","name":"OS Credential Dumping: Cached Domain Credentials","tactics":["Credential Access"],"platforms":["Linux","Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/005","sourceCount":8},{"id":"T1003.006","name":"OS Credential Dumping: DCSync","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/006","sourceCount":8},{"id":"T1003.007","name":"OS Credential Dumping: Proc Filesystem","tactics":["Credential Access"],"platforms":["Linux"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/007","sourceCount":3},{"id":"T1003.008","name":"OS Credential Dumping: /etc/passwd and /etc/shadow","tactics":["Credential Access"],"platforms":["Linux"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/008","sourceCount":2},{"id":"T1005","name":"Data from Local System","tactics":["Collection"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1005","sourceCount":218},{"id":"T1006","name":"Direct Volume Access","tactics":["Defense Evasion"],"platforms":["Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1006","sourceCount":4},{"id":"T1007","name":"System Service Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1007","sourceCount":67},{"id":"T1008","name":"Fallback Channels","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1008","sourceCount":53},{"id":"T1010","name":"Application Window Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1010","sourceCount":35},{"id":"T1011","name":"Exfiltration Over Other Network Medium","tactics":["Exfiltration"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1011","sourceCount":0},{"id":"T1011.001","name":"Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth","tactics":["Exfiltration"],"platforms":["Linux","Windows","macOS"],"parent":"T1011","url":"https://attack.mitre.org/techniques/T1011/001","sourceCount":1},{"id":"T1012","name":"Query Registry","tactics":["Discovery"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1012","sourceCount":118},{"id":"T1014","name":"Rootkit","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1014","sourceCount":32},{"id":"T1016","name":"System Network Configuration Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1016","sourceCount":277},{"id":"T1016.001","name":"System Network Configuration Discovery: Internet Connection Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1016","url":"https://attack.mitre.org/techniques/T1016/001","sourceCount":26},{"id":"T1016.002","name":"System Network Configuration Discovery: Wi-Fi Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1016","url":"https://attack.mitre.org/techniques/T1016/002","sourceCount":7},{"id":"T1018","name":"Remote System Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1018","sourceCount":99},{"id":"T1020","name":"Automated Exfiltration","tactics":["Exfiltration"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1020","sourceCount":29},{"id":"T1020.001","name":"Automated Exfiltration: Traffic Duplication","tactics":["Exfiltration"],"platforms":["IaaS","Network Devices"],"parent":"T1020","url":"https://attack.mitre.org/techniques/T1020/001","sourceCount":0},{"id":"T1021","name":"Remote Services","tactics":["Lateral Movement"],"platforms":["ESXi","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1021","sourceCount":7},{"id":"T1021.001","name":"Remote Services: Remote Desktop Protocol","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/001","sourceCount":59},{"id":"T1021.002","name":"Remote Services: SMB/Windows Admin Shares","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/002","sourceCount":64},{"id":"T1021.003","name":"Remote Services: Distributed Component Object Model","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/003","sourceCount":3},{"id":"T1021.004","name":"Remote Services: SSH","tactics":["Lateral Movement"],"platforms":["ESXi","Linux","macOS"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/004","sourceCount":26},{"id":"T1021.005","name":"Remote Services: VNC","tactics":["Lateral Movement"],"platforms":["Linux","Windows","macOS"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/005","sourceCount":11},{"id":"T1021.006","name":"Remote Services: Windows Remote Management","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/006","sourceCount":10},{"id":"T1021.007","name":"Remote Services: Cloud Services","tactics":["Lateral Movement"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/007","sourceCount":4},{"id":"T1021.008","name":"Remote Services: Direct Cloud VM Connections","tactics":["Lateral Movement"],"platforms":["IaaS"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/008","sourceCount":0},{"id":"T1025","name":"Data from Removable Media","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1025","sourceCount":24},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1027","sourceCount":152},{"id":"T1027.001","name":"Obfuscated Files or Information: Binary Padding","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/001","sourceCount":28},{"id":"T1027.002","name":"Obfuscated Files or Information: Software Packing","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/002","sourceCount":102},{"id":"T1027.003","name":"Obfuscated Files or Information: Steganography","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/003","sourceCount":29},{"id":"T1027.004","name":"Obfuscated Files or Information: Compile After Delivery","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/004","sourceCount":10},{"id":"T1027.005","name":"Obfuscated Files or Information: Indicator Removal from Tools","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/005","sourceCount":18},{"id":"T1027.006","name":"Obfuscated Files or Information: HTML Smuggling","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/006","sourceCount":3},{"id":"T1027.007","name":"Obfuscated Files or Information: Dynamic API Resolution","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/007","sourceCount":15},{"id":"T1027.008","name":"Obfuscated Files or Information: Stripped Payloads","tactics":["Defense Evasion"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/008","sourceCount":2},{"id":"T1027.009","name":"Obfuscated Files or Information: Embedded Payloads","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/009","sourceCount":23},{"id":"T1027.010","name":"Obfuscated Files or Information: Command Obfuscation","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/010","sourceCount":65},{"id":"T1027.011","name":"Obfuscated Files or Information: Fileless Storage","tactics":["Defense Evasion"],"platforms":["Linux","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/011","sourceCount":31},{"id":"T1027.012","name":"Obfuscated Files or Information: LNK Icon Smuggling","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/012","sourceCount":4},{"id":"T1027.013","name":"Obfuscated Files or Information: Encrypted/Encoded File","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/013","sourceCount":221},{"id":"T1027.014","name":"Obfuscated Files or Information: Polymorphic Code","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/014","sourceCount":1},{"id":"T1027.015","name":"Obfuscated Files or Information: Compression","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/015","sourceCount":31},{"id":"T1027.016","name":"Obfuscated Files or Information: Junk Code Insertion","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/016","sourceCount":19},{"id":"T1027.017","name":"Obfuscated Files or Information: SVG Smuggling","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/017","sourceCount":0},{"id":"T1029","name":"Scheduled Transfer","tactics":["Exfiltration"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1029","sourceCount":18},{"id":"T1030","name":"Data Transfer Size Limits","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1030","sourceCount":21},{"id":"T1033","name":"System Owner/User Discovery","tactics":["Discovery"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1033","sourceCount":231},{"id":"T1036","name":"Masquerading","tactics":["Defense Evasion"],"platforms":["Containers","ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1036","sourceCount":58},{"id":"T1036.001","name":"Masquerading: Invalid Code Signature","tactics":["Defense Evasion"],"platforms":["Windows","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/001","sourceCount":9},{"id":"T1036.002","name":"Masquerading: Right-to-Left Override","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/002","sourceCount":5},{"id":"T1036.003","name":"Masquerading: Rename Legitimate Utilities","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/003","sourceCount":10},{"id":"T1036.004","name":"Masquerading: Masquerade Task or Service","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/004","sourceCount":90},{"id":"T1036.005","name":"Masquerading: Match Legitimate Resource Name or Location","tactics":["Defense Evasion"],"platforms":["Containers","ESXi","Linux","Windows","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/005","sourceCount":202},{"id":"T1036.006","name":"Masquerading: Space after Filename","tactics":["Defense Evasion"],"platforms":["Linux","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/006","sourceCount":2},{"id":"T1036.007","name":"Masquerading: Double File Extension","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/007","sourceCount":5},{"id":"T1036.008","name":"Masquerading: Masquerade File Type","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/008","sourceCount":16},{"id":"T1036.009","name":"Masquerading: Break Process Trees","tactics":["Defense Evasion"],"platforms":["Linux","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/009","sourceCount":1},{"id":"T1036.010","name":"Masquerading: Masquerade Account Name","tactics":["Defense Evasion"],"platforms":["Containers","IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/010","sourceCount":7},{"id":"T1036.011","name":"Masquerading: Overwrite Process Arguments","tactics":["Defense Evasion"],"platforms":["Linux"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/011","sourceCount":1},{"id":"T1036.012","name":"Masquerading: Browser Fingerprint","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/012","sourceCount":1},{"id":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["Persistence","Privilege Escalation"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1037","sourceCount":7},{"id":"T1037.001","name":"Boot or Logon Initialization Scripts: Logon Script (Windows)","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/001","sourceCount":6},{"id":"T1037.002","name":"Boot or Logon Initialization Scripts: Login Hook","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/002","sourceCount":0},{"id":"T1037.003","name":"Boot or Logon Initialization Scripts: Network Logon Script","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/003","sourceCount":0},{"id":"T1037.004","name":"Boot or Logon Initialization Scripts: RC Scripts","tactics":["Persistence","Privilege Escalation"],"platforms":["ESXi","Linux","Network Devices","macOS"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/004","sourceCount":7},{"id":"T1037.005","name":"Boot or Logon Initialization Scripts: Startup Items","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/005","sourceCount":1},{"id":"T1039","name":"Data from Network Shared Drive","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1039","sourceCount":13},{"id":"T1040","name":"Network Sniffing","tactics":["Credential Access","Discovery"],"platforms":["IaaS","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1040","sourceCount":27},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1041","sourceCount":191},{"id":"T1046","name":"Network Service Discovery","tactics":["Discovery"],"platforms":["Containers","IaaS","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1046","sourceCount":71},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["Execution"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1047","sourceCount":138},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["Exfiltration"],"platforms":["ESXi","IaaS","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1048","sourceCount":9},{"id":"T1048.001","name":"Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1048","url":"https://attack.mitre.org/techniques/T1048/001","sourceCount":0},{"id":"T1048.002","name":"Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1048","url":"https://attack.mitre.org/techniques/T1048/002","sourceCount":6},{"id":"T1048.003","name":"Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1048","url":"https://attack.mitre.org/techniques/T1048/003","sourceCount":34},{"id":"T1049","name":"System Network Connections Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1049","sourceCount":95},{"id":"T1052","name":"Exfiltration Over Physical Medium","tactics":["Exfiltration"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1052","sourceCount":0},{"id":"T1052.001","name":"Exfiltration Over Physical Medium: Exfiltration over USB","tactics":["Exfiltration"],"platforms":["Linux","Windows","macOS"],"parent":"T1052","url":"https://attack.mitre.org/techniques/T1052/001","sourceCount":7},{"id":"T1053","name":"Scheduled Task/Job","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Containers","ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1053","sourceCount":1},{"id":"T1053.002","name":"Scheduled Task/Job: At","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Linux","Windows","macOS"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/002","sourceCount":6},{"id":"T1053.003","name":"Scheduled Task/Job: Cron","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["ESXi","Linux","macOS"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/003","sourceCount":16},{"id":"T1053.005","name":"Scheduled Task/Job: Scheduled Task","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/005","sourceCount":184},{"id":"T1053.006","name":"Scheduled Task/Job: Systemd Timers","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Linux"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/006","sourceCount":0},{"id":"T1053.007","name":"Scheduled Task/Job: Container Orchestration Job","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Containers"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/007","sourceCount":0},{"id":"T1055","name":"Process Injection","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1055","sourceCount":82},{"id":"T1055.001","name":"Process Injection: Dynamic-link Library Injection","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/001","sourceCount":66},{"id":"T1055.002","name":"Process Injection: Portable Executable Injection","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/002","sourceCount":13},{"id":"T1055.003","name":"Process Injection: Thread Execution Hijacking","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/003","sourceCount":4},{"id":"T1055.004","name":"Process Injection: Asynchronous Procedure Call","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/004","sourceCount":12},{"id":"T1055.005","name":"Process Injection: Thread Local Storage","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/005","sourceCount":2},{"id":"T1055.008","name":"Process Injection: Ptrace System Calls","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Linux"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/008","sourceCount":1},{"id":"T1055.009","name":"Process Injection: Proc Memory","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Linux"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/009","sourceCount":1},{"id":"T1055.011","name":"Process Injection: Extra Window Memory Injection","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/011","sourceCount":2},{"id":"T1055.012","name":"Process Injection: Process Hollowing","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/012","sourceCount":39},{"id":"T1055.013","name":"Process Injection: Process Doppelgänging","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/013","sourceCount":3},{"id":"T1055.014","name":"Process Injection: VDSO Hijacking","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Linux"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/014","sourceCount":0},{"id":"T1055.015","name":"Process Injection: ListPlanting","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/015","sourceCount":1},{"id":"T1056","name":"Input Capture","tactics":["Collection","Credential Access"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1056","sourceCount":12},{"id":"T1056.001","name":"Input Capture: Keylogging","tactics":["Collection","Credential Access"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1056","url":"https://attack.mitre.org/techniques/T1056/001","sourceCount":152},{"id":"T1056.002","name":"Input Capture: GUI Input Capture","tactics":["Collection","Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1056","url":"https://attack.mitre.org/techniques/T1056/002","sourceCount":13},{"id":"T1056.003","name":"Input Capture: Web Portal Capture","tactics":["Collection","Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1056","url":"https://attack.mitre.org/techniques/T1056/003","sourceCount":5},{"id":"T1056.004","name":"Input Capture: Credential API Hooking","tactics":["Collection","Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1056","url":"https://attack.mitre.org/techniques/T1056/004","sourceCount":12},{"id":"T1057","name":"Process Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1057","sourceCount":304},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["Execution"],"platforms":["ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1059","sourceCount":43},{"id":"T1059.001","name":"Command and Scripting Interpreter: PowerShell","tactics":["Execution"],"platforms":["Windows"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/001","sourceCount":223},{"id":"T1059.002","name":"Command and Scripting Interpreter: AppleScript","tactics":["Execution"],"platforms":["macOS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/002","sourceCount":5},{"id":"T1059.003","name":"Command and Scripting Interpreter: Windows Command Shell","tactics":["Execution"],"platforms":["Windows"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/003","sourceCount":372},{"id":"T1059.004","name":"Command and Scripting Interpreter: Unix Shell","tactics":["Execution"],"platforms":["ESXi","Linux","Network Devices","macOS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/004","sourceCount":60},{"id":"T1059.005","name":"Command and Scripting Interpreter: Visual Basic","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/005","sourceCount":127},{"id":"T1059.006","name":"Command and Scripting Interpreter: Python","tactics":["Execution"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/006","sourceCount":55},{"id":"T1059.007","name":"Command and Scripting Interpreter: JavaScript","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/007","sourceCount":62},{"id":"T1059.008","name":"Command and Scripting Interpreter: Network Device CLI","tactics":["Execution"],"platforms":["Network Devices"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/008","sourceCount":2},{"id":"T1059.009","name":"Command and Scripting Interpreter: Cloud API","tactics":["Execution"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/009","sourceCount":4},{"id":"T1059.010","name":"Command and Scripting Interpreter: AutoHotKey & AutoIT","tactics":["Execution"],"platforms":["Windows"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/010","sourceCount":6},{"id":"T1059.011","name":"Command and Scripting Interpreter: Lua","tactics":["Execution"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/011","sourceCount":5},{"id":"T1059.012","name":"Command and Scripting Interpreter: Hypervisor CLI","tactics":["Execution"],"platforms":["ESXi"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/012","sourceCount":4},{"id":"T1059.013","name":"Command and Scripting Interpreter: Container CLI/API","tactics":["Execution"],"platforms":["Containers"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/013","sourceCount":1},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["Privilege Escalation"],"platforms":["Containers","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1068","sourceCount":43},{"id":"T1069","name":"Permission Groups Discovery","tactics":["Discovery"],"platforms":["Containers","IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1069","sourceCount":13},{"id":"T1069.001","name":"Permission Groups Discovery: Local Groups","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1069","url":"https://attack.mitre.org/techniques/T1069/001","sourceCount":31},{"id":"T1069.002","name":"Permission Groups Discovery: Domain Groups","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1069","url":"https://attack.mitre.org/techniques/T1069/002","sourceCount":36},{"id":"T1069.003","name":"Permission Groups Discovery: Cloud Groups","tactics":["Discovery"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1069","url":"https://attack.mitre.org/techniques/T1069/003","sourceCount":4},{"id":"T1070","name":"Indicator Removal","tactics":["Defense Evasion"],"platforms":["Containers","ESXi","Linux","Network Devices","Office Suite","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1070","sourceCount":31},{"id":"T1070.001","name":"Indicator Removal: Clear Windows Event Logs","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/001","sourceCount":40},{"id":"T1070.002","name":"Indicator Removal: Clear Linux or Mac System Logs","tactics":["Defense Evasion"],"platforms":["Linux","macOS"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/002","sourceCount":8},{"id":"T1070.003","name":"Indicator Removal: Clear Command History","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/003","sourceCount":11},{"id":"T1070.004","name":"Indicator Removal: File Deletion","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/004","sourceCount":296},{"id":"T1070.005","name":"Indicator Removal: Network Share Connection Removal","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/005","sourceCount":5},{"id":"T1070.006","name":"Indicator Removal: Timestomp","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/006","sourceCount":56},{"id":"T1070.007","name":"Indicator Removal: Clear Network Connection History and Configurations","tactics":["Defense Evasion"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/007","sourceCount":4},{"id":"T1070.008","name":"Indicator Removal: Clear Mailbox Data","tactics":["Defense Evasion"],"platforms":["Linux","Office Suite","Windows","macOS"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/008","sourceCount":5},{"id":"T1070.009","name":"Indicator Removal: Clear Persistence","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/009","sourceCount":15},{"id":"T1070.010","name":"Indicator Removal: Relocate Malware","tactics":["Defense Evasion"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/010","sourceCount":0},{"id":"T1071","name":"Application Layer Protocol","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1071","sourceCount":16},{"id":"T1071.001","name":"Application Layer Protocol: Web Protocols","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/001","sourceCount":406},{"id":"T1071.002","name":"Application Layer Protocol: File Transfer Protocols","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/002","sourceCount":25},{"id":"T1071.003","name":"Application Layer Protocol: Mail Protocols","tactics":["Command and Control"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/003","sourceCount":26},{"id":"T1071.004","name":"Application Layer Protocol: DNS","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/004","sourceCount":53},{"id":"T1071.005","name":"Application Layer Protocol: Publish/Subscribe Protocols","tactics":["Command and Control"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/005","sourceCount":1},{"id":"T1072","name":"Software Deployment Tools","tactics":["Execution","Lateral Movement"],"platforms":["Linux","Network Devices","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1072","sourceCount":8},{"id":"T1074","name":"Data Staged","tactics":["Collection"],"platforms":["ESXi","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1074","sourceCount":8},{"id":"T1074.001","name":"Data Staged: Local Data Staging","tactics":["Collection"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1074","url":"https://attack.mitre.org/techniques/T1074/001","sourceCount":126},{"id":"T1074.002","name":"Data Staged: Remote Data Staging","tactics":["Collection"],"platforms":["ESXi","IaaS","Linux","Windows","macOS"],"parent":"T1074","url":"https://attack.mitre.org/techniques/T1074/002","sourceCount":13},{"id":"T1078","name":"Valid Accounts","tactics":["Defense Evasion","Initial Access","Persistence","Privilege Escalation"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1078","sourceCount":60},{"id":"T1078.001","name":"Valid Accounts: Default Accounts","tactics":["Defense Evasion","Initial Access","Persistence","Privilege Escalation"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":"T1078","url":"https://attack.mitre.org/techniques/T1078/001","sourceCount":7},{"id":"T1078.002","name":"Valid Accounts: Domain Accounts","tactics":["Defense Evasion","Initial Access","Persistence","Privilege Escalation"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1078","url":"https://attack.mitre.org/techniques/T1078/002","sourceCount":32},{"id":"T1078.003","name":"Valid Accounts: Local Accounts","tactics":["Defense Evasion","Initial Access","Persistence","Privilege Escalation"],"platforms":["Containers","ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1078","url":"https://attack.mitre.org/techniques/T1078/003","sourceCount":20},{"id":"T1078.004","name":"Valid Accounts: Cloud Accounts","tactics":["Defense Evasion","Initial Access","Persistence","Privilege Escalation"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1078","url":"https://attack.mitre.org/techniques/T1078/004","sourceCount":14},{"id":"T1080","name":"Taint Shared Content","tactics":["Lateral Movement"],"platforms":["Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1080","sourceCount":12},{"id":"T1082","name":"System Information Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1082","sourceCount":403},{"id":"T1083","name":"File and Directory Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1083","sourceCount":355},{"id":"T1087","name":"Account Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1087","sourceCount":9},{"id":"T1087.001","name":"Account Discovery: Local Account","tactics":["Discovery"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1087","url":"https://attack.mitre.org/techniques/T1087/001","sourceCount":63},{"id":"T1087.002","name":"Account Discovery: Domain Account","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1087","url":"https://attack.mitre.org/techniques/T1087/002","sourceCount":56},{"id":"T1087.003","name":"Account Discovery: Email Account","tactics":["Discovery"],"platforms":["Office Suite","Windows"],"parent":"T1087","url":"https://attack.mitre.org/techniques/T1087/003","sourceCount":14},{"id":"T1087.004","name":"Account Discovery: Cloud Account","tactics":["Discovery"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1087","url":"https://attack.mitre.org/techniques/T1087/004","sourceCount":6},{"id":"T1090","name":"Proxy","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1090","sourceCount":72},{"id":"T1090.001","name":"Proxy: Internal Proxy","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1090","url":"https://attack.mitre.org/techniques/T1090/001","sourceCount":32},{"id":"T1090.002","name":"Proxy: External Proxy","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1090","url":"https://attack.mitre.org/techniques/T1090/002","sourceCount":22},{"id":"T1090.003","name":"Proxy: Multi-hop Proxy","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1090","url":"https://attack.mitre.org/techniques/T1090/003","sourceCount":38},{"id":"T1090.004","name":"Proxy: Domain Fronting","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1090","url":"https://attack.mitre.org/techniques/T1090/004","sourceCount":5},{"id":"T1091","name":"Replication Through Removable Media","tactics":["Initial Access","Lateral Movement"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1091","sourceCount":28},{"id":"T1092","name":"Communication Through Removable Media","tactics":["Command and Control"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1092","sourceCount":3},{"id":"T1095","name":"Non-Application Layer Protocol","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1095","sourceCount":106},{"id":"T1098","name":"Account Manipulation","tactics":["Persistence","Privilege Escalation"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1098","sourceCount":6},{"id":"T1098.001","name":"Account Manipulation: Additional Cloud Credentials","tactics":["Persistence","Privilege Escalation"],"platforms":["IaaS","Identity Provider","SaaS"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/001","sourceCount":4},{"id":"T1098.002","name":"Account Manipulation: Additional Email Delegate Permissions","tactics":["Persistence","Privilege Escalation"],"platforms":["Office Suite","Windows"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/002","sourceCount":5},{"id":"T1098.003","name":"Account Manipulation: Additional Cloud Roles","tactics":["Persistence","Privilege Escalation"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/003","sourceCount":5},{"id":"T1098.004","name":"Account Manipulation: SSH Authorized Keys","tactics":["Persistence","Privilege Escalation"],"platforms":["ESXi","IaaS","Linux","Network Devices","macOS"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/004","sourceCount":6},{"id":"T1098.005","name":"Account Manipulation: Device Registration","tactics":["Persistence","Privilege Escalation"],"platforms":["Identity Provider","Windows"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/005","sourceCount":4},{"id":"T1098.006","name":"Account Manipulation: Additional Container Cluster Roles","tactics":["Persistence","Privilege Escalation"],"platforms":["Containers"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/006","sourceCount":0},{"id":"T1098.007","name":"Account Manipulation: Additional Local or Domain Groups","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","Windows","macOS"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/007","sourceCount":11},{"id":"T1102","name":"Web Service","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1102","sourceCount":45},{"id":"T1102.001","name":"Web Service: Dead Drop Resolver","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1102","url":"https://attack.mitre.org/techniques/T1102/001","sourceCount":23},{"id":"T1102.002","name":"Web Service: Bidirectional Communication","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1102","url":"https://attack.mitre.org/techniques/T1102/002","sourceCount":54},{"id":"T1102.003","name":"Web Service: One-Way Communication","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1102","url":"https://attack.mitre.org/techniques/T1102/003","sourceCount":9},{"id":"T1104","name":"Multi-Stage Channels","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1104","sourceCount":15},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1105","sourceCount":498},{"id":"T1106","name":"Native API","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1106","sourceCount":211},{"id":"T1110","name":"Brute Force","tactics":["Credential Access"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1110","sourceCount":23},{"id":"T1110.001","name":"Brute Force: Password Guessing","tactics":["Credential Access"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":"T1110","url":"https://attack.mitre.org/techniques/T1110/001","sourceCount":11},{"id":"T1110.002","name":"Brute Force: Password Cracking","tactics":["Credential Access"],"platforms":["Identity Provider","Linux","Network Devices","Office Suite","Windows","macOS"],"parent":"T1110","url":"https://attack.mitre.org/techniques/T1110/002","sourceCount":6},{"id":"T1110.003","name":"Brute Force: Password Spraying","tactics":["Credential Access"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":"T1110","url":"https://attack.mitre.org/techniques/T1110/003","sourceCount":17},{"id":"T1110.004","name":"Brute Force: Credential Stuffing","tactics":["Credential Access"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":"T1110","url":"https://attack.mitre.org/techniques/T1110/004","sourceCount":2},{"id":"T1111","name":"Multi-Factor Authentication Interception","tactics":["Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1111","sourceCount":8},{"id":"T1112","name":"Modify Registry","tactics":["Defense Evasion","Persistence"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1112","sourceCount":170},{"id":"T1113","name":"Screen Capture","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1113","sourceCount":166},{"id":"T1114","name":"Email Collection","tactics":["Collection"],"platforms":["Linux","Office Suite","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1114","sourceCount":6},{"id":"T1114.001","name":"Email Collection: Local Email Collection","tactics":["Collection"],"platforms":["Windows"],"parent":"T1114","url":"https://attack.mitre.org/techniques/T1114/001","sourceCount":18},{"id":"T1114.002","name":"Email Collection: Remote Email Collection","tactics":["Collection"],"platforms":["Office Suite","Windows"],"parent":"T1114","url":"https://attack.mitre.org/techniques/T1114/002","sourceCount":18},{"id":"T1114.003","name":"Email Collection: Email Forwarding Rule","tactics":["Collection"],"platforms":["Linux","Office Suite","Windows","macOS"],"parent":"T1114","url":"https://attack.mitre.org/techniques/T1114/003","sourceCount":5},{"id":"T1115","name":"Clipboard Data","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1115","sourceCount":45},{"id":"T1119","name":"Automated Collection","tactics":["Collection"],"platforms":["IaaS","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1119","sourceCount":69},{"id":"T1120","name":"Peripheral Device Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1120","sourceCount":57},{"id":"T1123","name":"Audio Capture","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1123","sourceCount":31},{"id":"T1124","name":"System Time Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1124","sourceCount":93},{"id":"T1125","name":"Video Capture","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1125","sourceCount":34},{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1127","sourceCount":0},{"id":"T1127.001","name":"Trusted Developer Utilities Proxy Execution: MSBuild","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1127","url":"https://attack.mitre.org/techniques/T1127/001","sourceCount":3},{"id":"T1127.002","name":"Trusted Developer Utilities Proxy Execution: ClickOnce","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1127","url":"https://attack.mitre.org/techniques/T1127/002","sourceCount":0},{"id":"T1127.003","name":"Trusted Developer Utilities Proxy Execution: JamPlus","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1127","url":"https://attack.mitre.org/techniques/T1127/003","sourceCount":0},{"id":"T1129","name":"Shared Modules","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1129","sourceCount":22},{"id":"T1132","name":"Data Encoding","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1132","sourceCount":6},{"id":"T1132.001","name":"Data Encoding: Standard Encoding","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1132","url":"https://attack.mitre.org/techniques/T1132/001","sourceCount":120},{"id":"T1132.002","name":"Data Encoding: Non-Standard Encoding","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1132","url":"https://attack.mitre.org/techniques/T1132/002","sourceCount":16},{"id":"T1133","name":"External Remote Services","tactics":["Initial Access","Persistence"],"platforms":["Containers","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1133","sourceCount":40},{"id":"T1134","name":"Access Token Manipulation","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1134","sourceCount":23},{"id":"T1134.001","name":"Access Token Manipulation: Token Impersonation/Theft","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/001","sourceCount":18},{"id":"T1134.002","name":"Access Token Manipulation: Create Process with Token","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/002","sourceCount":13},{"id":"T1134.003","name":"Access Token Manipulation: Make and Impersonate Token","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/003","sourceCount":5},{"id":"T1134.004","name":"Access Token Manipulation: Parent PID Spoofing","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/004","sourceCount":4},{"id":"T1134.005","name":"Access Token Manipulation: SID-History Injection","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/005","sourceCount":2},{"id":"T1135","name":"Network Share Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1135","sourceCount":77},{"id":"T1136","name":"Create Account","tactics":["Persistence"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1136","sourceCount":5},{"id":"T1136.001","name":"Create Account: Local Account","tactics":["Persistence"],"platforms":["Containers","ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1136","url":"https://attack.mitre.org/techniques/T1136/001","sourceCount":29},{"id":"T1136.002","name":"Create Account: Domain Account","tactics":["Persistence"],"platforms":["Linux","Windows","macOS"],"parent":"T1136","url":"https://attack.mitre.org/techniques/T1136/002","sourceCount":11},{"id":"T1136.003","name":"Create Account: Cloud Account","tactics":["Persistence"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1136","url":"https://attack.mitre.org/techniques/T1136/003","sourceCount":3},{"id":"T1137","name":"Office Application Startup","tactics":["Persistence"],"platforms":["Office Suite","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1137","sourceCount":2},{"id":"T1137.001","name":"Office Application Startup: Office Template Macros","tactics":["Persistence"],"platforms":["Office Suite","Windows"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/001","sourceCount":3},{"id":"T1137.002","name":"Office Application Startup: Office Test","tactics":["Persistence"],"platforms":["Office Suite","Windows"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/002","sourceCount":1},{"id":"T1137.003","name":"Office Application Startup: Outlook Forms","tactics":["Persistence"],"platforms":["Office Suite","Windows"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/003","sourceCount":1},{"id":"T1137.004","name":"Office Application Startup: Outlook Home Page","tactics":["Persistence"],"platforms":["Office Suite","Windows"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/004","sourceCount":2},{"id":"T1137.005","name":"Office Application Startup: Outlook Rules","tactics":["Persistence"],"platforms":["Office Suite","Windows"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/005","sourceCount":1},{"id":"T1137.006","name":"Office Application Startup: Add-ins","tactics":["Persistence"],"platforms":["Office Suite","Windows"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/006","sourceCount":4},{"id":"T1140","name":"Deobfuscate/Decode Files or Information","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1140","sourceCount":325},{"id":"T1176","name":"Software Extensions","tactics":["Persistence"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1176","sourceCount":0},{"id":"T1176.001","name":"Software Extensions: Browser Extensions","tactics":["Persistence"],"platforms":["Linux","Windows","macOS"],"parent":"T1176","url":"https://attack.mitre.org/techniques/T1176/001","sourceCount":7},{"id":"T1176.002","name":"Software Extensions: IDE Extensions","tactics":["Persistence"],"platforms":["Linux","Windows","macOS"],"parent":"T1176","url":"https://attack.mitre.org/techniques/T1176/002","sourceCount":1},{"id":"T1185","name":"Browser Session Hijacking","tactics":["Collection"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1185","sourceCount":14},{"id":"T1187","name":"Forced Authentication","tactics":["Credential Access"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1187","sourceCount":3},{"id":"T1189","name":"Drive-by Compromise","tactics":["Initial Access"],"platforms":["Identity Provider","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1189","sourceCount":44},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["Initial Access"],"platforms":["Containers","ESXi","IaaS","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1190","sourceCount":69},{"id":"T1195","name":"Supply Chain Compromise","tactics":["Initial Access"],"platforms":["Linux","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1195","sourceCount":5},{"id":"T1195.001","name":"Supply Chain Compromise: Compromise Software Dependencies and Development Tools","tactics":["Initial Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1195","url":"https://attack.mitre.org/techniques/T1195/001","sourceCount":2},{"id":"T1195.002","name":"Supply Chain Compromise: Compromise Software Supply Chain","tactics":["Initial Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1195","url":"https://attack.mitre.org/techniques/T1195/002","sourceCount":14},{"id":"T1195.003","name":"Supply Chain Compromise: Compromise Hardware Supply Chain","tactics":["Initial Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1195","url":"https://attack.mitre.org/techniques/T1195/003","sourceCount":0},{"id":"T1197","name":"BITS Jobs","tactics":["Defense Evasion","Persistence"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1197","sourceCount":13},{"id":"T1199","name":"Trusted Relationship","tactics":["Initial Access"],"platforms":["IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1199","sourceCount":12},{"id":"T1200","name":"Hardware Additions","tactics":["Initial Access"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1200","sourceCount":1},{"id":"T1201","name":"Password Policy Discovery","tactics":["Discovery"],"platforms":["IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1201","sourceCount":8},{"id":"T1202","name":"Indirect Command Execution","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1202","sourceCount":4},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1203","sourceCount":60},{"id":"T1204","name":"User Execution","tactics":["Execution"],"platforms":["Containers","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1204","sourceCount":5},{"id":"T1204.001","name":"User Execution: Malicious Link","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/001","sourceCount":83},{"id":"T1204.002","name":"User Execution: Malicious File","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/002","sourceCount":185},{"id":"T1204.003","name":"User Execution: Malicious Image","tactics":["Execution"],"platforms":["Containers","IaaS"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/003","sourceCount":1},{"id":"T1204.004","name":"User Execution: Malicious Copy and Paste","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/004","sourceCount":2},{"id":"T1204.005","name":"User Execution: Malicious Library","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/005","sourceCount":1},{"id":"T1205","name":"Traffic Signaling","tactics":["Command and Control","Defense Evasion","Persistence"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1205","sourceCount":21},{"id":"T1205.001","name":"Traffic Signaling: Port Knocking","tactics":["Command and Control","Defense Evasion","Persistence"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1205","url":"https://attack.mitre.org/techniques/T1205/001","sourceCount":6},{"id":"T1205.002","name":"Traffic Signaling: Socket Filters","tactics":["Command and Control","Defense Evasion","Persistence"],"platforms":["Linux","Windows","macOS"],"parent":"T1205","url":"https://attack.mitre.org/techniques/T1205/002","sourceCount":4},{"id":"T1207","name":"Rogue Domain Controller","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1207","sourceCount":1},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["Lateral Movement"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1210","sourceCount":24},{"id":"T1211","name":"Exploitation for Defense Evasion","tactics":["Defense Evasion"],"platforms":["IaaS","Linux","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1211","sourceCount":2},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["Credential Access"],"platforms":["Identity Provider","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1212","sourceCount":2},{"id":"T1213","name":"Data from Information Repositories","tactics":["Collection"],"platforms":["IaaS","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1213","sourceCount":4},{"id":"T1213.001","name":"Data from Information Repositories: Confluence","tactics":["Collection"],"platforms":["SaaS"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/001","sourceCount":1},{"id":"T1213.002","name":"Data from Information Repositories: Sharepoint","tactics":["Collection"],"platforms":["Office Suite","Windows"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/002","sourceCount":8},{"id":"T1213.003","name":"Data from Information Repositories: Code Repositories","tactics":["Collection"],"platforms":["SaaS"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/003","sourceCount":4},{"id":"T1213.004","name":"Data from Information Repositories: Customer Relationship Management Software","tactics":["Collection"],"platforms":["SaaS"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/004","sourceCount":1},{"id":"T1213.005","name":"Data from Information Repositories: Messaging Applications","tactics":["Collection"],"platforms":["Office Suite","SaaS"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/005","sourceCount":3},{"id":"T1213.006","name":"Data from Information Repositories: Databases","tactics":["Collection"],"platforms":["IaaS","Linux","SaaS","Windows","macOS"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/006","sourceCount":8},{"id":"T1216","name":"System Script Proxy Execution","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1216","sourceCount":0},{"id":"T1216.001","name":"System Script Proxy Execution: PubPrn","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1216","url":"https://attack.mitre.org/techniques/T1216/001","sourceCount":1},{"id":"T1216.002","name":"System Script Proxy Execution: SyncAppvPublishingServer","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1216","url":"https://attack.mitre.org/techniques/T1216/002","sourceCount":0},{"id":"T1217","name":"Browser Information Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1217","sourceCount":26},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1218","sourceCount":2},{"id":"T1218.001","name":"System Binary Proxy Execution: Compiled HTML File","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/001","sourceCount":6},{"id":"T1218.002","name":"System Binary Proxy Execution: Control Panel","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/002","sourceCount":2},{"id":"T1218.003","name":"System Binary Proxy Execution: CMSTP","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/003","sourceCount":4},{"id":"T1218.004","name":"System Binary Proxy Execution: InstallUtil","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/004","sourceCount":6},{"id":"T1218.005","name":"System Binary Proxy Execution: Mshta","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/005","sourceCount":30},{"id":"T1218.007","name":"System Binary Proxy Execution: Msiexec","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/007","sourceCount":29},{"id":"T1218.008","name":"System Binary Proxy Execution: Odbcconf","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/008","sourceCount":3},{"id":"T1218.009","name":"System Binary Proxy Execution: Regsvcs/Regasm","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/009","sourceCount":1},{"id":"T1218.010","name":"System Binary Proxy Execution: Regsvr32","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/010","sourceCount":36},{"id":"T1218.011","name":"System Binary Proxy Execution: Rundll32","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/011","sourceCount":103},{"id":"T1218.012","name":"System Binary Proxy Execution: Verclsid","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/012","sourceCount":1},{"id":"T1218.013","name":"System Binary Proxy Execution: Mavinject","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/013","sourceCount":1},{"id":"T1218.014","name":"System Binary Proxy Execution: MMC","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/014","sourceCount":2},{"id":"T1218.015","name":"System Binary Proxy Execution: Electron Applications","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/015","sourceCount":2},{"id":"T1219","name":"Remote Access Tools","tactics":["Command and Control"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1219","sourceCount":21},{"id":"T1219.001","name":"Remote Access Tools: IDE Tunneling","tactics":["Command and Control"],"platforms":["Linux","Windows","macOS"],"parent":"T1219","url":"https://attack.mitre.org/techniques/T1219/001","sourceCount":1},{"id":"T1219.002","name":"Remote Access Tools: Remote Desktop Software","tactics":["Command and Control"],"platforms":["Linux","Windows","macOS"],"parent":"T1219","url":"https://attack.mitre.org/techniques/T1219/002","sourceCount":12},{"id":"T1219.003","name":"Remote Access Tools: Remote Access Hardware","tactics":["Command and Control"],"platforms":["Linux","Windows","macOS"],"parent":"T1219","url":"https://attack.mitre.org/techniques/T1219/003","sourceCount":0},{"id":"T1220","name":"XSL Script Processing","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1220","sourceCount":4},{"id":"T1221","name":"Template Injection","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1221","sourceCount":11},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1222","sourceCount":1},{"id":"T1222.001","name":"File and Directory Permissions Modification: Windows File and Directory Permissions Modification","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1222","url":"https://attack.mitre.org/techniques/T1222/001","sourceCount":11},{"id":"T1222.002","name":"File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification","tactics":["Defense Evasion"],"platforms":["Linux","macOS"],"parent":"T1222","url":"https://attack.mitre.org/techniques/T1222/002","sourceCount":14},{"id":"T1480","name":"Execution Guardrails","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1480","sourceCount":37},{"id":"T1480.001","name":"Execution Guardrails: Environmental Keying","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1480","url":"https://attack.mitre.org/techniques/T1480/001","sourceCount":10},{"id":"T1480.002","name":"Execution Guardrails: Mutual Exclusion","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1480","url":"https://attack.mitre.org/techniques/T1480/002","sourceCount":16},{"id":"T1482","name":"Domain Trust Discovery","tactics":["Discovery"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1482","sourceCount":31},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Identity Provider","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1484","sourceCount":0},{"id":"T1484.001","name":"Domain or Tenant Policy Modification: Group Policy Modification","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1484","url":"https://attack.mitre.org/techniques/T1484/001","sourceCount":14},{"id":"T1484.002","name":"Domain or Tenant Policy Modification: Trust Modification","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Identity Provider","Windows"],"parent":"T1484","url":"https://attack.mitre.org/techniques/T1484/002","sourceCount":4},{"id":"T1485","name":"Data Destruction","tactics":["Impact"],"platforms":["Containers","ESXi","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1485","sourceCount":30},{"id":"T1485.001","name":"Data Destruction: Lifecycle-Triggered Deletion","tactics":["Impact"],"platforms":["IaaS"],"parent":"T1485","url":"https://attack.mitre.org/techniques/T1485/001","sourceCount":0},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["Impact"],"platforms":["ESXi","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1486","sourceCount":82},{"id":"T1489","name":"Service Stop","tactics":["Impact"],"platforms":["ESXi","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1489","sourceCount":50},{"id":"T1490","name":"Inhibit System Recovery","tactics":["Impact"],"platforms":["Containers","ESXi","IaaS","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1490","sourceCount":54},{"id":"T1491","name":"Defacement","tactics":["Impact"],"platforms":["ESXi","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1491","sourceCount":0},{"id":"T1491.001","name":"Defacement: Internal Defacement","tactics":["Impact"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1491","url":"https://attack.mitre.org/techniques/T1491/001","sourceCount":12},{"id":"T1491.002","name":"Defacement: External Defacement","tactics":["Impact"],"platforms":["IaaS","Linux","Windows","macOS"],"parent":"T1491","url":"https://attack.mitre.org/techniques/T1491/002","sourceCount":2},{"id":"T1495","name":"Firmware Corruption","tactics":["Impact"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1495","sourceCount":2},{"id":"T1496","name":"Resource Hijacking","tactics":["Impact"],"platforms":["Containers","IaaS","Linux","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1496","sourceCount":0},{"id":"T1496.001","name":"Resource Hijacking: Compute Hijacking","tactics":["Impact"],"platforms":["Containers","IaaS","Linux","Windows","macOS"],"parent":"T1496","url":"https://attack.mitre.org/techniques/T1496/001","sourceCount":14},{"id":"T1496.002","name":"Resource Hijacking: Bandwidth Hijacking","tactics":["Impact"],"platforms":["Containers","IaaS","Linux","Windows","macOS"],"parent":"T1496","url":"https://attack.mitre.org/techniques/T1496/002","sourceCount":0},{"id":"T1496.003","name":"Resource Hijacking: SMS Pumping","tactics":["Impact"],"platforms":["SaaS"],"parent":"T1496","url":"https://attack.mitre.org/techniques/T1496/003","sourceCount":0},{"id":"T1496.004","name":"Resource Hijacking: Cloud Service Hijacking","tactics":["Impact"],"platforms":["SaaS"],"parent":"T1496","url":"https://attack.mitre.org/techniques/T1496/004","sourceCount":0},{"id":"T1497","name":"Virtualization/Sandbox Evasion","tactics":["Defense Evasion","Discovery"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1497","sourceCount":26},{"id":"T1497.001","name":"Virtualization/Sandbox Evasion: System Checks","tactics":["Defense Evasion","Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1497","url":"https://attack.mitre.org/techniques/T1497/001","sourceCount":66},{"id":"T1497.002","name":"Virtualization/Sandbox Evasion: User Activity Based Checks","tactics":["Defense Evasion","Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1497","url":"https://attack.mitre.org/techniques/T1497/002","sourceCount":5},{"id":"T1497.003","name":"Virtualization/Sandbox Evasion: Time Based Checks","tactics":["Defense Evasion","Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1497","url":"https://attack.mitre.org/techniques/T1497/003","sourceCount":46},{"id":"T1498","name":"Network Denial of Service","tactics":["Impact"],"platforms":["Containers","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1498","sourceCount":3},{"id":"T1498.001","name":"Network Denial of Service: Direct Network Flood","tactics":["Impact"],"platforms":["IaaS","Linux","Windows","macOS"],"parent":"T1498","url":"https://attack.mitre.org/techniques/T1498/001","sourceCount":0},{"id":"T1498.002","name":"Network Denial of Service: Reflection Amplification","tactics":["Impact"],"platforms":["IaaS","Linux","Windows","macOS"],"parent":"T1498","url":"https://attack.mitre.org/techniques/T1498/002","sourceCount":0},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["Impact"],"platforms":["Containers","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1499","sourceCount":3},{"id":"T1499.001","name":"Endpoint Denial of Service: OS Exhaustion Flood","tactics":["Impact"],"platforms":["Linux","Windows","macOS"],"parent":"T1499","url":"https://attack.mitre.org/techniques/T1499/001","sourceCount":0},{"id":"T1499.002","name":"Endpoint Denial of Service: Service Exhaustion Flood","tactics":["Impact"],"platforms":["IaaS","Linux","Windows","macOS"],"parent":"T1499","url":"https://attack.mitre.org/techniques/T1499/002","sourceCount":0},{"id":"T1499.003","name":"Endpoint Denial of Service: Application Exhaustion Flood","tactics":["Impact"],"platforms":["IaaS","Linux","Windows","macOS"],"parent":"T1499","url":"https://attack.mitre.org/techniques/T1499/003","sourceCount":0},{"id":"T1499.004","name":"Endpoint Denial of Service: Application or System Exploitation","tactics":["Impact"],"platforms":["IaaS","Linux","Windows","macOS"],"parent":"T1499","url":"https://attack.mitre.org/techniques/T1499/004","sourceCount":1},{"id":"T1505","name":"Server Software Component","tactics":["Persistence"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1505","sourceCount":0},{"id":"T1505.001","name":"Server Software Component: SQL Stored Procedures","tactics":["Persistence"],"platforms":["Linux","Windows"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/001","sourceCount":2},{"id":"T1505.002","name":"Server Software Component: Transport Agent","tactics":["Persistence"],"platforms":["Linux","Windows"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/002","sourceCount":1},{"id":"T1505.003","name":"Server Software Component: Web Shell","tactics":["Persistence"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/003","sourceCount":62},{"id":"T1505.004","name":"Server Software Component: IIS Components","tactics":["Persistence"],"platforms":["Windows"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/004","sourceCount":5},{"id":"T1505.005","name":"Server Software Component: Terminal Services DLL","tactics":["Persistence"],"platforms":["Windows"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/005","sourceCount":0},{"id":"T1505.006","name":"Server Software Component: vSphere Installation Bundles","tactics":["Persistence"],"platforms":["ESXi"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/006","sourceCount":2},{"id":"T1518","name":"Software Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1518","sourceCount":50},{"id":"T1518.001","name":"Software Discovery: Security Software Discovery","tactics":["Discovery"],"platforms":["IaaS","Linux","Windows","macOS"],"parent":"T1518","url":"https://attack.mitre.org/techniques/T1518/001","sourceCount":135},{"id":"T1518.002","name":"Software Discovery: Backup Software Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1518","url":"https://attack.mitre.org/techniques/T1518/002","sourceCount":1},{"id":"T1525","name":"Implant Internal Image","tactics":["Persistence"],"platforms":["Containers","IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1525","sourceCount":0},{"id":"T1526","name":"Cloud Service Discovery","tactics":["Discovery"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1526","sourceCount":4},{"id":"T1528","name":"Steal Application Access Token","tactics":["Credential Access"],"platforms":["Containers","IaaS","Identity Provider","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1528","sourceCount":5},{"id":"T1529","name":"System Shutdown/Reboot","tactics":["Impact"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1529","sourceCount":27},{"id":"T1530","name":"Data from Cloud Storage","tactics":["Collection"],"platforms":["IaaS","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1530","sourceCount":9},{"id":"T1531","name":"Account Access Removal","tactics":["Impact"],"platforms":["ESXi","IaaS","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1531","sourceCount":6},{"id":"T1534","name":"Internal Spearphishing","tactics":["Lateral Movement"],"platforms":["Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1534","sourceCount":5},{"id":"T1535","name":"Unused/Unsupported Cloud Regions","tactics":["Defense Evasion"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1535","sourceCount":0},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["Exfiltration"],"platforms":["IaaS","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1537","sourceCount":3},{"id":"T1538","name":"Cloud Service Dashboard","tactics":["Discovery"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1538","sourceCount":1},{"id":"T1539","name":"Steal Web Session Cookie","tactics":["Credential Access"],"platforms":["Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1539","sourceCount":25},{"id":"T1542","name":"Pre-OS Boot","tactics":["Defense Evasion","Persistence"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1542","sourceCount":0},{"id":"T1542.001","name":"Pre-OS Boot: System Firmware","tactics":["Defense Evasion","Persistence"],"platforms":["Network Devices","Windows"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/001","sourceCount":3},{"id":"T1542.002","name":"Pre-OS Boot: Component Firmware","tactics":["Defense Evasion","Persistence"],"platforms":["Linux","Windows","macOS"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/002","sourceCount":2},{"id":"T1542.003","name":"Pre-OS Boot: Bootkit","tactics":["Defense Evasion","Persistence"],"platforms":["Linux","Windows"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/003","sourceCount":9},{"id":"T1542.004","name":"Pre-OS Boot: ROMMONkit","tactics":["Defense Evasion","Persistence"],"platforms":["Network Devices"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/004","sourceCount":0},{"id":"T1542.005","name":"Pre-OS Boot: TFTP Boot","tactics":["Defense Evasion","Persistence"],"platforms":["Network Devices"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/005","sourceCount":0},{"id":"T1543","name":"Create or Modify System Process","tactics":["Persistence","Privilege Escalation"],"platforms":["Containers","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1543","sourceCount":6},{"id":"T1543.001","name":"Create or Modify System Process: Launch Agent","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/001","sourceCount":21},{"id":"T1543.002","name":"Create or Modify System Process: Systemd Service","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/002","sourceCount":12},{"id":"T1543.003","name":"Create or Modify System Process: Windows Service","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/003","sourceCount":138},{"id":"T1543.004","name":"Create or Modify System Process: Launch Daemon","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/004","sourceCount":11},{"id":"T1543.005","name":"Create or Modify System Process: Container Service","tactics":["Persistence","Privilege Escalation"],"platforms":["Containers"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/005","sourceCount":0},{"id":"T1546","name":"Event Triggered Execution","tactics":["Persistence","Privilege Escalation"],"platforms":["IaaS","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1546","sourceCount":4},{"id":"T1546.001","name":"Event Triggered Execution: Change Default File Association","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/001","sourceCount":2},{"id":"T1546.002","name":"Event Triggered Execution: Screensaver","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/002","sourceCount":1},{"id":"T1546.003","name":"Event Triggered Execution: Windows Management Instrumentation Event Subscription","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/003","sourceCount":25},{"id":"T1546.004","name":"Event Triggered Execution: Unix Shell Configuration Modification","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","macOS"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/004","sourceCount":6},{"id":"T1546.005","name":"Event Triggered Execution: Trap","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","macOS"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/005","sourceCount":0},{"id":"T1546.006","name":"Event Triggered Execution: LC_LOAD_DYLIB Addition","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/006","sourceCount":0},{"id":"T1546.007","name":"Event Triggered Execution: Netsh Helper DLL","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/007","sourceCount":1},{"id":"T1546.008","name":"Event Triggered Execution: Accessibility Features","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/008","sourceCount":7},{"id":"T1546.009","name":"Event Triggered Execution: AppCert DLLs","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/009","sourceCount":1},{"id":"T1546.010","name":"Event Triggered Execution: AppInit DLLs","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/010","sourceCount":4},{"id":"T1546.011","name":"Event Triggered Execution: Application Shimming","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/011","sourceCount":4},{"id":"T1546.012","name":"Event Triggered Execution: Image File Execution Options Injection","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/012","sourceCount":3},{"id":"T1546.013","name":"Event Triggered Execution: PowerShell Profile","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/013","sourceCount":1},{"id":"T1546.014","name":"Event Triggered Execution: Emond","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/014","sourceCount":0},{"id":"T1546.015","name":"Event Triggered Execution: Component Object Model Hijacking","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/015","sourceCount":12},{"id":"T1546.016","name":"Event Triggered Execution: Installer Packages","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","Windows","macOS"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/016","sourceCount":2},{"id":"T1546.017","name":"Event Triggered Execution: Udev Rules","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/017","sourceCount":1},{"id":"T1546.018","name":"Event Triggered Execution: Python Startup Hooks","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","Windows","macOS"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/018","sourceCount":0},{"id":"T1547","name":"Boot or Logon Autostart Execution","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1547","sourceCount":6},{"id":"T1547.001","name":"Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/001","sourceCount":252},{"id":"T1547.002","name":"Boot or Logon Autostart Execution: Authentication Package","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/002","sourceCount":1},{"id":"T1547.003","name":"Boot or Logon Autostart Execution: Time Providers","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/003","sourceCount":0},{"id":"T1547.004","name":"Boot or Logon Autostart Execution: Winlogon Helper DLL","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/004","sourceCount":13},{"id":"T1547.005","name":"Boot or Logon Autostart Execution: Security Support Provider","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/005","sourceCount":3},{"id":"T1547.006","name":"Boot or Logon Autostart Execution: Kernel Modules and Extensions","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","macOS"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/006","sourceCount":4},{"id":"T1547.007","name":"Boot or Logon Autostart Execution: Re-opened Applications","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/007","sourceCount":0},{"id":"T1547.008","name":"Boot or Logon Autostart Execution: LSASS Driver","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/008","sourceCount":2},{"id":"T1547.009","name":"Boot or Logon Autostart Execution: Shortcut Modification","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/009","sourceCount":29},{"id":"T1547.010","name":"Boot or Logon Autostart Execution: Port Monitors","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/010","sourceCount":0},{"id":"T1547.012","name":"Boot or Logon Autostart Execution: Print Processors","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/012","sourceCount":3},{"id":"T1547.013","name":"Boot or Logon Autostart Execution: XDG Autostart Entries","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/013","sourceCount":7},{"id":"T1547.014","name":"Boot or Logon Autostart Execution: Active Setup","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/014","sourceCount":1},{"id":"T1547.015","name":"Boot or Logon Autostart Execution: Login Items","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/015","sourceCount":3},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["IaaS","Identity Provider","Linux","Office Suite","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1548","sourceCount":2},{"id":"T1548.001","name":"Abuse Elevation Control Mechanism: Setuid and Setgid","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Linux","macOS"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/001","sourceCount":2},{"id":"T1548.002","name":"Abuse Elevation Control Mechanism: Bypass User Account Control","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Windows"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/002","sourceCount":61},{"id":"T1548.003","name":"Abuse Elevation Control Mechanism: Sudo and Sudo Caching","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["Linux","macOS"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/003","sourceCount":3},{"id":"T1548.004","name":"Abuse Elevation Control Mechanism: Elevated Execution with Prompt","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["macOS"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/004","sourceCount":1},{"id":"T1548.005","name":"Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["IaaS","Identity Provider","Office Suite"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/005","sourceCount":0},{"id":"T1548.006","name":"Abuse Elevation Control Mechanism: TCC Manipulation","tactics":["Defense Evasion","Privilege Escalation"],"platforms":["macOS"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/006","sourceCount":1},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["Defense Evasion","Lateral Movement"],"platforms":["Containers","IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1550","sourceCount":2},{"id":"T1550.001","name":"Use Alternate Authentication Material: Application Access Token","tactics":["Defense Evasion","Lateral Movement"],"platforms":["Containers","IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1550","url":"https://attack.mitre.org/techniques/T1550/001","sourceCount":5},{"id":"T1550.002","name":"Use Alternate Authentication Material: Pass the Hash","tactics":["Defense Evasion","Lateral Movement"],"platforms":["Windows"],"parent":"T1550","url":"https://attack.mitre.org/techniques/T1550/002","sourceCount":20},{"id":"T1550.003","name":"Use Alternate Authentication Material: Pass the Ticket","tactics":["Defense Evasion","Lateral Movement"],"platforms":["Windows"],"parent":"T1550","url":"https://attack.mitre.org/techniques/T1550/003","sourceCount":6},{"id":"T1550.004","name":"Use Alternate Authentication Material: Web Session Cookie","tactics":["Defense Evasion","Lateral Movement"],"platforms":["IaaS","Office Suite","SaaS"],"parent":"T1550","url":"https://attack.mitre.org/techniques/T1550/004","sourceCount":2},{"id":"T1552","name":"Unsecured Credentials","tactics":["Credential Access"],"platforms":["Containers","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1552","sourceCount":6},{"id":"T1552.001","name":"Unsecured Credentials: Credentials In Files","tactics":["Credential Access"],"platforms":["Containers","IaaS","Linux","Windows","macOS"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/001","sourceCount":34},{"id":"T1552.002","name":"Unsecured Credentials: Credentials in Registry","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/002","sourceCount":9},{"id":"T1552.003","name":"Unsecured Credentials: Shell History","tactics":["Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/003","sourceCount":1},{"id":"T1552.004","name":"Unsecured Credentials: Private Keys","tactics":["Credential Access"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/004","sourceCount":18},{"id":"T1552.005","name":"Unsecured Credentials: Cloud Instance Metadata API","tactics":["Credential Access"],"platforms":["IaaS"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/005","sourceCount":3},{"id":"T1552.006","name":"Unsecured Credentials: Group Policy Preferences","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/006","sourceCount":4},{"id":"T1552.007","name":"Unsecured Credentials: Container API","tactics":["Credential Access"],"platforms":["Containers"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/007","sourceCount":1},{"id":"T1552.008","name":"Unsecured Credentials: Chat Messages","tactics":["Credential Access"],"platforms":["Office Suite","SaaS"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/008","sourceCount":1},{"id":"T1553","name":"Subvert Trust Controls","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1553","sourceCount":1},{"id":"T1553.001","name":"Subvert Trust Controls: Gatekeeper Bypass","tactics":["Defense Evasion"],"platforms":["macOS"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/001","sourceCount":6},{"id":"T1553.002","name":"Subvert Trust Controls: Code Signing","tactics":["Defense Evasion"],"platforms":["Windows","macOS"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/002","sourceCount":85},{"id":"T1553.003","name":"Subvert Trust Controls: SIP and Trust Provider Hijacking","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/003","sourceCount":0},{"id":"T1553.004","name":"Subvert Trust Controls: Install Root Certificate","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/004","sourceCount":4},{"id":"T1553.005","name":"Subvert Trust Controls: Mark-of-the-Web Bypass","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/005","sourceCount":5},{"id":"T1553.006","name":"Subvert Trust Controls: Code Signing Policy Modification","tactics":["Defense Evasion"],"platforms":["Windows","macOS"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/006","sourceCount":5},{"id":"T1554","name":"Compromise Host Software Binary","tactics":["Persistence"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1554","sourceCount":21},{"id":"T1555","name":"Credentials from Password Stores","tactics":["Credential Access"],"platforms":["IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1555","sourceCount":37},{"id":"T1555.001","name":"Credentials from Password Stores: Keychain","tactics":["Credential Access"],"platforms":["macOS"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/001","sourceCount":11},{"id":"T1555.002","name":"Credentials from Password Stores: Securityd Memory","tactics":["Credential Access"],"platforms":["Linux","macOS"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/002","sourceCount":1},{"id":"T1555.003","name":"Credentials from Password Stores: Credentials from Web Browsers","tactics":["Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/003","sourceCount":87},{"id":"T1555.004","name":"Credentials from Password Stores: Windows Credential Manager","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/004","sourceCount":14},{"id":"T1555.005","name":"Credentials from Password Stores: Password Managers","tactics":["Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/005","sourceCount":12},{"id":"T1555.006","name":"Credentials from Password Stores: Cloud Secrets Management Stores","tactics":["Credential Access"],"platforms":["IaaS"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/006","sourceCount":3},{"id":"T1556","name":"Modify Authentication Process","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1556","sourceCount":5},{"id":"T1556.001","name":"Modify Authentication Process: Domain Controller Authentication","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/001","sourceCount":2},{"id":"T1556.002","name":"Modify Authentication Process: Password Filter DLL","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/002","sourceCount":3},{"id":"T1556.003","name":"Modify Authentication Process: Pluggable Authentication Modules","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["Linux","macOS"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/003","sourceCount":2},{"id":"T1556.004","name":"Modify Authentication Process: Network Device Authentication","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["Network Devices"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/004","sourceCount":2},{"id":"T1556.005","name":"Modify Authentication Process: Reversible Encryption","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/005","sourceCount":0},{"id":"T1556.006","name":"Modify Authentication Process: Multi-Factor Authentication","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows","macOS"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/006","sourceCount":3},{"id":"T1556.007","name":"Modify Authentication Process: Hybrid Identity","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS","Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/007","sourceCount":2},{"id":"T1556.008","name":"Modify Authentication Process: Network Provider DLL","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/008","sourceCount":0},{"id":"T1556.009","name":"Modify Authentication Process: Conditional Access Policies","tactics":["Credential Access","Defense Evasion","Persistence"],"platforms":["IaaS","Identity Provider"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/009","sourceCount":2},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["Collection","Credential Access"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1557","sourceCount":7},{"id":"T1557.001","name":"Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay","tactics":["Collection","Credential Access"],"platforms":["Windows"],"parent":"T1557","url":"https://attack.mitre.org/techniques/T1557/001","sourceCount":7},{"id":"T1557.002","name":"Adversary-in-the-Middle: ARP Cache Poisoning","tactics":["Collection","Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1557","url":"https://attack.mitre.org/techniques/T1557/002","sourceCount":2},{"id":"T1557.003","name":"Adversary-in-the-Middle: DHCP Spoofing","tactics":["Collection","Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1557","url":"https://attack.mitre.org/techniques/T1557/003","sourceCount":0},{"id":"T1557.004","name":"Adversary-in-the-Middle: Evil Twin","tactics":["Collection","Credential Access"],"platforms":["Network Devices"],"parent":"T1557","url":"https://attack.mitre.org/techniques/T1557/004","sourceCount":1},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["Credential Access"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1558","sourceCount":1},{"id":"T1558.001","name":"Steal or Forge Kerberos Tickets: Golden Ticket","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/001","sourceCount":5},{"id":"T1558.002","name":"Steal or Forge Kerberos Tickets: Silver Ticket","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/002","sourceCount":4},{"id":"T1558.003","name":"Steal or Forge Kerberos Tickets: Kerberoasting","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/003","sourceCount":12},{"id":"T1558.004","name":"Steal or Forge Kerberos Tickets: AS-REP Roasting","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/004","sourceCount":1},{"id":"T1558.005","name":"Steal or Forge Kerberos Tickets: Ccache Files","tactics":["Credential Access"],"platforms":["Linux","macOS"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/005","sourceCount":1},{"id":"T1559","name":"Inter-Process Communication","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1559","sourceCount":16},{"id":"T1559.001","name":"Inter-Process Communication: Component Object Model","tactics":["Execution"],"platforms":["Windows"],"parent":"T1559","url":"https://attack.mitre.org/techniques/T1559/001","sourceCount":20},{"id":"T1559.002","name":"Inter-Process Communication: Dynamic Data Exchange","tactics":["Execution"],"platforms":["Windows"],"parent":"T1559","url":"https://attack.mitre.org/techniques/T1559/002","sourceCount":20},{"id":"T1559.003","name":"Inter-Process Communication: XPC Services","tactics":["Execution"],"platforms":["macOS"],"parent":"T1559","url":"https://attack.mitre.org/techniques/T1559/003","sourceCount":0},{"id":"T1560","name":"Archive Collected Data","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1560","sourceCount":54},{"id":"T1560.001","name":"Archive Collected Data: Archive via Utility","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":"T1560","url":"https://attack.mitre.org/techniques/T1560/001","sourceCount":78},{"id":"T1560.002","name":"Archive Collected Data: Archive via Library","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":"T1560","url":"https://attack.mitre.org/techniques/T1560/002","sourceCount":15},{"id":"T1560.003","name":"Archive Collected Data: Archive via Custom Method","tactics":["Collection"],"platforms":["Linux","Windows","macOS"],"parent":"T1560","url":"https://attack.mitre.org/techniques/T1560/003","sourceCount":39},{"id":"T1561","name":"Disk Wipe","tactics":["Impact"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1561","sourceCount":0},{"id":"T1561.001","name":"Disk Wipe: Disk Content Wipe","tactics":["Impact"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1561","url":"https://attack.mitre.org/techniques/T1561/001","sourceCount":16},{"id":"T1561.002","name":"Disk Wipe: Disk Structure Wipe","tactics":["Impact"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1561","url":"https://attack.mitre.org/techniques/T1561/002","sourceCount":17},{"id":"T1562","name":"Impair Defenses","tactics":["Defense Evasion"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1562","sourceCount":5},{"id":"T1562.001","name":"Impair Defenses: Disable or Modify Tools","tactics":["Defense Evasion"],"platforms":["Containers","IaaS","Linux","Network Devices","Windows","macOS"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/001","sourceCount":110},{"id":"T1562.002","name":"Impair Defenses: Disable Windows Event Logging","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/002","sourceCount":6},{"id":"T1562.003","name":"Impair Defenses: Impair Command History Logging","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/003","sourceCount":10},{"id":"T1562.004","name":"Impair Defenses: Disable or Modify System Firewall","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/004","sourceCount":45},{"id":"T1562.006","name":"Impair Defenses: Indicator Blocking","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/006","sourceCount":10},{"id":"T1562.007","name":"Impair Defenses: Disable or Modify Cloud Firewall","tactics":["Defense Evasion"],"platforms":["IaaS"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/007","sourceCount":1},{"id":"T1562.008","name":"Impair Defenses: Disable or Modify Cloud Logs","tactics":["Defense Evasion"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/008","sourceCount":2},{"id":"T1562.009","name":"Impair Defenses: Safe Mode Boot","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/009","sourceCount":7},{"id":"T1562.010","name":"Impair Defenses: Downgrade Attack","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/010","sourceCount":3},{"id":"T1562.011","name":"Impair Defenses: Spoof Security Alerting","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/011","sourceCount":0},{"id":"T1562.012","name":"Impair Defenses: Disable or Modify Linux Audit System","tactics":["Defense Evasion"],"platforms":["Linux"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/012","sourceCount":1},{"id":"T1562.013","name":"Impair Defenses: Disable or Modify Network Device Firewall","tactics":["Defense Evasion"],"platforms":["Network Devices"],"parent":"T1562","url":"https://attack.mitre.org/techniques/T1562/013","sourceCount":2},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["Lateral Movement"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1563","sourceCount":0},{"id":"T1563.001","name":"Remote Service Session Hijacking: SSH Hijacking","tactics":["Lateral Movement"],"platforms":["Linux","macOS"],"parent":"T1563","url":"https://attack.mitre.org/techniques/T1563/001","sourceCount":1},{"id":"T1563.002","name":"Remote Service Session Hijacking: RDP Hijacking","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1563","url":"https://attack.mitre.org/techniques/T1563/002","sourceCount":2},{"id":"T1564","name":"Hide Artifacts","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Office Suite","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1564","sourceCount":5},{"id":"T1564.001","name":"Hide Artifacts: Hidden Files and Directories","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/001","sourceCount":58},{"id":"T1564.002","name":"Hide Artifacts: Hidden Users","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/002","sourceCount":3},{"id":"T1564.003","name":"Hide Artifacts: Hidden Window","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/003","sourceCount":54},{"id":"T1564.004","name":"Hide Artifacts: NTFS File Attributes","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/004","sourceCount":16},{"id":"T1564.005","name":"Hide Artifacts: Hidden File System","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/005","sourceCount":6},{"id":"T1564.006","name":"Hide Artifacts: Run Virtual Instance","tactics":["Defense Evasion"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/006","sourceCount":3},{"id":"T1564.007","name":"Hide Artifacts: VBA Stomping","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/007","sourceCount":0},{"id":"T1564.008","name":"Hide Artifacts: Email Hiding Rules","tactics":["Defense Evasion"],"platforms":["Linux","Office Suite","Windows","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/008","sourceCount":2},{"id":"T1564.009","name":"Hide Artifacts: Resource Forking","tactics":["Defense Evasion"],"platforms":["macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/009","sourceCount":2},{"id":"T1564.010","name":"Hide Artifacts: Process Argument Spoofing","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/010","sourceCount":2},{"id":"T1564.011","name":"Hide Artifacts: Ignore Process Interrupts","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/011","sourceCount":6},{"id":"T1564.012","name":"Hide Artifacts: File/Path Exclusions","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/012","sourceCount":1},{"id":"T1564.013","name":"Hide Artifacts: Bind Mounts","tactics":["Defense Evasion"],"platforms":["Linux"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/013","sourceCount":1},{"id":"T1564.014","name":"Hide Artifacts: Extended Attributes","tactics":["Defense Evasion"],"platforms":["Linux","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/014","sourceCount":0},{"id":"T1565","name":"Data Manipulation","tactics":["Impact"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1565","sourceCount":1},{"id":"T1565.001","name":"Data Manipulation: Stored Data Manipulation","tactics":["Impact"],"platforms":["Linux","Windows","macOS"],"parent":"T1565","url":"https://attack.mitre.org/techniques/T1565/001","sourceCount":3},{"id":"T1565.002","name":"Data Manipulation: Transmitted Data Manipulation","tactics":["Impact"],"platforms":["Linux","Windows","macOS"],"parent":"T1565","url":"https://attack.mitre.org/techniques/T1565/002","sourceCount":4},{"id":"T1565.003","name":"Data Manipulation: Runtime Data Manipulation","tactics":["Impact"],"platforms":["Linux","Windows","macOS"],"parent":"T1565","url":"https://attack.mitre.org/techniques/T1565/003","sourceCount":1},{"id":"T1566","name":"Phishing","tactics":["Initial Access"],"platforms":["Identity Provider","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1566","sourceCount":9},{"id":"T1566.001","name":"Phishing: Spearphishing Attachment","tactics":["Initial Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1566","url":"https://attack.mitre.org/techniques/T1566/001","sourceCount":141},{"id":"T1566.002","name":"Phishing: Spearphishing Link","tactics":["Initial Access"],"platforms":["Identity Provider","Linux","Office Suite","SaaS","Windows","macOS"],"parent":"T1566","url":"https://attack.mitre.org/techniques/T1566/002","sourceCount":80},{"id":"T1566.003","name":"Phishing: Spearphishing via Service","tactics":["Initial Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1566","url":"https://attack.mitre.org/techniques/T1566/003","sourceCount":16},{"id":"T1566.004","name":"Phishing: Spearphishing Voice","tactics":["Initial Access"],"platforms":["Identity Provider","Linux","Windows","macOS"],"parent":"T1566","url":"https://attack.mitre.org/techniques/T1566/004","sourceCount":2},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1567","sourceCount":14},{"id":"T1567.001","name":"Exfiltration Over Web Service: Exfiltration to Code Repository","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1567","url":"https://attack.mitre.org/techniques/T1567/001","sourceCount":1},{"id":"T1567.002","name":"Exfiltration Over Web Service: Exfiltration to Cloud Storage","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1567","url":"https://attack.mitre.org/techniques/T1567/002","sourceCount":42},{"id":"T1567.003","name":"Exfiltration Over Web Service: Exfiltration to Text Storage Sites","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1567","url":"https://attack.mitre.org/techniques/T1567/003","sourceCount":0},{"id":"T1567.004","name":"Exfiltration Over Web Service: Exfiltration Over Webhook","tactics":["Exfiltration"],"platforms":["ESXi","Linux","Office Suite","SaaS","Windows","macOS"],"parent":"T1567","url":"https://attack.mitre.org/techniques/T1567/004","sourceCount":0},{"id":"T1568","name":"Dynamic Resolution","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1568","sourceCount":20},{"id":"T1568.001","name":"Dynamic Resolution: Fast Flux DNS","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1568","url":"https://attack.mitre.org/techniques/T1568/001","sourceCount":6},{"id":"T1568.002","name":"Dynamic Resolution: Domain Generation Algorithms","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1568","url":"https://attack.mitre.org/techniques/T1568/002","sourceCount":22},{"id":"T1568.003","name":"Dynamic Resolution: DNS Calculation","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":"T1568","url":"https://attack.mitre.org/techniques/T1568/003","sourceCount":1},{"id":"T1569","name":"System Services","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1569","sourceCount":0},{"id":"T1569.001","name":"System Services: Launchctl","tactics":["Execution"],"platforms":["macOS"],"parent":"T1569","url":"https://attack.mitre.org/techniques/T1569/001","sourceCount":6},{"id":"T1569.002","name":"System Services: Service Execution","tactics":["Execution"],"platforms":["Windows"],"parent":"T1569","url":"https://attack.mitre.org/techniques/T1569/002","sourceCount":71},{"id":"T1569.003","name":"System Services: Systemctl","tactics":["Execution"],"platforms":["Linux"],"parent":"T1569","url":"https://attack.mitre.org/techniques/T1569/003","sourceCount":1},{"id":"T1570","name":"Lateral Tool Transfer","tactics":["Lateral Movement"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1570","sourceCount":52},{"id":"T1571","name":"Non-Standard Port","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1571","sourceCount":60},{"id":"T1572","name":"Protocol Tunneling","tactics":["Command and Control"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1572","sourceCount":38},{"id":"T1573","name":"Encrypted Channel","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1573","sourceCount":17},{"id":"T1573.001","name":"Encrypted Channel: Symmetric Cryptography","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1573","url":"https://attack.mitre.org/techniques/T1573/001","sourceCount":177},{"id":"T1573.002","name":"Encrypted Channel: Asymmetric Cryptography","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":"T1573","url":"https://attack.mitre.org/techniques/T1573/002","sourceCount":89},{"id":"T1574","name":"Hijack Execution Flow","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1574","sourceCount":10},{"id":"T1574.001","name":"Hijack Execution Flow: DLL","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/001","sourceCount":103},{"id":"T1574.004","name":"Hijack Execution Flow: Dylib Hijacking","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/004","sourceCount":1},{"id":"T1574.005","name":"Hijack Execution Flow: Executable Installer File Permissions Weakness","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/005","sourceCount":1},{"id":"T1574.006","name":"Hijack Execution Flow: Dynamic Linker Hijacking","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Linux","macOS"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/006","sourceCount":9},{"id":"T1574.007","name":"Hijack Execution Flow: Path Interception by PATH Environment Variable","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Linux","Windows","macOS"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/007","sourceCount":3},{"id":"T1574.008","name":"Hijack Execution Flow: Path Interception by Search Order Hijacking","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/008","sourceCount":2},{"id":"T1574.009","name":"Hijack Execution Flow: Path Interception by Unquoted Path","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/009","sourceCount":2},{"id":"T1574.010","name":"Hijack Execution Flow: Services File Permissions Weakness","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/010","sourceCount":1},{"id":"T1574.011","name":"Hijack Execution Flow: Services Registry Permissions Weakness","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/011","sourceCount":1},{"id":"T1574.012","name":"Hijack Execution Flow: COR_PROFILER","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/012","sourceCount":2},{"id":"T1574.013","name":"Hijack Execution Flow: KernelCallbackTable","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/013","sourceCount":2},{"id":"T1574.014","name":"Hijack Execution Flow: AppDomainManager","tactics":["Defense Evasion","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/014","sourceCount":1},{"id":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["Defense Evasion"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1578","sourceCount":0},{"id":"T1578.001","name":"Modify Cloud Compute Infrastructure: Create Snapshot","tactics":["Defense Evasion"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/001","sourceCount":1},{"id":"T1578.002","name":"Modify Cloud Compute Infrastructure: Create Cloud Instance","tactics":["Defense Evasion"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/002","sourceCount":3},{"id":"T1578.003","name":"Modify Cloud Compute Infrastructure: Delete Cloud Instance","tactics":["Defense Evasion"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/003","sourceCount":2},{"id":"T1578.004","name":"Modify Cloud Compute Infrastructure: Revert Cloud Instance","tactics":["Defense Evasion"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/004","sourceCount":0},{"id":"T1578.005","name":"Modify Cloud Compute Infrastructure: Modify Cloud Compute Configurations","tactics":["Defense Evasion"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/005","sourceCount":0},{"id":"T1580","name":"Cloud Infrastructure Discovery","tactics":["Discovery"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1580","sourceCount":3},{"id":"T1583","name":"Acquire Infrastructure","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1583","sourceCount":8},{"id":"T1583.001","name":"Acquire Infrastructure: Domains","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/001","sourceCount":58},{"id":"T1583.002","name":"Acquire Infrastructure: DNS Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/002","sourceCount":3},{"id":"T1583.003","name":"Acquire Infrastructure: Virtual Private Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/003","sourceCount":20},{"id":"T1583.004","name":"Acquire Infrastructure: Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/004","sourceCount":10},{"id":"T1583.005","name":"Acquire Infrastructure: Botnet","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/005","sourceCount":3},{"id":"T1583.006","name":"Acquire Infrastructure: Web Services","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/006","sourceCount":27},{"id":"T1583.007","name":"Acquire Infrastructure: Serverless","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/007","sourceCount":1},{"id":"T1583.008","name":"Acquire Infrastructure: Malvertising","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/008","sourceCount":2},{"id":"T1584","name":"Compromise Infrastructure","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1584","sourceCount":2},{"id":"T1584.001","name":"Compromise Infrastructure: Domains","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/001","sourceCount":11},{"id":"T1584.002","name":"Compromise Infrastructure: DNS Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/002","sourceCount":2},{"id":"T1584.003","name":"Compromise Infrastructure: Virtual Private Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/003","sourceCount":3},{"id":"T1584.004","name":"Compromise Infrastructure: Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/004","sourceCount":15},{"id":"T1584.005","name":"Compromise Infrastructure: Botnet","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/005","sourceCount":5},{"id":"T1584.006","name":"Compromise Infrastructure: Web Services","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/006","sourceCount":6},{"id":"T1584.007","name":"Compromise Infrastructure: Serverless","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/007","sourceCount":0},{"id":"T1584.008","name":"Compromise Infrastructure: Network Devices","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/008","sourceCount":9},{"id":"T1585","name":"Establish Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1585","sourceCount":6},{"id":"T1585.001","name":"Establish Accounts: Social Media Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1585","url":"https://attack.mitre.org/techniques/T1585/001","sourceCount":19},{"id":"T1585.002","name":"Establish Accounts: Email Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1585","url":"https://attack.mitre.org/techniques/T1585/002","sourceCount":25},{"id":"T1585.003","name":"Establish Accounts: Cloud Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1585","url":"https://attack.mitre.org/techniques/T1585/003","sourceCount":2},{"id":"T1586","name":"Compromise Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1586","sourceCount":0},{"id":"T1586.001","name":"Compromise Accounts: Social Media Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1586","url":"https://attack.mitre.org/techniques/T1586/001","sourceCount":2},{"id":"T1586.002","name":"Compromise Accounts: Email Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1586","url":"https://attack.mitre.org/techniques/T1586/002","sourceCount":13},{"id":"T1586.003","name":"Compromise Accounts: Cloud Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1586","url":"https://attack.mitre.org/techniques/T1586/003","sourceCount":2},{"id":"T1587","name":"Develop Capabilities","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1587","sourceCount":3},{"id":"T1587.001","name":"Develop Capabilities: Malware","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1587","url":"https://attack.mitre.org/techniques/T1587/001","sourceCount":36},{"id":"T1587.002","name":"Develop Capabilities: Code Signing Certificates","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1587","url":"https://attack.mitre.org/techniques/T1587/002","sourceCount":4},{"id":"T1587.003","name":"Develop Capabilities: Digital Certificates","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1587","url":"https://attack.mitre.org/techniques/T1587/003","sourceCount":7},{"id":"T1587.004","name":"Develop Capabilities: Exploits","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1587","url":"https://attack.mitre.org/techniques/T1587/004","sourceCount":3},{"id":"T1588","name":"Obtain Capabilities","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1588","sourceCount":0},{"id":"T1588.001","name":"Obtain Capabilities: Malware","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/001","sourceCount":20},{"id":"T1588.002","name":"Obtain Capabilities: Tool","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/002","sourceCount":103},{"id":"T1588.003","name":"Obtain Capabilities: Code Signing Certificates","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/003","sourceCount":11},{"id":"T1588.004","name":"Obtain Capabilities: Digital Certificates","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/004","sourceCount":10},{"id":"T1588.005","name":"Obtain Capabilities: Exploits","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/005","sourceCount":2},{"id":"T1588.006","name":"Obtain Capabilities: Vulnerabilities","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/006","sourceCount":4},{"id":"T1588.007","name":"Obtain Capabilities: Artificial Intelligence","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/007","sourceCount":1},{"id":"T1589","name":"Gather Victim Identity Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1589","sourceCount":11},{"id":"T1589.001","name":"Gather Victim Identity Information: Credentials","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1589","url":"https://attack.mitre.org/techniques/T1589/001","sourceCount":7},{"id":"T1589.002","name":"Gather Victim Identity Information: Email Addresses","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1589","url":"https://attack.mitre.org/techniques/T1589/002","sourceCount":17},{"id":"T1589.003","name":"Gather Victim Identity Information: Employee Names","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1589","url":"https://attack.mitre.org/techniques/T1589/003","sourceCount":3},{"id":"T1590","name":"Gather Victim Network Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1590","sourceCount":3},{"id":"T1590.001","name":"Gather Victim Network Information: Domain Properties","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/001","sourceCount":2},{"id":"T1590.002","name":"Gather Victim Network Information: DNS","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/002","sourceCount":0},{"id":"T1590.003","name":"Gather Victim Network Information: Network Trust Dependencies","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/003","sourceCount":0},{"id":"T1590.004","name":"Gather Victim Network Information: Network Topology","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/004","sourceCount":3},{"id":"T1590.005","name":"Gather Victim Network Information: IP Addresses","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/005","sourceCount":3},{"id":"T1590.006","name":"Gather Victim Network Information: Network Security Appliances","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/006","sourceCount":1},{"id":"T1591","name":"Gather Victim Org Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1591","sourceCount":7},{"id":"T1591.001","name":"Gather Victim Org Information: Determine Physical Locations","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1591","url":"https://attack.mitre.org/techniques/T1591/001","sourceCount":1},{"id":"T1591.002","name":"Gather Victim Org Information: Business Relationships","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1591","url":"https://attack.mitre.org/techniques/T1591/002","sourceCount":3},{"id":"T1591.003","name":"Gather Victim Org Information: Identify Business Tempo","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1591","url":"https://attack.mitre.org/techniques/T1591/003","sourceCount":0},{"id":"T1591.004","name":"Gather Victim Org Information: Identify Roles","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1591","url":"https://attack.mitre.org/techniques/T1591/004","sourceCount":5},{"id":"T1592","name":"Gather Victim Host Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1592","sourceCount":1},{"id":"T1592.001","name":"Gather Victim Host Information: Hardware","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1592","url":"https://attack.mitre.org/techniques/T1592/001","sourceCount":0},{"id":"T1592.002","name":"Gather Victim Host Information: Software","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1592","url":"https://attack.mitre.org/techniques/T1592/002","sourceCount":3},{"id":"T1592.003","name":"Gather Victim Host Information: Firmware","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1592","url":"https://attack.mitre.org/techniques/T1592/003","sourceCount":0},{"id":"T1592.004","name":"Gather Victim Host Information: Client Configurations","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1592","url":"https://attack.mitre.org/techniques/T1592/004","sourceCount":1},{"id":"T1593","name":"Search Open Websites/Domains","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1593","sourceCount":6},{"id":"T1593.001","name":"Search Open Websites/Domains: Social Media","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1593","url":"https://attack.mitre.org/techniques/T1593/001","sourceCount":4},{"id":"T1593.002","name":"Search Open Websites/Domains: Search Engines","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1593","url":"https://attack.mitre.org/techniques/T1593/002","sourceCount":2},{"id":"T1593.003","name":"Search Open Websites/Domains: Code Repositories","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1593","url":"https://attack.mitre.org/techniques/T1593/003","sourceCount":3},{"id":"T1594","name":"Search Victim-Owned Websites","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1594","sourceCount":9},{"id":"T1595","name":"Active Scanning","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1595","sourceCount":1},{"id":"T1595.001","name":"Active Scanning: Scanning IP Blocks","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1595","url":"https://attack.mitre.org/techniques/T1595/001","sourceCount":2},{"id":"T1595.002","name":"Active Scanning: Vulnerability Scanning","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1595","url":"https://attack.mitre.org/techniques/T1595/002","sourceCount":15},{"id":"T1595.003","name":"Active Scanning: Wordlist Scanning","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1595","url":"https://attack.mitre.org/techniques/T1595/003","sourceCount":2},{"id":"T1596","name":"Search Open Technical Databases","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1596","sourceCount":2},{"id":"T1596.001","name":"Search Open Technical Databases: DNS/Passive DNS","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/001","sourceCount":0},{"id":"T1596.002","name":"Search Open Technical Databases: WHOIS","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/002","sourceCount":0},{"id":"T1596.003","name":"Search Open Technical Databases: Digital Certificates","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/003","sourceCount":0},{"id":"T1596.004","name":"Search Open Technical Databases: CDNs","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/004","sourceCount":0},{"id":"T1596.005","name":"Search Open Technical Databases: Scan Databases","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/005","sourceCount":3},{"id":"T1597","name":"Search Closed Sources","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1597","sourceCount":1},{"id":"T1597.001","name":"Search Closed Sources: Threat Intel Vendors","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1597","url":"https://attack.mitre.org/techniques/T1597/001","sourceCount":0},{"id":"T1597.002","name":"Search Closed Sources: Purchase Technical Data","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1597","url":"https://attack.mitre.org/techniques/T1597/002","sourceCount":1},{"id":"T1598","name":"Phishing for Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1598","sourceCount":5},{"id":"T1598.001","name":"Phishing for Information: Spearphishing Service","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1598","url":"https://attack.mitre.org/techniques/T1598/001","sourceCount":1},{"id":"T1598.002","name":"Phishing for Information: Spearphishing Attachment","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1598","url":"https://attack.mitre.org/techniques/T1598/002","sourceCount":4},{"id":"T1598.003","name":"Phishing for Information: Spearphishing Link","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1598","url":"https://attack.mitre.org/techniques/T1598/003","sourceCount":17},{"id":"T1598.004","name":"Phishing for Information: Spearphishing Voice","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1598","url":"https://attack.mitre.org/techniques/T1598/004","sourceCount":4},{"id":"T1599","name":"Network Boundary Bridging","tactics":["Defense Evasion"],"platforms":["Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1599","sourceCount":2},{"id":"T1599.001","name":"Network Boundary Bridging: Network Address Translation Traversal","tactics":["Defense Evasion"],"platforms":["Network Devices"],"parent":"T1599","url":"https://attack.mitre.org/techniques/T1599/001","sourceCount":0},{"id":"T1600","name":"Weaken Encryption","tactics":["Defense Evasion"],"platforms":["Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1600","sourceCount":0},{"id":"T1600.001","name":"Weaken Encryption: Reduce Key Space","tactics":["Defense Evasion"],"platforms":["Network Devices"],"parent":"T1600","url":"https://attack.mitre.org/techniques/T1600/001","sourceCount":0},{"id":"T1600.002","name":"Weaken Encryption: Disable Crypto Hardware","tactics":["Defense Evasion"],"platforms":["Network Devices"],"parent":"T1600","url":"https://attack.mitre.org/techniques/T1600/002","sourceCount":0},{"id":"T1601","name":"Modify System Image","tactics":["Defense Evasion"],"platforms":["Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1601","sourceCount":0},{"id":"T1601.001","name":"Modify System Image: Patch System Image","tactics":["Defense Evasion"],"platforms":["Network Devices"],"parent":"T1601","url":"https://attack.mitre.org/techniques/T1601/001","sourceCount":1},{"id":"T1601.002","name":"Modify System Image: Downgrade System Image","tactics":["Defense Evasion"],"platforms":["Network Devices"],"parent":"T1601","url":"https://attack.mitre.org/techniques/T1601/002","sourceCount":0},{"id":"T1602","name":"Data from Configuration Repository","tactics":["Collection"],"platforms":["Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1602","sourceCount":0},{"id":"T1602.001","name":"Data from Configuration Repository: SNMP (MIB Dump)","tactics":["Collection"],"platforms":["Network Devices"],"parent":"T1602","url":"https://attack.mitre.org/techniques/T1602/001","sourceCount":0},{"id":"T1602.002","name":"Data from Configuration Repository: Network Device Configuration Dump","tactics":["Collection"],"platforms":["Network Devices"],"parent":"T1602","url":"https://attack.mitre.org/techniques/T1602/002","sourceCount":1},{"id":"T1606","name":"Forge Web Credentials","tactics":["Credential Access"],"platforms":["IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1606","sourceCount":0},{"id":"T1606.001","name":"Forge Web Credentials: Web Cookies","tactics":["Credential Access"],"platforms":["IaaS","Linux","SaaS","Windows","macOS"],"parent":"T1606","url":"https://attack.mitre.org/techniques/T1606/001","sourceCount":1},{"id":"T1606.002","name":"Forge Web Credentials: SAML Tokens","tactics":["Credential Access"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS","Windows"],"parent":"T1606","url":"https://attack.mitre.org/techniques/T1606/002","sourceCount":2},{"id":"T1608","name":"Stage Capabilities","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1608","sourceCount":1},{"id":"T1608.001","name":"Stage Capabilities: Upload Malware","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/001","sourceCount":33},{"id":"T1608.002","name":"Stage Capabilities: Upload Tool","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/002","sourceCount":4},{"id":"T1608.003","name":"Stage Capabilities: Install Digital Certificate","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/003","sourceCount":1},{"id":"T1608.004","name":"Stage Capabilities: Drive-by Target","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/004","sourceCount":9},{"id":"T1608.005","name":"Stage Capabilities: Link Target","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/005","sourceCount":4},{"id":"T1608.006","name":"Stage Capabilities: SEO Poisoning","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/006","sourceCount":1},{"id":"T1609","name":"Container Administration Command","tactics":["Execution"],"platforms":["Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1609","sourceCount":5},{"id":"T1610","name":"Deploy Container","tactics":["Defense Evasion","Execution"],"platforms":["Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1610","sourceCount":4},{"id":"T1611","name":"Escape to Host","tactics":["Privilege Escalation"],"platforms":["Containers","ESXi","Linux","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1611","sourceCount":5},{"id":"T1612","name":"Build Image on Host","tactics":["Defense Evasion"],"platforms":["Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1612","sourceCount":0},{"id":"T1613","name":"Container and Resource Discovery","tactics":["Discovery"],"platforms":["Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1613","sourceCount":3},{"id":"T1614","name":"System Location Discovery","tactics":["Discovery"],"platforms":["IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1614","sourceCount":20},{"id":"T1614.001","name":"System Location Discovery: System Language Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1614","url":"https://attack.mitre.org/techniques/T1614/001","sourceCount":36},{"id":"T1615","name":"Group Policy Discovery","tactics":["Discovery"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1615","sourceCount":7},{"id":"T1619","name":"Cloud Storage Object Discovery","tactics":["Discovery"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1619","sourceCount":2},{"id":"T1620","name":"Reflective Code Loading","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1620","sourceCount":28},{"id":"T1621","name":"Multi-Factor Authentication Request Generation","tactics":["Credential Access"],"platforms":["IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1621","sourceCount":4},{"id":"T1622","name":"Debugger Evasion","tactics":["Defense Evasion","Discovery"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1622","sourceCount":23},{"id":"T1647","name":"Plist File Modification","tactics":["Defense Evasion"],"platforms":["macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1647","sourceCount":2},{"id":"T1648","name":"Serverless Execution","tactics":["Execution"],"platforms":["IaaS","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1648","sourceCount":1},{"id":"T1649","name":"Steal or Forge Authentication Certificates","tactics":["Credential Access"],"platforms":["Identity Provider","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1649","sourceCount":3},{"id":"T1650","name":"Acquire Access","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1650","sourceCount":1},{"id":"T1651","name":"Cloud Administration Command","tactics":["Execution"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1651","sourceCount":3},{"id":"T1652","name":"Device Driver Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1652","sourceCount":4},{"id":"T1653","name":"Power Settings","tactics":["Persistence"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1653","sourceCount":3},{"id":"T1654","name":"Log Enumeration","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1654","sourceCount":10},{"id":"T1656","name":"Impersonation","tactics":["Defense Evasion"],"platforms":["Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1656","sourceCount":12},{"id":"T1657","name":"Financial Theft","tactics":["Impact"],"platforms":["Linux","Office Suite","SaaS","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1657","sourceCount":20},{"id":"T1659","name":"Content Injection","tactics":["Command and Control","Initial Access"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1659","sourceCount":2},{"id":"T1665","name":"Hide Infrastructure","tactics":["Command and Control"],"platforms":["ESXi","Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1665","sourceCount":7},{"id":"T1666","name":"Modify Cloud Resource Hierarchy","tactics":["Defense Evasion"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1666","sourceCount":0},{"id":"T1667","name":"Email Bombing","tactics":["Impact"],"platforms":["Linux","Office Suite","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1667","sourceCount":1},{"id":"T1668","name":"Exclusive Control","tactics":["Persistence"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1668","sourceCount":0},{"id":"T1669","name":"Wi-Fi Networks","tactics":["Initial Access"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1669","sourceCount":2},{"id":"T1671","name":"Cloud Application Integration","tactics":["Persistence"],"platforms":["Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1671","sourceCount":1},{"id":"T1672","name":"Email Spoofing","tactics":["Defense Evasion"],"platforms":["Linux","Office Suite","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1672","sourceCount":0},{"id":"T1673","name":"Virtual Machine Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1673","sourceCount":4},{"id":"T1674","name":"Input Injection","tactics":["Execution"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1674","sourceCount":1},{"id":"T1675","name":"ESXi Administration Command","tactics":["Execution"],"platforms":["ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1675","sourceCount":2},{"id":"T1677","name":"Poisoned Pipeline Execution","tactics":["Execution"],"platforms":["SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1677","sourceCount":0},{"id":"T1678","name":"Delay Execution","tactics":["Defense Evasion"],"platforms":["Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1678","sourceCount":4},{"id":"T1679","name":"Selective Exclusion","tactics":["Defense Evasion"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1679","sourceCount":3},{"id":"T1680","name":"Local Storage Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1680","sourceCount":99},{"id":"T1681","name":"Search Threat Vendor Data","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1681","sourceCount":2}],"entities":[{"id":"C0028","name":"2015 Ukraine Electric Power Attack","type":"campaign","techniques":["T1018","T1040","T1055","T1056.001","T1059.005","T1070.004","T1071.001","T1078","T1105","T1112","T1133","T1136.002","T1204.002","T1218.011","T1562.001","T1566.001","T1570"]},{"id":"C0025","name":"2016 Ukraine Electric Power Attack","type":"campaign","techniques":["T1003.001","T1018","T1021.002","T1027","T1027.002","T1036.005","T1036.008","T1036.010","T1047","T1059.001","T1059.003","T1059.005","T1098","T1110","T1136","T1136.002","T1505.001","T1543.003","T1554","T1562.002","T1570"]},{"id":"C0034","name":"2022 Ukraine Electric Power Attack","type":"campaign","techniques":["T1036.004","T1053.005","T1059.001","T1095","T1484.001","T1485","T1505.003","T1543.002","T1570","T1572"]},{"id":"C0057","name":"3CX Supply Chain Attack","type":"campaign","techniques":["T1027","T1027.009","T1027.013","T1055","T1055.002","T1071.001","T1078","T1102.001","T1189","T1195.002","T1203","T1217","T1218.007","T1218.015","T1543.004","T1546.016","T1553.002","T1559","T1573.001","T1574.001","T1620","T1678"]},{"id":"C0051","name":"APT28 Nearest Neighbor Campaign","type":"campaign","techniques":["T1003.002","T1003.003","T1006","T1016.002","T1021.001","T1021.002","T1059.001","T1059.003","T1074.001","T1090.001","T1110.003","T1140","T1560.001","T1561.001","T1562.004","T1567","T1584","T1669"]},{"id":"C0040","name":"APT41 DUST","type":"campaign","techniques":["T1027.013","T1036.004","T1070.004","T1071.001","T1074.001","T1102","T1105","T1119","T1213.006","T1505.003","T1543.003","T1553.002","T1560.001","T1567.002","T1569.002","T1573.002","T1574.001","T1583.007","T1586.003","T1588.003","T1593.002","T1594","T1596.005"]},{"id":"C0046","name":"ArcaneDoor","type":"campaign","techniques":["T1014","T1020","T1036","T1037","T1040","T1041","T1055","T1059","T1070.004","T1071.001","T1082","T1102.003","T1119","T1133","T1140","T1190","T1556","T1557","T1562.001","T1562.003","T1583.003","T1583.006","T1587.001","T1587.003","T1653"]},{"id":"C0010","name":"C0010","type":"campaign","techniques":["T1105","T1189","T1583.001","T1584.001","T1587.001","T1588.002","T1608.001","T1608.002","T1608.004"]},{"id":"C0011","name":"C0011","type":"campaign","techniques":["T1059.005","T1204.001","T1204.002","T1566.001","T1566.002","T1583.001","T1587.003","T1608.001"]},{"id":"C0015","name":"C0015","type":"campaign","techniques":["T1005","T1016","T1018","T1021.001","T1027","T1030","T1036","T1039","T1047","T1055.001","T1057","T1059.003","T1059.005","T1059.007","T1069.001","T1069.002","T1074.001","T1083","T1105","T1124","T1135","T1204.002","T1218.005","T1218.010","T1218.011","T1219.002","T1482","T1486","T1553.002","T1566.001","T1567.002","T1570","T1588.001","T1588.002"]},{"id":"C0017","name":"C0017","type":"campaign","techniques":["T1001.003","T1003.002","T1005","T1016","T1027","T1027.002","T1033","T1036.004","T1036.005","T1041","T1048.003","T1053.005","T1059.003","T1059.007","T1071.001","T1074.001","T1090","T1102","T1102.001","T1105","T1134","T1140","T1190","T1505.003","T1560.003","T1567","T1574","T1588.002","T1680"]},{"id":"C0018","name":"C0018","type":"campaign","techniques":["T1016","T1021.001","T1027.010","T1033","T1036","T1036.005","T1046","T1047","T1059.001","T1071.001","T1072","T1105","T1190","T1218.011","T1219.002","T1486","T1570","T1571","T1588.002"]},{"id":"C0021","name":"C0021","type":"campaign","techniques":["T1027.009","T1027.010","T1059.001","T1071.001","T1095","T1105","T1140","T1204.001","T1218.011","T1566.002","T1573.002","T1583.001","T1584.001","T1588.002","T1608.001"]},{"id":"C0026","name":"C0026","type":"campaign","techniques":["T1005","T1030","T1105","T1560.001","T1568","T1583.001"]},{"id":"C0027","name":"C0027","type":"campaign","techniques":["T1003.006","T1021.007","T1046","T1047","T1069.003","T1078.004","T1087.003","T1087.004","T1090","T1098.001","T1098.003","T1098.005","T1102","T1105","T1133","T1190","T1213.002","T1219.002","T1530","T1566.004","T1572","T1578.002","T1588.002","T1589.001","T1598.001","T1598.004","T1621","T1656"]},{"id":"C0032","name":"C0032","type":"campaign","techniques":["T1003.001","T1021.001","T1021.004","T1036.005","T1053.005","T1059.001","T1070.004","T1070.006","T1074.001","T1078","T1133","T1505.003","T1546.012","T1571","T1572","T1583.003","T1588.002"]},{"id":"C0004","name":"CostaRicto","type":"campaign","techniques":["T1005","T1046","T1053.005","T1090.003","T1105","T1133","T1572","T1583.001","T1587.001","T1588.002"]},{"id":"C0029","name":"Cutting Edge","type":"campaign","techniques":["T1003.001","T1003.003","T1005","T1021.001","T1021.002","T1021.004","T1027.013","T1055","T1056.001","T1056.003","T1059","T1059.006","T1070","T1070.004","T1070.006","T1071.004","T1078.002","T1082","T1095","T1105","T1190","T1205","T1505.003","T1554","T1560.001","T1562.001","T1572","T1584.008","T1588.002","T1594","T1595.002"]},{"id":"C0053","name":"FLORAHOX Activity","type":"campaign","techniques":["T1059","T1059.004","T1090.003","T1190","T1583.003","T1584.008"]},{"id":"C0001","name":"Frankenstein","type":"campaign","techniques":["T1005","T1016","T1020","T1027.010","T1033","T1036.004","T1041","T1047","T1053.005","T1057","T1059.001","T1059.003","T1059.005","T1071.001","T1082","T1105","T1119","T1127.001","T1140","T1203","T1204.002","T1221","T1497.001","T1518.001","T1566.001","T1573.001","T1588.002"]},{"id":"C0041","name":"FrostyGoop Incident","type":"campaign","techniques":["T1003.002","T1071","T1190","T1505.003","T1562.010"]},{"id":"C0007","name":"FunnyDream","type":"campaign","techniques":["T1016","T1018","T1047","T1049","T1057","T1059.003","T1059.005","T1082","T1105","T1560.001","T1583.001","T1585.002","T1588.001","T1588.002"]},{"id":"C0038","name":"HomeLand Justice","type":"campaign","techniques":["T1003.001","T1021.001","T1021.002","T1036.005","T1041","T1046","T1047","T1059.001","T1059.003","T1078","T1078.001","T1087.003","T1098.002","T1105","T1114.002","T1134.001","T1190","T1486","T1505.003","T1561.002","T1562.001","T1562.002","T1570","T1588.002","T1588.003"]},{"id":"C0043","name":"Indian Critical Infrastructure Intrusions","type":"campaign","techniques":["T1071.001","T1568","T1571","T1573.002","T1583.001","T1584","T1588.004","T1599"]},{"id":"C0050","name":"J-magic Campaign","type":"campaign","techniques":["T1036.005","T1583.003","T1587.003","T1588.001"]},{"id":"C0044","name":"Juicy Mix","type":"campaign","techniques":["T1053.005","T1059.001","T1059.005","T1071.001","T1074.001","T1082","T1132.001","T1140","T1217","T1518","T1555.003","T1555.004","T1584.004","T1587.001"]},{"id":"C0035","name":"KV Botnet Activity","type":"campaign","techniques":["T1016","T1036","T1036.004","T1055.009","T1057","T1059.004","T1070.004","T1082","T1083","T1095","T1105","T1222.002","T1518.001","T1546","T1562.001","T1564.013","T1571","T1573","T1583.003","T1584.008"]},{"id":"C0049","name":"Leviathan Australian Intrusions","type":"campaign","techniques":["T1018","T1021.002","T1021.004","T1041","T1056","T1068","T1074.001","T1078","T1078.002","T1078.003","T1082","T1111","T1135","T1190","T1212","T1213.006","T1482","T1505.003","T1528","T1552","T1552.001","T1558.003","T1562.004","T1588.006","T1594","T1615"]},{"id":"C0002","name":"Night Dragon","type":"campaign","techniques":["T1003.002","T1005","T1008","T1027.002","T1027.013","T1033","T1059.003","T1071.001","T1074.002","T1078","T1078.002","T1083","T1105","T1110.002","T1112","T1114.001","T1133","T1190","T1204.001","T1219","T1550.002","T1562.001","T1566.002","T1568","T1583.004","T1584.004","T1588.001","T1588.002","T1608.001"]},{"id":"C0012","name":"Operation CuckooBees","type":"campaign","techniques":["T1003.002","T1005","T1007","T1016","T1018","T1027.010","T1027.011","T1033","T1036.005","T1049","T1053.005","T1057","T1059.003","T1059.005","T1069.001","T1071.001","T1078.002","T1082","T1083","T1087.001","T1087.002","T1120","T1124","T1133","T1135","T1190","T1201","T1505.003","T1543.003","T1547.006","T1560.001","T1574.001","T1588.002"]},{"id":"C0022","name":"Operation Dream Job","type":"campaign","techniques":["T1005","T1027.002","T1027.013","T1036.008","T1041","T1047","T1053.005","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1083","T1087.002","T1105","T1106","T1110","T1204.001","T1204.002","T1218.010","T1218.011","T1220","T1221","T1497.001","T1497.003","T1505.004","T1534","T1547.001","T1553.002","T1560.001","T1566.001","T1566.002","T1566.003","T1567.002","T1573.001","T1583.001","T1583.004","T1583.006","T1584.001","T1584.004","T1585.001","T1585.002","T1587.001","T1587.002","T1588.002","T1588.003","T1589","T1591","T1591.004","T1593.001","T1608.001","T1608.002","T1614.001","T1622","T1656"]},{"id":"C0016","name":"Operation Dust Storm","type":"campaign","techniques":["T1027.002","T1027.013","T1036","T1059.005","T1059.007","T1140","T1189","T1203","T1204.001","T1204.002","T1218.005","T1518","T1566.001","T1566.002","T1568","T1583.001","T1585.002"]},{"id":"C0023","name":"Operation Ghost","type":"campaign","techniques":["T1001.002","T1027.003","T1078.002","T1102.002","T1546.003","T1583.001","T1585.001","T1587.001"]},{"id":"C0006","name":"Operation Honeybee","type":"campaign","techniques":["T1005","T1027.013","T1036","T1036.005","T1041","T1057","T1059.003","T1059.005","T1070.004","T1071.002","T1074.001","T1082","T1083","T1105","T1106","T1112","T1140","T1204.002","T1543.003","T1548.002","T1553.002","T1560.001","T1569.002","T1574.011","T1583.001","T1583.004","T1585.002","T1588.004"]},{"id":"C0048","name":"Operation MidnightEclipse","type":"campaign","techniques":["T1003.003","T1005","T1021.002","T1021.006","T1053.003","T1059.004","T1071.001","T1074.001","T1078","T1078.002","T1090","T1105","T1190","T1559","T1584.003","T1584.006","T1588.002"]},{"id":"C0013","name":"Operation Sharpshooter","type":"campaign","techniques":["T1036.005","T1055","T1059.005","T1090","T1105","T1106","T1204.002","T1547.001","T1559.002","T1583.006","T1584.004","T1587.001","T1608.001"]},{"id":"C0005","name":"Operation Spalax","type":"campaign","techniques":["T1027.002","T1027.003","T1027.013","T1059","T1102","T1140","T1204.001","T1204.002","T1218.011","T1497","T1566.001","T1566.002","T1568","T1583.001","T1588.001","T1588.002","T1608.001"]},{"id":"C0014","name":"Operation Wocao","type":"campaign","techniques":["T1001","T1003.001","T1003.006","T1005","T1007","T1012","T1016","T1016.001","T1018","T1021.002","T1027.005","T1027.010","T1033","T1036.005","T1041","T1046","T1047","T1049","T1053.005","T1055","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1069.001","T1070.001","T1070.004","T1071.001","T1074.001","T1078","T1078.002","T1078.003","T1082","T1083","T1087.002","T1090","T1090.001","T1090.003","T1095","T1105","T1106","T1111","T1112","T1115","T1119","T1120","T1124","T1133","T1135","T1190","T1505.003","T1518","T1518.001","T1552.004","T1555.005","T1558.003","T1560.001","T1562.004","T1569.002","T1570","T1571","T1573.002","T1583.004","T1585.002","T1587.001","T1588.002","T1589","T1680"]},{"id":"C0042","name":"Outer Space","type":"campaign","techniques":["T1027.013","T1059.005","T1071.001","T1105","T1217","T1584.004","T1585.003","T1587.001"]},{"id":"C0036","name":"Pikabot Distribution February 2024","type":"campaign","techniques":["T1059.001","T1059.007","T1566.002","T1574"]},{"id":"C0055","name":"Quad7 Activity","type":"campaign","techniques":["T1027.011","T1059.004","T1071.001","T1071.002","T1090.002","T1090.003","T1105","T1110.003","T1190","T1562.001","T1571","T1584.005","T1584.008","T1589.002","T1665"]},{"id":"C0047","name":"RedDelta Modified PlugX Infection Chain Operations","type":"campaign","techniques":["T1027.013","T1036.004","T1059.001","T1071.001","T1082","T1090","T1095","T1203","T1204.001","T1204.002","T1218.007","T1218.014","T1480","T1547.001","T1553.002","T1564.001","T1566.001","T1566.002","T1574.001","T1583.001","T1588.004","T1608.001"]},{"id":"C0056","name":"RedPenguin","type":"campaign","techniques":["T1014","T1016","T1027.013","T1036.005","T1040","T1041","T1055","T1057","T1059.004","T1059.008","T1070.004","T1070.007","T1078","T1090","T1090.003","T1095","T1104","T1105","T1140","T1203","T1205","T1554","T1562.003","T1571","T1573.001","T1587.001"]},{"id":"C0052","name":"SPACEHOP Activity","type":"campaign","techniques":["T1090.003","T1190","T1583.003","T1588.002"]},{"id":"C0059","name":"Salesforce Data Exfiltration","type":"campaign","techniques":["T1020","T1036","T1059.006","T1078.002","T1083","T1090","T1090.003","T1213.004","T1567","T1585","T1585.002","T1586.002","T1587.001","T1588.002","T1598.004","T1608.005","T1656","T1671"]},{"id":"C0045","name":"ShadowRay","type":"campaign","techniques":["T1003.008","T1016","T1027.013","T1059.006","T1068","T1105","T1190","T1496.001","T1546.004","T1588.002"]},{"id":"C0058","name":"SharePoint ToolShell Exploitation","type":"campaign","techniques":["T1003.001","T1005","T1027.002","T1027.010","T1033","T1041","T1047","T1053.005","T1059.001","T1059.003","T1071.001","T1074.001","T1082","T1083","T1090","T1105","T1112","T1119","T1140","T1190","T1484.001","T1486","T1505.003","T1505.004","T1552.001","T1562.001","T1569.002","T1570","T1572","T1583.001","T1585.002","T1588.002","T1595.002","T1620","T1657"]},{"id":"C0024","name":"SolarWinds Compromise","type":"campaign","techniques":["T1003.006","T1005","T1016.001","T1018","T1021.001","T1021.002","T1021.006","T1036.004","T1036.005","T1047","T1048.002","T1053.005","T1057","T1059.001","T1059.003","T1059.005","T1069","T1069.002","T1070","T1070.004","T1070.006","T1070.008","T1071.001","T1074.002","T1078","T1078.002","T1078.003","T1078.004","T1083","T1087","T1087.002","T1090.001","T1098.001","T1098.002","T1098.003","T1098.005","T1105","T1114.002","T1133","T1140","T1190","T1195.002","T1199","T1213","T1213.003","T1218.011","T1482","T1484.002","T1539","T1546.003","T1550","T1550.001","T1550.004","T1552.004","T1553.002","T1555","T1555.003","T1558.003","T1560.001","T1562.001","T1562.002","T1562.004","T1568","T1583.001","T1584.001","T1587.001","T1589.001","T1606.001","T1606.002","T1665","T1680"]},{"id":"C0030","name":"Triton Safety Instrumented System Attack","type":"campaign","techniques":["T1003.001","T1027.005","T1036.005","T1053.005","T1056.003","T1059.001","T1573","T1587.001","T1588.002","T1595"]},{"id":"C0039","name":"Versa Director Zero Day Exploitation","type":"campaign","techniques":["T1056","T1071.001","T1095","T1190","T1505.003","T1573.002","T1584.008","T1587.001"]},{"id":"C0037","name":"Water Curupira Pikabot Distribution","type":"campaign","techniques":["T1059.003","T1059.007","T1105","T1140","T1204","T1204.001","T1204.002","T1218.011","T1566.001","T1589.002"]},{"id":"G0099","name":"APT-C-36","type":"group","techniques":["T1027","T1036.004","T1053.005","T1059.005","T1105","T1204.002","T1566.001","T1571","T1588.002"]},{"id":"G0006","name":"APT1","type":"group","techniques":["T1003.001","T1005","T1007","T1016","T1021.001","T1036.005","T1049","T1057","T1059.003","T1087.001","T1114.001","T1114.002","T1119","T1135","T1550.002","T1560.001","T1566.001","T1566.002","T1583.001","T1584.001","T1585.002","T1588.001","T1588.002"]},{"id":"G0005","name":"APT12","type":"group","techniques":["T1102.002","T1203","T1204.002","T1566.001","T1568.003"]},{"id":"G0025","name":"APT17","type":"group","techniques":["T1583.006","T1585"]},{"id":"G0026","name":"APT18","type":"group","techniques":["T1027.013","T1053.002","T1059.003","T1070.004","T1071.001","T1071.004","T1078","T1082","T1083","T1105","T1133","T1547.001"]},{"id":"G0073","name":"APT19","type":"group","techniques":["T1016","T1027.010","T1027.013","T1033","T1059","T1059.001","T1071.001","T1082","T1112","T1132.001","T1140","T1189","T1204.002","T1218.010","T1218.011","T1543.003","T1547.001","T1564.003","T1566.001","T1574.001","T1588.002"]},{"id":"G0007","name":"APT28","type":"group","techniques":["T1001.001","T1003","T1003.001","T1003.003","T1005","T1014","T1021.002","T1025","T1027.013","T1030","T1036","T1036.005","T1037.001","T1039","T1040","T1048.002","T1056.001","T1057","T1059.001","T1059.003","T1068","T1070.001","T1070.004","T1070.006","T1071.001","T1071.003","T1074.001","T1074.002","T1078","T1078.004","T1083","T1090.002","T1090.003","T1091","T1092","T1098.002","T1102.002","T1105","T1110","T1110.001","T1110.003","T1113","T1114.002","T1119","T1120","T1133","T1134.001","T1137.002","T1140","T1189","T1190","T1199","T1203","T1204.001","T1204.002","T1210","T1211","T1213","T1213.002","T1218.011","T1221","T1498","T1505.003","T1528","T1542.003","T1546.015","T1547.001","T1550.001","T1550.002","T1557.004","T1559.002","T1560","T1560.001","T1564.001","T1564.003","T1566.001","T1567","T1573.001","T1583.001","T1583.003","T1583.006","T1584.008","T1586.002","T1588.002","T1589.001","T1591","T1595.002","T1596","T1598","T1598.003","T1669"]},{"id":"G0016","name":"APT29","type":"group","techniques":["T1003.002","T1003.004","T1005","T1016.001","T1021.007","T1027.001","T1027.002","T1027.006","T1036.005","T1037","T1037.004","T1047","T1053.005","T1059.001","T1059.006","T1059.009","T1068","T1070.004","T1070.006","T1078","T1078.003","T1078.004","T1087.004","T1090.002","T1090.003","T1090.004","T1098.002","T1098.005","T1105","T1110.001","T1110.003","T1114.002","T1133","T1136.003","T1190","T1199","T1203","T1204.001","T1204.002","T1218.005","T1505.003","T1528","T1546.003","T1546.008","T1547.001","T1548.002","T1550.003","T1553.005","T1556.007","T1562.008","T1566.001","T1566.002","T1566.003","T1568","T1573","T1583.006","T1586.002","T1586.003","T1587.001","T1587.003","T1588.002","T1595.002","T1621","T1649","T1651","T1665"]},{"id":"G0022","name":"APT3","type":"group","techniques":["T1003.001","T1005","T1016","T1018","T1021.001","T1021.002","T1027","T1027.002","T1027.005","T1033","T1036.010","T1041","T1049","T1053.005","T1056.001","T1057","T1059.001","T1059.003","T1069","T1070.004","T1074.001","T1078.002","T1082","T1083","T1087.001","T1090.002","T1095","T1098.007","T1104","T1105","T1110.002","T1136.001","T1203","T1204.001","T1218.011","T1543.003","T1546.008","T1547.001","T1552.001","T1555.003","T1560.001","T1564.003","T1566.002","T1574.001"]},{"id":"G0013","name":"APT30","type":"group","techniques":["T1204.002","T1566.001"]},{"id":"G0050","name":"APT32","type":"group","techniques":["T1003","T1003.001","T1012","T1016","T1018","T1021.002","T1027.010","T1027.011","T1027.013","T1027.016","T1033","T1036","T1036.003","T1036.004","T1036.005","T1041","T1046","T1047","T1048.003","T1049","T1053.005","T1055","T1056.001","T1059","T1059.001","T1059.003","T1059.005","T1059.007","T1068","T1070.001","T1070.004","T1070.006","T1071.001","T1071.003","T1072","T1078.003","T1082","T1083","T1087.001","T1102","T1105","T1112","T1135","T1137","T1189","T1203","T1204.001","T1204.002","T1216.001","T1218.005","T1218.010","T1218.011","T1222.002","T1505.003","T1543.003","T1547.001","T1550.002","T1550.003","T1552.002","T1560","T1564.001","T1564.003","T1564.004","T1566.001","T1566.002","T1569.002","T1570","T1571","T1574.001","T1583.001","T1583.006","T1585.001","T1588.002","T1589","T1589.002","T1598.003","T1608.001","T1608.004"]},{"id":"G0064","name":"APT33","type":"group","techniques":["T1003.001","T1003.004","T1003.005","T1027.013","T1040","T1048.003","T1053.005","T1059.001","T1059.005","T1068","T1071.001","T1078","T1078.004","T1105","T1110.003","T1132.001","T1203","T1204.001","T1204.002","T1546.003","T1547.001","T1552.001","T1552.006","T1555","T1555.003","T1560.001","T1566.001","T1566.002","T1571","T1573.001","T1588.002"]},{"id":"G0067","name":"APT37","type":"group","techniques":["T1005","T1027","T1027.003","T1033","T1036.001","T1053.005","T1055","T1057","T1059","T1059.003","T1059.005","T1059.006","T1071.001","T1082","T1102.002","T1105","T1106","T1120","T1123","T1189","T1203","T1204.002","T1529","T1547.001","T1548.002","T1555.003","T1559.002","T1561.002","T1566.001"]},{"id":"G0082","name":"APT38","type":"group","techniques":["T1005","T1027.002","T1033","T1036.003","T1036.006","T1049","T1053.003","T1053.005","T1055","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1070.001","T1070.004","T1070.006","T1071.001","T1082","T1083","T1105","T1106","T1110","T1112","T1115","T1135","T1140","T1189","T1204.001","T1204.002","T1217","T1218.001","T1218.005","T1218.007","T1218.011","T1480.002","T1485","T1486","T1505.003","T1518.001","T1529","T1543.003","T1548.002","T1553.005","T1561.002","T1562.001","T1562.003","T1562.004","T1562.013","T1565.001","T1565.002","T1565.003","T1566.001","T1569.002","T1583.001","T1588.002"]},{"id":"G0087","name":"APT39","type":"group","techniques":["T1003","T1003.001","T1005","T1012","T1018","T1021.001","T1021.002","T1021.004","T1027.002","T1027.013","T1033","T1036.005","T1041","T1046","T1053.005","T1056","T1056.001","T1059","T1059.001","T1059.005","T1059.006","T1059.010","T1070.004","T1071.001","T1071.004","T1074.001","T1078","T1083","T1090.001","T1090.002","T1102.002","T1105","T1110","T1113","T1115","T1135","T1136.001","T1140","T1190","T1197","T1204.001","T1204.002","T1505.003","T1546.010","T1547.001","T1547.009","T1553.006","T1555","T1560.001","T1566.001","T1566.002","T1569.002","T1588.002"]},{"id":"G0096","name":"APT41","type":"group","techniques":["T1003.001","T1003.002","T1003.003","T1005","T1008","T1012","T1014","T1016","T1018","T1021.001","T1021.002","T1027","T1027.002","T1030","T1033","T1036.004","T1036.005","T1037","T1046","T1047","T1049","T1053.005","T1055","T1056.001","T1059.001","T1059.003","T1059.004","T1069","T1070.001","T1070.003","T1070.004","T1071.001","T1071.002","T1071.004","T1078","T1082","T1083","T1087.001","T1087.002","T1090","T1098.007","T1102.001","T1104","T1105","T1110","T1112","T1133","T1135","T1136.001","T1190","T1195.002","T1197","T1203","T1213.003","T1218.001","T1218.011","T1480.001","T1484.001","T1486","T1496.001","T1542.003","T1543.003","T1546.008","T1547.001","T1550.002","T1553.002","T1555","T1555.003","T1560.001","T1562.006","T1566.001","T1568.002","T1569.002","T1570","T1574.001","T1574.006","T1588.002","T1595.002","T1595.003","T1596.005","T1599","T1656"]},{"id":"G1044","name":"APT42","type":"group","techniques":["T1016","T1036.005","T1047","T1053.005","T1056","T1056.001","T1059.001","T1059.005","T1070","T1070.008","T1071.001","T1082","T1087.001","T1102","T1111","T1112","T1113","T1132.001","T1518.001","T1530","T1539","T1547","T1555.003","T1566.002","T1573.002","T1583.001","T1583.003","T1585.002","T1588.002","T1608.001","T1656"]},{"id":"G1023","name":"APT5","type":"group","techniques":["T1003.001","T1003.002","T1021.001","T1021.004","T1036.005","T1049","T1053.003","T1055","T1056.001","T1057","T1059.001","T1059.003","T1070","T1070.003","T1070.004","T1070.006","T1074.001","T1078.002","T1078.004","T1083","T1098.007","T1136.001","T1190","T1505.003","T1554","T1560.001","T1562.006","T1583.005","T1654"]},{"id":"G1030","name":"Agrius","type":"group","techniques":["T1003.001","T1003.002","T1005","T1018","T1021.001","T1036","T1041","T1046","T1059.003","T1074.001","T1078.002","T1110","T1110.003","T1119","T1140","T1190","T1505.003","T1543.003","T1560.001","T1562.001","T1570","T1583"]},{"id":"G0130","name":"Ajax Security Team","type":"group","techniques":["T1056.001","T1105","T1204.002","T1555.003","T1566.001","T1566.003"]},{"id":"G1024","name":"Akira","type":"group","techniques":["T1018","T1021.001","T1027.001","T1036.005","T1059.001","T1078","T1133","T1213.002","T1219","T1482","T1486","T1531","T1558","T1560.001","T1562.001","T1567.002","T1657"]},{"id":"G0138","name":"Andariel","type":"group","techniques":["T1005","T1027.003","T1049","T1057","T1105","T1189","T1203","T1204.002","T1566.001","T1588.001","T1590.005","T1592.002"]},{"id":"G1007","name":"Aoqin Dragon","type":"group","techniques":["T1027.002","T1036","T1083","T1091","T1203","T1204.002","T1570","T1587.001","T1588.002"]},{"id":"G1049","name":"AppleJeus","type":"group","techniques":["T1566","T1657"]},{"id":"G0143","name":"Aquatic Panda","type":"group","techniques":["T1003.001","T1005","T1007","T1021","T1021.001","T1021.002","T1021.004","T1027.010","T1033","T1036.004","T1036.005","T1047","T1059.001","T1059.003","T1059.004","T1070.001","T1070.003","T1070.004","T1078.002","T1082","T1087","T1105","T1112","T1218.011","T1518.001","T1543.003","T1550.002","T1560.001","T1562.001","T1574.001","T1574.006","T1588.001","T1588.002","T1595.002","T1654"]},{"id":"G0001","name":"Axiom","type":"group","techniques":["T1001.002","T1003","T1005","T1021.001","T1078","T1189","T1190","T1203","T1546.008","T1553","T1560","T1563.002","T1566","T1583.002","T1583.003","T1584.005"]},{"id":"G1002","name":"BITTER","type":"group","techniques":["T1027.013","T1036.004","T1053.005","T1068","T1071.001","T1095","T1105","T1203","T1204.002","T1559.002","T1566.001","T1568","T1573","T1583.001","T1588.002","T1608.001"]},{"id":"G0060","name":"BRONZE BUTLER","type":"group","techniques":["T1003.001","T1005","T1007","T1018","T1027.001","T1027.003","T1036","T1036.002","T1036.005","T1039","T1053.002","T1053.005","T1059.001","T1059.003","T1059.005","T1059.006","T1070.004","T1071.001","T1080","T1083","T1087.002","T1102.001","T1105","T1113","T1124","T1132.001","T1140","T1189","T1203","T1204.002","T1518","T1547.001","T1548.002","T1550.003","T1560.001","T1562.001","T1566.001","T1573.001","T1574.001","T1588.002"]},{"id":"G0135","name":"BackdoorDiplomacy","type":"group","techniques":["T1027","T1036.004","T1036.005","T1046","T1049","T1055.001","T1074.001","T1095","T1105","T1120","T1190","T1505.003","T1574.001","T1588.001","T1588.002"]},{"id":"G1043","name":"BlackByte","type":"group","techniques":["T1003","T1012","T1016","T1018","T1021.001","T1021.002","T1036.008","T1041","T1046","T1047","T1053.005","T1055","T1055.012","T1059.001","T1059.003","T1068","T1070.004","T1071.001","T1078","T1078.002","T1082","T1087.002","T1105","T1112","T1134.003","T1135","T1136.002","T1140","T1190","T1219","T1480","T1482","T1486","T1490","T1491.001","T1505.003","T1518.001","T1543.003","T1547.001","T1560","T1562","T1562.001","T1562.004","T1567","T1569.002","T1570","T1583.003","T1608.001","T1614.001"]},{"id":"G0098","name":"BlackTech","type":"group","techniques":["T1021.004","T1036.002","T1046","T1106","T1190","T1203","T1204.001","T1204.002","T1566.001","T1566.002","T1574.001","T1588.002","T1588.003","T1588.004"]},{"id":"G0108","name":"Blue Mockingbird","type":"group","techniques":["T1003.001","T1021.001","T1021.002","T1027.013","T1036.005","T1047","T1053.005","T1059.001","T1059.003","T1082","T1090","T1112","T1134","T1190","T1218.010","T1218.011","T1496.001","T1543.003","T1546.003","T1569.002","T1574.012","T1588.002"]},{"id":"G1012","name":"CURIUM","type":"group","techniques":["T1005","T1041","T1048.002","T1059.001","T1082","T1124","T1189","T1204.002","T1505.003","T1566.001","T1566.003","T1583.001","T1583.003","T1583.004","T1584.006","T1585.001","T1585.002","T1598.003","T1608.004"]},{"id":"G0008","name":"Carbanak","type":"group","techniques":["T1036.004","T1036.005","T1078","T1102.002","T1218.011","T1219","T1543.003","T1562.004","T1588.002"]},{"id":"G0114","name":"Chimera","type":"group","techniques":["T1003.003","T1007","T1012","T1016","T1018","T1021.001","T1021.002","T1021.006","T1027.010","T1033","T1036.005","T1039","T1041","T1046","T1047","T1049","T1053.005","T1057","T1059.001","T1059.003","T1069.001","T1070.001","T1070.004","T1070.006","T1071.001","T1071.004","T1074.001","T1074.002","T1078","T1078.002","T1083","T1087.001","T1087.002","T1105","T1106","T1110.003","T1110.004","T1111","T1114.001","T1114.002","T1119","T1124","T1133","T1135","T1201","T1213.002","T1217","T1482","T1550.002","T1556.001","T1560.001","T1567.002","T1569.002","T1570","T1572","T1574.001","T1588.002","T1589.001","T1680"]},{"id":"G1021","name":"Cinnamon Tempest","type":"group","techniques":["T1021.002","T1047","T1059.001","T1059.003","T1059.006","T1078","T1078.002","T1080","T1090","T1105","T1140","T1190","T1484.001","T1543.003","T1567.002","T1572","T1574.001","T1588.002","T1657"]},{"id":"G0003","name":"Cleaver","type":"group","techniques":["T1003.001","T1557.002","T1585.001","T1587.001","T1588.002"]},{"id":"G0080","name":"Cobalt Group","type":"group","techniques":["T1021.001","T1027.010","T1037.001","T1046","T1053.005","T1055","T1059.001","T1059.003","T1059.005","T1059.007","T1068","T1070.004","T1071.001","T1071.004","T1105","T1195.002","T1203","T1204.001","T1204.002","T1218.003","T1218.008","T1218.010","T1219","T1220","T1518.001","T1543.003","T1547.001","T1548.002","T1559.002","T1566.001","T1566.002","T1572","T1573.002","T1588.002"]},{"id":"G0142","name":"Confucius","type":"group","techniques":["T1041","T1053.005","T1059.001","T1059.005","T1071.001","T1083","T1105","T1119","T1203","T1204.001","T1204.002","T1218.005","T1221","T1547.001","T1566.001","T1566.002","T1567.002","T1583.006","T1680"]},{"id":"G1052","name":"Contagious Interview","type":"group","techniques":["T1027.010","T1027.013","T1036","T1041","T1048.003","T1059.003","T1059.004","T1059.005","T1059.006","T1059.007","T1070.004","T1071.003","T1082","T1083","T1090","T1204.001","T1204.002","T1204.004","T1204.005","T1219.002","T1480","T1497","T1543.001","T1546.004","T1547.001","T1547.013","T1555.001","T1562.001","T1566.003","T1567","T1567.002","T1571","T1573.001","T1583","T1583.001","T1583.003","T1583.006","T1585","T1585.001","T1585.002","T1587","T1587.001","T1588.002","T1588.007","T1589","T1593","T1593.001","T1593.003","T1608.001","T1656","T1657","T1681"]},{"id":"G0052","name":"CopyKittens","type":"group","techniques":["T1059.001","T1090","T1218.011","T1553.002","T1560.001","T1560.003","T1564.003","T1588.002"]},{"id":"G1034","name":"Daggerfly","type":"group","techniques":["T1003.002","T1012","T1036.003","T1053.005","T1059.001","T1071.001","T1082","T1105","T1136.001","T1189","T1195.002","T1204.001","T1218.011","T1553.002","T1574.001","T1584.004","T1587.002"]},{"id":"G0070","name":"Dark Caracal","type":"group","techniques":["T1005","T1027.002","T1027.013","T1059.003","T1071.001","T1083","T1113","T1189","T1204.002","T1218.001","T1547.001","T1566.003"]},{"id":"G0079","name":"DarkHydrus","type":"group","techniques":["T1059.001","T1187","T1204.002","T1221","T1564.003","T1566.001","T1588.002"]},{"id":"G0105","name":"DarkVishnya","type":"group","techniques":["T1040","T1046","T1059.001","T1110","T1135","T1200","T1219","T1543.003","T1571","T1588.002"]},{"id":"G0012","name":"Darkhotel","type":"group","techniques":["T1016","T1027.013","T1036.005","T1056.001","T1057","T1059.003","T1080","T1082","T1083","T1091","T1105","T1124","T1140","T1189","T1203","T1204.002","T1497","T1497.001","T1497.002","T1518.001","T1547.001","T1553.002","T1566.001","T1573.001"]},{"id":"G0009","name":"Deep Panda","type":"group","techniques":["T1018","T1021.002","T1027.005","T1047","T1057","T1059.001","T1218.010","T1505.003","T1546.008","T1564.003"]},{"id":"G0035","name":"Dragonfly","type":"group","techniques":["T1003.002","T1003.003","T1003.004","T1005","T1012","T1016","T1018","T1021.001","T1033","T1036.010","T1053.005","T1059","T1059.001","T1059.003","T1059.006","T1069.002","T1070.001","T1070.004","T1071.002","T1074.001","T1078","T1083","T1087.002","T1098.007","T1105","T1110","T1110.002","T1112","T1113","T1114.002","T1133","T1135","T1136.001","T1187","T1189","T1190","T1195.002","T1203","T1204.002","T1210","T1221","T1505.003","T1547.001","T1560","T1562.004","T1564.002","T1566.001","T1583.001","T1583.003","T1584.004","T1588.002","T1591.002","T1595.002","T1598.002","T1598.003","T1608.004"]},{"id":"G1011","name":"EXOTIC LILY","type":"group","techniques":["T1102","T1203","T1204.001","T1204.002","T1566.001","T1566.002","T1566.003","T1583.001","T1585.001","T1585.002","T1589.002","T1593.001","T1594","T1597","T1608.001"]},{"id":"G1006","name":"Earth Lusca","type":"group","techniques":["T1003.001","T1003.006","T1007","T1016","T1018","T1027","T1027.003","T1033","T1036.005","T1047","T1049","T1053.005","T1057","T1059.001","T1059.005","T1059.006","T1059.007","T1090","T1098.004","T1112","T1140","T1189","T1190","T1204.001","T1204.002","T1210","T1218.005","T1482","T1543.003","T1547.012","T1548.002","T1560.001","T1566.002","T1567.002","T1574.001","T1583.001","T1583.004","T1583.006","T1584.004","T1584.006","T1588.001","T1588.002","T1595.002","T1608.001"]},{"id":"G0066","name":"Elderwood","type":"group","techniques":["T1027.002","T1027.013","T1105","T1189","T1203","T1204.001","T1204.002","T1566.001","T1566.002"]},{"id":"G1003","name":"Ember Bear","type":"group","techniques":["T1003","T1003.001","T1003.002","T1003.004","T1005","T1018","T1021","T1036","T1036.005","T1046","T1047","T1053.005","T1059.001","T1070.004","T1071.004","T1078.001","T1090.003","T1095","T1110","T1110.003","T1112","T1114","T1119","T1125","T1133","T1190","T1195","T1203","T1210","T1491.002","T1505.003","T1550.002","T1552.001","T1560","T1561.002","T1562.001","T1567.002","T1570","T1571","T1572","T1583","T1583.003","T1585","T1588.001","T1588.005","T1595.001","T1595.002","T1654"]},{"id":"G0020","name":"Equation","type":"group","techniques":["T1120","T1480.001","T1542.002","T1564.005"]},{"id":"G0120","name":"Evilnum","type":"group","techniques":["T1059.007","T1070.004","T1105","T1204.001","T1219.002","T1497.001","T1539","T1548.002","T1555","T1566.002","T1574.001"]},{"id":"G0051","name":"FIN10","type":"group","techniques":["T1021.001","T1033","T1053.005","T1059.001","T1059.003","T1070.004","T1078","T1078.003","T1547.001","T1570","T1588.002"]},{"id":"G1016","name":"FIN13","type":"group","techniques":["T1003.001","T1003.002","T1003.003","T1005","T1016","T1016.001","T1021.001","T1021.002","T1021.004","T1021.006","T1036","T1036.004","T1036.005","T1046","T1047","T1049","T1053.005","T1056.001","T1059.001","T1059.003","T1059.005","T1069","T1071.001","T1074.001","T1078.001","T1082","T1083","T1087","T1087.002","T1090.001","T1098.007","T1105","T1133","T1134.003","T1135","T1136.001","T1140","T1190","T1505.003","T1547.001","T1550.002","T1552.001","T1556","T1560.001","T1564.001","T1565","T1572","T1574.001","T1587.001","T1588.002","T1589","T1590.004","T1657"]},{"id":"G0085","name":"FIN4","type":"group","techniques":["T1056.001","T1056.002","T1059.005","T1071.001","T1078","T1090.003","T1114.002","T1204.001","T1204.002","T1564.008","T1566.001","T1566.002"]},{"id":"G0053","name":"FIN5","type":"group","techniques":["T1018","T1059","T1070.001","T1070.004","T1074.001","T1078","T1090.002","T1110","T1119","T1133","T1588.002"]},{"id":"G0037","name":"FIN6","type":"group","techniques":["T1003.001","T1003.003","T1005","T1018","T1021.001","T1027.010","T1036.004","T1046","T1047","T1048.003","T1053.005","T1059","T1059.001","T1059.003","T1059.007","T1068","T1070.004","T1074.002","T1078","T1087.002","T1095","T1102","T1110.002","T1119","T1134","T1204.002","T1213.006","T1547.001","T1553.002","T1555","T1555.003","T1560","T1560.003","T1562.001","T1566.001","T1566.003","T1569.002","T1572","T1573.002","T1588.002"]},{"id":"G0046","name":"FIN7","type":"group","techniques":["T1005","T1008","T1021.001","T1021.004","T1021.005","T1027.010","T1027.016","T1033","T1036.004","T1036.005","T1047","T1053.005","T1057","T1059","T1059.001","T1059.003","T1059.005","T1059.007","T1069.002","T1071.004","T1078","T1078.003","T1082","T1087.002","T1091","T1102.002","T1105","T1113","T1124","T1125","T1140","T1190","T1195.002","T1204.001","T1204.002","T1210","T1218.005","T1218.011","T1219","T1486","T1497.002","T1543.003","T1546.011","T1547.001","T1553.002","T1558.003","T1559.002","T1562.004","T1564.001","T1564.003","T1566.001","T1566.002","T1567.002","T1569.002","T1571","T1572","T1583.001","T1583.006","T1587.001","T1588.002","T1591","T1591.004","T1608.001","T1608.004","T1608.005","T1620","T1674"]},{"id":"G0061","name":"FIN8","type":"group","techniques":["T1003.001","T1016.001","T1018","T1021.001","T1021.002","T1027.010","T1033","T1047","T1048.003","T1053.005","T1055.004","T1059.001","T1059.003","T1068","T1070.001","T1070.004","T1071.001","T1074.002","T1078","T1082","T1102","T1105","T1112","T1134.001","T1204.001","T1204.002","T1482","T1486","T1518.001","T1546.003","T1560.001","T1566.001","T1566.002","T1573.002","T1588.002","T1588.003"]},{"id":"G0137","name":"Ferocious Kitten","type":"group","techniques":["T1036.002","T1036.005","T1204.002","T1566.001","T1583.001","T1588.002"]},{"id":"G0117","name":"Fox Kitten","type":"group","techniques":["T1003.001","T1003.003","T1005","T1012","T1018","T1021.001","T1021.002","T1021.004","T1021.005","T1027.010","T1027.013","T1036.004","T1036.005","T1039","T1046","T1053.005","T1059","T1059.001","T1059.003","T1078","T1083","T1087.001","T1087.002","T1090","T1102","T1105","T1110","T1136.001","T1190","T1210","T1213.005","T1217","T1505.003","T1530","T1546.008","T1552.001","T1555.005","T1560.001","T1572","T1585","T1585.001"]},{"id":"G0093","name":"GALLIUM","type":"group","techniques":["T1003.001","T1003.002","T1005","T1016","T1018","T1027","T1027.002","T1027.005","T1033","T1036.003","T1041","T1047","T1049","T1053.005","T1059.001","T1059.003","T1074.001","T1078","T1090.002","T1105","T1133","T1136.002","T1190","T1505.003","T1550.002","T1553.002","T1560.001","T1570","T1574.001","T1583.004","T1588.002"]},{"id":"G0036","name":"GCMAN","type":"group","techniques":["T1021.004","T1021.005"]},{"id":"G0115","name":"GOLD SOUTHFIELD","type":"group","techniques":["T1027.010","T1059.001","T1113","T1133","T1190","T1195.002","T1199","T1219","T1566"]},{"id":"G0084","name":"Gallmaker","type":"group","techniques":["T1027","T1059.001","T1204.002","T1559.002","T1560.001","T1566.001"]},{"id":"G0047","name":"Gamaredon Group","type":"group","techniques":["T1001","T1005","T1012","T1016.001","T1020","T1021.005","T1025","T1027","T1027.004","T1027.010","T1027.012","T1027.015","T1027.016","T1033","T1036.005","T1039","T1041","T1047","T1053.005","T1055","T1057","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1080","T1082","T1083","T1090","T1090.003","T1091","T1095","T1102","T1102.002","T1102.003","T1105","T1106","T1112","T1113","T1119","T1120","T1137","T1140","T1204.001","T1204.002","T1218.005","T1218.011","T1221","T1480","T1491.001","T1497.001","T1518.001","T1534","T1547.001","T1559.001","T1561.001","T1562.001","T1564.003","T1566.001","T1568","T1568.001","T1571","T1583.001","T1583.003","T1583.006","T1587.003","T1588.002","T1608.001","T1620"]},{"id":"G0078","name":"Gorgon Group","type":"group","techniques":["T1055.002","T1055.012","T1059.001","T1059.003","T1059.005","T1105","T1106","T1112","T1140","T1204.002","T1547.001","T1547.009","T1562.001","T1564.003","T1566.001","T1588.002"]},{"id":"G0043","name":"Group5","type":"group","techniques":["T1027.013","T1056.001","T1070.004","T1113"]},{"id":"G0125","name":"HAFNIUM","type":"group","techniques":["T1003.001","T1003.003","T1005","T1016","T1016.001","T1018","T1033","T1057","T1059.001","T1059.003","T1068","T1070.001","T1071.001","T1078.003","T1078.004","T1083","T1095","T1098","T1105","T1110.003","T1114.002","T1119","T1132.001","T1136.002","T1190","T1199","T1213.002","T1218.011","T1505.003","T1530","T1550.001","T1555.006","T1560.001","T1564.001","T1567.002","T1583.003","T1583.005","T1583.006","T1584.005","T1589.002","T1590","T1590.005","T1592.004","T1593.003"]},{"id":"G1001","name":"HEXANE","type":"group","techniques":["T1010","T1016","T1016.001","T1018","T1021.001","T1027.010","T1033","T1049","T1053.005","T1056.001","T1057","T1059.001","T1059.005","T1069.001","T1082","T1102.002","T1105","T1110","T1110.003","T1204.002","T1518","T1534","T1546.003","T1555","T1555.003","T1567.002","T1583.001","T1583.002","T1585.001","T1585.002","T1586.002","T1588.002","T1589","T1589.002","T1591.004","T1608.001"]},{"id":"G0126","name":"Higaisa","type":"group","techniques":["T1001.003","T1016","T1027.001","T1027.013","T1027.015","T1029","T1036.004","T1041","T1053.005","T1057","T1059.003","T1059.005","T1059.007","T1071.001","T1082","T1090.001","T1106","T1124","T1140","T1203","T1204.002","T1220","T1547.001","T1564.003","T1566.001","T1573.001","T1574.001","T1680"]},{"id":"G1032","name":"INC Ransom","type":"group","techniques":["T1021.001","T1036.005","T1046","T1047","T1049","T1059.003","T1069.002","T1070.004","T1071","T1074","T1078","T1087.002","T1105","T1135","T1190","T1219","T1486","T1537","T1560.001","T1562.001","T1566","T1569.002","T1570","T1588.002","T1657"]},{"id":"G0100","name":"Inception","type":"group","techniques":["T1005","T1027.013","T1057","T1059.001","T1059.005","T1069.002","T1071.001","T1082","T1083","T1090.003","T1102","T1203","T1204.002","T1218.005","T1218.010","T1221","T1518","T1547.001","T1555.003","T1566.001","T1573.001","T1588.002"]},{"id":"G0136","name":"IndigoZebra","type":"group","techniques":["T1105","T1204.002","T1566.001","T1583.001","T1583.006","T1586.002","T1588.002"]},{"id":"G0119","name":"Indrik Spider","type":"group","techniques":["T1003.001","T1007","T1012","T1018","T1021.001","T1021.004","T1036.005","T1047","T1059.001","T1059.003","T1059.007","T1070.001","T1074.001","T1078","T1078.002","T1105","T1112","T1136","T1136.001","T1204.002","T1484.001","T1486","T1489","T1552.001","T1555.005","T1558.003","T1562.001","T1567.002","T1583","T1584.004","T1585.002","T1587.001","T1590"]},{"id":"G0004","name":"Ke3chang","type":"group","techniques":["T1003.001","T1003.002","T1003.003","T1003.004","T1005","T1007","T1016","T1018","T1020","T1021.002","T1027","T1033","T1036.002","T1036.005","T1041","T1049","T1056.001","T1057","T1059","T1059.003","T1069.002","T1071.001","T1071.004","T1078","T1078.004","T1082","T1083","T1087.001","T1087.002","T1105","T1114.002","T1119","T1133","T1140","T1190","T1213.002","T1543.003","T1547.001","T1558.001","T1560","T1560.001","T1569.002","T1583.005","T1587.001","T1588.002","T1614.001"]},{"id":"G0094","name":"Kimsuky","type":"group","techniques":["T1003.001","T1005","T1007","T1012","T1016","T1021.001","T1027","T1027.001","T1027.002","T1027.010","T1027.012","T1027.016","T1036.004","T1036.005","T1036.007","T1040","T1041","T1053.005","T1055","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1070.004","T1070.006","T1071.001","T1071.002","T1071.003","T1074.001","T1078.003","T1082","T1083","T1098.007","T1102.001","T1102.002","T1105","T1111","T1112","T1113","T1114.002","T1114.003","T1133","T1136.001","T1140","T1176.001","T1185","T1190","T1204.001","T1204.002","T1205","T1218.005","T1218.010","T1218.011","T1219.002","T1505.003","T1518.001","T1534","T1539","T1543.003","T1546.001","T1547.001","T1550.002","T1552.001","T1553.002","T1555.003","T1557","T1560.001","T1560.003","T1562.001","T1562.004","T1564.002","T1564.003","T1566","T1566.001","T1566.002","T1567.002","T1583","T1583.001","T1583.004","T1583.006","T1584.001","T1585","T1585.001","T1585.002","T1586.002","T1587","T1587.001","T1588.002","T1588.003","T1588.005","T1589.002","T1589.003","T1591","T1593","T1593.001","T1593.002","T1594","T1596","T1598","T1598.003","T1608.001","T1620","T1656","T1657","T1680"]},{"id":"G1004","name":"LAPSUS$","type":"group","techniques":["T1003.003","T1003.006","T1005","T1068","T1069.002","T1078","T1078.004","T1087.002","T1090","T1098.003","T1111","T1114.003","T1133","T1136.003","T1199","T1204","T1213.001","T1213.002","T1213.003","T1213.005","T1485","T1489","T1531","T1552.008","T1555.003","T1555.005","T1578.002","T1578.003","T1583.003","T1584.002","T1586.002","T1588.001","T1588.002","T1589","T1589.001","T1589.002","T1591.002","T1591.004","T1593.003","T1597.002","T1598.004","T1621","T1656"]},{"id":"G0032","name":"Lazarus Group","type":"group","techniques":["T1001.003","T1005","T1008","T1010","T1012","T1016","T1021.001","T1021.002","T1021.004","T1027.007","T1027.009","T1027.013","T1033","T1036.003","T1036.004","T1036.005","T1041","T1046","T1047","T1048.003","T1049","T1053.005","T1055.001","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1070","T1070.003","T1070.004","T1070.006","T1071.001","T1074.001","T1078","T1082","T1083","T1090.001","T1090.002","T1098","T1102.002","T1104","T1105","T1106","T1110.003","T1124","T1132.001","T1134.002","T1140","T1189","T1202","T1203","T1204.002","T1218","T1218.005","T1218.011","T1485","T1489","T1491.001","T1529","T1542.003","T1543.003","T1547.001","T1547.009","T1553.002","T1557.001","T1560","T1560.002","T1560.003","T1561.001","T1561.002","T1562.001","T1562.004","T1564.001","T1566.001","T1566.002","T1566.003","T1571","T1573.001","T1574.001","T1574.013","T1583.001","T1583.006","T1584.004","T1585.001","T1585.002","T1587.001","T1588.002","T1588.004","T1589.002","T1591","T1620","T1680"]},{"id":"G0140","name":"LazyScripter","type":"group","techniques":["T1027.010","T1036","T1059.001","T1059.003","T1059.005","T1059.007","T1071.004","T1102","T1105","T1204.001","T1204.002","T1218.005","T1218.011","T1547.001","T1566.001","T1566.002","T1583.001","T1583.006","T1588.001","T1608.001"]},{"id":"G0077","name":"Leafminer","type":"group","techniques":["T1003.001","T1003.004","T1003.005","T1018","T1027.010","T1046","T1055.013","T1059.007","T1083","T1110.003","T1114.002","T1136.001","T1189","T1552.001","T1555","T1555.003","T1588.002"]},{"id":"G0065","name":"Leviathan","type":"group","techniques":["T1003","T1003.001","T1021.001","T1021.004","T1027.001","T1027.003","T1027.013","T1027.015","T1041","T1047","T1055.001","T1059.001","T1059.005","T1074.001","T1074.002","T1078","T1090.003","T1102.003","T1105","T1133","T1140","T1189","T1190","T1197","T1203","T1204.001","T1204.002","T1218.010","T1505.003","T1534","T1546.003","T1547.001","T1547.009","T1553.002","T1559.002","T1560","T1566.001","T1566.002","T1567.002","T1572","T1583.001","T1584.004","T1584.008","T1585.001","T1585.002","T1586.001","T1586.002","T1587.004","T1589.001","T1595.002"]},{"id":"G0030","name":"Lotus Blossom","type":"group","techniques":["T1012","T1016","T1016.001","T1018","T1046","T1047","T1049","T1074.001","T1083","T1087.001","T1087.002","T1090.001","T1090.003","T1112","T1134","T1482","T1539","T1543.003","T1560.001","T1560.003","T1588.002"]},{"id":"G1014","name":"LuminousMoth","type":"group","techniques":["T1005","T1030","T1033","T1036.005","T1041","T1053.005","T1071.001","T1083","T1091","T1105","T1112","T1204.001","T1539","T1547.001","T1553.002","T1557.002","T1560","T1564.001","T1566.002","T1567.002","T1574.001","T1587.001","T1588.001","T1588.002","T1588.004","T1608.001","T1608.004","T1608.005"]},{"id":"G0095","name":"Machete","type":"group","techniques":["T1036.005","T1053.005","T1059.003","T1059.005","T1059.006","T1189","T1204.001","T1204.002","T1218.007","T1566.001","T1566.002"]},{"id":"G0059","name":"Magic Hound","type":"group","techniques":["T1003.001","T1005","T1016","T1016.001","T1016.002","T1018","T1021.001","T1027.010","T1027.013","T1033","T1036.004","T1036.005","T1036.010","T1046","T1047","T1049","T1053.005","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1070.003","T1070.004","T1071","T1071.001","T1078.001","T1078.002","T1082","T1083","T1087.003","T1090","T1098.002","T1098.007","T1102.002","T1105","T1112","T1113","T1114","T1114.001","T1114.002","T1136.001","T1189","T1190","T1204.001","T1204.002","T1218.011","T1482","T1486","T1505.003","T1547.001","T1560.001","T1562","T1562.001","T1562.002","T1562.004","T1564.003","T1566.002","T1566.003","T1567","T1570","T1571","T1572","T1573","T1583.001","T1583.006","T1584.001","T1585.001","T1585.002","T1586.002","T1588.002","T1589","T1589.001","T1589.002","T1590.005","T1591.001","T1592.002","T1595.002","T1598.003"]},{"id":"G1026","name":"Malteiro","type":"group","techniques":["T1027.013","T1055.001","T1059.005","T1082","T1140","T1204.002","T1518.001","T1555","T1555.003","T1566.001","T1614.001","T1657"]},{"id":"G1051","name":"Medusa Group","type":"group","techniques":["T1003.001","T1003.003","T1016","T1018","T1021.001","T1027.002","T1027.010","T1033","T1046","T1047","T1057","T1059.001","T1059.003","T1069.002","T1070.003","T1070.004","T1071.001","T1072","T1078","T1082","T1083","T1087.001","T1090.003","T1105","T1106","T1112","T1135","T1136.002","T1190","T1218.014","T1219","T1486","T1489","T1490","T1505.003","T1518.001","T1529","T1543.003","T1548.002","T1553.002","T1559.001","T1562.001","T1562.003","T1562.004","T1564.003","T1567.002","T1569.002","T1570","T1573.002","T1583.006","T1585.001","T1585.002","T1588.002","T1608.002","T1650","T1652","T1657"]},{"id":"G1013","name":"Metador","type":"group","techniques":["T1027.013","T1059.003","T1070.004","T1071.001","T1095","T1105","T1546.003","T1588.001","T1588.002"]},{"id":"G0103","name":"Mofang","type":"group","techniques":["T1027.013","T1027.015","T1204.001","T1204.002","T1566.001","T1566.002"]},{"id":"G0021","name":"Molerats","type":"group","techniques":["T1027.015","T1053.005","T1057","T1059.001","T1059.005","T1059.007","T1105","T1140","T1204.001","T1204.002","T1218.007","T1547.001","T1553.002","T1555.003","T1566.001","T1566.002"]},{"id":"G1036","name":"Moonstone Sleet","type":"group","techniques":["T1003.001","T1016","T1027","T1027.009","T1027.013","T1033","T1053.005","T1071.001","T1082","T1105","T1140","T1195.002","T1204.002","T1217","T1486","T1547.001","T1566.001","T1566.003","T1569.002","T1583.001","T1583.003","T1585.001","T1585.002","T1587","T1587.001","T1589.002","T1591","T1598","T1598.003","T1608.001"]},{"id":"G1009","name":"Moses Staff","type":"group","techniques":["T1016","T1021.002","T1027.013","T1082","T1087.001","T1105","T1190","T1505.003","T1553.002","T1562.004","T1587.001","T1588.002"]},{"id":"G1019","name":"MoustachedBouncer","type":"group","techniques":["T1027.002","T1059.001","T1059.007","T1068","T1074.002","T1090","T1113","T1659"]},{"id":"G0069","name":"MuddyWater","type":"group","techniques":["T1003.001","T1003.004","T1003.005","T1016","T1027.003","T1027.004","T1027.010","T1033","T1036.005","T1041","T1047","T1049","T1053.005","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1071.001","T1074.001","T1082","T1083","T1087.002","T1090.002","T1102.002","T1104","T1105","T1113","T1132.001","T1137.001","T1140","T1190","T1203","T1204.001","T1204.002","T1210","T1218.003","T1218.005","T1218.011","T1219","T1518","T1518.001","T1547.001","T1548.002","T1552.001","T1555","T1555.003","T1559.001","T1559.002","T1560.001","T1562.001","T1566.001","T1566.002","T1573.001","T1574.001","T1583.006","T1588.002"]},{"id":"G0129","name":"Mustang Panda","type":"group","techniques":["T1001.003","T1003","T1003.001","T1003.003","T1003.006","T1016","T1018","T1027","T1027.007","T1027.012","T1027.016","T1036.005","T1036.007","T1036.008","T1041","T1046","T1047","T1048.003","T1049","T1052.001","T1053.005","T1057","T1059","T1059.001","T1059.003","T1059.005","T1059.007","T1069.002","T1070","T1070.004","T1070.006","T1071.001","T1072","T1074.001","T1082","T1083","T1087.002","T1091","T1095","T1102","T1105","T1106","T1119","T1129","T1140","T1176.002","T1203","T1204.001","T1204.002","T1205","T1218.004","T1218.005","T1219.001","T1219.002","T1505.003","T1518","T1546.003","T1547.001","T1553.002","T1557","T1560.001","T1560.003","T1564.001","T1566.001","T1566.002","T1567.002","T1572","T1573.001","T1574.001","T1574.005","T1583.001","T1583.006","T1585.002","T1586.002","T1587.001","T1588.002","T1588.003","T1588.004","T1593","T1598.003","T1608","T1608.001","T1622","T1654","T1678"]},{"id":"G1020","name":"Mustard Tempest","type":"group","techniques":["T1036.005","T1082","T1105","T1189","T1204.001","T1566.002","T1583.004","T1583.008","T1584.001","T1608.001","T1608.004","T1608.006"]},{"id":"G0019","name":"Naikon","type":"group","techniques":["T1016","T1018","T1036.004","T1036.005","T1046","T1047","T1053.005","T1078.002","T1137.006","T1204.002","T1518.001","T1547.001","T1566.001","T1574.001"]},{"id":"G0133","name":"Nomadic Octopus","type":"group","techniques":["T1036","T1059.001","T1059.003","T1105","T1204.002","T1564.003","T1566.001"]},{"id":"G0049","name":"OilRig","type":"group","techniques":["T1003.001","T1003.004","T1003.005","T1005","T1007","T1008","T1012","T1016","T1021.001","T1021.004","T1025","T1027.005","T1027.013","T1033","T1036","T1036.005","T1046","T1047","T1048.003","T1049","T1053.005","T1056.001","T1057","T1059","T1059.001","T1059.003","T1059.005","T1068","T1069.001","T1069.002","T1070.004","T1071.001","T1071.004","T1078","T1078.002","T1082","T1087.001","T1087.002","T1105","T1110","T1112","T1113","T1115","T1119","T1120","T1133","T1137.004","T1140","T1195","T1201","T1203","T1204.001","T1204.002","T1218.001","T1219","T1497.001","T1505.003","T1543.003","T1552.001","T1553.002","T1555","T1555.003","T1555.004","T1556.002","T1562.004","T1566.001","T1566.002","T1566.003","T1572","T1573.002","T1583.001","T1586.002","T1587.001","T1588.002","T1588.003","T1608.001"]},{"id":"G0071","name":"Orangeworm","type":"group","techniques":["T1021.002","T1071.001"]},{"id":"G0068","name":"PLATINUM","type":"group","techniques":["T1003.001","T1036","T1055","T1056.001","T1056.004","T1068","T1095","T1105","T1189","T1204.002","T1566.001"]},{"id":"G1005","name":"POLONIUM","type":"group","techniques":["T1078","T1090","T1102.002","T1199","T1567.002","T1583.006","T1588.002"]},{"id":"G0056","name":"PROMETHIUM","type":"group","techniques":["T1036.004","T1036.005","T1078.003","T1189","T1204.002","T1205.001","T1543.003","T1547.001","T1553.002","T1587.002","T1587.003"]},{"id":"G0040","name":"Patchwork","type":"group","techniques":["T1005","T1021.001","T1027.001","T1027.002","T1027.005","T1027.010","T1033","T1036.005","T1053.005","T1055.012","T1059.001","T1059.003","T1059.005","T1070.004","T1074.001","T1082","T1083","T1102.001","T1105","T1112","T1119","T1132.001","T1189","T1197","T1203","T1204.001","T1204.002","T1518.001","T1547.001","T1548.002","T1553.002","T1555.003","T1559.002","T1560","T1566.001","T1566.002","T1574.001","T1587.002","T1588.002","T1598.003","T1680"]},{"id":"G0011","name":"PittyTiger","type":"group","techniques":["T1078","T1588.002"]},{"id":"G1040","name":"Play","type":"group","techniques":["T1003.001","T1016","T1018","T1021.002","T1027.010","T1030","T1048","T1057","T1059.001","T1059.003","T1070.001","T1070.004","T1078","T1078.002","T1078.003","T1082","T1083","T1105","T1133","T1190","T1518.001","T1560.001","T1562.001","T1587.001","T1588.002","T1657"]},{"id":"G0033","name":"Poseidon Group","type":"group","techniques":["T1003","T1007","T1036.005","T1049","T1057","T1059.001","T1087.001","T1087.002"]},{"id":"G0024","name":"Putter Panda","type":"group","techniques":["T1027.013","T1055.001","T1547.001","T1562.001"]},{"id":"G0048","name":"RTM","type":"group","techniques":["T1102.001","T1189","T1204.002","T1219.002","T1547.001","T1566.001","T1574.001"]},{"id":"G0075","name":"Rancor","type":"group","techniques":["T1053.005","T1059.003","T1059.005","T1071.001","T1105","T1204.002","T1218.007","T1546.003","T1566.001"]},{"id":"G1039","name":"RedCurl","type":"group","techniques":["T1003.001","T1005","T1020","T1027","T1036.005","T1039","T1046","T1053.005","T1056.002","T1059.001","T1059.003","T1059.005","T1059.006","T1070.004","T1071.001","T1080","T1082","T1083","T1087.001","T1087.002","T1087.003","T1102","T1114.001","T1119","T1199","T1202","T1204.001","T1204.002","T1218.011","T1537","T1547.001","T1552.001","T1552.002","T1555.003","T1560.001","T1564.001","T1566.001","T1566.002","T1573.001","T1573.002","T1587.001"]},{"id":"G1042","name":"RedEcho","type":"group","techniques":["T1071.001","T1568","T1571","T1573.002","T1583.001"]},{"id":"G0106","name":"Rocke","type":"group","techniques":["T1014","T1018","T1021.004","T1027","T1027.002","T1027.004","T1036.005","T1037","T1046","T1053.003","T1055.002","T1057","T1059.004","T1059.006","T1070.002","T1070.004","T1070.006","T1071","T1071.001","T1082","T1102","T1102.001","T1105","T1140","T1190","T1222.002","T1496.001","T1518.001","T1543.002","T1547.001","T1552.004","T1562.001","T1562.004","T1564.001","T1571","T1574.006"]},{"id":"G1031","name":"Saint Bear","type":"group","techniques":["T1027.002","T1027.013","T1059","T1059.001","T1059.003","T1059.007","T1112","T1203","T1204.001","T1204.002","T1497","T1553.002","T1562.001","T1566.001","T1583.006","T1589.002","T1608.001","T1656"]},{"id":"G1045","name":"Salt Typhoon","type":"group","techniques":["T1021.004","T1040","T1048.003","T1070.002","T1098.004","T1110.002","T1136","T1190","T1562.004","T1572","T1587.001","T1588.002","T1590.004","T1602.002"]},{"id":"G0034","name":"Sandworm Team","type":"group","techniques":["T1003.001","T1003.003","T1005","T1018","T1021.002","T1027","T1027.010","T1033","T1036","T1036.005","T1040","T1041","T1047","T1049","T1053.005","T1056.001","T1059.001","T1059.005","T1070.004","T1071.001","T1072","T1078","T1078.002","T1082","T1083","T1087.002","T1087.003","T1090","T1102.002","T1105","T1106","T1132.001","T1133","T1140","T1190","T1195","T1195.002","T1199","T1203","T1204.001","T1204.002","T1213.006","T1218.011","T1219","T1485","T1486","T1489","T1490","T1491.002","T1499","T1505.003","T1539","T1555.003","T1561.002","T1566.001","T1566.002","T1570","T1571","T1583","T1583.001","T1583.004","T1584.004","T1584.005","T1585.001","T1585.002","T1586.001","T1587.001","T1588.002","T1588.006","T1589.002","T1589.003","T1590.001","T1591.002","T1592.002","T1593","T1594","T1595.002","T1598.003","T1608.001"]},{"id":"G1015","name":"Scattered Spider","type":"group","techniques":["T1003.003","T1006","T1016","T1018","T1021.001","T1021.004","T1021.007","T1041","T1059.001","T1059.004","T1068","T1069","T1069.002","T1070.008","T1074","T1078","T1078.004","T1082","T1083","T1087","T1087.002","T1090","T1098","T1098.003","T1105","T1114","T1114.003","T1133","T1136","T1204","T1213.003","T1213.005","T1217","T1219.002","T1484.002","T1486","T1490","T1530","T1538","T1539","T1543.002","T1552.001","T1552.004","T1553.002","T1555.005","T1556.006","T1556.009","T1562.001","T1564.008","T1567.002","T1572","T1578.002","T1580","T1583.001","T1585.001","T1588.001","T1588.002","T1589","T1598","T1598.003","T1598.004","T1621","T1656","T1657"]},{"id":"G1041","name":"Sea Turtle","type":"group","techniques":["T1027.004","T1059.004","T1070.002","T1071.001","T1074.002","T1078","T1078.003","T1114.001","T1133","T1190","T1199","T1203","T1213.006","T1505.003","T1557","T1560.001","T1562.003","T1564.011","T1566","T1583","T1583.001","T1583.002","T1583.003","T1584.002","T1588.002","T1588.004","T1608.003"]},{"id":"G1008","name":"SideCopy","type":"group","techniques":["T1016","T1036.005","T1059.005","T1082","T1105","T1106","T1204.002","T1218.005","T1518","T1518.001","T1566.001","T1574.001","T1584.001","T1598.002","T1608.001","T1614"]},{"id":"G0121","name":"Sidewinder","type":"group","techniques":["T1016","T1020","T1027.010","T1027.013","T1033","T1036.005","T1057","T1059.001","T1059.005","T1059.007","T1071.001","T1074.001","T1082","T1083","T1105","T1119","T1124","T1203","T1204.001","T1204.002","T1218.005","T1518","T1518.001","T1547.001","T1559.002","T1566.001","T1566.002","T1574.001","T1598.002","T1598.003"]},{"id":"G0091","name":"Silence","type":"group","techniques":["T1003.001","T1018","T1021.001","T1027.010","T1036.005","T1053.005","T1055","T1059.001","T1059.003","T1059.005","T1059.007","T1070.004","T1072","T1078","T1090.002","T1105","T1106","T1112","T1113","T1125","T1204.002","T1218.001","T1547.001","T1553.002","T1566.001","T1569.002","T1571","T1588.002"]},{"id":"G0122","name":"Silent Librarian","type":"group","techniques":["T1078","T1110.003","T1114","T1114.003","T1583.001","T1585.002","T1588.002","T1588.004","T1589.002","T1589.003","T1594","T1598.003","T1608.005"]},{"id":"G0083","name":"SilverTerrier","type":"group","techniques":["T1071.001","T1071.002","T1071.003","T1657"]},{"id":"G0054","name":"Sowbug","type":"group","techniques":["T1003","T1036.005","T1039","T1056.001","T1059.003","T1082","T1083","T1135","T1560.001"]},{"id":"G1033","name":"Star Blizzard","type":"group","techniques":["T1059.007","T1078","T1114.002","T1114.003","T1204.002","T1539","T1550.004","T1566.001","T1583","T1583.001","T1585.001","T1585.002","T1586.002","T1588.002","T1589","T1593","T1598.002","T1598.003","T1608.001"]},{"id":"G0038","name":"Stealth Falcon","type":"group","techniques":["T1005","T1012","T1016","T1033","T1041","T1047","T1053.005","T1057","T1059","T1059.001","T1071.001","T1082","T1555","T1555.003","T1555.004","T1573.001"]},{"id":"G1053","name":"Storm-0501","type":"group","techniques":["T1003","T1003.006","T1021.006","T1021.007","T1027.002","T1036.004","T1053.005","T1057","T1059.001","T1059.009","T1078.004","T1082","T1087.002","T1087.004","T1098.001","T1098.003","T1110","T1190","T1218.010","T1218.011","T1219.002","T1482","T1484.001","T1484.002","T1485","T1486","T1490","T1518.001","T1526","T1530","T1537","T1552.004","T1555.005","T1555.006","T1556.009","T1567.002","T1578.003","T1580","T1587.003","T1588.006","T1614.001","T1657"]},{"id":"G1046","name":"Storm-1811","type":"group","techniques":["T1021.002","T1021.004","T1027.013","T1033","T1036","T1036.005","T1036.010","T1048.002","T1056","T1059.001","T1059.003","T1074.001","T1087.002","T1105","T1140","T1204.002","T1219.002","T1222.001","T1482","T1486","T1547.001","T1566.002","T1566.003","T1566.004","T1570","T1574.001","T1583.001","T1585.003","T1588.002","T1656","T1667"]},{"id":"G0041","name":"Strider","type":"group","techniques":["T1090.001","T1556.002","T1564.005"]},{"id":"G0039","name":"Suckfly","type":"group","techniques":["T1003","T1046","T1059.003","T1078","T1553.002"]},{"id":"G1018","name":"TA2541","type":"group","techniques":["T1016.001","T1027.002","T1027.013","T1027.015","T1036.005","T1047","T1053.005","T1055","T1055.012","T1059.001","T1059.005","T1082","T1105","T1204.001","T1204.002","T1218.005","T1518.001","T1547.001","T1562.001","T1566.001","T1566.002","T1568","T1573.002","T1583.001","T1583.006","T1588.001","T1588.002","T1608.001"]},{"id":"G0062","name":"TA459","type":"group","techniques":["T1059.001","T1059.005","T1203","T1204.002","T1566.001"]},{"id":"G0092","name":"TA505","type":"group","techniques":["T1027.002","T1027.010","T1027.013","T1055.001","T1059.001","T1059.003","T1059.005","T1059.007","T1069","T1071.001","T1078.002","T1087.003","T1105","T1106","T1112","T1140","T1204.001","T1204.002","T1218.007","T1218.011","T1486","T1552.001","T1553.002","T1553.005","T1555.003","T1559.002","T1562.001","T1566.001","T1566.002","T1568.001","T1583.001","T1588.001","T1588.002","T1608.001"]},{"id":"G0127","name":"TA551","type":"group","techniques":["T1027.003","T1027.010","T1036","T1059.003","T1071.001","T1105","T1132.001","T1204.002","T1218.005","T1218.010","T1218.011","T1566.001","T1568.002","T1589.002"]},{"id":"G1037","name":"TA577","type":"group","techniques":["T1027.009","T1059.003","T1059.007","T1204.001","T1566.002","T1586.002"]},{"id":"G1038","name":"TA578","type":"group","techniques":["T1059.007","T1204.001","T1583.006","T1594"]},{"id":"G0139","name":"TeamTNT","type":"group","techniques":["T1007","T1014","T1016","T1021.004","T1027.002","T1027.013","T1036","T1036.005","T1046","T1048","T1049","T1057","T1059.001","T1059.003","T1059.004","T1059.009","T1059.013","T1070.002","T1070.003","T1070.004","T1071","T1071.001","T1074.001","T1082","T1083","T1098.004","T1102","T1105","T1120","T1133","T1136.001","T1140","T1204.003","T1219","T1222.002","T1496.001","T1518.001","T1543.002","T1543.003","T1547.001","T1552.001","T1552.004","T1552.005","T1562.001","T1562.004","T1569.003","T1583.001","T1587.001","T1595.001","T1595.002","T1608.001","T1609","T1610","T1611","T1613","T1680"]},{"id":"G0089","name":"The White Company","type":"group","techniques":["T1027.002","T1070.004","T1124","T1203","T1204.002","T1518.001","T1566.001"]},{"id":"G0028","name":"Threat Group-1314","type":"group","techniques":["T1021.002","T1059.003","T1072","T1078.002"]},{"id":"G0027","name":"Threat Group-3390","type":"group","techniques":["T1003.001","T1003.002","T1003.004","T1005","T1012","T1016","T1018","T1021.006","T1027.002","T1027.013","T1027.015","T1030","T1033","T1046","T1047","T1049","T1053.002","T1055.012","T1056.001","T1059.001","T1059.003","T1068","T1070.004","T1070.005","T1071.001","T1074.001","T1074.002","T1078","T1087.001","T1105","T1112","T1119","T1133","T1140","T1189","T1190","T1195.002","T1199","T1203","T1204.002","T1210","T1505.003","T1543.003","T1547.001","T1548.002","T1555.005","T1560.002","T1562.002","T1566.001","T1567.002","T1574.001","T1583.001","T1588.002","T1588.003","T1608.001","T1608.002","T1608.004"]},{"id":"G0076","name":"Thrip","type":"group","techniques":["T1048.003","T1059.001","T1219.002","T1588.002"]},{"id":"G1022","name":"ToddyCat","type":"group","techniques":["T1005","T1018","T1021.002","T1036.005","T1047","T1049","T1053.005","T1057","T1059.001","T1059.003","T1069.002","T1074.002","T1078.002","T1083","T1087.002","T1095","T1106","T1190","T1518.001","T1560.001","T1562.004","T1564.003","T1566.003","T1567.002","T1680"]},{"id":"G0131","name":"Tonto Team","type":"group","techniques":["T1003","T1056.001","T1059.001","T1059.006","T1068","T1069.001","T1090.002","T1105","T1135","T1203","T1204.002","T1210","T1505.003","T1566.001","T1574.001"]},{"id":"G0134","name":"Transparent Tribe","type":"group","techniques":["T1027.013","T1036.005","T1059.005","T1189","T1203","T1204.001","T1204.002","T1564.001","T1566.001","T1566.002","T1568","T1583.001","T1584.001","T1608.004"]},{"id":"G0081","name":"Tropic Trooper","type":"group","techniques":["T1016","T1020","T1027.003","T1027.013","T1033","T1036.005","T1046","T1049","T1052.001","T1055.001","T1057","T1059.003","T1070.004","T1071.001","T1071.004","T1078.003","T1082","T1083","T1091","T1105","T1106","T1119","T1132.001","T1135","T1140","T1203","T1204.002","T1221","T1505.003","T1518","T1518.001","T1543.003","T1547.001","T1547.004","T1564.001","T1566.001","T1573","T1573.002","T1574.001","T1680"]},{"id":"G0010","name":"Turla","type":"group","techniques":["T1005","T1007","T1012","T1016","T1016.001","T1018","T1021.002","T1025","T1027.005","T1027.010","T1027.011","T1036.005","T1049","T1055","T1055.001","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1068","T1069.001","T1069.002","T1071.001","T1071.003","T1078.003","T1082","T1083","T1087.001","T1087.002","T1090","T1090.001","T1102","T1102.002","T1105","T1106","T1110","T1112","T1120","T1124","T1134.002","T1140","T1189","T1201","T1204.001","T1213.006","T1518.001","T1546.003","T1546.013","T1547.001","T1547.004","T1553.006","T1555.004","T1560.001","T1562.001","T1564.012","T1566.002","T1567.002","T1570","T1583.006","T1584.003","T1584.004","T1584.006","T1587.001","T1588.001","T1588.002","T1615"]},{"id":"G1048","name":"UNC3886","type":"group","techniques":["T1003.001","T1008","T1014","T1021.004","T1027.005","T1036.004","T1037","T1037.004","T1040","T1057","T1059.001","T1059.003","T1059.004","T1059.006","T1059.012","T1068","T1070.004","T1070.006","T1070.007","T1074.001","T1078","T1078.001","T1083","T1095","T1124","T1190","T1203","T1205","T1205.001","T1212","T1218.011","T1505.006","T1548","T1554","T1555.005","T1560.001","T1560.003","T1562.001","T1562.003","T1562.004","T1564.011","T1570","T1587.001","T1587.004","T1588.001","T1588.004","T1673","T1675","T1681"]},{"id":"G1047","name":"Velvet Ant","type":"group","techniques":["T1021.002","T1036.005","T1037.004","T1040","T1047","T1049","T1055","T1059.004","T1071","T1078.003","T1083","T1090.001","T1132","T1133","T1211","T1562.001","T1562.004","T1569.002","T1570","T1571","T1573.002","T1574.001"]},{"id":"G0123","name":"Volatile Cedar","type":"group","techniques":["T1105","T1190","T1505.003","T1595.002","T1595.003"]},{"id":"G1017","name":"Volt Typhoon","type":"group","techniques":["T1003.001","T1003.003","T1005","T1006","T1007","T1010","T1012","T1016","T1016.001","T1018","T1021.001","T1027.002","T1033","T1036.005","T1036.008","T1046","T1047","T1049","T1056.001","T1057","T1059.001","T1059.003","T1059.004","T1068","T1069","T1069.001","T1069.002","T1070.001","T1070.004","T1070.007","T1074","T1074.001","T1078","T1078.002","T1083","T1087.001","T1087.002","T1090","T1090.001","T1090.003","T1105","T1112","T1113","T1120","T1124","T1133","T1140","T1190","T1217","T1218","T1497.001","T1505.003","T1518","T1552","T1552.004","T1555","T1555.003","T1560.001","T1570","T1573.001","T1584.003","T1584.004","T1584.005","T1584.008","T1587.004","T1588.002","T1588.006","T1589","T1589.002","T1590","T1590.004","T1590.006","T1591","T1591.004","T1592","T1593","T1594","T1596.005","T1614","T1654","T1680"]},{"id":"G0090","name":"WIRTE","type":"group","techniques":["T1036.005","T1059.001","T1059.005","T1071.001","T1105","T1140","T1204.002","T1218.010","T1566.001","T1571","T1588.002"]},{"id":"G1050","name":"Water Galura","type":"group","techniques":["T1486","T1585.001","T1657"]},{"id":"G0107","name":"Whitefly","type":"group","techniques":["T1003.001","T1027.013","T1036.005","T1059","T1068","T1105","T1204.002","T1574.001","T1588.002"]},{"id":"G0124","name":"Windigo","type":"group","techniques":["T1005","T1059","T1082","T1083","T1090","T1189","T1518"]},{"id":"G0112","name":"Windshift","type":"group","techniques":["T1027","T1033","T1036","T1036.001","T1047","T1057","T1059.005","T1071.001","T1082","T1105","T1189","T1204.001","T1204.002","T1518","T1518.001","T1547.001","T1566.001","T1566.002","T1566.003"]},{"id":"G0044","name":"Winnti Group","type":"group","techniques":["T1014","T1057","T1083","T1105","T1553.002","T1583.001"]},{"id":"G1035","name":"Winter Vivern","type":"group","techniques":["T1020","T1033","T1036","T1036.004","T1041","T1053.005","T1056.003","T1059","T1059.001","T1059.003","T1059.007","T1071.001","T1082","T1083","T1105","T1113","T1114.001","T1119","T1140","T1189","T1190","T1204.001","T1566.001","T1583.001","T1583.003","T1584.006","T1595.002"]},{"id":"G0102","name":"Wizard Spider","type":"group","techniques":["T1003.001","T1003.002","T1003.003","T1005","T1016","T1018","T1021","T1021.001","T1021.002","T1021.006","T1027.010","T1033","T1036.004","T1041","T1047","T1048.003","T1053.005","T1055","T1055.001","T1059.001","T1059.003","T1070.004","T1071.001","T1074","T1074.001","T1078","T1078.002","T1082","T1087.002","T1105","T1112","T1133","T1135","T1136.001","T1136.002","T1197","T1204.001","T1204.002","T1210","T1218.011","T1222.001","T1489","T1490","T1518.001","T1518.002","T1543.003","T1547.001","T1547.004","T1550.002","T1552.006","T1553.002","T1555.004","T1557.001","T1558.003","T1560.001","T1562.001","T1566.001","T1566.002","T1567.002","T1569.002","T1570","T1585.002","T1588.002","T1588.003"]},{"id":"G0128","name":"ZIRCONIUM","type":"group","techniques":["T1012","T1016","T1027.002","T1033","T1036","T1036.004","T1041","T1059.003","T1059.006","T1068","T1082","T1090.003","T1102.002","T1105","T1124","T1140","T1204.001","T1218.007","T1547.001","T1555.003","T1566.002","T1567.002","T1573.001","T1583.001","T1583.006","T1584.008","T1598","T1598.003","T1665"]},{"id":"G0018","name":"admin@338","type":"group","techniques":["T1007","T1016","T1036.005","T1049","T1059.003","T1069.001","T1082","T1083","T1087.001","T1203","T1204.002","T1566.001"]},{"id":"G0045","name":"menuPass","type":"group","techniques":["T1003.002","T1003.003","T1003.004","T1005","T1016","T1018","T1021.001","T1021.004","T1027.013","T1036","T1036.003","T1036.005","T1039","T1046","T1047","T1049","T1053.005","T1055.012","T1056.001","T1059.001","T1059.003","T1070.003","T1070.004","T1074.001","T1074.002","T1078","T1083","T1087.002","T1090.002","T1105","T1106","T1119","T1140","T1190","T1199","T1204.002","T1210","T1218.004","T1553.002","T1560","T1560.001","T1566.001","T1568.001","T1574.001","T1583.001","T1588.002"]},{"id":"S0066","name":"3PARA RAT","type":"software","techniques":["T1070.006","T1071.001","T1083","T1573.001"]},{"id":"S0065","name":"4H RAT","type":"software","techniques":["T1057","T1059.003","T1071.001","T1082","T1083","T1573.001"]},{"id":"S0677","name":"AADInternals","type":"software","techniques":["T1003.004","T1048","T1059.001","T1069.003","T1087.004","T1098.005","T1112","T1136.003","T1484.002","T1526","T1528","T1530","T1552.001","T1552.004","T1556.006","T1556.007","T1558.002","T1566.002","T1589.002","T1590.001","T1598.003","T1606.002","T1649","T1651"]},{"id":"S0469","name":"ABK","type":"software","techniques":["T1027.003","T1055","T1059.003","T1071.001","T1105","T1140","T1518.001"]},{"id":"S0045","name":"ADVSTORESHELL","type":"software","techniques":["T1012","T1027","T1029","T1041","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1074.001","T1082","T1083","T1106","T1112","T1120","T1132.001","T1218.011","T1546.015","T1547.001","T1560","T1560.003","T1573.001","T1573.002"]},{"id":"S1074","name":"ANDROMEDA","type":"software","techniques":["T1036.005","T1036.008","T1055","T1071.001","T1091","T1105","T1547.001"]},{"id":"S1167","name":"AcidPour","type":"software","techniques":["T1070.004","T1082","T1083","T1120","T1485","T1529","T1561.001"]},{"id":"S1125","name":"AcidRain","type":"software","techniques":["T1083","T1485","T1529","T1561.001"]},{"id":"S1028","name":"Action RAT","type":"software","techniques":["T1005","T1016","T1027","T1033","T1047","T1059.003","T1071.001","T1082","T1083","T1105","T1140","T1518.001"]},{"id":"S0552","name":"AdFind","type":"software","techniques":["T1016","T1018","T1069.002","T1087.002","T1482"]},{"id":"S0331","name":"Agent Tesla","type":"software","techniques":["T1016","T1016.002","T1027","T1033","T1047","T1048.003","T1053.005","T1055","T1055.012","T1056.001","T1057","T1071.001","T1071.003","T1082","T1087.001","T1105","T1112","T1113","T1115","T1124","T1125","T1140","T1185","T1203","T1204.002","T1218.009","T1497","T1547.001","T1552.001","T1552.002","T1555","T1555.003","T1560","T1562.001","T1564.001","T1564.003","T1566.001"]},{"id":"S0092","name":"Agent.btz","type":"software","techniques":["T1016","T1033","T1052.001","T1091","T1105","T1560.003"]},{"id":"S1129","name":"Akira","type":"software","techniques":["T1047","T1057","T1059.001","T1059.003","T1082","T1083","T1106","T1135","T1486","T1490"]},{"id":"S1194","name":"Akira _v2","type":"software","techniques":["T1083","T1480","T1486","T1489","T1543","T1654"]},{"id":"S1025","name":"Amadey","type":"software","techniques":["T1005","T1016","T1027","T1033","T1041","T1071.001","T1082","T1083","T1105","T1106","T1112","T1140","T1518.001","T1547.001","T1553.005","T1568.001","T1614"]},{"id":"S0504","name":"Anchor","type":"software","techniques":["T1008","T1016","T1021.002","T1027","T1027.002","T1053.003","T1053.005","T1059.003","T1059.004","T1070.004","T1071.001","T1071.004","T1082","T1095","T1105","T1480","T1543.003","T1553.002","T1564.004","T1569.002"]},{"id":"S1133","name":"Apostle","type":"software","techniques":["T1053.005","T1057","T1070.001","T1070.004","T1140","T1480","T1485","T1486","T1529","T1561.001"]},{"id":"S0584","name":"AppleJeus","type":"software","techniques":["T1027","T1041","T1053.005","T1059.004","T1070.004","T1071.001","T1082","T1140","T1204.001","T1204.002","T1218.007","T1497.003","T1543.003","T1543.004","T1546.016","T1548.002","T1553.002","T1564.001","T1566.002","T1569.001"]},{"id":"S0622","name":"AppleSeed","type":"software","techniques":["T1005","T1008","T1016","T1025","T1027","T1027.002","T1030","T1036","T1036.005","T1041","T1056.001","T1057","T1059.001","T1059.007","T1070.004","T1071.001","T1074.001","T1082","T1083","T1106","T1113","T1119","T1124","T1134","T1140","T1204.002","T1218.010","T1547.001","T1560","T1560.001","T1566.001","T1567"]},{"id":"S0456","name":"Aria-body","type":"software","techniques":["T1010","T1016","T1025","T1027.013","T1033","T1049","T1055.001","T1057","T1070.004","T1071.001","T1082","T1083","T1090","T1095","T1105","T1106","T1113","T1134.001","T1134.002","T1140","T1547.001","T1560","T1568.002","T1680"]},{"id":"S0099","name":"Arp","type":"software","techniques":["T1016","T1018"]},{"id":"S0373","name":"Astaroth","type":"software","techniques":["T1016","T1027.002","T1027.010","T1027.013","T1041","T1047","T1055.012","T1056.001","T1057","T1059.003","T1059.005","T1059.007","T1074.001","T1082","T1102.001","T1105","T1115","T1124","T1129","T1132.001","T1140","T1204.002","T1218.001","T1218.010","T1220","T1497.001","T1518.001","T1547.001","T1547.009","T1552","T1555","T1564.003","T1564.004","T1566.001","T1568.002","T1574.001"]},{"id":"S1087","name":"AsyncRAT","type":"software","techniques":["T1033","T1053.005","T1056.001","T1057","T1105","T1106","T1113","T1125","T1497.001","T1564.003","T1568","T1622","T1680"]},{"id":"S0438","name":"Attor","type":"software","techniques":["T1010","T1012","T1020","T1027.013","T1036.004","T1037.001","T1041","T1053.005","T1055","T1055.004","T1056.001","T1070.004","T1070.006","T1071.002","T1074.001","T1083","T1090.003","T1105","T1106","T1112","T1113","T1115","T1119","T1120","T1123","T1129","T1218.011","T1497.001","T1543.003","T1560.003","T1564.001","T1569.002","T1573.001","T1573.002","T1680"]},{"id":"S1029","name":"AuTo Stealer","type":"software","techniques":["T1005","T1033","T1041","T1059.003","T1071.001","T1074.001","T1082","T1095","T1518.001","T1547.001"]},{"id":"S0347","name":"AuditCred","type":"software","techniques":["T1027.013","T1055","T1059.003","T1070.004","T1083","T1090","T1105","T1140","T1543.003"]},{"id":"S0129","name":"AutoIt backdoor","type":"software","techniques":["T1059.001","T1083","T1132.001","T1548.002"]},{"id":"S0640","name":"Avaddon","type":"software","techniques":["T1016","T1027","T1047","T1057","T1059.007","T1083","T1106","T1112","T1135","T1140","T1486","T1489","T1490","T1547.001","T1548.002","T1562.001","T1614.001"]},{"id":"S0473","name":"Avenger","type":"software","techniques":["T1016","T1027.003","T1027.013","T1055","T1057","T1071.001","T1082","T1083","T1105","T1140","T1518.001","T1680"]},{"id":"S1053","name":"AvosLocker","type":"software","techniques":["T1027","T1027.007","T1036.008","T1057","T1083","T1106","T1124","T1135","T1140","T1486","T1489","T1529","T1547.001","T1562.009","T1564.003"]},{"id":"S0344","name":"Azorult","type":"software","techniques":["T1012","T1016","T1033","T1055.012","T1057","T1070.004","T1082","T1083","T1105","T1113","T1124","T1134.002","T1140","T1552.001","T1555.003","T1573.001"]},{"id":"S0031","name":"BACKSPACE","type":"software","techniques":["T1012","T1041","T1057","T1059.003","T1071.001","T1082","T1083","T1090.001","T1104","T1112","T1132.002","T1547.001","T1547.009","T1562.004"]},{"id":"S0245","name":"BADCALL","type":"software","techniques":["T1001.003","T1016","T1082","T1090","T1112","T1562.004","T1571","T1573.001"]},{"id":"S0642","name":"BADFLICK","type":"software","techniques":["T1005","T1016","T1082","T1083","T1105","T1140","T1204.002","T1497.003","T1560.002","T1566.001"]},{"id":"S1081","name":"BADHATCH","type":"software","techniques":["T1018","T1027.009","T1027.010","T1027.015","T1033","T1041","T1046","T1047","T1049","T1053.005","T1055","T1055.001","T1055.004","T1057","T1059.001","T1059.003","T1069.002","T1070.004","T1071.001","T1071.002","T1082","T1090","T1102","T1105","T1106","T1113","T1124","T1134.001","T1135","T1482","T1546.003","T1548.002","T1550.002","T1573.002","T1620"]},{"id":"S0128","name":"BADNEWS","type":"software","techniques":["T1005","T1025","T1036.001","T1036.005","T1039","T1053.005","T1055.012","T1056.001","T1059.003","T1071.001","T1074.001","T1083","T1102.001","T1102.002","T1105","T1106","T1113","T1119","T1120","T1132","T1132.001","T1547.001","T1573.001","T1574.001"]},{"id":"S0470","name":"BBK","type":"software","techniques":["T1027.003","T1055","T1059.003","T1071.001","T1105","T1106","T1140"]},{"id":"S0127","name":"BBSRAT","type":"software","techniques":["T1007","T1055.012","T1057","T1070.004","T1071.001","T1083","T1140","T1543.003","T1546.015","T1547.001","T1560.002","T1569.002","T1573.001","T1574.001"]},{"id":"S1136","name":"BFG Agonizer","type":"software","techniques":["T1490","T1529","T1554","T1561.002"]},{"id":"S0017","name":"BISCUIT","type":"software","techniques":["T1008","T1033","T1056.001","T1057","T1059.003","T1082","T1105","T1113","T1124","T1573.002"]},{"id":"S0190","name":"BITSAdmin","type":"software","techniques":["T1048.003","T1105","T1197","T1570"]},{"id":"S0069","name":"BLACKCOFFEE","type":"software","techniques":["T1057","T1059.003","T1070.004","T1083","T1102.001","T1102.002","T1104"]},{"id":"S0520","name":"BLINDINGCAN","type":"software","techniques":["T1005","T1016","T1027.002","T1027.013","T1036.005","T1041","T1059.003","T1070.004","T1070.006","T1071.001","T1082","T1083","T1105","T1129","T1132.001","T1140","T1204.002","T1218.011","T1553.002","T1566.001","T1573.001","T1680"]},{"id":"S0657","name":"BLUELIGHT","type":"software","techniques":["T1016","T1027.013","T1033","T1041","T1057","T1070.004","T1071.001","T1082","T1083","T1102.002","T1105","T1113","T1124","T1497.001","T1518.001","T1539","T1555.003","T1560","T1560.003"]},{"id":"S1184","name":"BOLDMOVE","type":"software","techniques":["T1016","T1059.004","T1070.004","T1071.001","T1082","T1083","T1090.003","T1190","T1480","T1543","T1554","T1562","T1562.006","T1564.011","T1573.002"]},{"id":"S0360","name":"BONDUPDATER","type":"software","techniques":["T1053.005","T1059.001","T1059.003","T1071.004","T1105","T1564.003","T1568.002"]},{"id":"S1226","name":"BOOKWORM","type":"software","techniques":["T1001.003","T1027","T1027.013","T1033","T1036.004","T1056.001","T1070.006","T1071.001","T1106","T1112","T1115","T1140","T1543.003","T1553.002","T1564.003","T1573.001","T1574.001"]},{"id":"S0415","name":"BOOSTWRITE","type":"software","techniques":["T1027.013","T1129","T1140","T1553.002","T1574.001"]},{"id":"S0114","name":"BOOTRASH","type":"software","techniques":["T1542.003","T1564.005"]},{"id":"S1161","name":"BPFDoor","type":"software","techniques":["T1027","T1036.009","T1036.011","T1059.004","T1070","T1070.004","T1070.006","T1205.002","T1480","T1480.002","T1562.003","T1562.004","T1564.011"]},{"id":"S0043","name":"BUBBLEWRAP","type":"software","techniques":["T1071.001","T1082","T1095"]},{"id":"S1118","name":"BUSHWALK","type":"software","techniques":["T1027","T1105","T1140","T1205","T1505.003","T1554"]},{"id":"S0638","name":"Babuk","type":"software","techniques":["T1007","T1027.002","T1049","T1057","T1059.003","T1083","T1106","T1135","T1140","T1486","T1489","T1490","T1562.001","T1680"]},{"id":"S0414","name":"BabyShark","type":"software","techniques":["T1012","T1016","T1033","T1053.005","T1056.001","T1057","T1059.003","T1059.005","T1070.004","T1082","T1083","T1105","T1132.001","T1140","T1218.005","T1547.001"]},{"id":"S0475","name":"BackConfig","type":"software","techniques":["T1027.010","T1036.005","T1053.005","T1059.003","T1059.005","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1137.001","T1140","T1204.001","T1553.002","T1564.001"]},{"id":"S0093","name":"Backdoor.Oldrea","type":"software","techniques":["T1016","T1018","T1033","T1046","T1055","T1057","T1070.004","T1082","T1083","T1087.003","T1105","T1132.001","T1218.011","T1547.001","T1555.003","T1560"]},{"id":"S0606","name":"Bad Rabbit","type":"software","techniques":["T1003.001","T1036.005","T1053.005","T1057","T1106","T1110.003","T1135","T1189","T1204.002","T1210","T1218.011","T1486","T1495","T1548.002","T1569.002"]},{"id":"S0337","name":"BadPatch","type":"software","techniques":["T1005","T1056.001","T1071.001","T1071.003","T1074.001","T1082","T1083","T1105","T1113","T1497.001","T1518.001","T1547.001"]},{"id":"S0234","name":"Bandook","type":"software","techniques":["T1005","T1016","T1027.003","T1041","T1055.012","T1056.001","T1059","T1059.001","T1059.003","T1059.005","T1059.006","T1070.004","T1083","T1095","T1105","T1106","T1113","T1120","T1123","T1125","T1140","T1204.002","T1553.002","T1566.001","T1573.001","T1680"]},{"id":"S0239","name":"Bankshot","type":"software","techniques":["T1001.003","T1005","T1012","T1041","T1057","T1059.003","T1070","T1070.004","T1070.006","T1071.001","T1082","T1083","T1087.001","T1087.002","T1105","T1106","T1112","T1119","T1132.002","T1134.002","T1140","T1203","T1543.003","T1571","T1680"]},{"id":"S0534","name":"Bazar","type":"software","techniques":["T1005","T1008","T1012","T1016","T1018","T1027.002","T1027.007","T1027.013","T1033","T1036.004","T1036.005","T1036.007","T1047","T1053.005","T1055","T1055.012","T1055.013","T1057","T1059.001","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1083","T1087.001","T1087.002","T1102","T1104","T1105","T1106","T1124","T1135","T1140","T1197","T1204.001","T1482","T1497","T1497.003","T1518","T1518.001","T1547.001","T1547.004","T1547.009","T1553.002","T1562.001","T1566.002","T1568.002","T1573.001","T1573.002","T1614.001"]},{"id":"S1246","name":"BeaverTail","type":"software","techniques":["T1001.001","T1005","T1027.013","T1036","T1041","T1059.007","T1070.004","T1071.001","T1074.001","T1082","T1083","T1105","T1124","T1195.001","T1204.002","T1217","T1555","T1555.001","T1555.003","T1560.001","T1571","T1654","T1657"]},{"id":"S0574","name":"BendyBear","type":"software","techniques":["T1001.001","T1012","T1027.013","T1027.014","T1105","T1106","T1124","T1140","T1497.003","T1571","T1573.001"]},{"id":"S0268","name":"Bisonal","type":"software","techniques":["T1005","T1012","T1016","T1027.001","T1027.002","T1027.013","T1036","T1036.005","T1041","T1057","T1059.003","T1059.005","T1070.004","T1071.001","T1082","T1083","T1090","T1095","T1105","T1106","T1112","T1124","T1132.001","T1137.006","T1140","T1204.002","T1218.011","T1497","T1497.003","T1543.003","T1547.001","T1566.001","T1568","T1573.001"]},{"id":"S0570","name":"BitPaymer","type":"software","techniques":["T1007","T1012","T1018","T1027.013","T1070.006","T1087.001","T1106","T1112","T1134.001","T1135","T1222.001","T1480","T1486","T1490","T1543.003","T1547.001","T1548.002","T1564.004"]},{"id":"S1070","name":"Black Basta","type":"software","techniques":["T1007","T1018","T1027.001","T1036.004","T1036.005","T1047","T1059.001","T1059.003","T1082","T1083","T1106","T1112","T1204.002","T1222.002","T1480.002","T1486","T1490","T1491.001","T1497","T1497.001","T1529","T1543.003","T1553.002","T1562.009","T1622","T1680"]},{"id":"S1181","name":"BlackByte 2.0 Ransomware","type":"software","techniques":["T1055","T1068","T1070.004","T1070.006","T1112","T1135","T1486","T1489","T1490","T1562.004","T1569.002"]},{"id":"S1180","name":"BlackByte Ransomware","type":"software","techniques":["T1012","T1021.002","T1027.013","T1046","T1053.005","T1059.007","T1082","T1106","T1112","T1135","T1140","T1222.001","T1480","T1486","T1490","T1497.001","T1518.001","T1562.001","T1562.010","T1570","T1614.001"]},{"id":"S1068","name":"BlackCat","type":"software","techniques":["T1018","T1033","T1047","T1059.003","T1069.002","T1070.001","T1082","T1083","T1087.002","T1112","T1134","T1135","T1222.001","T1486","T1489","T1490","T1491.001","T1548.002","T1561.001","T1570","T1680"]},{"id":"S0089","name":"BlackEnergy","type":"software","techniques":["T1008","T1016","T1021.002","T1046","T1047","T1049","T1055.001","T1056.001","T1057","T1070","T1070.001","T1071.001","T1082","T1083","T1113","T1120","T1485","T1543.003","T1547.001","T1547.009","T1548.002","T1552.001","T1553.006","T1555.003","T1574.010"]},{"id":"S0564","name":"BlackMould","type":"software","techniques":["T1005","T1059.003","T1071.001","T1083","T1105","T1680"]},{"id":"S0521","name":"BloodHound","type":"software","techniques":["T1018","T1033","T1059.001","T1069.001","T1069.002","T1087.001","T1087.002","T1106","T1482","T1560","T1615"]},{"id":"S0486","name":"Bonadan","type":"software","techniques":["T1016","T1033","T1057","T1059","T1082","T1105","T1496.001","T1554","T1573.001"]},{"id":"S0635","name":"BoomBox","type":"software","techniques":["T1027","T1033","T1036","T1071.001","T1082","T1083","T1087.002","T1087.003","T1102","T1105","T1140","T1204.002","T1218.011","T1480","T1547.001","T1567.002"]},{"id":"S0651","name":"BoxCaon","type":"software","techniques":["T1005","T1016","T1027","T1041","T1059.003","T1074.001","T1083","T1102.002","T1105","T1106","T1547","T1567.002"]},{"id":"S0252","name":"Brave Prince","type":"software","techniques":["T1012","T1016","T1048.003","T1057","T1082","T1083","T1562.001"]},{"id":"S0204","name":"Briba","type":"software","techniques":["T1105","T1218.011","T1543.003","T1547.001"]},{"id":"S1063","name":"Brute Ratel C4","type":"software","techniques":["T1005","T1021","T1021.002","T1021.006","T1027","T1027.007","T1036.005","T1036.008","T1046","T1047","T1055.002","T1057","T1059.003","T1069.002","T1071.001","T1071.004","T1087.002","T1095","T1102","T1105","T1106","T1113","T1140","T1204.002","T1482","T1497.003","T1518.001","T1558.003","T1562.006","T1569.002","T1572","T1574.001","T1620"]},{"id":"S1039","name":"Bumblebee","type":"software","techniques":["T1005","T1008","T1012","T1027","T1033","T1036.005","T1041","T1047","T1053.005","T1055","T1055.001","T1055.004","T1057","T1059.001","T1059.003","T1059.005","T1070.004","T1082","T1102","T1105","T1106","T1129","T1132.001","T1140","T1204.001","T1204.002","T1218.008","T1218.011","T1497","T1497.001","T1497.003","T1518.001","T1548.002","T1559.001","T1560","T1566.001","T1566.002","T1573.001","T1622"]},{"id":"S0482","name":"Bundlore","type":"software","techniques":["T1027","T1036.005","T1048","T1056.002","T1057","T1059.002","T1059.004","T1059.006","T1059.007","T1071.001","T1082","T1098.004","T1105","T1140","T1176.001","T1189","T1204.002","T1222.002","T1518","T1543.001","T1543.004","T1562.001","T1564"]},{"id":"S0025","name":"CALENDAR","type":"software","techniques":["T1059.003","T1102.002"]},{"id":"S1237","name":"CANONSTAGER","type":"software","techniques":["T1027.007","T1036.005","T1055.005","T1106","T1564.003","T1574.001"]},{"id":"S0465","name":"CARROTBALL","type":"software","techniques":["T1027","T1071.002","T1105","T1204.002"]},{"id":"S0462","name":"CARROTBAT","type":"software","techniques":["T1027.010","T1027.013","T1059.003","T1070.004","T1082","T1105"]},{"id":"S1224","name":"CASTLETAP","type":"software","techniques":["T1005","T1040","T1059.004","T1105","T1140","T1205.002","T1573.001","T1573.002"]},{"id":"S0222","name":"CCBkdr","type":"software","techniques":["T1195.002","T1568.002"]},{"id":"S1149","name":"CHIMNEYSWEEP","type":"software","techniques":["T1005","T1027","T1027.001","T1027.007","T1027.009","T1033","T1041","T1053.005","T1056.001","T1057","T1059.001","T1059.005","T1070.006","T1071.001","T1074.001","T1083","T1102","T1105","T1106","T1112","T1113","T1115","T1120","T1132.002","T1140","T1218.003","T1480","T1518.001","T1529","T1548.002","T1553.002"]},{"id":"S0023","name":"CHOPSTICK","type":"software","techniques":["T1008","T1012","T1027.011","T1056.001","T1059","T1071.001","T1071.003","T1083","T1090.001","T1091","T1092","T1105","T1112","T1113","T1497","T1518.001","T1568.002","T1573.001","T1573.002"]},{"id":"S1236","name":"CLAIMLOADER","type":"software","techniques":["T1027.007","T1036.005","T1053.005","T1106","T1140","T1204.002","T1480.002","T1547.001","T1559.001","T1564.001","T1574.001"]},{"id":"S1105","name":"COATHANGER","type":"software","techniques":["T1014","T1027","T1027.002","T1055","T1057","T1059.004","T1070.004","T1071.001","T1083","T1095","T1140","T1190","T1222.002","T1543.004","T1564.001","T1573.002","T1574","T1574.006"]},{"id":"S0212","name":"CORALDECK","type":"software","techniques":["T1048.003","T1083","T1560.001"]},{"id":"S0137","name":"CORESHELL","type":"software","techniques":["T1027","T1027.016","T1071.001","T1071.003","T1082","T1105","T1132.001","T1218.011","T1547.001","T1573.001","T1680"]},{"id":"S0527","name":"CSPY Downloader","type":"software","techniques":["T1027.002","T1036.004","T1053.005","T1070","T1070.004","T1071.001","T1105","T1112","T1204.002","T1497.001","T1548.002","T1553.002"]},{"id":"S0693","name":"CaddyWiper","type":"software","techniques":["T1057","T1082","T1083","T1106","T1222.001","T1485","T1561.002"]},{"id":"S0454","name":"Cadelspy","type":"software","techniques":["T1010","T1056.001","T1082","T1113","T1115","T1120","T1123","T1560"]},{"id":"S0274","name":"Calisto","type":"software","techniques":["T1005","T1016","T1036.005","T1056.002","T1070.004","T1074.001","T1098","T1105","T1136.001","T1217","T1543.001","T1555.001","T1560.001","T1564.001","T1569.001"]},{"id":"S0077","name":"CallMe","type":"software","techniques":["T1041","T1059.004","T1105","T1573.001"]},{"id":"S0351","name":"Cannon","type":"software","techniques":["T1033","T1041","T1057","T1071.003","T1082","T1083","T1105","T1113","T1124","T1547.004","T1680"]},{"id":"S0030","name":"Carbanak","type":"software","techniques":["T1003","T1012","T1021.001","T1027","T1030","T1055.002","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1113","T1114.001","T1132.001","T1136.001","T1219","T1547.001","T1573.001"]},{"id":"S0484","name":"Carberp","type":"software","techniques":["T1012","T1014","T1021.005","T1027.013","T1036.005","T1041","T1055.001","T1055.004","T1056.004","T1057","T1068","T1071.001","T1082","T1105","T1106","T1113","T1185","T1497","T1518.001","T1542.003","T1547.001","T1555","T1555.003","T1562.001","T1564.001"]},{"id":"S0335","name":"Carbon","type":"software","techniques":["T1012","T1016","T1018","T1027","T1048.003","T1049","T1053.005","T1055.001","T1057","T1069","T1071.001","T1074.001","T1095","T1102","T1124","T1140","T1543.003","T1573.002"]},{"id":"S0348","name":"Cardinal RAT","type":"software","techniques":["T1008","T1012","T1027.004","T1027.013","T1033","T1055","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1090","T1105","T1112","T1113","T1140","T1204.002","T1547.001","T1560.002","T1573.001"]},{"id":"S0261","name":"Catchamas","type":"software","techniques":["T1010","T1016","T1036.004","T1056.001","T1074.001","T1112","T1113","T1115","T1543.003"]},{"id":"S0572","name":"Caterpillar WebShell","type":"software","techniques":["T1005","T1007","T1014","T1016","T1033","T1041","T1046","T1057","T1059.003","T1069.001","T1082","T1083","T1105","T1110","T1112"]},{"id":"S0144","name":"ChChes","type":"software","techniques":["T1036.005","T1057","T1071.001","T1082","T1083","T1105","T1132.001","T1547.001","T1553.002","T1555.003","T1562.001","T1573.001"]},{"id":"S0631","name":"Chaes","type":"software","techniques":["T1027.011","T1033","T1036.005","T1048","T1056","T1059.003","T1059.005","T1059.006","T1059.007","T1071.001","T1082","T1105","T1106","T1112","T1113","T1132.001","T1140","T1185","T1204.002","T1218.004","T1218.007","T1221","T1539","T1547.001","T1555.003","T1566.001","T1573","T1574.001"]},{"id":"S0220","name":"Chaos","type":"software","techniques":["T1059.004","T1104","T1110","T1205","T1573.001"]},{"id":"S0674","name":"CharmPower","type":"software","techniques":["T1005","T1008","T1012","T1016","T1016.002","T1041","T1047","T1048.003","T1057","T1059.001","T1059.003","T1070.004","T1071.001","T1082","T1083","T1102","T1102.001","T1105","T1112","T1113","T1132.001","T1140","T1518","T1573.001"]},{"id":"S1096","name":"Cheerscrypt","type":"software","techniques":["T1059.012","T1083","T1486","T1489","T1673"]},{"id":"S0107","name":"Cherry Picker","type":"software","techniques":["T1048.003","T1070.004","T1546.010"]},{"id":"S0020","name":"China Chopper","type":"software","techniques":["T1005","T1027.002","T1046","T1059.003","T1070.006","T1071.001","T1083","T1105","T1110.001","T1505.003"]},{"id":"S1041","name":"Chinoxy","type":"software","techniques":["T1027.013","T1036.005","T1140","T1547.001","T1574.001"]},{"id":"S0667","name":"Chrommme","type":"software","techniques":["T1005","T1016","T1027.013","T1029","T1033","T1041","T1074.001","T1082","T1105","T1106","T1113","T1140","T1560","T1680"]},{"id":"S0660","name":"Clambling","type":"software","techniques":["T1005","T1012","T1016","T1027","T1033","T1055","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1071","T1071.001","T1082","T1083","T1095","T1102.002","T1112","T1113","T1115","T1124","T1125","T1135","T1140","T1204.002","T1497.003","T1543.003","T1547.001","T1548.002","T1564.001","T1566.001","T1567.002","T1569.002","T1574.001"]},{"id":"S0611","name":"Clop","type":"software","techniques":["T1027.002","T1057","T1059.003","T1083","T1106","T1112","T1135","T1140","T1218.007","T1486","T1489","T1490","T1497.003","T1518.001","T1553.002","T1562.001","T1614.001"]},{"id":"S0054","name":"CloudDuke","type":"software","techniques":["T1071.001","T1102.002","T1105"]},{"id":"S0154","name":"Cobalt Strike","type":"software","techniques":["T1001.003","T1003.001","T1003.002","T1005","T1007","T1012","T1016","T1018","T1021.001","T1021.002","T1021.003","T1021.004","T1021.006","T1027","T1027.005","T1029","T1030","T1046","T1047","T1049","T1055","T1055.001","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1068","T1069.001","T1069.002","T1070.006","T1071.001","T1071.002","T1071.004","T1078.002","T1078.003","T1083","T1087.002","T1090.001","T1090.004","T1095","T1105","T1106","T1112","T1113","T1132.001","T1134.001","T1134.003","T1134.004","T1135","T1137.001","T1140","T1185","T1197","T1203","T1218.011","T1518","T1543.003","T1548.002","T1548.003","T1550.002","T1553.002","T1562.001","T1564.010","T1569.002","T1572","T1573.001","T1573.002","T1620"]},{"id":"S0338","name":"Cobian RAT","type":"software","techniques":["T1056.001","T1059.003","T1071.004","T1113","T1123","T1125","T1132.001","T1547.001"]},{"id":"S0369","name":"CoinTicker","type":"software","techniques":["T1027","T1059.003","T1059.004","T1059.006","T1105","T1140","T1543.001","T1553.001","T1564.001"]},{"id":"S0126","name":"ComRAT","type":"software","techniques":["T1012","T1027","T1027.009","T1027.010","T1027.011","T1029","T1036.004","T1053.005","T1055.001","T1059.001","T1059.003","T1071.001","T1071.003","T1102.002","T1106","T1112","T1124","T1140","T1518","T1546.015","T1564.005","T1573.002"]},{"id":"S0244","name":"Comnie","type":"software","techniques":["T1007","T1016","T1018","T1027","T1027.001","T1049","T1057","T1059.003","T1059.005","T1071.001","T1082","T1087.001","T1102.002","T1119","T1218.011","T1518.001","T1547.001","T1547.009","T1573.001"]},{"id":"S0608","name":"Conficker","type":"software","techniques":["T1021.002","T1027","T1046","T1091","T1105","T1112","T1124","T1210","T1490","T1543.003","T1547.001","T1562.001","T1568.002"]},{"id":"S0591","name":"ConnectWise","type":"software","techniques":["T1059.001","T1113","T1125"]},{"id":"S0575","name":"Conti","type":"software","techniques":["T1016","T1018","T1021.002","T1027","T1049","T1055.001","T1057","T1059.003","T1080","T1083","T1106","T1135","T1140","T1486","T1489","T1490"]},{"id":"S0492","name":"CookieMiner","type":"software","techniques":["T1005","T1027.010","T1048.003","T1059.004","T1059.006","T1083","T1105","T1140","T1496.001","T1518.001","T1539","T1543.001","T1555.003","T1562.004"]},{"id":"S1235","name":"CorKLOG","type":"software","techniques":["T1027.013","T1053.005","T1056.001","T1074.001","T1140","T1543.003","T1553.002","T1574.001"]},{"id":"S0050","name":"CosmicDuke","type":"software","techniques":["T1003.002","T1003.004","T1005","T1020","T1025","T1039","T1048.003","T1053.005","T1056.001","T1068","T1071.001","T1083","T1113","T1114.001","T1115","T1543.003","T1555","T1555.003","T1573.001"]},{"id":"S0614","name":"CostaBricks","type":"software","techniques":["T1027.001","T1027.002","T1055","T1105","T1106","T1140"]},{"id":"S1155","name":"Covenant","type":"software","techniques":["T1047","T1059.001","T1059.003","T1071.001","T1082","T1218.004","T1218.005","T1218.010","T1571","T1573.002"]},{"id":"S0046","name":"CozyCar","type":"software","techniques":["T1003.001","T1003.002","T1027.013","T1036.003","T1053.005","T1059.003","T1071.001","T1082","T1102.002","T1218.011","T1497","T1518.001","T1543.003","T1547.001"]},{"id":"S0488","name":"CrackMapExec","type":"software","techniques":["T1003.002","T1003.003","T1003.004","T1016","T1018","T1047","T1049","T1053.002","T1059.001","T1069.002","T1083","T1087.002","T1110","T1110.001","T1110.003","T1112","T1135","T1201","T1550.002","T1680"]},{"id":"S1023","name":"CreepyDrive","type":"software","techniques":["T1005","T1059.001","T1071.001","T1083","T1102.002","T1105","T1550.001","T1567.002"]},{"id":"S1024","name":"CreepySnail","type":"software","techniques":["T1016","T1033","T1041","T1059.001","T1071.001","T1078.002","T1132.001"]},{"id":"S0115","name":"Crimson","type":"software","techniques":["T1005","T1012","T1016","T1025","T1033","T1041","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1091","T1095","T1105","T1112","T1113","T1114.001","T1120","T1123","T1124","T1125","T1140","T1497.003","T1518.001","T1547.001","T1555.003","T1614","T1680"]},{"id":"S0235","name":"CrossRAT","type":"software","techniques":["T1083","T1113","T1543.001","T1547.001","T1547.013"]},{"id":"S0538","name":"Crutch","type":"software","techniques":["T1005","T1008","T1020","T1025","T1036.004","T1041","T1053.005","T1071.001","T1074.001","T1102.002","T1119","T1120","T1560.001","T1567.002","T1574.001"]},{"id":"S0498","name":"Cryptoistic","type":"software","techniques":["T1005","T1033","T1070.004","T1083","T1095","T1105","T1573"]},{"id":"S0625","name":"Cuba","type":"software","techniques":["T1007","T1016","T1027","T1027.002","T1036.005","T1049","T1056.001","T1057","T1059.001","T1059.003","T1070.004","T1083","T1105","T1106","T1134","T1135","T1486","T1489","T1543.003","T1564.003","T1614.001","T1620","T1680"]},{"id":"S1153","name":"Cuckoo Stealer","type":"software","techniques":["T1027.008","T1027.013","T1033","T1036.005","T1041","T1056.002","T1057","T1059.002","T1059.004","T1071.001","T1074.001","T1082","T1083","T1095","T1113","T1140","T1217","T1518","T1543.001","T1553.001","T1555.001","T1564.001","T1569.001","T1614","T1614.001","T1647"]},{"id":"S0687","name":"Cyclops Blink","type":"software","techniques":["T1005","T1016","T1036.005","T1037.004","T1041","T1057","T1070.006","T1071.001","T1082","T1083","T1090.003","T1105","T1106","T1132.002","T1140","T1542.002","T1559","T1562.004","T1571","T1572","T1573.002"]},{"id":"S1033","name":"DCSrv","type":"software","techniques":["T1027.013","T1036.004","T1106","T1112","T1124","T1486","T1529","T1543.003"]},{"id":"S0255","name":"DDKONG","type":"software","techniques":["T1083","T1105","T1140","T1218.011"]},{"id":"S1052","name":"DEADEYE","type":"software","techniques":["T1016","T1027.009","T1027.013","T1036.004","T1059.003","T1082","T1106","T1140","T1218.007","T1218.011","T1480","T1564.004"]},{"id":"S1134","name":"DEADWOOD","type":"software","techniques":["T1027.009","T1027.013","T1036.004","T1124","T1140","T1485","T1531","T1561.001","T1561.002","T1569.002"]},{"id":"S0616","name":"DEATHRANSOM","type":"software","techniques":["T1047","T1071.001","T1083","T1105","T1135","T1486","T1490","T1614.001","T1680"]},{"id":"S0213","name":"DOGCALL","type":"software","techniques":["T1027.013","T1056.001","T1102.002","T1105","T1113","T1123"]},{"id":"S0694","name":"DRATzarus","type":"software","techniques":["T1005","T1018","T1027","T1027.002","T1033","T1036.005","T1057","T1071.001","T1105","T1106","T1124","T1497.003","T1622"]},{"id":"S1158","name":"DUSTPAN","type":"software","techniques":["T1027.009","T1027.013","T1036.005","T1055.002","T1140","T1543.003"]},{"id":"S1159","name":"DUSTTRAP","type":"software","techniques":["T1005","T1010","T1012","T1016","T1018","T1027.009","T1027.013","T1041","T1055","T1056.001","T1057","T1059.003","T1070","T1070.001","T1070.005","T1082","T1083","T1087.001","T1087.002","T1105","T1113","T1124","T1135","T1140","T1482","T1497.001","T1518.001","T1615","T1654"]},{"id":"S0497","name":"Dacls","type":"software","techniques":["T1027.013","T1036","T1057","T1071.001","T1083","T1105","T1543.001","T1543.004","T1564.001"]},{"id":"S1014","name":"DanBot","type":"software","techniques":["T1005","T1021.005","T1027.013","T1036.005","T1053.005","T1059.003","T1059.005","T1070.004","T1071.001","T1071.004","T1105","T1140","T1204.002","T1566.001"]},{"id":"S0334","name":"DarkComet","type":"software","techniques":["T1021.001","T1027.002","T1033","T1036.005","T1056.001","T1057","T1059","T1059.003","T1071.001","T1082","T1105","T1112","T1115","T1123","T1125","T1547.001","T1562.001","T1562.004"]},{"id":"S1111","name":"DarkGate","type":"software","techniques":["T1001","T1005","T1010","T1027","T1027.013","T1036","T1036.003","T1036.007","T1041","T1047","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1059.010","T1070.004","T1071.004","T1082","T1083","T1098.007","T1105","T1106","T1115","T1119","T1124","T1134.004","T1136.001","T1140","T1204.002","T1480","T1486","T1490","T1496.001","T1497.001","T1518.001","T1529","T1539","T1547.001","T1548.002","T1552","T1555","T1561.001","T1562.001","T1564.001","T1566.001","T1566.002","T1569.002","T1574","T1574.001","T1574.007","T1583.001","T1614","T1622","T1657","T1665","T1680"]},{"id":"S1066","name":"DarkTortilla","type":"software","techniques":["T1007","T1016.001","T1027","T1036","T1047","T1055.001","T1056.001","T1057","T1059.003","T1071.001","T1082","T1102","T1105","T1106","T1112","T1115","T1140","T1204.002","T1497.001","T1497.003","T1518.001","T1547.001","T1547.004","T1559.001","T1564","T1566.001","T1574.012","T1622"]},{"id":"S0673","name":"DarkWatchman","type":"software","techniques":["T1005","T1010","T1012","T1027.004","T1027.010","T1027.011","T1027.015","T1033","T1036","T1047","T1053.005","T1056.001","T1059.001","T1059.003","T1059.007","T1070","T1070.004","T1071.001","T1074.001","T1082","T1083","T1112","T1120","T1124","T1129","T1132.001","T1140","T1217","T1490","T1518.001","T1566.001","T1568.002","T1573.002","T1614"]},{"id":"S0187","name":"Daserf","type":"software","techniques":["T1001.002","T1003.001","T1027","T1027.002","T1027.005","T1036.005","T1056.001","T1059.003","T1071.001","T1105","T1113","T1132.001","T1553.002","T1560","T1560.001","T1573.001"]},{"id":"S0243","name":"DealersChoice","type":"software","techniques":["T1059.003","T1071.001","T1203"]},{"id":"S0354","name":"Denis","type":"software","techniques":["T1012","T1016","T1027","T1027.010","T1033","T1055.012","T1059.001","T1059.003","T1070.004","T1071.004","T1082","T1083","T1105","T1106","T1132.001","T1140","T1497.001","T1560.002","T1574","T1574.001"]},{"id":"S0021","name":"Derusbi","type":"software","techniques":["T1008","T1012","T1033","T1055.001","T1056.001","T1057","T1059.004","T1070.004","T1070.006","T1082","T1083","T1095","T1113","T1123","T1125","T1218.010","T1571","T1573.001"]},{"id":"S0659","name":"Diavol","type":"software","techniques":["T1016","T1018","T1021.002","T1027","T1027.003","T1033","T1057","T1071.001","T1082","T1083","T1105","T1106","T1135","T1485","T1486","T1489","T1490","T1491.001","T1562.001"]},{"id":"S0200","name":"Dipsind","type":"software","techniques":["T1029","T1059.003","T1071.001","T1105","T1132.001","T1547.004","T1573.001"]},{"id":"S1088","name":"Disco","type":"software","techniques":["T1053.005","T1071.002","T1105","T1204.002","T1659"]},{"id":"S1021","name":"DnsSystem","type":"software","techniques":["T1005","T1033","T1041","T1059.003","T1071.004","T1105","T1132.001","T1204.002","T1547.001"]},{"id":"S0281","name":"Dok","type":"software","techniques":["T1027.002","T1048.003","T1056.002","T1059.002","T1090.003","T1222.002","T1543.001","T1547.015","T1548.003","T1553.004","T1557"]},{"id":"S0600","name":"Doki","type":"software","techniques":["T1020","T1036.005","T1041","T1057","T1059.004","T1071.001","T1083","T1102","T1105","T1133","T1568.002","T1573.002","T1610","T1611"]},{"id":"S0695","name":"Donut","type":"software","techniques":["T1027.002","T1027.013","T1027.015","T1055","T1057","T1059","T1059.001","T1059.005","T1059.006","T1059.007","T1070","T1071.001","T1105","T1106","T1562.001","T1620"]},{"id":"S0186","name":"DownPaper","type":"software","techniques":["T1012","T1033","T1059.001","T1059.003","T1071.001","T1082","T1547.001"]},{"id":"S0134","name":"Downdelph","type":"software","techniques":["T1001.001","T1105","T1548.002","T1573.001","T1574.001"]},{"id":"S0384","name":"Dridex","type":"software","techniques":["T1027","T1053.005","T1071.001","T1082","T1090","T1090.003","T1106","T1185","T1204.002","T1218.010","T1219","T1518","T1573.001","T1573.002","T1574.001"]},{"id":"S0547","name":"DropBook","type":"software","techniques":["T1059.003","T1059.006","T1082","T1083","T1102","T1105","T1140","T1567","T1614.001"]},{"id":"S0502","name":"Drovorub","type":"software","techniques":["T1005","T1014","T1027","T1041","T1059.004","T1070.004","T1071.001","T1090.001","T1095","T1105","T1140","T1547.006"]},{"id":"S0567","name":"Dtrack","type":"software","techniques":["T1005","T1012","T1016","T1027.009","T1036.005","T1049","T1055.012","T1056.001","T1057","T1059.003","T1070.004","T1074.001","T1078","T1082","T1083","T1105","T1129","T1140","T1217","T1543.003","T1547","T1560","T1574"]},{"id":"S0038","name":"Duqu","type":"software","techniques":["T1001.002","T1010","T1016","T1021.002","T1049","T1053.005","T1055.001","T1055.012","T1056.001","T1057","T1071","T1074.001","T1078","T1087.001","T1090.001","T1134","T1218.007","T1543.003","T1560.003","T1572","T1573.001"]},{"id":"S0062","name":"DustySky","type":"software","techniques":["T1008","T1027","T1041","T1047","T1056.001","T1057","T1070.004","T1071.001","T1074.001","T1082","T1083","T1091","T1113","T1120","T1518","T1518.001","T1547.001","T1560.001","T1570"]},{"id":"S0024","name":"Dyre","type":"software","techniques":["T1007","T1016","T1027.002","T1033","T1041","T1053.005","T1055","T1055.001","T1071.001","T1074.001","T1082","T1105","T1140","T1497.001","T1518","T1543.003"]},{"id":"S0593","name":"ECCENTRICBANDWAGON","type":"software","techniques":["T1027","T1056.001","T1059.003","T1070.004","T1074.001","T1113"]},{"id":"S0605","name":"EKANS","type":"software","techniques":["T1016","T1027","T1036.005","T1047","T1057","T1486","T1489","T1490","T1562.001"]},{"id":"S0064","name":"ELMER","type":"software","techniques":["T1057","T1071.001","T1083"]},{"id":"S0568","name":"EVILNUM","type":"software","techniques":["T1033","T1041","T1047","T1070","T1070.006","T1082","T1102.003","T1105","T1112","T1218.010","T1218.011","T1518.001","T1539","T1547.001"]},{"id":"S0377","name":"Ebury","type":"software","techniques":["T1008","T1014","T1020","T1027","T1041","T1059.004","T1059.006","T1071.004","T1129","T1132.001","T1140","T1552.004","T1553.002","T1554","T1556","T1556.003","T1562.001","T1562.006","T1562.012","T1568.002","T1573.001","T1574.006"]},{"id":"S0624","name":"Ecipekac","type":"software","techniques":["T1027","T1105","T1140","T1553.002","T1574.001"]},{"id":"S0554","name":"Egregor","type":"software","techniques":["T1027.002","T1033","T1036.004","T1039","T1049","T1055","T1059.001","T1059.003","T1069.002","T1071.001","T1082","T1105","T1106","T1124","T1140","T1197","T1218.010","T1218.011","T1219","T1484.001","T1486","T1497","T1497.003","T1562.001","T1574.001"]},{"id":"S0081","name":"Elise","type":"software","techniques":["T1007","T1016","T1027.013","T1036.005","T1055.001","T1057","T1070.004","T1070.006","T1071.001","T1074.001","T1082","T1083","T1087.001","T1105","T1132.001","T1218.011","T1543.003","T1547.001","T1573.001"]},{"id":"S1247","name":"Embargo","type":"software","techniques":["T1007","T1027.013","T1053.005","T1057","T1059.003","T1068","T1070.004","T1083","T1106","T1112","T1135","T1140","T1480.002","T1486","T1489","T1490","T1543.003","T1547.001","T1562.009","T1569.002","T1657","T1679"]},{"id":"S0082","name":"Emissary","type":"software","techniques":["T1007","T1016","T1027.001","T1027.013","T1055.001","T1059.003","T1069.001","T1071.001","T1082","T1105","T1218.011","T1543.003","T1547.001","T1573.001","T1615"]},{"id":"S0367","name":"Emotet","type":"software","techniques":["T1003.001","T1016.002","T1021.002","T1027.001","T1027.002","T1027.009","T1027.010","T1027.013","T1033","T1036.004","T1040","T1041","T1047","T1053.005","T1055.001","T1055.012","T1057","T1059.001","T1059.003","T1059.005","T1071.001","T1078.003","T1087.003","T1105","T1106","T1110.001","T1114","T1114.001","T1132.001","T1134.001","T1135","T1140","T1204.001","T1204.002","T1210","T1218.010","T1543.003","T1547.001","T1552.001","T1555.003","T1566.001","T1566.002","T1570","T1571","T1573","T1573.001","T1620"]},{"id":"S0363","name":"Empire","type":"software","techniques":["T1003.001","T1016","T1020","T1021.003","T1021.004","T1027.010","T1033","T1040","T1041","T1046","T1047","T1049","T1053.005","T1055","T1056.001","T1056.004","T1057","T1059","T1059.001","T1059.003","T1068","T1070.006","T1071.001","T1082","T1083","T1087.001","T1087.002","T1102.002","T1105","T1106","T1113","T1114.001","T1115","T1119","T1125","T1127.001","T1134","T1134.002","T1134.005","T1135","T1136.001","T1136.002","T1210","T1217","T1482","T1484.001","T1518.001","T1543.003","T1546.008","T1547.001","T1547.005","T1547.009","T1548.002","T1550.002","T1552.001","T1552.004","T1555.001","T1555.003","T1557.001","T1558.001","T1558.002","T1558.003","T1560","T1567.001","T1567.002","T1569.002","T1573.002","T1574.001","T1574.004","T1574.007","T1574.008","T1574.009","T1615"]},{"id":"S0634","name":"EnvyScout","type":"software","techniques":["T1005","T1027.006","T1027.013","T1036","T1059.003","T1059.007","T1082","T1140","T1187","T1204.002","T1218.011","T1480","T1564.001","T1566.001"]},{"id":"S0091","name":"Epic","type":"software","techniques":["T1007","T1012","T1016","T1018","T1027","T1033","T1049","T1055.011","T1057","T1069.001","T1070.004","T1071.001","T1082","T1083","T1087.001","T1124","T1518.001","T1553.002","T1560","T1560.002","T1573.001","T1680"]},{"id":"S0396","name":"EvilBunny","type":"software","techniques":["T1047","T1053.005","T1057","T1059.003","T1059.011","T1070.004","T1071.001","T1105","T1106","T1124","T1203","T1497.001","T1497.003","T1518.001","T1547.001"]},{"id":"S0152","name":"EvilGrab","type":"software","techniques":["T1056.001","T1113","T1123","T1125","T1547.001"]},{"id":"S0401","name":"Exaramel for Linux","type":"software","techniques":["T1008","T1027.013","T1033","T1053.003","T1059.004","T1070.004","T1071.001","T1105","T1140","T1543","T1543.002","T1548.001"]},{"id":"S0343","name":"Exaramel for Windows","type":"software","techniques":["T1027.011","T1036.004","T1059.003","T1059.005","T1074.001","T1112","T1543.003","T1560"]},{"id":"S1179","name":"Exbyte","type":"software","techniques":["T1069.001","T1070.004","T1083","T1106","T1140","T1480","T1497.001","T1518.001","T1567"]},{"id":"S0361","name":"Expand","type":"software","techniques":["T1140","T1564.004","T1570"]},{"id":"S0569","name":"Explosive","type":"software","techniques":["T1016","T1025","T1033","T1056.001","T1071.001","T1082","T1105","T1106","T1112","T1115","T1564.001","T1573.001"]},{"id":"S0181","name":"FALLCHILL","type":"software","techniques":["T1001.003","T1016","T1070.004","T1070.006","T1082","T1083","T1543.003","T1573.001","T1680"]},{"id":"S0267","name":"FELIXROOT","type":"software","techniques":["T1012","T1016","T1027.013","T1033","T1047","T1057","T1059.003","T1070.004","T1071.001","T1082","T1105","T1112","T1124","T1218.011","T1518.001","T1547.001","T1547.009","T1560","T1680"]},{"id":"S0618","name":"FIVEHANDS","type":"software","techniques":["T1027.013","T1047","T1059","T1083","T1135","T1140","T1486","T1490"]},{"id":"S0036","name":"FLASHFLOOD","type":"software","techniques":["T1005","T1025","T1074.001","T1083","T1547.001","T1560.003"]},{"id":"S1120","name":"FRAMESTING","type":"software","techniques":["T1001","T1001.003","T1059.006","T1071.001","T1140","T1505.003","T1554"]},{"id":"S1144","name":"FRP","type":"software","techniques":["T1046","T1049","T1059.007","T1071.001","T1090","T1090.003","T1095","T1572","T1573.001","T1573.002"]},{"id":"S0628","name":"FYAnti","type":"software","techniques":["T1027.002","T1083","T1105","T1140"]},{"id":"S0076","name":"FakeM","type":"software","techniques":["T1001.003","T1056.001","T1095","T1573.001"]},{"id":"S0512","name":"FatDuke","type":"software","techniques":["T1005","T1008","T1012","T1016","T1027","T1027.002","T1027.016","T1036.012","T1057","T1059.001","T1070.004","T1071.001","T1082","T1083","T1090.001","T1106","T1140","T1218.011","T1497.003","T1547.001","T1573.001"]},{"id":"S0171","name":"Felismus","type":"software","techniques":["T1016","T1033","T1036.005","T1059.003","T1071.001","T1082","T1105","T1132.001","T1518.001","T1573.001"]},{"id":"S0679","name":"Ferocious","type":"software","techniques":["T1059.001","T1059.005","T1070.004","T1082","T1112","T1120","T1497.001","T1518.001","T1546.015"]},{"id":"S0182","name":"FinFisher","type":"software","techniques":["T1012","T1027","T1027.002","T1027.016","T1036.005","T1055.001","T1056.004","T1057","T1070.001","T1082","T1083","T1113","T1134.001","T1140","T1497.001","T1518.001","T1542.003","T1543.003","T1547.001","T1548.002","T1574.001","T1574.013"]},{"id":"S0355","name":"Final1stspy","type":"software","techniques":["T1027","T1057","T1071.001","T1082","T1140","T1547.001"]},{"id":"S0696","name":"Flagpro","type":"software","techniques":["T1005","T1010","T1016","T1018","T1027","T1029","T1033","T1036","T1041","T1049","T1057","T1059.003","T1059.005","T1069.001","T1070","T1071.001","T1105","T1106","T1132.001","T1135","T1204.002","T1547.001","T1566.001","T1614.001"]},{"id":"S0143","name":"Flame","type":"software","techniques":["T1011.001","T1036.010","T1091","T1113","T1123","T1136.001","T1210","T1218.011","T1518.001","T1547.002"]},{"id":"S0381","name":"FlawedAmmyy","type":"software","techniques":["T1001","T1005","T1033","T1041","T1047","T1056","T1056.001","T1059.001","T1059.003","T1069.001","T1070.004","T1071.001","T1082","T1105","T1113","T1115","T1120","T1218.007","T1218.011","T1518.001","T1547.001","T1573.001"]},{"id":"S0661","name":"FoggyWeb","type":"software","techniques":["T1005","T1027.004","T1027.013","T1036","T1036.005","T1040","T1041","T1057","T1071.001","T1083","T1105","T1106","T1129","T1140","T1550","T1552.004","T1560.002","T1560.003","T1573.001","T1574.001","T1620"]},{"id":"S0193","name":"Forfiles","type":"software","techniques":["T1005","T1083","T1202"]},{"id":"S0503","name":"FrameworkPOS","type":"software","techniques":["T1005","T1048","T1057","T1074.001","T1560.003"]},{"id":"S0277","name":"FruitFly","type":"software","techniques":["T1027.010","T1057","T1070.004","T1083","T1113","T1543.001","T1564.001"]},{"id":"S1044","name":"FunnyDream","type":"software","techniques":["T1001","T1005","T1010","T1012","T1016","T1018","T1025","T1027.013","T1033","T1036.004","T1041","T1047","T1055.001","T1056.001","T1057","T1059.003","T1070","T1070.004","T1074.001","T1083","T1090","T1095","T1105","T1106","T1113","T1119","T1120","T1124","T1218.011","T1518.001","T1543.003","T1547.001","T1559.001","T1560.002","T1560.003","T1572","T1680"]},{"id":"S0410","name":"Fysbis","type":"software","techniques":["T1027.013","T1036.004","T1036.005","T1056.001","T1057","T1059.004","T1070.004","T1082","T1083","T1132.001","T1543.002","T1547.013"]},{"id":"S1117","name":"GLASSTOKEN","type":"software","techniques":["T1059.001","T1132.001","T1140","T1505.003"]},{"id":"S0026","name":"GLOOXMAIL","type":"software","techniques":["T1071.005","T1102.002"]},{"id":"S0417","name":"GRIFFON","type":"software","techniques":["T1053.005","T1059.001","T1059.007","T1069.002","T1082","T1113","T1124","T1547.001"]},{"id":"S0168","name":"Gazer","type":"software","techniques":["T1027.013","T1033","T1053.005","T1055","T1055.003","T1070.004","T1070.006","T1071.001","T1105","T1480.002","T1546.002","T1547.001","T1547.004","T1547.009","T1553.002","T1564.004","T1573.001","T1573.002"]},{"id":"S0666","name":"Gelsemium","type":"software","techniques":["T1005","T1008","T1012","T1027.011","T1027.015","T1027.016","T1033","T1036.001","T1036.005","T1055.001","T1057","T1059.003","T1070.004","T1070.006","T1071.001","T1071.004","T1082","T1083","T1095","T1105","T1106","T1112","T1134","T1140","T1497","T1518.001","T1543.003","T1547.001","T1547.012","T1548.002","T1559.001","T1568","T1620"]},{"id":"S0049","name":"GeminiDuke","type":"software","techniques":["T1007","T1016","T1057","T1071.001","T1083","T1087.001"]},{"id":"S0460","name":"Get2","type":"software","techniques":["T1033","T1055.001","T1057","T1059","T1071.001","T1082"]},{"id":"S1197","name":"GoBear","type":"software","techniques":["T1036.005","T1090","T1553.002"]},{"id":"S0249","name":"Gold Dragon","type":"software","techniques":["T1012","T1033","T1057","T1059.003","T1070.004","T1071.001","T1074.001","T1082","T1083","T1105","T1518.001","T1547.001","T1560","T1562.001"]},{"id":"S0597","name":"GoldFinder","type":"software","techniques":["T1016.001","T1071.001","T1119"]},{"id":"S0588","name":"GoldMax","type":"software","techniques":["T1001.001","T1016","T1027.002","T1027.013","T1036.004","T1036.005","T1041","T1053.003","T1053.005","T1059.003","T1071.001","T1105","T1124","T1140","T1497.001","T1497.003","T1564.011","T1573.002"]},{"id":"S0493","name":"GoldenSpy","type":"software","techniques":["T1027.013","T1036.005","T1041","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1136.001","T1195.002","T1497.003","T1543.003","T1571"]},{"id":"S1198","name":"Gomir","type":"software","techniques":["T1016","T1018","T1053.003","T1059.004","T1069.001","T1070.004","T1071.001","T1082","T1083","T1090.001","T1132.001","T1543.002","T1573","T1573.002"]},{"id":"S0477","name":"Goopy","type":"software","techniques":["T1005","T1027.001","T1027.016","T1033","T1036.005","T1041","T1053.005","T1057","T1059.003","T1059.005","T1070.008","T1071.001","T1071.003","T1071.004","T1106","T1140","T1562.001","T1574.001"]},{"id":"S1138","name":"Gootloader","type":"software","techniques":["T1016","T1027","T1055.002","T1055.012","T1059.001","T1059.007","T1069.002","T1082","T1105","T1132.001","T1140","T1204.001","T1497.003","T1547.001","T1584.001","T1584.006","T1614","T1614.001"]},{"id":"S0531","name":"Grandoreiro","type":"software","techniques":["T1010","T1016","T1027.001","T1027.011","T1027.013","T1033","T1036.005","T1041","T1056.001","T1057","T1059.005","T1070.004","T1071.001","T1082","T1087.003","T1102.001","T1102.002","T1105","T1106","T1112","T1115","T1124","T1140","T1176.001","T1185","T1189","T1204.001","T1204.002","T1218.007","T1222.001","T1497.001","T1518.001","T1539","T1547.001","T1547.009","T1548.002","T1555.003","T1562.001","T1562.004","T1562.013","T1566.002","T1568.002","T1573.002"]},{"id":"S0237","name":"GravityRAT","type":"software","techniques":["T1005","T1007","T1016","T1025","T1027.005","T1027.013","T1033","T1047","T1049","T1053.005","T1057","T1059.003","T1071.001","T1082","T1083","T1124","T1497.001","T1559.002","T1571"]},{"id":"S0690","name":"Green Lambert","type":"software","techniques":["T1005","T1016","T1027","T1036.004","T1036.005","T1037.004","T1059.004","T1070.004","T1071.004","T1082","T1090","T1124","T1140","T1543.001","T1543.004","T1546.004","T1547.015","T1555.001"]},{"id":"S0342","name":"GreyEnergy","type":"software","techniques":["T1003.001","T1007","T1027.002","T1027.013","T1055.002","T1056.001","T1059.003","T1070.004","T1071.001","T1090.003","T1105","T1112","T1218.011","T1543.003","T1553.002","T1573.001","T1573.002"]},{"id":"S0632","name":"GrimAgent","type":"software","techniques":["T1001.001","T1005","T1016","T1027","T1027.001","T1033","T1041","T1053.005","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1083","T1105","T1106","T1132.001","T1140","T1480.002","T1497.003","T1547.001","T1573.001","T1573.002","T1614","T1614.001"]},{"id":"S0561","name":"GuLoader","type":"software","techniques":["T1055","T1070.004","T1071.001","T1102","T1105","T1106","T1204.001","T1204.002","T1497.001","T1497.003","T1547.001","T1566.002"]},{"id":"S0132","name":"H1N1","type":"software","techniques":["T1027","T1027.002","T1059.003","T1080","T1091","T1105","T1132","T1490","T1548.002","T1555.003","T1562.001","T1562.004","T1573.001"]},{"id":"S0151","name":"HALFBAKED","type":"software","techniques":["T1047","T1057","T1059.001","T1070.004","T1082","T1113"]},{"id":"S0037","name":"HAMMERTOSS","type":"software","techniques":["T1001.002","T1059.001","T1071.001","T1102.003","T1564.003","T1567.002","T1573.001"]},{"id":"S0214","name":"HAPPYWORK","type":"software","techniques":["T1033","T1082","T1105"]},{"id":"S0246","name":"HARDRAIN","type":"software","techniques":["T1001.003","T1059.003","T1090","T1562.004","T1571"]},{"id":"S0391","name":"HAWKBALL","type":"software","techniques":["T1027.013","T1033","T1041","T1059.003","T1070.004","T1071.001","T1082","T1106","T1203","T1559.002","T1560.003"]},{"id":"S0061","name":"HDoor","type":"software","techniques":["T1046","T1562.001"]},{"id":"S0617","name":"HELLOKITTY","type":"software","techniques":["T1047","T1057","T1135","T1486","T1490","T1680"]},{"id":"S0135","name":"HIDEDRV","type":"software","techniques":["T1014","T1055.001"]},{"id":"S1230","name":"HIUPAN","type":"software","techniques":["T1057","T1091","T1112","T1120","T1204.002","T1547.001","T1564.001","T1574.001","T1678"]},{"id":"S0232","name":"HOMEFRY","type":"software","techniques":["T1003","T1027.013","T1059.003"]},{"id":"S0376","name":"HOPLIGHT","type":"software","techniques":["T1003.002","T1008","T1012","T1041","T1047","T1055","T1059.003","T1082","T1083","T1090","T1105","T1112","T1124","T1132.001","T1546.003","T1550.002","T1562.004","T1569.002","T1571","T1652","T1680"]},{"id":"S0040","name":"HTRAN","type":"software","techniques":["T1014","T1055","T1090"]},{"id":"S0070","name":"HTTPBrowser","type":"software","techniques":["T1027","T1036.005","T1056.001","T1059.003","T1070.004","T1071.001","T1071.004","T1083","T1105","T1547.001","T1574.001"]},{"id":"S1097","name":"HUI Loader","type":"software","techniques":["T1140","T1562.006","T1574.001"]},{"id":"S0047","name":"Hacking Team UEFI Rootkit","type":"software","techniques":["T1014","T1542.001"]},{"id":"S0499","name":"Hancitor","type":"software","techniques":["T1027","T1027.015","T1059.001","T1070.004","T1105","T1106","T1140","T1204.001","T1204.002","T1218.012","T1497","T1547.001","T1566.001","T1566.002"]},{"id":"S1211","name":"Hannotog","type":"software","techniques":["T1020","T1059.003","T1105","T1489","T1543.003","T1562.004","T1571"]},{"id":"S1229","name":"Havoc","type":"software","techniques":["T1005","T1016","T1016.001","T1018","T1033","T1055.001","T1055.002","T1057","T1059.001","T1059.003","T1071.001","T1071.002","T1082","T1083","T1087","T1090","T1105","T1106","T1113","T1134.001","T1204.004","T1497.003","T1559","T1566.002","T1570","T1573.001"]},{"id":"S0170","name":"Helminth","type":"software","techniques":["T1027.013","T1030","T1053.005","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1069.001","T1069.002","T1071.001","T1071.004","T1074.001","T1105","T1115","T1119","T1132.001","T1547.001","T1547.009","T1553.002","T1573.001"]},{"id":"S0697","name":"HermeticWiper","type":"software","techniques":["T1027.015","T1036.005","T1053.005","T1059.003","T1070","T1070.001","T1070.004","T1082","T1083","T1106","T1112","T1134","T1140","T1484.001","T1485","T1489","T1490","T1497.003","T1529","T1543.003","T1553.002","T1561.001","T1561.002","T1562.006","T1569.002","T1680"]},{"id":"S0698","name":"HermeticWizard","type":"software","techniques":["T1018","T1021.002","T1027.013","T1036.005","T1046","T1047","T1059.003","T1070.001","T1106","T1110.001","T1218.010","T1218.011","T1553.002","T1559.001","T1569.002","T1570"]},{"id":"S1249","name":"HexEval Loader","type":"software","techniques":["T1016","T1027.013","T1033","T1036.005","T1041","T1056.001","T1059.007","T1071.001","T1082","T1105","T1140","T1614"]},{"id":"S1027","name":"Heyoka Backdoor","type":"software","techniques":["T1007","T1027.013","T1036.004","T1055.001","T1057","T1070.004","T1071.004","T1083","T1120","T1140","T1204.002","T1218.011","T1547.001","T1572","T1680"]},{"id":"S0087","name":"Hi-Zor","type":"software","techniques":["T1027.013","T1059.003","T1070.004","T1071.001","T1105","T1218.010","T1547.001","T1573.001","T1573.002"]},{"id":"S0394","name":"HiddenWasp","type":"software","techniques":["T1014","T1027.013","T1037.004","T1059.003","T1095","T1105","T1136.001","T1140","T1573.001","T1574.006"]},{"id":"S0009","name":"Hikit","type":"software","techniques":["T1005","T1014","T1059.003","T1071.001","T1090.001","T1105","T1553.004","T1553.006","T1566","T1573.001","T1574.001"]},{"id":"S0601","name":"Hildegard","type":"software","techniques":["T1014","T1027.002","T1027.013","T1036.004","T1046","T1059.004","T1068","T1070.003","T1070.004","T1071","T1082","T1102","T1105","T1133","T1136.001","T1140","T1219","T1496.001","T1543.002","T1552.001","T1552.004","T1552.005","T1562.001","T1574.006","T1609","T1611","T1613"]},{"id":"S0431","name":"HotCroissant","type":"software","techniques":["T1007","T1010","T1016","T1027.002","T1027.013","T1033","T1041","T1053.005","T1057","T1059.003","T1070.004","T1082","T1083","T1105","T1106","T1113","T1489","T1518","T1564.003","T1573.001"]},{"id":"S0203","name":"Hydraq","type":"software","techniques":["T1005","T1007","T1012","T1016","T1027","T1048","T1057","T1070.001","T1070.004","T1082","T1083","T1105","T1112","T1113","T1129","T1134","T1543.003","T1569.002","T1573.001"]},{"id":"S0398","name":"HyperBro","type":"software","techniques":["T1007","T1027.002","T1027.013","T1055","T1070.004","T1071.001","T1105","T1106","T1113","T1140","T1569.002","T1574.001"]},{"id":"S0537","name":"HyperStack","type":"software","techniques":["T1078.001","T1087.001","T1106","T1112","T1559","T1573.001"]},{"id":"S1152","name":"IMAPLoader","type":"software","techniques":["T1047","T1053.005","T1071.003","T1082","T1105","T1106","T1543","T1564.003","T1574.014"]},{"id":"S1139","name":"INC Ransomware","type":"software","techniques":["T1047","T1057","T1083","T1106","T1120","T1135","T1140","T1486","T1489","T1490","T1491.001","T1566","T1570","T1652","T1680"]},{"id":"S1132","name":"IPsec Helper","type":"software","techniques":["T1005","T1027.013","T1041","T1057","T1059.001","T1059.003","T1059.005","T1070","T1070.004","T1070.009","T1071.001","T1112","T1497.003","T1569.002","T1570"]},{"id":"S0189","name":"ISMInjector","type":"software","techniques":["T1027","T1053.005","T1055.012","T1140"]},{"id":"S1022","name":"IceApple","type":"software","techniques":["T1003.002","T1003.004","T1005","T1016","T1027.010","T1036.005","T1041","T1056.003","T1070.004","T1071.001","T1082","T1083","T1087.002","T1140","T1505.004","T1552.002","T1560.001","T1573.001","T1620"]},{"id":"S0483","name":"IcedID","type":"software","techniques":["T1016","T1027.002","T1027.003","T1027.009","T1027.013","T1036.005","T1047","T1048.002","T1053.005","T1055.004","T1055.012","T1059.005","T1069","T1071.001","T1082","T1087.002","T1105","T1106","T1135","T1185","T1189","T1204.002","T1218.007","T1218.011","T1482","T1497","T1518.001","T1547.001","T1566.001","T1573.002","T1614.001"]},{"id":"S0434","name":"Imminent Monitor","type":"software","techniques":["T1021.001","T1027","T1041","T1056.001","T1057","T1059","T1070.004","T1083","T1106","T1123","T1125","T1140","T1496.001","T1555.003","T1562.001","T1564.001"]},{"id":"S0357","name":"Impacket","type":"software","techniques":["T1003.001","T1003.002","T1003.003","T1003.004","T1040","T1047","T1557.001","T1558.003","T1558.005","T1569.002","T1570"]},{"id":"S0604","name":"Industroyer","type":"software","techniques":["T1012","T1016","T1018","T1027","T1041","T1046","T1071.001","T1078","T1082","T1083","T1090.003","T1105","T1140","T1485","T1489","T1499.004","T1543.003","T1554","T1572"]},{"id":"S0259","name":"InnaputRAT","type":"software","techniques":["T1027","T1036.004","T1036.005","T1059.003","T1070.004","T1082","T1083","T1106","T1543.003","T1547.001","T1680"]},{"id":"S0260","name":"InvisiMole","type":"software","techniques":["T1001.003","T1005","T1007","T1008","T1010","T1012","T1016","T1025","T1027","T1027.005","T1033","T1036.004","T1036.005","T1046","T1053.005","T1055","T1055.002","T1055.004","T1055.015","T1056.001","T1057","T1059.003","T1059.007","T1068","T1070.004","T1070.005","T1070.006","T1071.001","T1071.004","T1074.001","T1080","T1082","T1083","T1087.001","T1090.001","T1090.002","T1095","T1105","T1106","T1112","T1113","T1119","T1123","T1124","T1125","T1132.002","T1135","T1140","T1203","T1204.002","T1210","T1218.002","T1218.011","T1480.001","T1490","T1497.001","T1518","T1518.001","T1543.003","T1547.001","T1547.009","T1548.002","T1559.001","T1560.001","T1560.002","T1560.003","T1562.004","T1564.001","T1564.003","T1569.002","T1573.001","T1574.001","T1680"]},{"id":"S1245","name":"InvisibleFerret","type":"software","techniques":["T1005","T1016","T1027.013","T1033","T1041","T1048.003","T1056","T1056.001","T1057","T1059.001","T1059.006","T1071.001","T1074.001","T1082","T1083","T1087.001","T1095","T1105","T1115","T1140","T1219","T1489","T1518","T1543.001","T1547.001","T1547.013","T1555.003","T1555.005","T1560.001","T1564.003","T1567","T1571","T1614","T1657","T1679"]},{"id":"S0231","name":"Invoke-PSImage","type":"software","techniques":["T1027.003","T1027.009"]},{"id":"S0581","name":"IronNetInjector","type":"software","techniques":["T1027.013","T1036.004","T1053.005","T1055","T1055.001","T1057","T1059.006","T1140"]},{"id":"S0015","name":"Ixeshe","type":"software","techniques":["T1005","T1007","T1016","T1033","T1036.005","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1132.001","T1547.001","T1564.001"]},{"id":"S1203","name":"J-magic","type":"software","techniques":["T1016","T1036.005","T1040","T1059.004","T1070.003","T1095","T1205","T1573.002"]},{"id":"S0389","name":"JCry","type":"software","techniques":["T1059.001","T1059.003","T1059.005","T1204.002","T1486","T1490","T1547.001"]},{"id":"S0044","name":"JHUHUGIT","type":"software","techniques":["T1008","T1016","T1027.013","T1037.001","T1053.005","T1055","T1057","T1059.003","T1068","T1070.004","T1071.001","T1105","T1113","T1115","T1132.001","T1218.011","T1543.003","T1546.015","T1547.001","T1680"]},{"id":"S0201","name":"JPIN","type":"software","techniques":["T1007","T1012","T1016","T1027","T1033","T1055","T1056.001","T1057","T1059.003","T1069.001","T1070.004","T1071.002","T1071.003","T1082","T1083","T1105","T1197","T1222.001","T1518.001","T1562.001"]},{"id":"S0648","name":"JSS Loader","type":"software","techniques":["T1053.005","T1059.001","T1059.005","T1059.007","T1105","T1204.002","T1566.001"]},{"id":"S0163","name":"Janicab","type":"software","techniques":["T1053.003","T1113","T1123","T1553.002"]},{"id":"S0528","name":"Javali","type":"software","techniques":["T1027.001","T1057","T1059.005","T1102.001","T1105","T1204.001","T1204.002","T1218.007","T1555.003","T1566.001","T1566.002","T1574.001"]},{"id":"S1206","name":"JumbledPath","type":"software","techniques":["T1040","T1070.002","T1104","T1560","T1562","T1665"]},{"id":"S0215","name":"KARAE","type":"software","techniques":["T1082","T1102.002","T1105","T1189"]},{"id":"S0271","name":"KEYMARBLE","type":"software","techniques":["T1016","T1057","T1059.003","T1070.004","T1082","T1083","T1105","T1112","T1113","T1573.001","T1680"]},{"id":"S1051","name":"KEYPLUG","type":"software","techniques":["T1027.013","T1071.001","T1090","T1095","T1102.001","T1124","T1140","T1573.002"]},{"id":"S0526","name":"KGH_SPY","type":"software","techniques":["T1005","T1027.013","T1036.005","T1037.001","T1041","T1056.001","T1059.001","T1059.003","T1071.001","T1074.001","T1083","T1105","T1114.001","T1140","T1204.002","T1518","T1555","T1555.003","T1555.004","T1680"]},{"id":"S0669","name":"KOCTOPUS","type":"software","techniques":["T1027.010","T1036.005","T1059.001","T1059.003","T1059.005","T1070.009","T1082","T1090","T1105","T1106","T1112","T1140","T1204.001","T1204.002","T1547.001","T1548.002","T1562.001","T1564.003","T1566.001","T1566.002"]},{"id":"S0156","name":"KOMPROGO","type":"software","techniques":["T1047","T1059.003","T1082"]},{"id":"S0356","name":"KONNI","type":"software","techniques":["T1005","T1016","T1027.002","T1027.013","T1033","T1036.004","T1036.005","T1041","T1048.003","T1049","T1056.001","T1057","T1059.001","T1059.003","T1059.007","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1112","T1113","T1115","T1132.001","T1134.002","T1134.004","T1140","T1204.002","T1218.011","T1543.003","T1546.015","T1547.001","T1547.009","T1548.002","T1555.003","T1560","T1566.001","T1573.001","T1680"]},{"id":"S1075","name":"KOPILUWAK","type":"software","techniques":["T1005","T1016","T1033","T1041","T1049","T1057","T1059.007","T1071.001","T1074.001","T1135","T1204.002","T1566.001","T1680"]},{"id":"S1190","name":"Kapeka","type":"software","techniques":["T1012","T1027.013","T1036.008","T1053.005","T1059.003","T1070.009","T1071.001","T1082","T1090","T1106","T1112","T1132.001","T1140","T1218.011"]},{"id":"S0088","name":"Kasidet","type":"software","techniques":["T1056.001","T1057","T1059.003","T1082","T1083","T1105","T1113","T1518.001","T1547.001","T1562.004"]},{"id":"S0265","name":"Kazuar","type":"software","techniques":["T1005","T1008","T1010","T1016","T1027","T1029","T1033","T1047","T1055.001","T1057","T1059.003","T1059.004","T1069.001","T1070.004","T1071.001","T1071.002","T1074.001","T1082","T1083","T1087.001","T1090.001","T1102.002","T1105","T1113","T1125","T1132.001","T1485","T1543.003","T1547.001","T1547.009","T1680"]},{"id":"S0585","name":"Kerrdown","type":"software","techniques":["T1027.013","T1027.015","T1059.005","T1082","T1105","T1140","T1204.001","T1204.002","T1566.001","T1566.002","T1574.001"]},{"id":"S0487","name":"Kessel","type":"software","techniques":["T1016","T1027.013","T1030","T1041","T1048.003","T1059","T1082","T1090","T1105","T1132.001","T1140","T1554","T1556","T1560"]},{"id":"S1020","name":"Kevin","type":"software","techniques":["T1001.001","T1005","T1008","T1016","T1027.013","T1030","T1036.003","T1041","T1059.003","T1070.004","T1071.001","T1071.004","T1074","T1082","T1105","T1106","T1132.001","T1497","T1546.003","T1564.003","T1572"]},{"id":"S0387","name":"KeyBoy","type":"software","techniques":["T1001.003","T1016","T1027.013","T1056.001","T1059.001","T1059.003","T1059.005","T1059.006","T1070.006","T1082","T1083","T1105","T1113","T1543.003","T1547.004","T1555.003","T1559.002","T1564.003"]},{"id":"S0276","name":"Keydnap","type":"software","techniques":["T1036.006","T1056.002","T1059.006","T1071.001","T1090.003","T1543.001","T1548.001","T1555.002","T1564.009"]},{"id":"S0607","name":"KillDisk","type":"software","techniques":["T1027","T1036.004","T1057","T1070.001","T1070.004","T1083","T1106","T1129","T1134","T1485","T1486","T1489","T1529","T1561.002","T1680"]},{"id":"S0599","name":"Kinsing","type":"software","techniques":["T1018","T1021.004","T1053.003","T1057","T1059.004","T1071.001","T1078","T1083","T1105","T1110","T1133","T1222.002","T1496.001","T1552.003","T1552.004","T1609","T1610"]},{"id":"S0437","name":"Kivars","type":"software","techniques":["T1021","T1056.001","T1070.004","T1083","T1105","T1113","T1564.003"]},{"id":"S0250","name":"Koadic","type":"software","techniques":["T1003.002","T1003.003","T1005","T1016","T1021.001","T1033","T1046","T1047","T1053.005","T1055.001","T1059.001","T1059.003","T1059.005","T1071.001","T1082","T1083","T1105","T1115","T1135","T1218.005","T1218.010","T1218.011","T1547.001","T1548.002","T1564.003","T1569.002","T1573.002"]},{"id":"S0641","name":"Kobalos","type":"software","techniques":["T1016","T1027","T1048","T1056","T1059.004","T1070.003","T1070.006","T1074","T1082","T1090.003","T1140","T1205","T1554","T1573.001","T1573.002"]},{"id":"S0162","name":"Komplex","type":"software","techniques":["T1033","T1057","T1070.004","T1071.001","T1543.001","T1564.001","T1573.001"]},{"id":"S0236","name":"Kwampirs","type":"software","techniques":["T1007","T1008","T1016","T1018","T1021.002","T1027.001","T1027.013","T1033","T1036.004","T1049","T1057","T1069.001","T1069.002","T1082","T1083","T1087.001","T1105","T1135","T1140","T1201","T1218.011","T1543.003"]},{"id":"S1119","name":"LIGHTWIRE","type":"software","techniques":["T1071.001","T1140","T1505.003","T1554","T1573.001"]},{"id":"S1121","name":"LITTLELAMB.WOOLTEA","type":"software","techniques":["T1082","T1083","T1090","T1095","T1543","T1554","T1573.002"]},{"id":"S0042","name":"LOWBALL","type":"software","techniques":["T1071.001","T1102.002","T1105"]},{"id":"S0349","name":"LaZagne","type":"software","techniques":["T1003.001","T1003.004","T1003.005","T1003.007","T1003.008","T1552.001","T1555","T1555.001","T1555.003","T1555.004"]},{"id":"S1160","name":"Latrodectus","type":"software","techniques":["T1005","T1016","T1021.005","T1027.001","T1027.002","T1027.007","T1027.013","T1033","T1036.005","T1041","T1047","T1053.005","T1057","T1059.003","T1059.007","T1069.002","T1070.004","T1071.001","T1082","T1083","T1087.002","T1102","T1104","T1105","T1106","T1132.001","T1135","T1140","T1204.001","T1204.002","T1218.007","T1218.011","T1482","T1497.001","T1518.001","T1529","T1547.001","T1559.001","T1564.004","T1566.001","T1566.002","T1573.001","T1622"]},{"id":"S0395","name":"LightNeuron","type":"software","techniques":["T1001.002","T1005","T1016","T1020","T1027.013","T1029","T1036.005","T1041","T1059.003","T1070.004","T1071.003","T1074.001","T1082","T1105","T1106","T1114.002","T1119","T1140","T1505.002","T1560","T1565.002","T1573.001"]},{"id":"S1185","name":"LightSpy","type":"software","techniques":["T1027.001","T1027.013","T1041","T1046","T1057","T1071.001","T1082","T1083","T1105","T1113","T1123","T1129","T1217","T1480","T1518","T1555.001"]},{"id":"S1186","name":"Line Dancer","type":"software","techniques":["T1014","T1040","T1041","T1059.008","T1071.001","T1082","T1140","T1562.003","T1653"]},{"id":"S1188","name":"Line Runner","type":"software","techniques":["T1027.015","T1041","T1059.011","T1070.004","T1071.001","T1505.003","T1557","T1653"]},{"id":"S0211","name":"Linfo","type":"software","techniques":["T1005","T1008","T1029","T1057","T1059.003","T1070.004","T1082","T1083","T1105"]},{"id":"S0362","name":"Linux Rabbit","type":"software","techniques":["T1033","T1078","T1110.003","T1132","T1133","T1546.004"]},{"id":"S0513","name":"LiteDuke","type":"software","techniques":["T1012","T1016","T1027.002","T1027.003","T1033","T1070.004","T1071.001","T1082","T1105","T1140","T1497.003","T1518.001","T1547.001"]},{"id":"S0680","name":"LitePower","type":"software","techniques":["T1012","T1033","T1041","T1053.005","T1059.001","T1071.001","T1082","T1105","T1106","T1113","T1518.001","T1680"]},{"id":"S0681","name":"Lizar","type":"software","techniques":["T1003.001","T1016","T1027","T1033","T1049","T1055","T1055.001","T1055.002","T1057","T1059.001","T1059.003","T1059.006","T1082","T1087.003","T1095","T1105","T1106","T1113","T1132.002","T1140","T1217","T1518.001","T1555.003","T1555.004","T1560","T1573","T1588.002","T1620"]},{"id":"S1101","name":"LoFiSe","type":"software","techniques":["T1005","T1074.001","T1083","T1119","T1560","T1574.001"]},{"id":"S0397","name":"LoJax","type":"software","techniques":["T1014","T1112","T1542.001","T1547.001","T1564.004"]},{"id":"S1199","name":"LockBit 2.0","type":"software","techniques":["T1021.002","T1047","T1053.005","T1057","T1059.001","T1059.003","T1070.001","T1070.004","T1082","T1083","T1112","T1120","T1135","T1136","T1140","T1480","T1484.001","T1486","T1489","T1490","T1547.001","T1548.002","T1562.001","T1564.003","T1614.001","T1680"]},{"id":"S1202","name":"LockBit 3.0","type":"software","techniques":["T1021.002","T1027.002","T1027.013","T1057","T1059.001","T1070.001","T1070.004","T1071.001","T1078.003","T1082","T1083","T1106","T1112","T1120","T1132.001","T1135","T1140","T1218.003","T1480","T1480.002","T1484.001","T1486","T1489","T1490","T1543.003","T1547.004","T1548.002","T1562.001","T1562.009","T1569.002","T1573.001","T1614.001","T1622","T1680"]},{"id":"S0372","name":"LockerGoga","type":"software","techniques":["T1070.004","T1486","T1529","T1531","T1553.002","T1562.001","T1570"]},{"id":"S0447","name":"Lokibot","type":"software","techniques":["T1016","T1027","T1027.002","T1033","T1041","T1053","T1053.005","T1055.012","T1056.001","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1112","T1140","T1204.002","T1497.003","T1548.002","T1555","T1555.003","T1564.001","T1566.001","T1620"]},{"id":"S0582","name":"LookBack","type":"software","techniques":["T1007","T1036.005","T1057","T1059.003","T1059.005","T1070.004","T1071.001","T1083","T1095","T1113","T1140","T1489","T1529","T1547.001","T1573.001","T1574.001"]},{"id":"S0451","name":"LoudMiner","type":"software","techniques":["T1016","T1027.010","T1027.013","T1057","T1059.003","T1059.004","T1070.004","T1082","T1105","T1189","T1218.007","T1496.001","T1543.003","T1543.004","T1564.001","T1564.006","T1569.001","T1569.002"]},{"id":"S0532","name":"Lucifer","type":"software","techniques":["T1012","T1016","T1021.002","T1027.002","T1033","T1046","T1047","T1049","T1053.005","T1057","T1059.003","T1070.001","T1071","T1082","T1105","T1110.001","T1140","T1210","T1496.001","T1497.001","T1498","T1547.001","T1570","T1573.001"]},{"id":"S1213","name":"Lumma Stealer","type":"software","techniques":["T1027","T1027.013","T1036.008","T1041","T1055.012","T1059.001","T1059.006","T1059.010","T1071.001","T1074.001","T1082","T1113","T1119","T1140","T1176.001","T1195","T1204","T1204.002","T1217","T1218.005","T1218.015","T1497.001","T1518.001","T1539","T1547.001","T1553.002","T1555.003","T1562.001","T1564.003","T1566.001","T1566.002","T1573.002","T1574.001","T1620","T1622"]},{"id":"S1143","name":"LunarLoader","type":"software","techniques":["T1016","T1137.006","T1140","T1480","T1620"]},{"id":"S1142","name":"LunarMail","type":"software","techniques":["T1001.002","T1027.013","T1041","T1059.005","T1070.004","T1070.008","T1071.003","T1074.001","T1082","T1083","T1095","T1113","T1114.001","T1137.006","T1140","T1204.002","T1543"]},{"id":"S1141","name":"LunarWeb","type":"software","techniques":["T1001.002","T1016","T1027.013","T1030","T1033","T1047","T1049","T1057","T1059.001","T1059.003","T1069.001","T1070.004","T1071.001","T1082","T1083","T1090","T1104","T1132.001","T1135","T1140","T1497.003","T1518","T1518.001","T1559","T1560.001","T1560.002","T1572","T1573.001","T1573.002","T1615"]},{"id":"S0010","name":"Lurid","type":"software","techniques":["T1560","T1573.001"]},{"id":"S0500","name":"MCMD","type":"software","techniques":["T1005","T1027","T1036.005","T1053.005","T1059.003","T1070.009","T1071.001","T1105","T1547.001","T1564.003"]},{"id":"S1220","name":"MEDUSA","type":"software","techniques":["T1014","T1027.013","T1563.001","T1574.006"]},{"id":"S0443","name":"MESSAGETAP","type":"software","techniques":["T1040","T1049","T1070.004","T1074.001","T1083","T1119","T1140","T1560.003"]},{"id":"S1221","name":"MOPSLED","type":"software","techniques":["T1027.013","T1071.001","T1095","T1102","T1102.001","T1140"]},{"id":"S0233","name":"MURKYTOP","type":"software","techniques":["T1018","T1046","T1053.002","T1059.003","T1069","T1070.004","T1082","T1087.001","T1135"]},{"id":"S1016","name":"MacMa","type":"software","techniques":["T1005","T1016","T1021","T1033","T1041","T1056.001","T1057","T1059.004","T1070.002","T1070.004","T1070.006","T1074.001","T1082","T1083","T1095","T1105","T1106","T1113","T1123","T1140","T1543.001","T1553.001","T1553.002","T1555.001","T1571","T1573","T1680"]},{"id":"S0282","name":"MacSpy","type":"software","techniques":["T1056.001","T1070.004","T1071.001","T1090.003","T1113","T1115","T1123","T1543.001","T1564.001"]},{"id":"S0409","name":"Machete","type":"software","techniques":["T1005","T1008","T1010","T1016","T1016.002","T1020","T1025","T1027.002","T1027.010","T1029","T1036.004","T1036.005","T1041","T1052.001","T1053.005","T1056.001","T1057","T1059.006","T1070.004","T1071.001","T1071.002","T1074.001","T1082","T1083","T1105","T1113","T1115","T1120","T1123","T1125","T1132.001","T1140","T1217","T1547.001","T1552.004","T1555.003","T1560","T1560.003","T1564.001","T1573.001","T1573.002"]},{"id":"S1060","name":"Mafalda","type":"software","techniques":["T1003.001","T1005","T1012","T1016","T1027.013","T1033","T1041","T1049","T1056","T1057","T1059.001","T1059.003","T1070.001","T1071.001","T1074.001","T1082","T1083","T1090.001","T1095","T1105","T1106","T1112","T1113","T1132.001","T1133","T1134","T1134.003","T1140","T1205.001","T1217","T1518.001","T1552.004","T1569.002","T1573.001","T1622","T1680"]},{"id":"S1182","name":"MagicRAT","type":"software","techniques":["T1016","T1027.013","T1036.005","T1036.008","T1041","T1053.005","T1059.003","T1070.004","T1071.001","T1082","T1105","T1140","T1547.001"]},{"id":"S0413","name":"MailSniper","type":"software","techniques":["T1087.003","T1110.003","T1114.002"]},{"id":"S1169","name":"Mango","type":"software","techniques":["T1027.013","T1033","T1041","T1053.005","T1071.001","T1082","T1083","T1106","T1132.001","T1204.002","T1562.001","T1573.001","T1573.002"]},{"id":"S1156","name":"Manjusaka","type":"software","techniques":["T1016","T1041","T1059.003","T1071.001","T1082","T1083","T1113","T1132.001","T1555","T1555.003"]},{"id":"S0652","name":"MarkiRAT","type":"software","techniques":["T1005","T1033","T1036.005","T1041","T1056.001","T1057","T1059.003","T1071.001","T1074.001","T1082","T1083","T1105","T1106","T1113","T1115","T1197","T1518","T1518.001","T1547.001","T1547.009","T1555.005","T1614.001"]},{"id":"S0167","name":"Matryoshka","type":"software","techniques":["T1027","T1053.005","T1055.001","T1056.001","T1059","T1071.004","T1113","T1218.011","T1547.001","T1555"]},{"id":"S0449","name":"Maze","type":"software","techniques":["T1027","T1027.016","T1036.004","T1047","T1049","T1053.005","T1055.001","T1057","T1059.003","T1070","T1071.001","T1082","T1106","T1218.007","T1486","T1489","T1490","T1529","T1547.001","T1562.001","T1564.006","T1568","T1614.001"]},{"id":"S0459","name":"MechaFlounder","type":"software","techniques":["T1033","T1036.005","T1041","T1059.003","T1059.006","T1071.001","T1105","T1132.001"]},{"id":"S1244","name":"Medusa Ransomware","type":"software","techniques":["T1007","T1027.013","T1057","T1059.001","T1059.003","T1070.004","T1082","T1083","T1106","T1124","T1135","T1140","T1486","T1489","T1490","T1518.001","T1543.003","T1559","T1562.001","T1564.003","T1679","T1680"]},{"id":"S0576","name":"MegaCortex","type":"software","techniques":["T1055.001","T1059.003","T1083","T1106","T1112","T1134","T1140","T1218.011","T1486","T1489","T1490","T1497.001","T1531","T1561.001","T1562.001","T1588.003"]},{"id":"S1191","name":"Megazord","type":"software","techniques":["T1057","T1059.003","T1083","T1486","T1489","T1654"]},{"id":"S0530","name":"Melcoz","type":"software","techniques":["T1027.002","T1059.005","T1059.010","T1105","T1115","T1185","T1204.001","T1218.007","T1555.003","T1565.002","T1566.002","T1574.001"]},{"id":"S0455","name":"Metamorfo","type":"software","techniques":["T1010","T1027.002","T1027.013","T1033","T1036.005","T1041","T1055.001","T1056.001","T1056.002","T1057","T1059.003","T1059.005","T1059.007","T1070","T1070.004","T1071.001","T1082","T1083","T1095","T1102.001","T1102.003","T1105","T1106","T1112","T1113","T1115","T1119","T1124","T1129","T1140","T1204.002","T1218.005","T1218.007","T1497","T1518","T1518.001","T1547.001","T1553.002","T1562.001","T1564.003","T1565.002","T1566.001","T1571","T1573.001","T1573.002","T1574.001"]},{"id":"S0688","name":"Meteor","type":"software","techniques":["T1036.004","T1047","T1053.005","T1057","T1059.001","T1059.003","T1070.001","T1070.004","T1082","T1105","T1106","T1484.001","T1485","T1489","T1490","T1491.001","T1518.001","T1531","T1562.001","T1564.003"]},{"id":"S1146","name":"MgBot","type":"software","techniques":["T1003","T1005","T1018","T1025","T1033","T1046","T1056.001","T1057","T1087.001","T1087.002","T1115","T1123","T1213.006","T1482","T1539","T1555","T1555.003"]},{"id":"S0339","name":"Micropsia","type":"software","techniques":["T1027.013","T1033","T1047","T1056.001","T1059.003","T1071.001","T1082","T1083","T1105","T1113","T1119","T1123","T1518.001","T1547.009","T1560.001","T1564.001"]},{"id":"S1015","name":"Milan","type":"software","techniques":["T1005","T1012","T1016","T1027.013","T1033","T1036","T1036.007","T1053.005","T1059.003","T1070.004","T1071.001","T1071.004","T1074.001","T1082","T1087.001","T1105","T1106","T1559.001","T1568.002","T1572"]},{"id":"S0002","name":"Mimikatz","type":"software","techniques":["T1003.001","T1003.002","T1003.004","T1003.006","T1098","T1134.005","T1207","T1547.005","T1550.002","T1550.003","T1552.004","T1555","T1555.003","T1555.004","T1558.001","T1558.002","T1649"]},{"id":"S0051","name":"MiniDuke","type":"software","techniques":["T1008","T1027","T1071.001","T1082","T1083","T1090.001","T1102.001","T1105","T1568.002"]},{"id":"S0280","name":"MirageFox","type":"software","techniques":["T1033","T1059.003","T1082","T1140","T1574.001"]},{"id":"S0084","name":"Mis-Type","type":"software","techniques":["T1005","T1008","T1016","T1033","T1036.005","T1041","T1055","T1059.003","T1071.001","T1074.001","T1082","T1087.001","T1095","T1105","T1106","T1132.001","T1136.001","T1547"]},{"id":"S0083","name":"Misdat","type":"software","techniques":["T1005","T1027.002","T1036.005","T1041","T1059.003","T1070.004","T1070.006","T1070.009","T1082","T1083","T1095","T1105","T1106","T1132.001","T1547","T1614.001"]},{"id":"S1122","name":"Mispadu","type":"software","techniques":["T1027.013","T1041","T1055","T1056.001","T1056.002","T1057","T1059.005","T1082","T1083","T1106","T1113","T1115","T1140","T1176.001","T1204.002","T1217","T1218.007","T1218.011","T1497.001","T1518.001","T1547.001","T1555","T1555.003","T1566.002","T1573.002","T1614.001"]},{"id":"S0080","name":"Mivast","type":"software","techniques":["T1003.002","T1059.003","T1105","T1547.001"]},{"id":"S0079","name":"MobileOrder","type":"software","techniques":["T1005","T1041","T1057","T1082","T1083","T1105","T1217"]},{"id":"S0553","name":"MoleNet","type":"software","techniques":["T1047","T1059.001","T1059.003","T1082","T1105","T1518.001","T1547.001"]},{"id":"S1137","name":"Moneybird","type":"software","techniques":["T1027.009","T1486"]},{"id":"S1026","name":"Mongall","type":"software","techniques":["T1005","T1027.002","T1041","T1055.001","T1071.001","T1082","T1105","T1120","T1132.001","T1140","T1204.002","T1218.011","T1547.001","T1573.001","T1680"]},{"id":"S0149","name":"MoonWind","type":"software","techniques":["T1016","T1033","T1056.001","T1057","T1059.003","T1070.004","T1074.001","T1082","T1083","T1095","T1120","T1124","T1543.003","T1571","T1573.001"]},{"id":"S0284","name":"More_eggs","type":"software","techniques":["T1016","T1016.001","T1027.013","T1033","T1059.003","T1070.004","T1071.001","T1082","T1105","T1132.001","T1140","T1218.010","T1518.001","T1553.002","T1573.001"]},{"id":"S1047","name":"Mori","type":"software","techniques":["T1001.001","T1012","T1070.004","T1071.001","T1071.004","T1112","T1132.001","T1140","T1218.010"]},{"id":"S0256","name":"Mosquito","type":"software","techniques":["T1016","T1027.011","T1027.013","T1033","T1047","T1057","T1059.001","T1059.003","T1070.004","T1105","T1106","T1112","T1218.011","T1518.001","T1546.015","T1547.001","T1573.001"]},{"id":"S1135","name":"MultiLayer Wiper","type":"software","techniques":["T1027.009","T1053.005","T1059.003","T1070","T1070.001","T1070.004","T1070.006","T1083","T1485","T1490","T1529","T1561.002","T1562.001","T1565.001"]},{"id":"S0699","name":"Mythic","type":"software","techniques":["T1008","T1030","T1071.001","T1071.002","T1071.004","T1090.001","T1090.002","T1090.004","T1095","T1119","T1132","T1572","T1573.002"]},{"id":"S0590","name":"NBTscan","type":"software","techniques":["T1016","T1018","T1033","T1040","T1046"]},{"id":"S0272","name":"NDiskMonitor","type":"software","techniques":["T1033","T1082","T1083","T1105","T1573.001"]},{"id":"S0034","name":"NETEAGLE","type":"software","techniques":["T1008","T1041","T1057","T1059.003","T1071","T1071.001","T1083","T1095","T1547.001","T1568","T1573.001"]},{"id":"S0198","name":"NETWIRE","type":"software","techniques":["T1010","T1016","T1027","T1027.002","T1027.011","T1036.001","T1036.005","T1049","T1053.003","T1053.005","T1055","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1059.004","T1059.005","T1071.001","T1074.001","T1082","T1083","T1090","T1095","T1102","T1105","T1106","T1112","T1113","T1119","T1204.001","T1204.002","T1543.001","T1547.001","T1547.013","T1547.015","T1555","T1555.003","T1560","T1560.003","T1564.001","T1566.001","T1566.002","T1573","T1573.001"]},{"id":"S1106","name":"NGLite","type":"software","techniques":["T1016","T1033","T1071.001","T1090.003","T1573.001"]},{"id":"S1192","name":"NICECURL","type":"software","techniques":["T1059","T1070.004","T1071.001","T1105","T1573.002"]},{"id":"S1107","name":"NKAbuse","type":"software","techniques":["T1016.001","T1053.003","T1057","T1059.004","T1082","T1090.003","T1113","T1498"]},{"id":"S0353","name":"NOKKI","type":"software","techniques":["T1016","T1027","T1033","T1036.005","T1056.004","T1070.004","T1071.001","T1071.002","T1074.001","T1082","T1105","T1124","T1140","T1218.011","T1547.001","T1680"]},{"id":"S1131","name":"NPPSPY","type":"software","techniques":["T1005","T1056","T1112","T1119","T1552","T1557","T1656"]},{"id":"S0205","name":"Naid","type":"software","techniques":["T1016","T1082","T1112","T1543.003"]},{"id":"S0228","name":"NanHaiShu","type":"software","techniques":["T1016","T1027.013","T1033","T1059.005","T1059.007","T1070.004","T1071.004","T1082","T1105","T1218.005","T1547.001","T1562.001"]},{"id":"S0336","name":"NanoCore","type":"software","techniques":["T1016","T1027","T1056.001","T1059.003","T1059.005","T1105","T1112","T1123","T1125","T1547.001","T1562.001","T1562.004","T1573.001"]},{"id":"S0637","name":"NativeZone","type":"software","techniques":["T1036","T1140","T1204.002","T1218.011","T1480","T1497.001"]},{"id":"S0247","name":"NavRAT","type":"software","techniques":["T1055","T1056.001","T1057","T1059.003","T1071.003","T1074.001","T1082","T1105","T1547.001"]},{"id":"S0630","name":"Nebulae","type":"software","techniques":["T1005","T1036.004","T1036.005","T1057","T1059.003","T1070.004","T1083","T1095","T1105","T1106","T1543.003","T1547.001","T1573.001","T1574.001","T1680"]},{"id":"S1189","name":"Neo-reGeorg","type":"software","techniques":["T1059.006","T1071.001","T1090","T1095","T1105","T1132.002","T1505.003","T1572"]},{"id":"S0691","name":"Neoichor","type":"software","techniques":["T1005","T1016","T1016.001","T1033","T1070","T1071.001","T1082","T1105","T1112","T1559.001","T1614.001"]},{"id":"S0210","name":"Nerex","type":"software","techniques":["T1105","T1112","T1543.003","T1553.002"]},{"id":"S0039","name":"Net","type":"software","techniques":["T1007","T1018","T1021.002","T1049","T1069.001","T1069.002","T1070.005","T1087.001","T1087.002","T1098.007","T1124","T1135","T1136.001","T1136.002","T1201","T1569.002"]},{"id":"S0056","name":"Net Crawler","type":"software","techniques":["T1003.001","T1021.002","T1110.002","T1569.002"]},{"id":"S0033","name":"NetTraveler","type":"software","techniques":["T1010","T1056.001"]},{"id":"S0457","name":"Netwalker","type":"software","techniques":["T1027.009","T1027.010","T1047","T1055.001","T1059.001","T1059.003","T1082","T1105","T1106","T1112","T1140","T1486","T1489","T1490","T1518.001","T1562.001","T1569.002","T1570"]},{"id":"S0118","name":"Nidiran","type":"software","techniques":["T1036.004","T1105","T1543.003"]},{"id":"S1090","name":"NightClub","type":"software","techniques":["T1005","T1010","T1027","T1036.004","T1036.005","T1041","T1056.001","T1057","T1070.006","T1071.003","T1071.004","T1074.001","T1083","T1105","T1106","T1112","T1113","T1120","T1123","T1132.002","T1543.003"]},{"id":"S1147","name":"Nightdoor","type":"software","techniques":["T1016","T1033","T1053.005","T1057","T1059.003","T1070.004","T1071","T1082","T1102","T1124","T1140","T1497.001","T1574","T1680"]},{"id":"S1100","name":"Ninja","type":"software","techniques":["T1001","T1001.003","T1016","T1027.013","T1027.015","T1029","T1036.005","T1055","T1057","T1070.006","T1071.001","T1082","T1083","T1090.001","T1090.003","T1095","T1106","T1132.002","T1140","T1204.002","T1218.011","T1480.001","T1543.003","T1559","T1566.003","T1573.001","T1574.001","T1680"]},{"id":"S0359","name":"Nltest","type":"software","techniques":["T1016","T1018","T1482"]},{"id":"S0368","name":"NotPetya","type":"software","techniques":["T1003.001","T1021.002","T1036","T1047","T1053.005","T1070.001","T1078.003","T1083","T1210","T1218.011","T1486","T1518.001","T1529","T1569.002"]},{"id":"S1170","name":"ODAgent","type":"software","techniques":["T1041","T1059.003","T1070.004","T1083","T1102.002","T1105","T1106","T1140","T1567.002"]},{"id":"S0138","name":"OLDBAIT","type":"software","techniques":["T1027","T1036.005","T1071.001","T1071.003","T1555","T1555.003"]},{"id":"S0165","name":"OSInfo","type":"software","techniques":["T1012","T1016","T1018","T1049","T1069.001","T1069.002","T1082","T1087.001","T1087.002","T1135"]},{"id":"S0402","name":"OSX/Shlayer","type":"software","techniques":["T1036.005","T1059.004","T1082","T1083","T1105","T1140","T1176.001","T1204.002","T1222.002","T1548.004","T1553.001","T1564","T1564.001","T1564.009","T1564.011"]},{"id":"S0352","name":"OSX_OCEANLOTUS.D","type":"software","techniques":["T1005","T1016","T1027.002","T1027.013","T1036.004","T1036.008","T1059.001","T1059.004","T1059.005","T1070.004","T1070.006","T1071.001","T1082","T1095","T1105","T1129","T1132.001","T1140","T1222.002","T1497.001","T1543.001","T1543.004","T1553.001","T1560.002","T1560.003","T1564.001","T1571","T1573.001"]},{"id":"S0644","name":"ObliqueRAT","type":"software","techniques":["T1025","T1027.003","T1030","T1033","T1057","T1074.001","T1082","T1083","T1113","T1120","T1125","T1204.001","T1497.001","T1547.001"]},{"id":"S0346","name":"OceanSalt","type":"software","techniques":["T1016","T1057","T1059.003","T1070.004","T1082","T1083","T1132.002","T1566.001"]},{"id":"S0340","name":"Octopus","type":"software","techniques":["T1005","T1016","T1033","T1036.005","T1041","T1047","T1071.001","T1074.001","T1082","T1083","T1105","T1113","T1132.001","T1204.002","T1547.001","T1560.001","T1566.001","T1567.002","T1680"]},{"id":"S1172","name":"OilBooster","type":"software","techniques":["T1008","T1033","T1041","T1059.003","T1071.001","T1074.001","T1082","T1102.002","T1105","T1106","T1140","T1559","T1564.003","T1567.002","T1573.002"]},{"id":"S1171","name":"OilCheck","type":"software","techniques":["T1102.002","T1105","T1567"]},{"id":"S0439","name":"Okrum","type":"software","techniques":["T1001","T1001.003","T1003.001","T1003.005","T1016","T1027.003","T1033","T1036.004","T1041","T1049","T1053.005","T1056.001","T1059.003","T1070.004","T1071.001","T1082","T1083","T1090.002","T1105","T1124","T1132.001","T1134.001","T1140","T1497.001","T1497.002","T1497.003","T1543.003","T1547.001","T1547.009","T1560.001","T1560.003","T1564.001","T1569.002","T1573.001"]},{"id":"S0365","name":"Olympic Destroyer","type":"software","techniques":["T1003.001","T1016","T1018","T1021.002","T1047","T1070.001","T1135","T1485","T1489","T1490","T1529","T1555.003","T1569.002","T1570"]},{"id":"S0052","name":"OnionDuke","type":"software","techniques":["T1003","T1071.001","T1102.003","T1140","T1499"]},{"id":"S0264","name":"OopsIE","type":"software","techniques":["T1027","T1027.002","T1030","T1041","T1047","T1053.005","T1059.003","T1059.005","T1070.004","T1071.001","T1074.001","T1082","T1105","T1124","T1132.001","T1140","T1497.001","T1560.001","T1560.003"]},{"id":"S0229","name":"Orz","type":"software","techniques":["T1016","T1027","T1055.012","T1057","T1059.003","T1070","T1082","T1083","T1102.002","T1105","T1112","T1218.010","T1518"]},{"id":"S0594","name":"Out1","type":"software","techniques":["T1005","T1027","T1059.003","T1071.001","T1114.001"]},{"id":"S1017","name":"OutSteel","type":"software","techniques":["T1005","T1020","T1036.005","T1041","T1057","T1059.003","T1059.010","T1070.004","T1071.001","T1083","T1105","T1119","T1204.001","T1204.002","T1566.001","T1566.002","T1570"]},{"id":"S0072","name":"OwaAuth","type":"software","techniques":["T1036.005","T1056.001","T1070.006","T1071.001","T1083","T1505.003","T1505.004","T1560.003"]},{"id":"S0598","name":"P.A.S. Webshell","type":"software","techniques":["T1005","T1027","T1046","T1059","T1070.004","T1071.001","T1083","T1087.001","T1105","T1110.001","T1140","T1213.006","T1222.002","T1505.003","T1518"]},{"id":"S0626","name":"P8RAT","type":"software","techniques":["T1001.001","T1057","T1105","T1497.001","T1497.003"]},{"id":"S1109","name":"PACEMAKER","type":"software","techniques":["T1003.007","T1055.008","T1059.004","T1074.001","T1083","T1119"]},{"id":"S1233","name":"PAKLOG","type":"software","techniques":["T1010","T1027.013","T1056.001","T1057","T1074.001","T1106","T1115","T1124","T1553.002","T1574.001"]},{"id":"S0158","name":"PHOREAL","type":"software","techniques":["T1059.003","T1095","T1112"]},{"id":"S1123","name":"PITSTOP","type":"software","techniques":["T1059.004","T1140","T1205.002","T1559","T1573.002"]},{"id":"S0254","name":"PLAINTEE","type":"software","techniques":["T1016","T1057","T1059.003","T1082","T1105","T1112","T1547.001","T1548.002","T1573.001"]},{"id":"S0435","name":"PLEAD","type":"software","techniques":["T1001.001","T1010","T1057","T1059.003","T1070.004","T1071.001","T1083","T1090","T1105","T1106","T1204.001","T1204.002","T1555","T1555.003","T1573.001"]},{"id":"S0216","name":"POORAIM","type":"software","techniques":["T1057","T1082","T1083","T1102.002","T1113","T1189"]},{"id":"S0150","name":"POSHSPY","type":"software","techniques":["T1027","T1030","T1059.001","T1070.006","T1105","T1546.003","T1568.002","T1573.002"]},{"id":"S0145","name":"POWERSOURCE","type":"software","techniques":["T1012","T1059.001","T1071.004","T1105","T1547.001","T1564.004"]},{"id":"S0223","name":"POWERSTATS","type":"software","techniques":["T1005","T1016","T1027.010","T1027.016","T1029","T1033","T1036.004","T1047","T1053.005","T1057","T1059.001","T1059.005","T1059.007","T1070.004","T1082","T1087.001","T1090.002","T1105","T1113","T1132.001","T1140","T1218.005","T1518.001","T1559.001","T1559.002","T1562.001","T1573.002"]},{"id":"S0371","name":"POWERTON","type":"software","techniques":["T1003.002","T1059.001","T1071.001","T1546.003","T1547.001","T1573.001"]},{"id":"S0184","name":"POWRUNER","type":"software","techniques":["T1012","T1016","T1033","T1047","T1049","T1053.005","T1057","T1059.001","T1059.003","T1069.001","T1069.002","T1071.001","T1071.004","T1082","T1083","T1087.002","T1105","T1113","T1132.001","T1518.001"]},{"id":"S0613","name":"PS1","type":"software","techniques":["T1027.013","T1055.001","T1059.001","T1105","T1140"]},{"id":"S1228","name":"PUBLOAD","type":"software","techniques":["T1001.003","T1007","T1012","T1016","T1016.001","T1016.002","T1027","T1027.015","T1033","T1036.005","T1047","T1048.003","T1049","T1053.005","T1057","T1059.003","T1071.001","T1071.002","T1082","T1105","T1106","T1124","T1140","T1205","T1480.001","T1518","T1518.001","T1547.001","T1553.002","T1560.001","T1573.001","T1574.001","T1614.001","T1622","T1680"]},{"id":"S1108","name":"PULSECHECK","type":"software","techniques":["T1059.004","T1071.001","T1132.001","T1505.003"]},{"id":"S0196","name":"PUNCHBUGGY","type":"software","techniques":["T1027","T1036.005","T1059.001","T1059.006","T1070.004","T1071.001","T1074.001","T1082","T1087.001","T1105","T1129","T1140","T1218.011","T1518.001","T1546.009","T1547.001","T1560.001"]},{"id":"S0197","name":"PUNCHTRACK","type":"software","techniques":["T1005","T1027","T1074.001"]},{"id":"S1091","name":"Pacu","type":"software","techniques":["T1049","T1059.009","T1069.003","T1078.004","T1087.004","T1098.001","T1119","T1518.001","T1526","T1530","T1546","T1552","T1555.006","T1562.007","T1562.008","T1578.001","T1580","T1619","T1648","T1651","T1654"]},{"id":"S0664","name":"Pandora","type":"software","techniques":["T1027.015","T1055","T1057","T1068","T1071.001","T1105","T1112","T1205","T1543.003","T1553.006","T1569.002","T1573.001","T1574.001"]},{"id":"S0208","name":"Pasam","type":"software","techniques":["T1005","T1057","T1070.004","T1082","T1083","T1105","T1547.008","T1680"]},{"id":"S0556","name":"Pay2Key","type":"software","techniques":["T1016","T1070.004","T1082","T1090.001","T1095","T1486","T1489","T1573.002"]},{"id":"S1050","name":"PcShare","type":"software","techniques":["T1005","T1012","T1016","T1027.013","T1027.015","T1036.001","T1036.005","T1041","T1055","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1106","T1112","T1113","T1125","T1140","T1218.011","T1546.015"]},{"id":"S1102","name":"Pcexter","type":"software","techniques":["T1005","T1083","T1567.002","T1574.001"]},{"id":"S0683","name":"Peirates","type":"software","techniques":["T1046","T1078.004","T1528","T1530","T1550.001","T1552.005","T1552.007","T1609","T1610","T1611","T1613","T1619"]},{"id":"S0587","name":"Penquin","type":"software","techniques":["T1016","T1027.005","T1027.013","T1036.005","T1040","T1041","T1053.003","T1059.004","T1070.004","T1082","T1083","T1095","T1105","T1205","T1205.002","T1222.002","T1573.002","T1680"]},{"id":"S0643","name":"Peppy","type":"software","techniques":["T1020","T1056.001","T1059.003","T1071.001","T1083","T1105","T1113"]},{"id":"S1145","name":"Pikabot","type":"software","techniques":["T1016","T1027.003","T1027.009","T1027.011","T1041","T1055.002","T1055.003","T1059.003","T1082","T1087.001","T1106","T1132.001","T1140","T1480.001","T1482","T1497.001","T1547.001","T1571","T1573.001","T1620","T1622"]},{"id":"S0517","name":"Pillowmint","type":"software","techniques":["T1005","T1012","T1027","T1027.011","T1027.015","T1055.004","T1057","T1059.001","T1070.004","T1070.009","T1106","T1112","T1140","T1546.011","T1560"]},{"id":"S0048","name":"PinchDuke","type":"software","techniques":["T1003","T1005","T1071.001","T1082","T1083","T1555","T1555.003"]},{"id":"S1031","name":"PingPull","type":"software","techniques":["T1005","T1016","T1036.004","T1041","T1059.003","T1070.006","T1071.001","T1082","T1083","T1095","T1132.001","T1140","T1543.003","T1571","T1573.001"]},{"id":"S0501","name":"PipeMon","type":"software","techniques":["T1008","T1016","T1027.011","T1027.013","T1036.005","T1055.001","T1057","T1082","T1095","T1105","T1106","T1112","T1124","T1129","T1134.002","T1134.004","T1140","T1518.001","T1543.003","T1547.012","T1548.002","T1553.002","T1573.001"]},{"id":"S0124","name":"Pisloader","type":"software","techniques":["T1016","T1027","T1059.003","T1071.004","T1082","T1083","T1105","T1132.001","T1547.001"]},{"id":"S1162","name":"Playcrypt","type":"software","techniques":["T1083","T1486","T1490"]},{"id":"S0013","name":"PlugX","type":"software","techniques":["T1012","T1016","T1027","T1027.001","T1027.007","T1027.013","T1033","T1036.004","T1036.005","T1041","T1049","T1053.005","T1056.001","T1057","T1059.003","T1070.004","T1070.009","T1071.001","T1071.004","T1074.001","T1082","T1083","T1091","T1095","T1102.001","T1105","T1106","T1112","T1113","T1120","T1124","T1127.001","T1135","T1140","T1204.002","T1480.002","T1497.001","T1543.003","T1547.001","T1562.004","T1564.001","T1564.003","T1571","T1573.001","T1574.001","T1614","T1620","T1622","T1680"]},{"id":"S0428","name":"PoetRAT","type":"software","techniques":["T1003.001","T1018","T1027","T1027.010","T1033","T1041","T1048","T1048.003","T1056.001","T1057","T1059.003","T1059.005","T1059.006","T1059.011","T1070.004","T1071.001","T1071.002","T1082","T1083","T1105","T1112","T1113","T1119","T1125","T1140","T1204.002","T1497.001","T1547.001","T1555.003","T1559.002","T1560.001","T1564.001","T1566.001","T1571","T1573.002"]},{"id":"S0012","name":"PoisonIvy","type":"software","techniques":["T1005","T1010","T1014","T1027","T1055.001","T1056.001","T1059.003","T1074.001","T1105","T1112","T1480.002","T1543.003","T1547.001","T1547.014","T1573.001"]},{"id":"S0518","name":"PolyglotDuke","type":"software","techniques":["T1027","T1027.003","T1027.011","T1071.001","T1102.001","T1105","T1106","T1112","T1140","T1218.011"]},{"id":"S0453","name":"Pony","type":"software","techniques":["T1027.015","T1027.016","T1036","T1059.003","T1070.004","T1071.001","T1082","T1087.001","T1105","T1106","T1110.001","T1204.001","T1204.002","T1497.003","T1566.001","T1566.002"]},{"id":"S0378","name":"PoshC2","type":"software","techniques":["T1003.001","T1007","T1016","T1040","T1046","T1047","T1049","T1055","T1056.001","T1068","T1069.001","T1071.001","T1082","T1083","T1087.001","T1087.002","T1090","T1110","T1119","T1134","T1134.002","T1201","T1210","T1482","T1546.003","T1548.002","T1550.002","T1552.001","T1555","T1557.001","T1560.001","T1569.002"]},{"id":"S1046","name":"PowGoop","type":"software","techniques":["T1036","T1036.005","T1059.001","T1071.001","T1132.002","T1140","T1573","T1574.001"]},{"id":"S0139","name":"PowerDuke","type":"software","techniques":["T1010","T1016","T1027.003","T1033","T1057","T1059.003","T1070.004","T1082","T1083","T1105","T1124","T1218.011","T1485","T1547.001","T1564.004"]},{"id":"S1173","name":"PowerExchange","type":"software","techniques":["T1041","T1059.001","T1071.003","T1105","T1140"]},{"id":"S1012","name":"PowerLess","type":"software","techniques":["T1005","T1056.001","T1059.001","T1074.001","T1105","T1140","T1217","T1560","T1573"]},{"id":"S0685","name":"PowerPunch","type":"software","techniques":["T1027.010","T1059.001","T1105","T1480.001"]},{"id":"S0441","name":"PowerShower","type":"software","techniques":["T1016","T1033","T1041","T1057","T1059.001","T1059.005","T1070.004","T1071.001","T1082","T1112","T1132.001","T1547.001","T1560.001","T1564.003"]},{"id":"S0194","name":"PowerSploit","type":"software","techniques":["T1003.001","T1005","T1012","T1027.005","T1027.010","T1047","T1053.005","T1055.001","T1056.001","T1057","T1059.001","T1087.001","T1113","T1123","T1134","T1482","T1543.003","T1547.001","T1547.005","T1552.002","T1552.006","T1555.004","T1558.003","T1574.001","T1574.007","T1574.008","T1574.009","T1620"]},{"id":"S0393","name":"PowerStallion","type":"software","techniques":["T1027","T1057","T1059.001","T1070.006","T1102.002"]},{"id":"S1058","name":"Prestige","type":"software","techniques":["T1053.005","T1059.001","T1083","T1106","T1112","T1484.001","T1486","T1489","T1490"]},{"id":"S0113","name":"Prikormka","type":"software","techniques":["T1016","T1025","T1027.013","T1033","T1056.001","T1070.004","T1074.001","T1082","T1083","T1113","T1120","T1132.001","T1218.011","T1518.001","T1547.001","T1555","T1555.003","T1560","T1573.001","T1574.001"]},{"id":"S0654","name":"ProLock","type":"software","techniques":["T1027.003","T1047","T1068","T1070.004","T1197","T1486","T1490"]},{"id":"S0279","name":"Proton","type":"software","techniques":["T1021.005","T1056.001","T1056.002","T1059.004","T1070.002","T1070.004","T1113","T1140","T1543.001","T1548.003","T1555.001","T1555.003","T1555.005","T1560","T1562.001"]},{"id":"S0238","name":"Proxysvc","type":"software","techniques":["T1005","T1012","T1016","T1041","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1119","T1124","T1485","T1569.002","T1680"]},{"id":"S0029","name":"PsExec","type":"software","techniques":["T1021.002","T1136.002","T1543.003","T1569.002","T1570"]},{"id":"S0078","name":"Psylo","type":"software","techniques":["T1041","T1070.006","T1071.001","T1083","T1105"]},{"id":"S0147","name":"Pteranodon","type":"software","techniques":["T1027.007","T1041","T1053.005","T1059.003","T1059.005","T1070.004","T1071.001","T1074.001","T1083","T1105","T1106","T1113","T1140","T1218.005","T1218.011","T1497","T1547.001"]},{"id":"S0192","name":"Pupy","type":"software","techniques":["T1003.001","T1003.004","T1003.005","T1016","T1021.001","T1033","T1041","T1046","T1049","T1055.001","T1056.001","T1057","T1059.001","T1059.006","T1070.001","T1071.001","T1082","T1083","T1087.001","T1105","T1113","T1114.001","T1123","T1125","T1134.001","T1135","T1136.001","T1136.002","T1497.001","T1543.002","T1547.001","T1547.013","T1548.002","T1550.003","T1552.001","T1555","T1555.003","T1557.001","T1560.001","T1569.002","T1573.002"]},{"id":"S1032","name":"PyDCrypt","type":"software","techniques":["T1027.013","T1033","T1036.005","T1047","T1049","T1059.001","T1059.003","T1059.006","T1070.004","T1140","T1562.004"]},{"id":"S0583","name":"Pysa","type":"software","techniques":["T1003.001","T1016","T1021.001","T1036.005","T1046","T1059.001","T1059.006","T1070.004","T1110","T1112","T1486","T1489","T1490","T1552.001","T1562.001","T1569.002"]},{"id":"S0269","name":"QUADAGENT","type":"software","techniques":["T1008","T1012","T1016","T1027.010","T1027.011","T1033","T1036.005","T1053.005","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1071.004","T1112","T1132.001","T1140"]},{"id":"S1076","name":"QUIETCANARY","type":"software","techniques":["T1012","T1016","T1071.001","T1074","T1106","T1132.001","T1140","T1564.003","T1573.001"]},{"id":"S1084","name":"QUIETEXIT","type":"software","techniques":["T1008","T1036.005","T1071","T1090.002","T1095"]},{"id":"S0650","name":"QakBot","type":"software","techniques":["T1005","T1010","T1016","T1016.001","T1018","T1027","T1027.001","T1027.002","T1027.005","T1027.006","T1027.010","T1027.011","T1033","T1036.008","T1041","T1047","T1049","T1053.005","T1055","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1059.007","T1069.001","T1070.004","T1071.001","T1074.001","T1082","T1083","T1090.002","T1091","T1095","T1105","T1106","T1110","T1112","T1114.001","T1120","T1124","T1132.001","T1135","T1140","T1185","T1204.001","T1204.002","T1210","T1218.007","T1218.010","T1218.011","T1482","T1497.001","T1497.003","T1518","T1518.001","T1539","T1543.003","T1547.001","T1553.002","T1553.005","T1555.003","T1562.001","T1564.001","T1566.001","T1566.002","T1568.002","T1572","T1573.001","T1574.001"]},{"id":"S1242","name":"Qilin","type":"software","techniques":["T1003.001","T1007","T1012","T1016","T1018","T1021.002","T1027.013","T1053.005","T1055.001","T1057","T1059.001","T1070.001","T1070.004","T1083","T1087.001","T1106","T1112","T1134","T1135","T1190","T1204.001","T1204.002","T1222","T1480","T1480.002","T1484.001","T1486","T1489","T1490","T1491.001","T1529","T1547.001","T1547.004","T1548.002","T1562.001","T1562.009","T1566.001","T1566.002","T1673","T1680"]},{"id":"S0262","name":"QuasarRAT","type":"software","techniques":["T1005","T1016","T1021.001","T1033","T1053.005","T1056.001","T1059.003","T1082","T1090","T1095","T1105","T1112","T1125","T1547.001","T1548.002","T1552.001","T1553.002","T1555","T1555.003","T1564.001","T1564.003","T1571","T1573.001","T1614"]},{"id":"S1209","name":"Quick Assist","type":"software","techniques":["T1071.001","T1113","T1125"]},{"id":"S0686","name":"QuietSieve","type":"software","techniques":["T1005","T1016.001","T1071.001","T1083","T1105","T1113","T1120","T1135","T1564.003"]},{"id":"S1113","name":"RAPIDPULSE","type":"software","techniques":["T1005","T1027.013","T1140","T1505.003"]},{"id":"S0055","name":"RARSTONE","type":"software","techniques":["T1055.001","T1083","T1095","T1105"]},{"id":"S0241","name":"RATANKBA","type":"software","techniques":["T1007","T1012","T1016","T1018","T1033","T1047","T1049","T1055.001","T1057","T1059.001","T1059.003","T1071.001","T1082","T1087.001","T1105"]},{"id":"S0662","name":"RCSession","type":"software","techniques":["T1005","T1027.011","T1027.015","T1033","T1036","T1055.012","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1095","T1105","T1106","T1112","T1113","T1218.007","T1547.001","T1548.002","T1573","T1574.001"]},{"id":"S0495","name":"RDAT","type":"software","techniques":["T1001","T1001.002","T1008","T1027.003","T1030","T1036.004","T1036.005","T1041","T1059.003","T1070.004","T1071.001","T1071.003","T1071.004","T1105","T1113","T1132.001","T1132.002","T1140","T1543.003","T1573.001"]},{"id":"S0416","name":"RDFSNIFFER","type":"software","techniques":["T1056.004","T1070.004","T1106"]},{"id":"S1219","name":"REPTILE","type":"software","techniques":["T1014","T1059.004","T1095","T1140","T1205","T1205.001","T1543.004","T1546.017","T1547.006","T1564.001","T1573.002"]},{"id":"S0496","name":"REvil","type":"software","techniques":["T1007","T1012","T1027.011","T1027.013","T1036.005","T1041","T1047","T1055","T1059.001","T1059.003","T1059.005","T1069.002","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1112","T1134.001","T1134.002","T1140","T1189","T1204.002","T1480.002","T1485","T1486","T1489","T1490","T1562.001","T1562.009","T1566.001","T1573.002","T1614.001","T1680"]},{"id":"S0258","name":"RGDoor","type":"software","techniques":["T1033","T1059.003","T1071.001","T1105","T1140","T1505.004","T1560.003"]},{"id":"S1222","name":"RIFLESPINE","type":"software","techniques":["T1059.004","T1071.001","T1074.001","T1082","T1102.002","T1105","T1140","T1543.002","T1567.002","T1573.001"]},{"id":"S0003","name":"RIPTIDE","type":"software","techniques":["T1071.001","T1573.001"]},{"id":"S1150","name":"ROADSWEEP","type":"software","techniques":["T1027.013","T1059.003","T1070.004","T1083","T1120","T1140","T1480","T1486","T1489","T1490","T1491.001","T1547.001","T1553.002","T1559","T1680"]},{"id":"S0684","name":"ROADTools","type":"software","techniques":["T1018","T1069.003","T1078.004","T1087.004","T1119","T1526"]},{"id":"S0240","name":"ROKRAT","type":"software","techniques":["T1005","T1010","T1012","T1027","T1033","T1041","T1055","T1056.001","T1057","T1059.005","T1070.004","T1071.001","T1082","T1083","T1102.002","T1105","T1106","T1112","T1113","T1115","T1123","T1140","T1204.002","T1480.001","T1497.001","T1555.003","T1555.004","T1566.001","T1567.002","T1622"]},{"id":"S0148","name":"RTM","type":"software","techniques":["T1027","T1027.015","T1033","T1036","T1036.004","T1053.005","T1056.001","T1057","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1083","T1102.001","T1105","T1106","T1112","T1113","T1115","T1119","T1120","T1124","T1204.002","T1218.011","T1219","T1497","T1518","T1518.001","T1547.001","T1548.002","T1553.002","T1553.004","T1559.002","T1566.001","T1568","T1571","T1573.001"]},{"id":"S1148","name":"Raccoon Stealer","type":"software","techniques":["T1005","T1012","T1020","T1027.007","T1027.013","T1033","T1041","T1070.004","T1071.001","T1082","T1083","T1087.001","T1105","T1113","T1119","T1124","T1140","T1195","T1213","T1518","T1539","T1555.003","T1560","T1614"]},{"id":"S0481","name":"Ragnar Locker","type":"software","techniques":["T1059.003","T1120","T1218.007","T1218.010","T1218.011","T1486","T1489","T1490","T1543.003","T1562.001","T1564.006","T1569.002","T1614"]},{"id":"S0565","name":"Raindrop","type":"software","techniques":["T1027.002","T1027.003","T1027.013","T1036","T1036.005","T1140","T1497.003"]},{"id":"S0629","name":"RainyDay","type":"software","techniques":["T1005","T1007","T1008","T1027.013","T1036.004","T1036.005","T1053.005","T1057","T1059.003","T1070.004","T1071.001","T1074.001","T1083","T1090","T1095","T1105","T1106","T1113","T1140","T1543.003","T1555.003","T1555.004","T1567.002","T1573.001","T1574.001"]},{"id":"S0458","name":"Ramsay","type":"software","techniques":["T1005","T1014","T1016","T1025","T1027","T1027.003","T1036","T1036.005","T1039","T1046","T1049","T1053.005","T1055.001","T1057","T1059.005","T1071.001","T1074.001","T1080","T1083","T1091","T1106","T1113","T1119","T1120","T1132.001","T1135","T1140","T1203","T1204.002","T1546.010","T1547.001","T1548.002","T1559.001","T1559.002","T1560.001","T1560.003","T1566.001","T1574.001","T1680"]},{"id":"S1212","name":"RansomHub","type":"software","techniques":["T1018","T1021.002","T1027.013","T1057","T1059.001","T1059.003","T1070.001","T1070.004","T1082","T1083","T1090","T1135","T1140","T1480","T1486","T1489","T1490","T1491.001","T1497.003","T1547.001","T1562.009"]},{"id":"S1130","name":"Raspberry Robin","type":"software","techniques":["T1027","T1027.002","T1033","T1036.004","T1036.008","T1047","T1055.012","T1057","T1059","T1059.003","T1070.004","T1070.009","T1071","T1071.001","T1082","T1083","T1091","T1102","T1105","T1140","T1204","T1218.007","T1218.008","T1218.010","T1218.011","T1480","T1497","T1497.001","T1518.001","T1547.001","T1548","T1548.002","T1559","T1559.001","T1562.001","T1571","T1574","T1574.001","T1583.001","T1583.008","T1622"]},{"id":"S0364","name":"RawDisk","type":"software","techniques":["T1485","T1561.001","T1561.002"]},{"id":"S0169","name":"RawPOS","type":"software","techniques":["T1005","T1036.004","T1074.001","T1543.003","T1560.003"]},{"id":"S1040","name":"Rclone","type":"software","techniques":["T1030","T1048.002","T1048.003","T1083","T1560.001","T1567.002"]},{"id":"S0172","name":"Reaver","type":"software","techniques":["T1012","T1016","T1027.013","T1033","T1070.004","T1071.001","T1082","T1095","T1218.002","T1543.003","T1547.001","T1547.009","T1560.003","T1680"]},{"id":"S0153","name":"RedLeaves","type":"software","techniques":["T1016","T1027.013","T1033","T1049","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1113","T1547.001","T1547.009","T1555.003","T1571","T1573.001","T1574.001"]},{"id":"S1240","name":"RedLine Stealer","type":"software","techniques":["T1005","T1012","T1016","T1027.002","T1027.010","T1027.013","T1033","T1036","T1041","T1053.005","T1059.003","T1059.011","T1071.001","T1082","T1087.001","T1102","T1105","T1113","T1132.001","T1140","T1204.002","T1217","T1218.007","T1480","T1497","T1518","T1518.001","T1539","T1553.002","T1555","T1555.003","T1562.001","T1614","T1614.001","T1657"]},{"id":"S0075","name":"Reg","type":"software","techniques":["T1012","T1112","T1552.002"]},{"id":"S0511","name":"RegDuke","type":"software","techniques":["T1027","T1027.003","T1027.011","T1059.001","T1102.002","T1105","T1112","T1140","T1546.003"]},{"id":"S0019","name":"Regin","type":"software","techniques":["T1021.002","T1036.001","T1040","T1056.001","T1071.001","T1071.002","T1090.002","T1095","T1112","T1564.004","T1564.005"]},{"id":"S0332","name":"Remcos","type":"software","techniques":["T1027","T1055","T1056.001","T1059.003","T1059.006","T1083","T1090","T1105","T1112","T1113","T1115","T1123","T1125","T1497.001","T1547.001","T1548.002"]},{"id":"S0375","name":"Remexi","type":"software","techniques":["T1010","T1027.013","T1041","T1047","T1053.005","T1056.001","T1059.003","T1059.005","T1071.001","T1083","T1113","T1115","T1140","T1547.001","T1547.004","T1560"]},{"id":"S0166","name":"RemoteCMD","type":"software","techniques":["T1053.005","T1105","T1569.002"]},{"id":"S0592","name":"RemoteUtilities","type":"software","techniques":["T1083","T1105","T1113","T1218.007"]},{"id":"S0125","name":"Remsec","type":"software","techniques":["T1003.002","T1016","T1018","T1025","T1027.013","T1033","T1036.005","T1046","T1048.003","T1049","T1052.001","T1053.005","T1055.001","T1056.001","T1057","T1059.011","T1068","T1070.004","T1071.001","T1071.003","T1071.004","T1082","T1083","T1087.001","T1095","T1105","T1518.001","T1556.002","T1562.004","T1652"]},{"id":"S0174","name":"Responder","type":"software","techniques":["T1040","T1557.001"]},{"id":"S0379","name":"Revenge RAT","type":"software","techniques":["T1003","T1016","T1021.001","T1033","T1053.005","T1056.001","T1059.001","T1059.003","T1082","T1102.002","T1105","T1113","T1123","T1125","T1132.001","T1202","T1218.005","T1547.004"]},{"id":"S0433","name":"Rifdoor","type":"software","techniques":["T1016","T1027.001","T1027.013","T1033","T1082","T1204.002","T1547.001","T1566.001","T1573.001"]},{"id":"S0448","name":"Rising Sun","type":"software","techniques":["T1005","T1012","T1016","T1016.001","T1027.013","T1033","T1041","T1057","T1059.003","T1070","T1070.004","T1071.001","T1082","T1083","T1106","T1140","T1560.003","T1564.001","T1573.002","T1680"]},{"id":"S0400","name":"RobbinHood","type":"software","techniques":["T1059.003","T1070.005","T1486","T1489","T1490","T1562.001"]},{"id":"S0270","name":"RogueRobin","type":"software","techniques":["T1016","T1027.010","T1033","T1047","T1057","T1059.001","T1059.003","T1082","T1102.002","T1105","T1113","T1132.001","T1140","T1218.010","T1497.001","T1518.001","T1547.001","T1547.009"]},{"id":"S1078","name":"RotaJakiro","type":"software","techniques":["T1036.005","T1037","T1041","T1057","T1082","T1095","T1106","T1119","T1129","T1132.001","T1140","T1543.002","T1546.004","T1547.013","T1559","T1571","T1573.001"]},{"id":"S0090","name":"Rover","type":"software","techniques":["T1005","T1020","T1025","T1056.001","T1074.001","T1083","T1112","T1113","T1119","T1547.001"]},{"id":"S1073","name":"Royal","type":"software","techniques":["T1016","T1021.002","T1046","T1057","T1059.012","T1082","T1083","T1095","T1106","T1135","T1486","T1489","T1490","T1566","T1680"]},{"id":"S1071","name":"Rubeus","type":"software","techniques":["T1482","T1558.001","T1558.002","T1558.003","T1558.004"]},{"id":"S0358","name":"Ruler","type":"software","techniques":["T1087.003","T1137.003","T1137.004","T1137.005"]},{"id":"S0253","name":"RunningRAT","type":"software","techniques":["T1056.001","T1059.003","T1070.001","T1070.004","T1082","T1115","T1547.001","T1560","T1562.001","T1680"]},{"id":"S0446","name":"Ryuk","type":"software","techniques":["T1016","T1021.002","T1027","T1036","T1036.005","T1053.005","T1055","T1057","T1059.003","T1078.002","T1083","T1106","T1134","T1205","T1222.001","T1486","T1489","T1490","T1547.001","T1562.001","T1614.001","T1680"]},{"id":"S0085","name":"S-Type","type":"software","techniques":["T1007","T1008","T1016","T1027.002","T1033","T1036.005","T1041","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1087.001","T1105","T1106","T1132.001","T1136.001","T1547.001","T1547.009","T1614.001"]},{"id":"S0461","name":"SDBbot","type":"software","techniques":["T1005","T1016","T1021.001","T1027","T1027.002","T1033","T1041","T1055.001","T1057","T1059.003","T1070","T1070.004","T1082","T1083","T1090","T1095","T1105","T1125","T1140","T1218.011","T1546.011","T1546.012","T1547.001","T1614"]},{"id":"S0195","name":"SDelete","type":"software","techniques":["T1070.004","T1485"]},{"id":"S0185","name":"SEASHARPEE","type":"software","techniques":["T1059.003","T1070.006","T1105","T1505.003"]},{"id":"S0450","name":"SHARPSTATS","type":"software","techniques":["T1016","T1027.010","T1033","T1059.001","T1082","T1105","T1124"]},{"id":"S0028","name":"SHIPSHAPE","type":"software","techniques":["T1091","T1547.001","T1547.009"]},{"id":"S0063","name":"SHOTPUT","type":"software","techniques":["T1018","T1027","T1049","T1057","T1083","T1087.001"]},{"id":"S0217","name":"SHUTTERSPEED","type":"software","techniques":["T1082","T1105","T1113"]},{"id":"S0692","name":"SILENTTRINITY","type":"software","techniques":["T1003.001","T1007","T1010","T1012","T1018","T1021.003","T1021.006","T1033","T1041","T1046","T1047","T1055","T1056.001","T1056.002","T1057","T1059.001","T1059.003","T1059.006","T1069.001","T1069.002","T1070","T1070.004","T1082","T1083","T1087.002","T1105","T1106","T1112","T1113","T1115","T1124","T1134.001","T1134.003","T1135","T1518.001","T1543.003","T1546.001","T1546.003","T1546.015","T1547.001","T1548.002","T1552.006","T1555.003","T1555.004","T1556","T1558.003","T1559.001","T1562.001","T1562.003","T1562.010","T1564.003","T1620","T1680"]},{"id":"S1110","name":"SLIGHTPULSE","type":"software","techniques":["T1005","T1059","T1071.001","T1074.001","T1105","T1132.001","T1140","T1505.003","T1573.001"]},{"id":"S0533","name":"SLOTHFULMEDIA","type":"software","techniques":["T1001","T1005","T1007","T1033","T1036.004","T1036.005","T1041","T1049","T1055","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1112","T1113","T1489","T1543.003","T1564.001","T1569.002","T1680"]},{"id":"S0218","name":"SLOWDRIFT","type":"software","techniques":["T1082","T1102.002","T1105"]},{"id":"S1104","name":"SLOWPULSE","type":"software","techniques":["T1027","T1074.001","T1111","T1554","T1556.004","T1556.006"]},{"id":"S0649","name":"SMOKEDHAM","type":"software","techniques":["T1027.009","T1033","T1041","T1056.001","T1059.001","T1071.001","T1082","T1087.001","T1090.004","T1098.007","T1102","T1105","T1112","T1113","T1132.001","T1136.001","T1204.001","T1547.001","T1564.002","T1573.001","T1598.003"]},{"id":"S0159","name":"SNUGRIDE","type":"software","techniques":["T1059.003","T1071.001","T1547.001","T1573.001"]},{"id":"S0157","name":"SOUNDBITE","type":"software","techniques":["T1010","T1071.004","T1082","T1083","T1112"]},{"id":"S0035","name":"SPACESHIP","type":"software","techniques":["T1052.001","T1074.001","T1083","T1547.001","T1547.009","T1560.003"]},{"id":"S0390","name":"SQLRat","type":"software","techniques":["T1027.010","T1053.005","T1059.001","T1059.003","T1070.004","T1105","T1140","T1204.002"]},{"id":"S1037","name":"STARWHALE","type":"software","techniques":["T1005","T1016","T1027.013","T1033","T1041","T1059.003","T1059.005","T1071.001","T1074.001","T1082","T1132.001","T1204.002","T1543.003","T1547.001"]},{"id":"S1238","name":"STATICPLUGIN","type":"software","techniques":["T1036.005","T1036.008","T1204.002","T1553.002","T1559.001"]},{"id":"S1112","name":"STEADYPULSE","type":"software","techniques":["T1071.001","T1105","T1132.001","T1140","T1505.003"]},{"id":"S1042","name":"SUGARDUMP","type":"software","techniques":["T1036.004","T1036.005","T1041","T1053.005","T1071.001","T1071.003","T1074.001","T1083","T1204.002","T1217","T1518","T1555.003","T1560.003"]},{"id":"S1049","name":"SUGARUSH","type":"software","techniques":["T1016.001","T1059.003","T1095","T1543.003","T1571","T1680"]},{"id":"S0559","name":"SUNBURST","type":"software","techniques":["T1001.001","T1001.002","T1001.003","T1005","T1007","T1012","T1016","T1027","T1027.005","T1027.015","T1033","T1036.005","T1047","T1057","T1059.005","T1070","T1070.004","T1070.007","T1070.009","T1071.001","T1071.004","T1082","T1083","T1105","T1112","T1124","T1132.001","T1218.011","T1497.001","T1497.003","T1518.001","T1546.012","T1553.002","T1562.001","T1568","T1573.001"]},{"id":"S0562","name":"SUNSPOT","type":"software","techniques":["T1027","T1036.005","T1057","T1070.004","T1083","T1106","T1134","T1140","T1195.002","T1480","T1480.002","T1565.001"]},{"id":"S0578","name":"SUPERNOVA","type":"software","techniques":["T1027.013","T1036.005","T1071.001","T1203","T1505.003"]},{"id":"S1064","name":"SVCReady","type":"software","techniques":["T1005","T1012","T1027","T1033","T1036.004","T1041","T1047","T1053.005","T1057","T1059.005","T1071.001","T1082","T1105","T1106","T1113","T1120","T1124","T1204.002","T1218.011","T1497.001","T1497.003","T1518","T1546.015","T1566.001"]},{"id":"S0519","name":"SYNful Knock","type":"software","techniques":["T1205","T1556.004","T1601.001"]},{"id":"S0464","name":"SYSCON","type":"software","techniques":["T1057","T1059.003","T1071.002","T1082","T1204.002"]},{"id":"S1210","name":"Sagerunex","type":"software","techniques":["T1016","T1027.002","T1027.013","T1041","T1055.001","T1057","T1071.001","T1074.001","T1082","T1090","T1102.002","T1102.003","T1106","T1134","T1140","T1480","T1560.001","T1573.002"]},{"id":"S1018","name":"Saint Bot","type":"software","techniques":["T1005","T1012","T1016","T1027","T1027.002","T1033","T1036","T1036.005","T1053.005","T1055.001","T1055.004","T1055.012","T1057","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1132.001","T1140","T1204.001","T1204.002","T1218.004","T1218.010","T1497.001","T1497.003","T1547.001","T1548.002","T1566.001","T1566.002","T1574","T1614","T1622"]},{"id":"S0074","name":"Sakula","type":"software","techniques":["T1027.013","T1059.003","T1070.004","T1071.001","T1105","T1218.011","T1543.003","T1547.001","T1548.002","T1573.001","T1574.001"]},{"id":"S0370","name":"SamSam","type":"software","techniques":["T1027.013","T1027.016","T1059.003","T1070.004","T1486"]},{"id":"S1168","name":"SampleCheck5000","type":"software","techniques":["T1059.003","T1071.001","T1074.001","T1082","T1102.002","T1105","T1140","T1560.001","T1567","T1680"]},{"id":"S1099","name":"Samurai","type":"software","techniques":["T1005","T1012","T1027","T1027.004","T1027.007","T1027.015","T1036.005","T1059.003","T1071.001","T1083","T1090","T1095","T1105","T1106","T1112","T1132.001","T1518","T1543.003","T1573.001"]},{"id":"S1085","name":"Sardonic","type":"software","techniques":["T1005","T1007","T1016","T1027","T1027.010","T1047","T1049","T1055.004","T1057","T1059.001","T1059.003","T1070","T1082","T1095","T1105","T1106","T1132.001","T1135","T1140","T1546.003","T1571","T1573.001","T1573.002","T1620","T1680"]},{"id":"S0053","name":"SeaDuke","type":"software","techniques":["T1027.002","T1059.001","T1059.003","T1070.004","T1071.001","T1078","T1105","T1114.002","T1132.001","T1546.003","T1547.001","T1547.009","T1550.003","T1560.002","T1573.001"]},{"id":"S0345","name":"Seasalt","type":"software","techniques":["T1027.013","T1036.004","T1057","T1059.003","T1070.004","T1071.001","T1083","T1105","T1543.003","T1547.001"]},{"id":"S0382","name":"ServHelper","type":"software","techniques":["T1021.001","T1033","T1036.010","T1053.005","T1059.001","T1059.003","T1070.004","T1071.001","T1082","T1098.007","T1105","T1136.001","T1218.011","T1547.001","T1573.002"]},{"id":"S0639","name":"Seth-Locker","type":"software","techniques":["T1059.003","T1105","T1486"]},{"id":"S0596","name":"ShadowPad","type":"software","techniques":["T1016","T1027","T1027.011","T1029","T1033","T1055","T1055.001","T1057","T1070","T1071.001","T1071.002","T1071.004","T1082","T1095","T1105","T1112","T1124","T1132.002","T1140","T1568.002","T1680"]},{"id":"S0140","name":"Shamoon","type":"software","techniques":["T1012","T1016","T1018","T1021.002","T1027","T1036.004","T1053.005","T1070.006","T1071.001","T1078.002","T1082","T1105","T1112","T1124","T1134.001","T1140","T1485","T1486","T1529","T1543.003","T1548.002","T1561.002","T1569.002","T1570"]},{"id":"S1019","name":"Shark","type":"software","techniques":["T1005","T1008","T1012","T1027.013","T1029","T1036.005","T1041","T1059.003","T1070.004","T1071.001","T1071.004","T1074","T1082","T1105","T1140","T1497.001","T1568.002"]},{"id":"S1089","name":"SharpDisco","type":"software","techniques":["T1005","T1041","T1053.005","T1059.003","T1071.002","T1083","T1105","T1106","T1120","T1564.003","T1680"]},{"id":"S0546","name":"SharpStage","type":"software","techniques":["T1047","T1053.005","T1059.001","T1059.003","T1082","T1102","T1105","T1113","T1140","T1547.001","T1614.001"]},{"id":"S0444","name":"ShimRat","type":"software","techniques":["T1005","T1008","T1027.002","T1027.015","T1029","T1036.004","T1059.003","T1070.004","T1071.001","T1083","T1090.002","T1105","T1106","T1112","T1135","T1140","T1543.003","T1546.011","T1547.001","T1548.002","T1574"]},{"id":"S0445","name":"ShimRatReporter","type":"software","techniques":["T1016","T1020","T1027","T1036.005","T1041","T1049","T1057","T1069","T1071.001","T1082","T1087","T1105","T1106","T1119","T1518","T1560"]},{"id":"S1178","name":"ShrinkLocker","type":"software","techniques":["T1016","T1041","T1047","T1057","T1059.001","T1059.005","T1070.001","T1070.004","T1071.001","T1082","T1102","T1112","T1124","T1480","T1485","T1486","T1491.001","T1529","T1562.001","T1562.004"]},{"id":"S0589","name":"Sibot","type":"software","techniques":["T1012","T1016","T1027.010","T1027.011","T1036.005","T1047","T1049","T1053.005","T1059.005","T1070","T1070.004","T1071.001","T1102","T1105","T1112","T1140","T1218.005","T1218.011"]},{"id":"S0610","name":"SideTwist","type":"software","techniques":["T1001","T1005","T1008","T1016","T1033","T1041","T1059.003","T1071.001","T1082","T1083","T1105","T1106","T1132.001","T1140","T1573.001"]},{"id":"S0623","name":"Siloscape","type":"software","techniques":["T1027","T1059.003","T1068","T1069","T1071","T1083","T1090.003","T1106","T1134.001","T1140","T1190","T1518","T1609","T1611"]},{"id":"S0468","name":"Skidmap","type":"software","techniques":["T1014","T1027.013","T1036.005","T1053.003","T1057","T1059.004","T1082","T1083","T1098.004","T1105","T1140","T1496.001","T1518.001","T1547.006","T1556.003","T1562.001"]},{"id":"S0633","name":"Sliver","type":"software","techniques":["T1001.002","T1003.001","T1016","T1027","T1027.004","T1027.013","T1041","T1049","T1055","T1059.001","T1071","T1071.001","T1071.004","T1083","T1090.001","T1105","T1113","T1132.001","T1134","T1548.002","T1558.001","T1573.001","T1573.002"]},{"id":"S1035","name":"Small Sieve","type":"software","techniques":["T1016","T1027","T1033","T1036.005","T1059.003","T1059.006","T1071.001","T1102.002","T1105","T1132.002","T1480","T1547.001","T1573.002"]},{"id":"S0226","name":"Smoke Loader","type":"software","techniques":["T1027.013","T1053.005","T1055","T1055.012","T1059.005","T1071.001","T1083","T1105","T1114.001","T1140","T1497.001","T1547.001","T1552.001","T1555.003"]},{"id":"S1163","name":"SnappyTCP","type":"software","techniques":["T1059.004","T1071.001","T1095","T1505.003","T1573.002"]},{"id":"S1086","name":"Snip3","type":"software","techniques":["T1027","T1027.001","T1047","T1055.012","T1059.001","T1059.005","T1082","T1102","T1104","T1105","T1140","T1189","T1204.001","T1204.002","T1497.001","T1497.003","T1547.001","T1564.003","T1566.001","T1566.002"]},{"id":"S1124","name":"SocGholish","type":"software","techniques":["T1016","T1027.013","T1027.015","T1033","T1036.005","T1047","T1048.003","T1057","T1059.007","T1074.001","T1082","T1102","T1105","T1189","T1204.001","T1482","T1518","T1566.002","T1614"]},{"id":"S0273","name":"Socksbot","type":"software","techniques":["T1055.001","T1057","T1059.001","T1090","T1113"]},{"id":"S0627","name":"SodaMaster","type":"software","techniques":["T1012","T1027","T1033","T1057","T1082","T1105","T1106","T1497.001","T1497.003","T1573.001","T1573.002"]},{"id":"S1166","name":"Solar","type":"software","techniques":["T1020","T1041","T1053.005","T1070.004","T1082","T1105","T1132.001","T1573.001"]},{"id":"S0615","name":"SombRAT","type":"software","techniques":["T1005","T1007","T1027","T1033","T1036","T1041","T1055.001","T1057","T1070.004","T1071.004","T1074.001","T1082","T1083","T1090","T1095","T1105","T1106","T1124","T1140","T1560.003","T1564.010","T1568.002","T1573.001","T1573.002"]},{"id":"S0516","name":"SoreFang","type":"software","techniques":["T1016","T1027","T1053.005","T1057","T1069.002","T1071.001","T1082","T1083","T1087.001","T1087.002","T1105","T1140","T1190","T1680"]},{"id":"S0543","name":"Spark","type":"software","techniques":["T1027.002","T1033","T1041","T1059.003","T1071.001","T1082","T1132.001","T1140","T1497.002","T1614.001"]},{"id":"S0374","name":"SpeakUp","type":"software","techniques":["T1016","T1027.013","T1033","T1046","T1049","T1053.003","T1059","T1059.006","T1070.004","T1071.001","T1082","T1105","T1110.001","T1132.001","T1203"]},{"id":"S1140","name":"Spica","type":"software","techniques":["T1036.004","T1053.005","T1059.001","T1083","T1095","T1105","T1140","T1539","T1560"]},{"id":"S0646","name":"SpicyOmelette","type":"software","techniques":["T1005","T1016","T1018","T1059.007","T1082","T1105","T1204.001","T1518","T1518.001","T1553.002","T1566.002"]},{"id":"S1234","name":"SplatCloak","type":"software","techniques":["T1036.001","T1082","T1083","T1106","T1518.001","T1562.001"]},{"id":"S1232","name":"SplatDropper","type":"software","techniques":["T1027.007","T1027.013","T1070.009","T1106","T1140","T1543.003","T1553.002","T1574.001"]},{"id":"S1030","name":"Squirrelwaffle","type":"software","techniques":["T1016","T1027.002","T1027.013","T1033","T1041","T1059.001","T1059.003","T1059.005","T1071.001","T1082","T1105","T1132.001","T1140","T1204.001","T1204.002","T1218.010","T1218.011","T1497","T1560.003","T1566.001","T1566.002"]},{"id":"S0058","name":"SslMM","type":"software","techniques":["T1008","T1033","T1036.005","T1056.001","T1082","T1134","T1547.001","T1547.009","T1562.001"]},{"id":"S1227","name":"StarProxy","type":"software","techniques":["T1001.003","T1059","T1090.001","T1095","T1106","T1124","T1140","T1573.001","T1574.001"]},{"id":"S0188","name":"Starloader","type":"software","techniques":["T1036.005","T1140"]},{"id":"S1200","name":"StealBit","type":"software","techniques":["T1005","T1027.013","T1030","T1070.004","T1071.001","T1082","T1083","T1095","T1106","T1140","T1480","T1559","T1562.006","T1614.001","T1622"]},{"id":"S0380","name":"StoneDrill","type":"software","techniques":["T1012","T1027.013","T1047","T1055","T1059.005","T1070.004","T1082","T1105","T1113","T1124","T1485","T1497","T1518.001","T1561.001","T1561.002"]},{"id":"S0142","name":"StreamEx","type":"software","techniques":["T1027","T1057","T1059.003","T1082","T1083","T1112","T1218.011","T1518.001","T1543.003"]},{"id":"S1183","name":"StrelaStealer","type":"software","techniques":["T1001","T1020","T1027","T1027.002","T1027.013","T1027.015","T1027.016","T1036","T1036.003","T1036.005","T1036.008","T1041","T1059.001","T1059.003","T1059.007","T1071.001","T1082","T1105","T1119","T1132.001","T1140","T1204.002","T1218.011","T1480","T1480.002","T1497","T1518","T1552.001","T1552.002","T1553.002","T1566.001","T1574.001","T1614.001","T1622"]},{"id":"S1034","name":"StrifeWater","type":"software","techniques":["T1005","T1033","T1036.005","T1041","T1053.005","T1059.003","T1070.004","T1082","T1083","T1105","T1106","T1113","T1124","T1497.003","T1573.001"]},{"id":"S0491","name":"StrongPity","type":"software","techniques":["T1016","T1020","T1027.013","T1036.004","T1036.005","T1041","T1057","T1059.001","T1070.004","T1071.001","T1083","T1090.003","T1105","T1119","T1204.002","T1518.001","T1543.003","T1547.001","T1553.002","T1560.003","T1562.001","T1564.003","T1569.002","T1571","T1573.002","T1680"]},{"id":"S0603","name":"Stuxnet","type":"software","techniques":["T1008","T1012","T1014","T1016","T1021","T1021.002","T1027.013","T1041","T1047","T1053.005","T1055.001","T1068","T1070","T1070.004","T1070.006","T1071.001","T1078.001","T1078.002","T1080","T1082","T1083","T1087.001","T1087.002","T1090.001","T1091","T1106","T1112","T1120","T1124","T1129","T1132.001","T1134.001","T1135","T1140","T1210","T1480","T1505.001","T1518.001","T1543.003","T1553.002","T1560.003","T1562","T1570","T1573.001"]},{"id":"S0018","name":"Sykipot","type":"software","techniques":["T1007","T1016","T1018","T1049","T1055.001","T1056.001","T1057","T1087.002","T1111","T1547.001","T1573.002"]},{"id":"S0242","name":"SynAck","type":"software","techniques":["T1007","T1012","T1027","T1033","T1055.013","T1057","T1070.001","T1082","T1083","T1106","T1112","T1486","T1497.001","T1614.001"]},{"id":"S0060","name":"Sys10","type":"software","techniques":["T1016","T1033","T1069.001","T1071.001","T1082","T1573.001"]},{"id":"S0663","name":"SysUpdate","type":"software","techniques":["T1005","T1007","T1016","T1016.001","T1027.002","T1027.011","T1027.013","T1033","T1036.004","T1041","T1047","T1057","T1070.004","T1071.004","T1082","T1083","T1105","T1106","T1112","T1113","T1132.001","T1140","T1543.002","T1543.003","T1547.001","T1553.002","T1564.001","T1569.002","T1573.001","T1574.001","T1680"]},{"id":"S0098","name":"T9000","type":"software","techniques":["T1016","T1033","T1082","T1113","T1119","T1120","T1123","T1124","T1125","T1518.001","T1546.010","T1560.003","T1574.001"]},{"id":"S0586","name":"TAINTEDSCRIBE","type":"software","techniques":["T1001.003","T1008","T1018","T1027.001","T1036.005","T1057","T1059.003","T1070.004","T1070.006","T1083","T1105","T1124","T1547.001","T1560","T1573.001","T1680"]},{"id":"S1193","name":"TAMECAT","type":"software","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1071.001","T1105","T1132.001","T1518.001","T1573.001"]},{"id":"S0164","name":"TDTESS","type":"software","techniques":["T1059.003","T1070.004","T1070.006","T1105","T1543.003"]},{"id":"S0560","name":"TEARDROP","type":"software","techniques":["T1012","T1027","T1036.005","T1112","T1140","T1543.003"]},{"id":"S0146","name":"TEXTMATE","type":"software","techniques":["T1059.003","T1071.004"]},{"id":"S1223","name":"THINCRUST","type":"software","techniques":["T1059.006","T1071.001","T1140","T1562.004","T1573.001"]},{"id":"S0131","name":"TINYTYPHON","type":"software","techniques":["T1020","T1027.013","T1083","T1547.001"]},{"id":"S1239","name":"TONESHELL","type":"software","techniques":["T1001.003","T1010","T1027.001","T1027.007","T1027.012","T1033","T1036.004","T1036.005","T1047","T1053.005","T1055.001","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1087","T1095","T1105","T1106","T1113","T1132.002","T1134.002","T1140","T1205","T1218.010","T1218.013","T1480","T1480.001","T1480.002","T1497.002","T1518.001","T1543.003","T1547.001","T1553.002","T1559","T1560.001","T1573.001","T1574.001","T1622","T1678","T1680"]},{"id":"S1201","name":"TRANSLATEXT","type":"software","techniques":["T1012","T1036.005","T1041","T1059.001","T1071.001","T1102.001","T1102.002","T1112","T1113","T1114","T1176.001","T1185","T1205","T1539","T1555.003"]},{"id":"S0436","name":"TSCookie","type":"software","techniques":["T1016","T1055","T1057","T1059.003","T1071.001","T1083","T1090","T1095","T1105","T1140","T1204.001","T1555.003","T1573.001"]},{"id":"S0199","name":"TURNEDUP","type":"software","techniques":["T1055.004","T1059.003","T1082","T1105","T1113","T1547.001"]},{"id":"S0263","name":"TYPEFRAME","type":"software","techniques":["T1027.011","T1027.013","T1059.003","T1059.005","T1070.004","T1083","T1090","T1105","T1112","T1140","T1204.002","T1543.003","T1562.004","T1571","T1680"]},{"id":"S0011","name":"Taidoor","type":"software","techniques":["T1005","T1012","T1016","T1027.013","T1055.001","T1057","T1059.003","T1070.004","T1071.001","T1083","T1095","T1105","T1106","T1112","T1124","T1140","T1204.002","T1547.001","T1566.001","T1573.001"]},{"id":"S0467","name":"TajMahal","type":"software","techniques":["T1005","T1016","T1020","T1025","T1027","T1041","T1055.001","T1056.001","T1057","T1082","T1083","T1112","T1113","T1115","T1119","T1120","T1123","T1124","T1125","T1129","T1518","T1518.001","T1539","T1560.002"]},{"id":"S1011","name":"Tarrask","type":"software","techniques":["T1036.004","T1036.005","T1053.005","T1059.003","T1112","T1134.001","T1564"]},{"id":"S0057","name":"Tasklist","type":"software","techniques":["T1007","T1057","T1518.001"]},{"id":"S0595","name":"ThiefQuest","type":"software","techniques":["T1036.005","T1041","T1056.001","T1057","T1059.002","T1071.001","T1105","T1106","T1486","T1497.003","T1518.001","T1543.001","T1543.004","T1554","T1562.001","T1564.001","T1620","T1622"]},{"id":"S0665","name":"ThreatNeedle","type":"software","techniques":["T1005","T1027.011","T1027.013","T1027.015","T1036.005","T1082","T1083","T1105","T1112","T1140","T1204.002","T1543.003","T1547.001","T1566.001"]},{"id":"S0668","name":"TinyTurla","type":"software","techniques":["T1005","T1008","T1012","T1027.011","T1029","T1036.004","T1036.005","T1059.003","T1071.001","T1105","T1106","T1112","T1569.002","T1573.002"]},{"id":"S0004","name":"TinyZBot","type":"software","techniques":["T1056.001","T1059.003","T1113","T1115","T1543.003","T1547.001","T1547.009","T1562.001"]},{"id":"S0671","name":"Tomiris","type":"software","techniques":["T1005","T1027.002","T1041","T1053.005","T1071.001","T1105","T1497.003","T1568"]},{"id":"S0183","name":"Tor","type":"software","techniques":["T1090.003","T1573.002"]},{"id":"S0678","name":"Torisma","type":"software","techniques":["T1016","T1027.002","T1027.013","T1041","T1049","T1071.001","T1106","T1124","T1132.001","T1140","T1480","T1573.001","T1680"]},{"id":"S0682","name":"TrailBlazer","type":"software","techniques":["T1001","T1001.001","T1036","T1071.001","T1546.003"]},{"id":"S0266","name":"TrickBot","type":"software","techniques":["T1005","T1007","T1008","T1016","T1018","T1021.005","T1027","T1027.002","T1027.013","T1033","T1036","T1041","T1053.005","T1055","T1055.012","T1056.004","T1057","T1059.001","T1059.003","T1069","T1071.001","T1082","T1083","T1087.001","T1087.003","T1090.002","T1105","T1106","T1110.004","T1112","T1132.001","T1135","T1140","T1185","T1204.002","T1210","T1219","T1482","T1495","T1497.003","T1542.003","T1543.003","T1547.001","T1552.001","T1552.002","T1553.002","T1555.003","T1555.005","T1559.001","T1562.001","T1564.003","T1566.001","T1566.002","T1571","T1573.001"]},{"id":"S0094","name":"Trojan.Karagany","type":"software","techniques":["T1003","T1010","T1016","T1027","T1027.002","T1033","T1049","T1055.003","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1074.001","T1082","T1083","T1105","T1113","T1497.001","T1547.001","T1555.003","T1573.002"]},{"id":"S1196","name":"Troll Stealer","type":"software","techniques":["T1005","T1016","T1027.002","T1036.005","T1041","T1059.001","T1059.003","T1070.004","T1071.001","T1074.001","T1082","T1083","T1113","T1132.001","T1213","T1217","T1218.011","T1480.002","T1552.004","T1553.002","T1560","T1573.001"]},{"id":"S0178","name":"Truvasys","type":"software","techniques":["T1036.004","T1547.001"]},{"id":"S0647","name":"Turian","type":"software","techniques":["T1001.001","T1016","T1027","T1033","T1036.004","T1059.003","T1059.004","T1059.006","T1071.001","T1074.001","T1082","T1083","T1105","T1113","T1120","T1140","T1547.001","T1560.001"]},{"id":"S0333","name":"UBoatRAT","type":"software","techniques":["T1057","T1059.003","T1071.001","T1102.002","T1105","T1197","T1497.001","T1573.001"]},{"id":"S0275","name":"UPPERCUT","type":"software","techniques":["T1016","T1033","T1059.003","T1071.001","T1082","T1083","T1105","T1113","T1124","T1573.001"]},{"id":"S1164","name":"UPSTYLE","type":"software","techniques":["T1001.001","T1027.013","T1036","T1057","T1059.006","T1070.002","T1070.004","T1070.006","T1102.003","T1140","T1546","T1665"]},{"id":"S0136","name":"USBStealer","type":"software","techniques":["T1020","T1025","T1027.013","T1036.005","T1052.001","T1070.004","T1070.006","T1074.001","T1083","T1091","T1092","T1119","T1120","T1547.001"]},{"id":"S0452","name":"USBferry","type":"software","techniques":["T1005","T1016","T1018","T1049","T1057","T1059.003","T1083","T1087.001","T1091","T1120","T1218.011"]},{"id":"S0221","name":"Umbreon","type":"software","techniques":["T1014","T1059.003","T1078.003","T1095","T1205"]},{"id":"S0130","name":"Unknown Logger","type":"software","techniques":["T1016","T1033","T1056.001","T1082","T1091","T1105","T1555.003","T1562.001"]},{"id":"S0022","name":"Uroburos","type":"software","techniques":["T1001.001","T1001.003","T1005","T1008","T1012","T1014","T1027.002","T1027.009","T1027.011","T1027.013","T1036.004","T1055.001","T1057","T1059.003","T1070.004","T1071.001","T1071.003","T1071.004","T1082","T1083","T1090.003","T1095","T1104","T1105","T1106","T1112","T1132.002","T1140","T1205","T1543.003","T1559","T1564.005","T1572","T1573.001","T1573.002","T1620"]},{"id":"S0386","name":"Ursnif","type":"software","techniques":["T1005","T1007","T1012","T1027.010","T1027.013","T1036.005","T1041","T1047","T1055.005","T1055.012","T1056.004","T1057","T1059.001","T1059.005","T1070.004","T1071.001","T1074.001","T1080","T1082","T1090","T1090.003","T1091","T1105","T1106","T1112","T1113","T1132","T1140","T1185","T1497.003","T1543.003","T1547.001","T1559.001","T1564.003","T1568.002"]},{"id":"S0442","name":"VBShower","type":"software","techniques":["T1059.005","T1070.004","T1071.001","T1105","T1547.001"]},{"id":"S0257","name":"VERMIN","type":"software","techniques":["T1016","T1027.002","T1027.013","T1033","T1056.001","T1057","T1070.004","T1071.001","T1082","T1105","T1113","T1115","T1119","T1123","T1140","T1518.001","T1560"]},{"id":"S1218","name":"VIRTUALPIE","type":"software","techniques":["T1059.006","T1059.012","T1505.006","T1570","T1571","T1573.001"]},{"id":"S1217","name":"VIRTUALPITA","type":"software","techniques":["T1036.004","T1036.005","T1037","T1059.004","T1059.006","T1105","T1489","T1562.003","T1570","T1571","T1673","T1675"]},{"id":"S0476","name":"Valak","type":"software","techniques":["T1008","T1012","T1016","T1027","T1027.002","T1027.011","T1033","T1041","T1047","T1053.005","T1057","T1059.001","T1059.007","T1071.001","T1082","T1087.001","T1087.002","T1104","T1105","T1112","T1113","T1114.002","T1119","T1132.001","T1140","T1204.002","T1218.010","T1518.001","T1552.002","T1555.004","T1559.002","T1564.004","T1566.001","T1566.002"]},{"id":"S0636","name":"VaporRage","type":"software","techniques":["T1071.001","T1105","T1140","T1480"]},{"id":"S0207","name":"Vasport","type":"software","techniques":["T1071.001","T1090","T1105","T1547.001"]},{"id":"S1154","name":"VersaMem","type":"software","techniques":["T1027.013","T1040","T1056.004","T1059","T1070.004","T1074.001","T1129","T1203"]},{"id":"S0180","name":"Volgmer","type":"software","techniques":["T1007","T1012","T1016","T1027.011","T1027.013","T1036.004","T1049","T1057","T1059.003","T1070.004","T1082","T1083","T1105","T1106","T1112","T1140","T1543.003","T1573.001","T1573.002"]},{"id":"S1116","name":"WARPWIRE","type":"software","techniques":["T1048.003","T1056.003","T1059.007","T1132.001","T1554"]},{"id":"S0109","name":"WEBC2","type":"software","techniques":["T1059.003","T1105","T1574.001"]},{"id":"S0155","name":"WINDSHIELD","type":"software","techniques":["T1012","T1033","T1070.004","T1082","T1095"]},{"id":"S0219","name":"WINERACK","type":"software","techniques":["T1007","T1010","T1033","T1057","T1059","T1082","T1083"]},{"id":"S1115","name":"WIREFIRE","type":"software","techniques":["T1071.001","T1105","T1132.001","T1140","T1505.003","T1554","T1573.001"]},{"id":"S0366","name":"WannaCry","type":"software","techniques":["T1016","T1018","T1047","T1083","T1090.003","T1120","T1210","T1222.001","T1486","T1489","T1490","T1543.003","T1563.002","T1564.001","T1570","T1573.002"]},{"id":"S0670","name":"WarzoneRAT","type":"software","techniques":["T1005","T1014","T1021.001","T1021.005","T1041","T1055","T1056.001","T1057","T1059.001","T1059.003","T1082","T1083","T1090","T1095","T1105","T1106","T1112","T1125","T1140","T1204.002","T1221","T1546.015","T1547.001","T1548.002","T1555.003","T1562.001","T1564","T1564.003","T1566.001","T1573.001"]},{"id":"S0612","name":"WastedLocker","type":"software","techniques":["T1012","T1027.013","T1027.016","T1059.003","T1083","T1106","T1112","T1120","T1135","T1140","T1222.001","T1486","T1490","T1497.001","T1543.003","T1548.002","T1564.001","T1564.004","T1569.002","T1574.001"]},{"id":"S0579","name":"Waterbear","type":"software","techniques":["T1012","T1027.005","T1027.013","T1049","T1055","T1055.003","T1057","T1105","T1106","T1112","T1140","T1518.001","T1562.006","T1574.001"]},{"id":"S0515","name":"WellMail","type":"software","techniques":["T1005","T1016","T1033","T1095","T1105","T1140","T1560","T1571","T1573.002"]},{"id":"S0514","name":"WellMess","type":"software","techniques":["T1001.001","T1005","T1016","T1033","T1059.001","T1059.003","T1069.002","T1071.001","T1071.004","T1082","T1105","T1132.001","T1140","T1573.001","T1573.002"]},{"id":"S0645","name":"Wevtutil","type":"software","techniques":["T1005","T1070.001","T1562.002"]},{"id":"S0689","name":"WhisperGate","type":"software","techniques":["T1027.013","T1036","T1055.012","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1083","T1102","T1105","T1106","T1134.002","T1135","T1140","T1218.004","T1485","T1497.001","T1497.003","T1518.001","T1529","T1542.003","T1561.001","T1561.002","T1562.001","T1569.002","T1620","T1680"]},{"id":"S0206","name":"Wiarp","type":"software","techniques":["T1055","T1059.003","T1105","T1543.003"]},{"id":"S0059","name":"WinMM","type":"software","techniques":["T1008","T1033","T1057","T1071.001","T1082","T1083"]},{"id":"S0466","name":"WindTail","type":"software","techniques":["T1027.013","T1027.015","T1036","T1036.001","T1048.003","T1059.004","T1070.004","T1071.001","T1083","T1106","T1119","T1124","T1140","T1560.001","T1564.003"]},{"id":"S0176","name":"Wingbird","type":"software","techniques":["T1055","T1068","T1070.004","T1082","T1518.001","T1543.003","T1547.008","T1569.002","T1574.001"]},{"id":"S0430","name":"Winnti for Linux","type":"software","techniques":["T1014","T1027.013","T1071.001","T1095","T1105","T1140","T1205","T1573.001"]},{"id":"S0141","name":"Winnti for Windows","type":"software","techniques":["T1027.013","T1027.015","T1036.005","T1057","T1070.004","T1070.006","T1071.001","T1082","T1083","T1090.001","T1090.002","T1095","T1105","T1106","T1140","T1218.011","T1480.001","T1543.003","T1547.001","T1548.002","T1569.002","T1573.001"]},{"id":"S1065","name":"Woody RAT","type":"software","techniques":["T1005","T1012","T1016","T1016.001","T1027.013","T1033","T1041","T1055","T1055.012","T1057","T1059.001","T1059.003","T1070.004","T1071.001","T1082","T1083","T1087","T1105","T1106","T1113","T1140","T1203","T1204.002","T1518","T1518.001","T1562.006","T1566.001","T1573.001","T1573.002","T1680"]},{"id":"S0161","name":"XAgentOSX","type":"software","techniques":["T1033","T1056.001","T1057","T1070.004","T1071.002","T1082","T1083","T1106","T1113","T1555.003"]},{"id":"S0658","name":"XCSSET","type":"software","techniques":["T1005","T1027.013","T1036","T1041","T1056.002","T1059.004","T1068","T1082","T1083","T1087","T1098.004","T1105","T1113","T1195.001","T1222.002","T1486","T1497.003","T1518","T1518.001","T1539","T1543.004","T1546","T1546.004","T1548.006","T1553.001","T1554","T1560","T1564.001","T1569.001","T1573.001","T1574.006","T1614.001","T1647"]},{"id":"S1207","name":"XLoader","type":"software","techniques":["T1027.002","T1027.013","T1033","T1053.005","T1055.004","T1055.012","T1056.001","T1059.010","T1070.004","T1071.001","T1082","T1106","T1113","T1115","T1140","T1185","T1203","T1497","T1497.001","T1529","T1539","T1547.001","T1555","T1555.003","T1562.001","T1566.001","T1583.001","T1622"]},{"id":"S1248","name":"XORIndex Loader","type":"software","techniques":["T1016","T1027.010","T1027.013","T1033","T1036.005","T1041","T1059.007","T1071.001","T1082","T1105","T1140","T1614"]},{"id":"S0117","name":"XTunnel","type":"software","techniques":["T1008","T1027","T1027.016","T1046","T1059.003","T1090","T1552.001","T1573.002"]},{"id":"S0341","name":"Xbash","type":"software","techniques":["T1016","T1046","T1053.003","T1059.001","T1059.005","T1059.007","T1071.001","T1102.001","T1105","T1110.001","T1203","T1218.005","T1218.010","T1485","T1486","T1547.001"]},{"id":"S0388","name":"YAHOYAH","type":"software","techniques":["T1027.013","T1071.001","T1082","T1105","T1140","T1518.001"]},{"id":"S1114","name":"ZIPLINE","type":"software","techniques":["T1057","T1059.004","T1083","T1090","T1095","T1105","T1205","T1562.001","T1573.001"]},{"id":"S0086","name":"ZLib","type":"software","techniques":["T1007","T1036.005","T1041","T1059.003","T1071.001","T1082","T1083","T1105","T1113","T1543.003","T1560.002"]},{"id":"S0251","name":"Zebrocy","type":"software","techniques":["T1012","T1016","T1027.002","T1033","T1037.001","T1041","T1047","T1049","T1053.005","T1056.004","T1057","T1059.003","T1070.004","T1071.001","T1071.003","T1074.001","T1082","T1083","T1105","T1113","T1119","T1120","T1124","T1132.001","T1135","T1140","T1547.001","T1555.003","T1560","T1573.002","T1680"]},{"id":"S1151","name":"ZeroCleare","type":"software","techniques":["T1059","T1059.001","T1068","T1070.004","T1106","T1553.002","T1561.002","T1680"]},{"id":"S0230","name":"ZeroT","type":"software","techniques":["T1001.002","T1016","T1027.002","T1027.013","T1027.016","T1071.001","T1082","T1105","T1140","T1543.003","T1548.002","T1573.001","T1574.001"]},{"id":"S0027","name":"Zeroaccess","type":"software","techniques":["T1014","T1564.004"]},{"id":"S0330","name":"Zeus Panda","type":"software","techniques":["T1012","T1027.010","T1027.013","T1055.002","T1056.001","T1056.004","T1057","T1059","T1059.001","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1112","T1113","T1115","T1124","T1140","T1518.001","T1547.001","T1614.001"]},{"id":"S0672","name":"Zox","type":"software","techniques":["T1001.002","T1005","T1021.002","T1027.013","T1057","T1068","T1083","T1105","T1680"]},{"id":"S0412","name":"ZxShell","type":"software","techniques":["T1005","T1007","T1012","T1021.001","T1021.005","T1033","T1046","T1055.001","T1056.001","T1056.004","T1057","T1059.003","T1070.001","T1070.004","T1071.001","T1071.002","T1082","T1083","T1090","T1105","T1106","T1112","T1113","T1125","T1134.002","T1136.001","T1190","T1218.011","T1499","T1543.003","T1562.001","T1562.004","T1569.002","T1571"]},{"id":"S1013","name":"ZxxZ","type":"software","techniques":["T1005","T1012","T1027.013","T1033","T1036.004","T1053.005","T1057","T1082","T1105","T1106","T1140","T1204.002","T1518.001","T1566.001"]},{"id":"S0202","name":"adbupd","type":"software","techniques":["T1059.003","T1546.003","T1573.002"]},{"id":"S0471","name":"build_downer","type":"software","techniques":["T1027.003","T1036.004","T1105","T1106","T1124","T1518.001","T1547.001","T1680"]},{"id":"S1043","name":"ccf32","type":"software","techniques":["T1005","T1048.003","T1053.005","T1059.003","T1070.004","T1074.001","T1074.002","T1083","T1119","T1124","T1560.001","T1564.001"]},{"id":"S1204","name":"cd00r","type":"software","techniques":["T1016","T1040","T1095","T1205.001"]},{"id":"S0160","name":"certutil","type":"software","techniques":["T1105","T1140","T1553.004","T1560.001"]},{"id":"S0106","name":"cmd","type":"software","techniques":["T1059.003","T1070.004","T1082","T1083","T1105","T1570"]},{"id":"S0472","name":"down_new","type":"software","techniques":["T1016","T1057","T1071.001","T1083","T1105","T1132.001","T1518","T1518.001","T1573.001","T1680"]},{"id":"S0105","name":"dsquery","type":"software","techniques":["T1069.002","T1082","T1087.002","T1482"]},{"id":"S0404","name":"esentutl","type":"software","techniques":["T1003.003","T1005","T1006","T1105","T1564.004","T1570"]},{"id":"S0095","name":"ftp","type":"software","techniques":["T1048.003","T1105","T1570"]},{"id":"S0032","name":"gh0st RAT","type":"software","techniques":["T1012","T1055","T1056.001","T1057","T1059","T1070.001","T1070.004","T1082","T1095","T1105","T1106","T1112","T1113","T1129","T1132.001","T1140","T1218.011","T1543.003","T1547.001","T1568.001","T1569.002","T1573","T1573.001","T1574.001"]},{"id":"S0008","name":"gsecdump","type":"software","techniques":["T1003.002","T1003.004"]},{"id":"S0071","name":"hcdLoader","type":"software","techniques":["T1059.003","T1543.003"]},{"id":"S0068","name":"httpclient","type":"software","techniques":["T1059.003","T1071.001","T1573.001"]},{"id":"S0278","name":"iKitten","type":"software","techniques":["T1016","T1037.004","T1056.002","T1057","T1555.001","T1560.001","T1564.001"]},{"id":"S0283","name":"jRAT","type":"software","techniques":["T1007","T1016","T1021.001","T1027","T1027.002","T1029","T1037.005","T1047","T1049","T1056.001","T1057","T1059.003","T1059.005","T1059.007","T1070.004","T1082","T1083","T1090","T1105","T1113","T1115","T1120","T1123","T1125","T1518.001","T1552.001","T1552.004","T1555.003"]},{"id":"S1048","name":"macOS.OSAMiner","type":"software","techniques":["T1027.008","T1027.009","T1057","T1059.002","T1082","T1105","T1497.001","T1543.001","T1562.001","T1569.001","T1680"]},{"id":"S1059","name":"metaMain","type":"software","techniques":["T1005","T1027.013","T1033","T1041","T1055","T1056","T1056.001","T1057","T1070.004","T1070.006","T1071.001","T1074.001","T1082","T1083","T1090.001","T1095","T1105","T1106","T1112","T1113","T1140","T1205.001","T1497.003","T1546.003","T1560.003","T1573.001","T1574.001","T1620"]},{"id":"S0102","name":"nbtstat","type":"software","techniques":["T1016","T1049"]},{"id":"S0108","name":"netsh","type":"software","techniques":["T1090","T1518.001","T1546.007","T1562.004"]},{"id":"S0508","name":"ngrok","type":"software","techniques":["T1090","T1102","T1567","T1568.002","T1572"]},{"id":"S0385","name":"njRAT","type":"software","techniques":["T1005","T1010","T1012","T1018","T1021.001","T1027.004","T1027.013","T1033","T1041","T1056.001","T1057","T1059.001","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1083","T1091","T1105","T1106","T1112","T1113","T1120","T1125","T1132.001","T1547.001","T1555.003","T1562.004","T1568.001","T1571"]},{"id":"S0067","name":"pngdowner","type":"software","techniques":["T1070.004","T1071.001","T1552.001"]},{"id":"S1187","name":"reGeorg","type":"software","techniques":["T1021.001","T1021.002","T1021.004","T1059.006","T1071.001","T1090","T1095","T1105","T1505.003","T1572"]},{"id":"S0653","name":"xCaon","type":"software","techniques":["T1005","T1016","T1059.003","T1071.001","T1105","T1106","T1132.001","T1140","T1518.001","T1547","T1573.001"]},{"id":"S0248","name":"yty","type":"software","techniques":["T1005","T1016","T1018","T1027.002","T1027.016","T1033","T1053.005","T1056.001","T1057","T1082","T1083","T1102.002","T1113","T1497.001","T1680"]},{"id":"S0350","name":"zwShell","type":"software","techniques":["T1016","T1021.001","T1021.002","T1033","T1053.005","T1059.003","T1070.004","T1082","T1083","T1112","T1543.003"]}]} \ No newline at end of file diff --git a/src/assets/data/mitre-enterprise-v19.2.json b/src/assets/data/mitre-enterprise-v19.2.json new file mode 100644 index 0000000..355095b --- /dev/null +++ b/src/assets/data/mitre-enterprise-v19.2.json @@ -0,0 +1 @@ +{"version":"19.2","tacticOrder":["Reconnaissance","Resource Development","Initial Access","Execution","Persistence","Privilege Escalation","Stealth","Defense Impairment","Credential Access","Discovery","Lateral Movement","Collection","Command and Control","Exfiltration","Impact"],"techniques":[{"id":"T1001","name":"Data Obfuscation","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1001","sourceCount":3},{"id":"T1001.001","name":"Junk Data","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1001","url":"https://attack.mitre.org/techniques/T1001/001","sourceCount":3},{"id":"T1001.002","name":"Steganography","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows","ESXi"],"parent":"T1001","url":"https://attack.mitre.org/techniques/T1001/002","sourceCount":2},{"id":"T1001.003","name":"Protocol or Service Impersonation","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1001","url":"https://attack.mitre.org/techniques/T1001/003","sourceCount":4},{"id":"T1003","name":"OS Credential Dumping","tactics":["Credential Access"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1003","sourceCount":11},{"id":"T1003.001","name":"LSASS Memory","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/001","sourceCount":8},{"id":"T1003.002","name":"Security Account Manager","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/002","sourceCount":2},{"id":"T1003.003","name":"NTDS","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/003","sourceCount":3},{"id":"T1003.004","name":"LSA Secrets","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/004","sourceCount":6},{"id":"T1003.005","name":"Cached Domain Credentials","tactics":["Credential Access"],"platforms":["Windows","Linux"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/005","sourceCount":6},{"id":"T1003.006","name":"DCSync","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/006","sourceCount":13},{"id":"T1003.007","name":"Proc Filesystem","tactics":["Credential Access"],"platforms":["Linux"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/007","sourceCount":6},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["Credential Access"],"platforms":["Linux"],"parent":"T1003","url":"https://attack.mitre.org/techniques/T1003/008","sourceCount":4},{"id":"T1005","name":"Data from Local System","tactics":["Collection"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1005","sourceCount":4},{"id":"T1006","name":"Direct Volume Access","tactics":["Stealth"],"platforms":["Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1006","sourceCount":4},{"id":"T1007","name":"System Service Discovery","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1007","sourceCount":5},{"id":"T1008","name":"Fallback Channels","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1008","sourceCount":2},{"id":"T1010","name":"Application Window Discovery","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1010","sourceCount":3},{"id":"T1011","name":"Exfiltration Over Other Network Medium","tactics":["Exfiltration"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1011","sourceCount":1},{"id":"T1011.001","name":"Exfiltration Over Bluetooth","tactics":["Exfiltration"],"platforms":["Linux","macOS","Windows"],"parent":"T1011","url":"https://attack.mitre.org/techniques/T1011/001","sourceCount":1},{"id":"T1012","name":"Query Registry","tactics":["Discovery"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1012","sourceCount":2},{"id":"T1014","name":"Rootkit","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1014","sourceCount":5},{"id":"T1016","name":"System Network Configuration Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1016","sourceCount":4},{"id":"T1016.001","name":"Internet Connection Discovery","tactics":["Discovery"],"platforms":["Windows","Linux","macOS","ESXi"],"parent":"T1016","url":"https://attack.mitre.org/techniques/T1016/001","sourceCount":1},{"id":"T1016.002","name":"Wi-Fi Discovery","tactics":["Discovery"],"platforms":["Linux","Windows","macOS"],"parent":"T1016","url":"https://attack.mitre.org/techniques/T1016/002","sourceCount":7},{"id":"T1018","name":"Remote System Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1018","sourceCount":4},{"id":"T1020","name":"Automated Exfiltration","tactics":["Exfiltration"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1020","sourceCount":2},{"id":"T1020.001","name":"Traffic Duplication","tactics":["Exfiltration"],"platforms":["Network Devices","IaaS"],"parent":"T1020","url":"https://attack.mitre.org/techniques/T1020/001","sourceCount":8},{"id":"T1021","name":"Remote Services","tactics":["Lateral Movement"],"platforms":["Linux","macOS","Windows","IaaS","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1021","sourceCount":9},{"id":"T1021.001","name":"Remote Desktop Protocol","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/001","sourceCount":3},{"id":"T1021.002","name":"SMB/Windows Admin Shares","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/002","sourceCount":7},{"id":"T1021.003","name":"Distributed Component Object Model","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/003","sourceCount":11},{"id":"T1021.004","name":"SSH","tactics":["Lateral Movement"],"platforms":["ESXi","Linux","macOS"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/004","sourceCount":5},{"id":"T1021.005","name":"VNC","tactics":["Lateral Movement"],"platforms":["Linux","Windows","macOS"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/005","sourceCount":13},{"id":"T1021.006","name":"Windows Remote Management","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/006","sourceCount":5},{"id":"T1021.007","name":"Cloud Services","tactics":["Lateral Movement"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/007","sourceCount":1},{"id":"T1021.008","name":"Direct Cloud VM Connections","tactics":["Lateral Movement"],"platforms":["IaaS"],"parent":"T1021","url":"https://attack.mitre.org/techniques/T1021/008","sourceCount":6},{"id":"T1025","name":"Data from Removable Media","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1025","sourceCount":1},{"id":"T1027","name":"Obfuscated Files or Information","tactics":["Stealth"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1027","sourceCount":7},{"id":"T1027.001","name":"Binary Padding","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/001","sourceCount":4},{"id":"T1027.002","name":"Software Packing","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/002","sourceCount":3},{"id":"T1027.003","name":"Steganography","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/003","sourceCount":3},{"id":"T1027.004","name":"Compile After Delivery","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/004","sourceCount":4},{"id":"T1027.005","name":"Indicator Removal from Tools","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/005","sourceCount":1},{"id":"T1027.006","name":"HTML Smuggling","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/006","sourceCount":5},{"id":"T1027.007","name":"Dynamic API Resolution","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/007","sourceCount":5},{"id":"T1027.008","name":"Stripped Payloads","tactics":["Stealth"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/008","sourceCount":4},{"id":"T1027.009","name":"Embedded Payloads","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/009","sourceCount":8},{"id":"T1027.010","name":"Command Obfuscation","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/010","sourceCount":10},{"id":"T1027.011","name":"Fileless Storage","tactics":["Stealth"],"platforms":["Linux","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/011","sourceCount":9},{"id":"T1027.012","name":"LNK Icon Smuggling","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/012","sourceCount":3},{"id":"T1027.013","name":"Encrypted/Encoded File","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/013","sourceCount":3},{"id":"T1027.014","name":"Polymorphic Code","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/014","sourceCount":5},{"id":"T1027.015","name":"Compression","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/015","sourceCount":5},{"id":"T1027.016","name":"Junk Code Insertion","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/016","sourceCount":3},{"id":"T1027.017","name":"SVG Smuggling","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/017","sourceCount":5},{"id":"T1027.018","name":"Invisible Unicode","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1027","url":"https://attack.mitre.org/techniques/T1027/018","sourceCount":8},{"id":"T1029","name":"Scheduled Transfer","tactics":["Exfiltration"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1029","sourceCount":1},{"id":"T1030","name":"Data Transfer Size Limits","tactics":["Exfiltration"],"platforms":["Linux","macOS","Windows","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1030","sourceCount":2},{"id":"T1033","name":"System Owner/User Discovery","tactics":["Discovery"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1033","sourceCount":3},{"id":"T1036","name":"Masquerading","tactics":["Stealth"],"platforms":["Containers","ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1036","sourceCount":2},{"id":"T1036.001","name":"Invalid Code Signature","tactics":["Stealth"],"platforms":["macOS","Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/001","sourceCount":2},{"id":"T1036.002","name":"Right-to-Left Override","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/002","sourceCount":4},{"id":"T1036.003","name":"Rename Legitimate Utilities","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/003","sourceCount":7},{"id":"T1036.004","name":"Masquerade Task or Service","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/004","sourceCount":5},{"id":"T1036.005","name":"Match Legitimate Resource Name or Location","tactics":["Stealth"],"platforms":["Containers","ESXi","Linux","macOS","Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/005","sourceCount":2},{"id":"T1036.006","name":"Space after Filename","tactics":["Stealth"],"platforms":["Linux","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/006","sourceCount":2},{"id":"T1036.007","name":"Double File Extension","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/007","sourceCount":3},{"id":"T1036.008","name":"Masquerade File Type","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/008","sourceCount":2},{"id":"T1036.009","name":"Break Process Trees","tactics":["Stealth"],"platforms":["Linux","macOS"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/009","sourceCount":4},{"id":"T1036.010","name":"Masquerade Account Name","tactics":["Stealth"],"platforms":["Containers","IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/010","sourceCount":5},{"id":"T1036.011","name":"Overwrite Process Arguments","tactics":["Stealth"],"platforms":["Linux"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/011","sourceCount":3},{"id":"T1036.012","name":"Browser Fingerprint","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1036","url":"https://attack.mitre.org/techniques/T1036/012","sourceCount":3},{"id":"T1037","name":"Boot or Logon Initialization Scripts","tactics":["Persistence","Privilege Escalation"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1037","sourceCount":3},{"id":"T1037.001","name":"Logon Script (Windows)","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/001","sourceCount":3},{"id":"T1037.002","name":"Login Hook","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/002","sourceCount":5},{"id":"T1037.003","name":"Network Logon Script","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/003","sourceCount":2},{"id":"T1037.004","name":"RC Scripts","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS","Linux","Network Devices","ESXi"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/004","sourceCount":9},{"id":"T1037.005","name":"Startup Items","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1037","url":"https://attack.mitre.org/techniques/T1037/005","sourceCount":3},{"id":"T1039","name":"Data from Network Shared Drive","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1039","sourceCount":1},{"id":"T1040","name":"Network Sniffing","tactics":["Credential Access","Discovery"],"platforms":["IaaS","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1040","sourceCount":8},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["Exfiltration"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1041","sourceCount":2},{"id":"T1046","name":"Network Service Discovery","tactics":["Discovery"],"platforms":["Containers","IaaS","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1046","sourceCount":4},{"id":"T1047","name":"Windows Management Instrumentation","tactics":["Execution"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1047","sourceCount":6},{"id":"T1048","name":"Exfiltration Over Alternative Protocol","tactics":["Exfiltration"],"platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1048","sourceCount":4},{"id":"T1048.001","name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","tactics":["Exfiltration"],"platforms":["Linux","macOS","Windows","ESXi"],"parent":"T1048","url":"https://attack.mitre.org/techniques/T1048/001","sourceCount":2},{"id":"T1048.002","name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["Exfiltration"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1048","url":"https://attack.mitre.org/techniques/T1048/002","sourceCount":2},{"id":"T1048.003","name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["Exfiltration"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1048","url":"https://attack.mitre.org/techniques/T1048/003","sourceCount":3},{"id":"T1049","name":"System Network Connections Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1049","sourceCount":6},{"id":"T1052","name":"Exfiltration Over Physical Medium","tactics":["Exfiltration"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1052","sourceCount":1},{"id":"T1052.001","name":"Exfiltration over USB","tactics":["Exfiltration"],"platforms":["Linux","Windows","macOS"],"parent":"T1052","url":"https://attack.mitre.org/techniques/T1052/001","sourceCount":1},{"id":"T1053","name":"Scheduled Task/Job","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1053","sourceCount":3},{"id":"T1053.002","name":"At","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Windows","Linux","macOS"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/002","sourceCount":10},{"id":"T1053.003","name":"Cron","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Linux","macOS","ESXi"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/003","sourceCount":3},{"id":"T1053.005","name":"Scheduled Task","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/005","sourceCount":12},{"id":"T1053.006","name":"Systemd Timers","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Linux"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/006","sourceCount":8},{"id":"T1053.007","name":"Container Orchestration Job","tactics":["Execution","Persistence","Privilege Escalation"],"platforms":["Containers"],"parent":"T1053","url":"https://attack.mitre.org/techniques/T1053/007","sourceCount":4},{"id":"T1055","name":"Process Injection","tactics":["Privilege Escalation","Stealth"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1055","sourceCount":1},{"id":"T1055.001","name":"Dynamic-link Library Injection","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/001","sourceCount":5},{"id":"T1055.002","name":"Portable Executable Injection","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/002","sourceCount":2},{"id":"T1055.003","name":"Thread Execution Hijacking","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/003","sourceCount":2},{"id":"T1055.004","name":"Asynchronous Procedure Call","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/004","sourceCount":5},{"id":"T1055.005","name":"Thread Local Storage","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/005","sourceCount":2},{"id":"T1055.008","name":"Ptrace System Calls","tactics":["Privilege Escalation","Stealth"],"platforms":["Linux"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/008","sourceCount":4},{"id":"T1055.009","name":"Proc Memory","tactics":["Privilege Escalation","Stealth"],"platforms":["Linux"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/009","sourceCount":4},{"id":"T1055.011","name":"Extra Window Memory Injection","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/011","sourceCount":7},{"id":"T1055.012","name":"Process Hollowing","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/012","sourceCount":3},{"id":"T1055.013","name":"Process Doppelgänging","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/013","sourceCount":5},{"id":"T1055.014","name":"VDSO Hijacking","tactics":["Privilege Escalation","Stealth"],"platforms":["Linux"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/014","sourceCount":5},{"id":"T1055.015","name":"ListPlanting","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1055","url":"https://attack.mitre.org/techniques/T1055/015","sourceCount":5},{"id":"T1056","name":"Input Capture","tactics":["Credential Access","Collection"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1056","sourceCount":2},{"id":"T1056.001","name":"Keylogging","tactics":["Credential Access","Collection"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":"T1056","url":"https://attack.mitre.org/techniques/T1056/001","sourceCount":4},{"id":"T1056.002","name":"GUI Input Capture","tactics":["Credential Access","Collection"],"platforms":["Linux","macOS","Windows"],"parent":"T1056","url":"https://attack.mitre.org/techniques/T1056/002","sourceCount":6},{"id":"T1056.003","name":"Web Portal Capture","tactics":["Credential Access","Collection"],"platforms":["Linux","macOS","Windows"],"parent":"T1056","url":"https://attack.mitre.org/techniques/T1056/003","sourceCount":2},{"id":"T1056.004","name":"Credential API Hooking","tactics":["Credential Access","Collection"],"platforms":["Windows","Linux","macOS"],"parent":"T1056","url":"https://attack.mitre.org/techniques/T1056/004","sourceCount":16},{"id":"T1057","name":"Process Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1057","sourceCount":5},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["Execution"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1059","sourceCount":4},{"id":"T1059.001","name":"PowerShell","tactics":["Execution"],"platforms":["Windows"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/001","sourceCount":9},{"id":"T1059.002","name":"AppleScript","tactics":["Execution"],"platforms":["macOS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/002","sourceCount":5},{"id":"T1059.003","name":"Windows Command Shell","tactics":["Execution"],"platforms":["Windows"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/003","sourceCount":2},{"id":"T1059.004","name":"Unix Shell","tactics":["Execution"],"platforms":["ESXi","Linux","macOS","Network Devices"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/004","sourceCount":3},{"id":"T1059.005","name":"Visual Basic","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/005","sourceCount":7},{"id":"T1059.006","name":"Python","tactics":["Execution"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/006","sourceCount":2},{"id":"T1059.007","name":"JavaScript","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/007","sourceCount":10},{"id":"T1059.008","name":"Network Device CLI","tactics":["Execution"],"platforms":["Network Devices"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/008","sourceCount":3},{"id":"T1059.009","name":"Cloud API","tactics":["Execution"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/009","sourceCount":2},{"id":"T1059.010","name":"AutoHotKey & AutoIT","tactics":["Execution"],"platforms":["Windows"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/010","sourceCount":4},{"id":"T1059.011","name":"Lua","tactics":["Execution"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/011","sourceCount":7},{"id":"T1059.012","name":"Hypervisor CLI","tactics":["Execution"],"platforms":["ESXi"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/012","sourceCount":4},{"id":"T1059.013","name":"Container CLI/API","tactics":["Execution"],"platforms":["Containers"],"parent":"T1059","url":"https://attack.mitre.org/techniques/T1059/013","sourceCount":5},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["Privilege Escalation"],"platforms":["Containers","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1068","sourceCount":4},{"id":"T1069","name":"Permission Groups Discovery","tactics":["Discovery"],"platforms":["Containers","IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1069","sourceCount":3},{"id":"T1069.001","name":"Local Groups","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":"T1069","url":"https://attack.mitre.org/techniques/T1069/001","sourceCount":1},{"id":"T1069.002","name":"Domain Groups","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":"T1069","url":"https://attack.mitre.org/techniques/T1069/002","sourceCount":1},{"id":"T1069.003","name":"Cloud Groups","tactics":["Discovery"],"platforms":["SaaS","IaaS","Office Suite","Identity Provider"],"parent":"T1069","url":"https://attack.mitre.org/techniques/T1069/003","sourceCount":8},{"id":"T1070","name":"Indicator Removal","tactics":["Stealth"],"platforms":["Containers","ESXi","Linux","macOS","Network Devices","Office Suite","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1070","sourceCount":1},{"id":"T1070.003","name":"Clear Command History","tactics":["Stealth"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/003","sourceCount":6},{"id":"T1070.004","name":"File Deletion","tactics":["Stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/004","sourceCount":2},{"id":"T1070.005","name":"Network Share Connection Removal","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/005","sourceCount":2},{"id":"T1070.006","name":"Timestomp","tactics":["Stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/006","sourceCount":7},{"id":"T1070.007","name":"Clear Network Connection History and Configurations","tactics":["Stealth"],"platforms":["Linux","macOS","Windows","Network Devices"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/007","sourceCount":6},{"id":"T1070.008","name":"Clear Mailbox Data","tactics":["Stealth"],"platforms":["Linux","macOS","Office Suite","Windows"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/008","sourceCount":6},{"id":"T1070.009","name":"Clear Persistence","tactics":["Stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/009","sourceCount":4},{"id":"T1070.010","name":"Relocate Malware","tactics":["Stealth"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":"T1070","url":"https://attack.mitre.org/techniques/T1070/010","sourceCount":3},{"id":"T1071","name":"Application Layer Protocol","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows","Network Devices","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1071","sourceCount":3},{"id":"T1071.001","name":"Web Protocols","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/001","sourceCount":4},{"id":"T1071.002","name":"File Transfer Protocols","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/002","sourceCount":4},{"id":"T1071.003","name":"Mail Protocols","tactics":["Command and Control"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/003","sourceCount":3},{"id":"T1071.004","name":"DNS","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/004","sourceCount":6},{"id":"T1071.005","name":"Publish/Subscribe Protocols","tactics":["Command and Control"],"platforms":["macOS","Linux","Windows","Network Devices"],"parent":"T1071","url":"https://attack.mitre.org/techniques/T1071/005","sourceCount":3},{"id":"T1072","name":"Software Deployment Tools","tactics":["Execution","Lateral Movement"],"platforms":["Linux","macOS","Network Devices","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1072","sourceCount":4},{"id":"T1074","name":"Data Staged","tactics":["Collection"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1074","sourceCount":3},{"id":"T1074.001","name":"Local Data Staging","tactics":["Collection"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1074","url":"https://attack.mitre.org/techniques/T1074/001","sourceCount":2},{"id":"T1074.002","name":"Remote Data Staging","tactics":["Collection"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"parent":"T1074","url":"https://attack.mitre.org/techniques/T1074/002","sourceCount":2},{"id":"T1078","name":"Valid Accounts","tactics":["Initial Access","Persistence","Privilege Escalation","Stealth"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1078","sourceCount":4},{"id":"T1078.001","name":"Default Accounts","tactics":["Initial Access","Persistence","Privilege Escalation","Stealth"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"parent":"T1078","url":"https://attack.mitre.org/techniques/T1078/001","sourceCount":7},{"id":"T1078.002","name":"Domain Accounts","tactics":["Initial Access","Persistence","Privilege Escalation","Stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1078","url":"https://attack.mitre.org/techniques/T1078/002","sourceCount":3},{"id":"T1078.003","name":"Local Accounts","tactics":["Initial Access","Persistence","Privilege Escalation","Stealth"],"platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1078","url":"https://attack.mitre.org/techniques/T1078/003","sourceCount":1},{"id":"T1078.004","name":"Cloud Accounts","tactics":["Initial Access","Persistence","Privilege Escalation","Stealth"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1078","url":"https://attack.mitre.org/techniques/T1078/004","sourceCount":5},{"id":"T1080","name":"Taint Shared Content","tactics":["Lateral Movement"],"platforms":["Windows","SaaS","Linux","macOS","Office Suite"],"parent":null,"url":"https://attack.mitre.org/techniques/T1080","sourceCount":2},{"id":"T1082","name":"System Information Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1082","sourceCount":9},{"id":"T1083","name":"File and Directory Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1083","sourceCount":3},{"id":"T1087","name":"Account Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1087","sourceCount":4},{"id":"T1087.001","name":"Local Account","tactics":["Discovery"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1087","url":"https://attack.mitre.org/techniques/T1087/001","sourceCount":6},{"id":"T1087.002","name":"Domain Account","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":"T1087","url":"https://attack.mitre.org/techniques/T1087/002","sourceCount":2},{"id":"T1087.003","name":"Email Account","tactics":["Discovery"],"platforms":["Windows","Office Suite"],"parent":"T1087","url":"https://attack.mitre.org/techniques/T1087/003","sourceCount":5},{"id":"T1087.004","name":"Cloud Account","tactics":["Discovery"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1087","url":"https://attack.mitre.org/techniques/T1087/004","sourceCount":8},{"id":"T1090","name":"Proxy","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1090","sourceCount":3},{"id":"T1090.001","name":"Internal Proxy","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1090","url":"https://attack.mitre.org/techniques/T1090/001","sourceCount":3},{"id":"T1090.002","name":"External Proxy","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1090","url":"https://attack.mitre.org/techniques/T1090/002","sourceCount":3},{"id":"T1090.003","name":"Multi-hop Proxy","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1090","url":"https://attack.mitre.org/techniques/T1090/003","sourceCount":4},{"id":"T1090.004","name":"Domain Fronting","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows","ESXi"],"parent":"T1090","url":"https://attack.mitre.org/techniques/T1090/004","sourceCount":2},{"id":"T1091","name":"Replication Through Removable Media","tactics":["Initial Access","Lateral Movement"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1091","sourceCount":4},{"id":"T1092","name":"Communication Through Removable Media","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1092","sourceCount":2},{"id":"T1095","name":"Non-Application Layer Protocol","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1095","sourceCount":7},{"id":"T1098","name":"Account Manipulation","tactics":["Persistence","Privilege Escalation"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1098","sourceCount":6},{"id":"T1098.001","name":"Additional Cloud Credentials","tactics":["Persistence","Privilege Escalation"],"platforms":["IaaS","Identity Provider","SaaS"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/001","sourceCount":16},{"id":"T1098.002","name":"Additional Email Delegate Permissions","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows","Office Suite"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/002","sourceCount":8},{"id":"T1098.003","name":"Additional Cloud Roles","tactics":["Persistence","Privilege Escalation"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/003","sourceCount":8},{"id":"T1098.004","name":"SSH Authorized Keys","tactics":["Persistence","Privilege Escalation"],"platforms":["ESXi","IaaS","Linux","macOS","Network Devices"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/004","sourceCount":9},{"id":"T1098.005","name":"Device Registration","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows","Identity Provider"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/005","sourceCount":10},{"id":"T1098.006","name":"Additional Container Cluster Roles","tactics":["Persistence","Privilege Escalation"],"platforms":["Containers"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/006","sourceCount":7},{"id":"T1098.007","name":"Additional Local or Domain Groups","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows","macOS","Linux"],"parent":"T1098","url":"https://attack.mitre.org/techniques/T1098/007","sourceCount":7},{"id":"T1102","name":"Web Service","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1102","sourceCount":3},{"id":"T1102.001","name":"Dead Drop Resolver","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1102","url":"https://attack.mitre.org/techniques/T1102/001","sourceCount":2},{"id":"T1102.002","name":"Bidirectional Communication","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1102","url":"https://attack.mitre.org/techniques/T1102/002","sourceCount":2},{"id":"T1102.003","name":"One-Way Communication","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows","ESXi"],"parent":"T1102","url":"https://attack.mitre.org/techniques/T1102/003","sourceCount":2},{"id":"T1104","name":"Multi-Stage Channels","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1104","sourceCount":1},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1105","sourceCount":7},{"id":"T1106","name":"Native API","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1106","sourceCount":16},{"id":"T1110","name":"Brute Force","tactics":["Credential Access"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1110","sourceCount":4},{"id":"T1110.001","name":"Password Guessing","tactics":["Credential Access"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"parent":"T1110","url":"https://attack.mitre.org/techniques/T1110/001","sourceCount":4},{"id":"T1110.002","name":"Password Cracking","tactics":["Credential Access"],"platforms":["Identity Provider","Linux","macOS","Network Devices","Office Suite","Windows"],"parent":"T1110","url":"https://attack.mitre.org/techniques/T1110/002","sourceCount":3},{"id":"T1110.003","name":"Password Spraying","tactics":["Credential Access"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","Network Devices","Office Suite","SaaS","Windows","macOS"],"parent":"T1110","url":"https://attack.mitre.org/techniques/T1110/003","sourceCount":5},{"id":"T1110.004","name":"Credential Stuffing","tactics":["Credential Access"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"parent":"T1110","url":"https://attack.mitre.org/techniques/T1110/004","sourceCount":2},{"id":"T1111","name":"Multi-Factor Authentication Interception","tactics":["Credential Access"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1111","sourceCount":4},{"id":"T1112","name":"Modify Registry","tactics":["Persistence","Defense Impairment"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1112","sourceCount":11},{"id":"T1113","name":"Screen Capture","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1113","sourceCount":3},{"id":"T1114","name":"Email Collection","tactics":["Collection"],"platforms":["Windows","macOS","Linux","Office Suite"],"parent":null,"url":"https://attack.mitre.org/techniques/T1114","sourceCount":4},{"id":"T1114.001","name":"Local Email Collection","tactics":["Collection"],"platforms":["Windows"],"parent":"T1114","url":"https://attack.mitre.org/techniques/T1114/001","sourceCount":3},{"id":"T1114.002","name":"Remote Email Collection","tactics":["Collection"],"platforms":["Office Suite","Windows"],"parent":"T1114","url":"https://attack.mitre.org/techniques/T1114/002","sourceCount":1},{"id":"T1114.003","name":"Email Forwarding Rule","tactics":["Collection"],"platforms":["Linux","macOS","Office Suite","Windows"],"parent":"T1114","url":"https://attack.mitre.org/techniques/T1114/003","sourceCount":6},{"id":"T1115","name":"Clipboard Data","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1115","sourceCount":6},{"id":"T1119","name":"Automated Collection","tactics":["Collection"],"platforms":["IaaS","Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1119","sourceCount":2},{"id":"T1120","name":"Peripheral Device Discovery","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1120","sourceCount":3},{"id":"T1123","name":"Audio Capture","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1123","sourceCount":2},{"id":"T1124","name":"System Time Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1124","sourceCount":13},{"id":"T1125","name":"Video Capture","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1125","sourceCount":2},{"id":"T1127","name":"Trusted Developer Utilities Proxy Execution","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1127","sourceCount":7},{"id":"T1127.001","name":"MSBuild","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1127","url":"https://attack.mitre.org/techniques/T1127/001","sourceCount":4},{"id":"T1127.002","name":"ClickOnce","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1127","url":"https://attack.mitre.org/techniques/T1127/002","sourceCount":7},{"id":"T1127.003","name":"JamPlus","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1127","url":"https://attack.mitre.org/techniques/T1127/003","sourceCount":4},{"id":"T1129","name":"Shared Modules","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1129","sourceCount":6},{"id":"T1132","name":"Data Encoding","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1132","sourceCount":4},{"id":"T1132.001","name":"Standard Encoding","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1132","url":"https://attack.mitre.org/techniques/T1132/001","sourceCount":4},{"id":"T1132.002","name":"Non-Standard Encoding","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1132","url":"https://attack.mitre.org/techniques/T1132/002","sourceCount":3},{"id":"T1133","name":"External Remote Services","tactics":["Initial Access","Persistence"],"platforms":["Containers","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1133","sourceCount":7},{"id":"T1134","name":"Access Token Manipulation","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1134","sourceCount":2},{"id":"T1134.001","name":"Token Impersonation/Theft","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/001","sourceCount":2},{"id":"T1134.002","name":"Create Process with Token","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/002","sourceCount":2},{"id":"T1134.003","name":"Make and Impersonate Token","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/003","sourceCount":2},{"id":"T1134.004","name":"Parent PID Spoofing","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/004","sourceCount":6},{"id":"T1134.005","name":"SID-History Injection","tactics":["Privilege Escalation","Stealth"],"platforms":["Windows"],"parent":"T1134","url":"https://attack.mitre.org/techniques/T1134/005","sourceCount":4},{"id":"T1135","name":"Network Share Discovery","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1135","sourceCount":3},{"id":"T1136","name":"Create Account","tactics":["Persistence"],"platforms":["Windows","IaaS","Linux","macOS","Network Devices","Containers","SaaS","Office Suite","Identity Provider","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1136","sourceCount":3},{"id":"T1136.001","name":"Local Account","tactics":["Persistence"],"platforms":["Containers","ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1136","url":"https://attack.mitre.org/techniques/T1136/001","sourceCount":5},{"id":"T1136.002","name":"Domain Account","tactics":["Persistence"],"platforms":["Linux","macOS","Windows"],"parent":"T1136","url":"https://attack.mitre.org/techniques/T1136/002","sourceCount":3},{"id":"T1136.003","name":"Cloud Account","tactics":["Persistence"],"platforms":["IaaS","SaaS","Office Suite","Identity Provider"],"parent":"T1136","url":"https://attack.mitre.org/techniques/T1136/003","sourceCount":10},{"id":"T1137","name":"Office Application Startup","tactics":["Persistence"],"platforms":["Windows","Office Suite"],"parent":null,"url":"https://attack.mitre.org/techniques/T1137","sourceCount":7},{"id":"T1137.001","name":"Office Template Macros","tactics":["Persistence"],"platforms":["Office Suite","Windows"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/001","sourceCount":8},{"id":"T1137.002","name":"Office Test","tactics":["Persistence"],"platforms":["Windows","Office Suite"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/002","sourceCount":3},{"id":"T1137.003","name":"Outlook Forms","tactics":["Persistence"],"platforms":["Windows","Office Suite"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/003","sourceCount":4},{"id":"T1137.004","name":"Outlook Home Page","tactics":["Persistence"],"platforms":["Windows","Office Suite"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/004","sourceCount":4},{"id":"T1137.005","name":"Outlook Rules","tactics":["Persistence"],"platforms":["Windows","Office Suite"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/005","sourceCount":5},{"id":"T1137.006","name":"Add-ins","tactics":["Persistence"],"platforms":["Windows","Office Suite"],"parent":"T1137","url":"https://attack.mitre.org/techniques/T1137/006","sourceCount":5},{"id":"T1140","name":"Deobfuscate/Decode Files or Information","tactics":["Stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1140","sourceCount":5},{"id":"T1176","name":"Software Extensions","tactics":["Persistence"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1176","sourceCount":4},{"id":"T1176.001","name":"Browser Extensions","tactics":["Persistence"],"platforms":["Linux","Windows","macOS"],"parent":"T1176","url":"https://attack.mitre.org/techniques/T1176/001","sourceCount":14},{"id":"T1176.002","name":"IDE Extensions","tactics":["Persistence"],"platforms":["Linux","macOS","Windows"],"parent":"T1176","url":"https://attack.mitre.org/techniques/T1176/002","sourceCount":5},{"id":"T1185","name":"Browser Session Hijacking","tactics":["Collection"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1185","sourceCount":5},{"id":"T1187","name":"Forced Authentication","tactics":["Credential Access"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1187","sourceCount":10},{"id":"T1189","name":"Drive-by Compromise","tactics":["Initial Access"],"platforms":["Identity Provider","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1189","sourceCount":5},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["Initial Access"],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1190","sourceCount":12},{"id":"T1195","name":"Supply Chain Compromise","tactics":["Initial Access"],"platforms":["Linux","Windows","macOS","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1195","sourceCount":9},{"id":"T1195.001","name":"Compromise Software Dependencies and Development Tools","tactics":["Initial Access"],"platforms":["Linux","macOS","Windows"],"parent":"T1195","url":"https://attack.mitre.org/techniques/T1195/001","sourceCount":11},{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["Initial Access"],"platforms":["Linux","Windows","macOS"],"parent":"T1195","url":"https://attack.mitre.org/techniques/T1195/002","sourceCount":3},{"id":"T1195.003","name":"Compromise Hardware Supply Chain","tactics":["Initial Access"],"platforms":["Linux","macOS","Windows"],"parent":"T1195","url":"https://attack.mitre.org/techniques/T1195/003","sourceCount":1},{"id":"T1197","name":"BITS Jobs","tactics":["Execution","Persistence","Stealth"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1197","sourceCount":8},{"id":"T1199","name":"Trusted Relationship","tactics":["Initial Access"],"platforms":["IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1199","sourceCount":3},{"id":"T1200","name":"Hardware Additions","tactics":["Initial Access"],"platforms":["Windows","Linux","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1200","sourceCount":5},{"id":"T1201","name":"Password Policy Discovery","tactics":["Discovery"],"platforms":["Windows","Linux","macOS","IaaS","Network Devices","Identity Provider","SaaS","Office Suite"],"parent":null,"url":"https://attack.mitre.org/techniques/T1201","sourceCount":5},{"id":"T1202","name":"Indirect Command Execution","tactics":["Stealth"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1202","sourceCount":7},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1203","sourceCount":1},{"id":"T1204","name":"User Execution","tactics":["Execution"],"platforms":["Linux","Windows","macOS","IaaS","Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1204","sourceCount":6},{"id":"T1204.001","name":"Malicious Link","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/001","sourceCount":1},{"id":"T1204.002","name":"Malicious File","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/002","sourceCount":3},{"id":"T1204.003","name":"Malicious Image","tactics":["Execution"],"platforms":["IaaS","Containers"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/003","sourceCount":3},{"id":"T1204.004","name":"Malicious Copy and Paste","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/004","sourceCount":7},{"id":"T1204.005","name":"Malicious Library","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":"T1204","url":"https://attack.mitre.org/techniques/T1204/005","sourceCount":3},{"id":"T1205","name":"Traffic Signaling","tactics":["Persistence","Stealth","Command and Control"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1205","sourceCount":7},{"id":"T1205.001","name":"Port Knocking","tactics":["Persistence","Stealth","Command and Control"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":"T1205","url":"https://attack.mitre.org/techniques/T1205/001","sourceCount":2},{"id":"T1205.002","name":"Socket Filters","tactics":["Persistence","Stealth","Command and Control"],"platforms":["Linux","macOS","Windows"],"parent":"T1205","url":"https://attack.mitre.org/techniques/T1205/002","sourceCount":4},{"id":"T1207","name":"Rogue Domain Controller","tactics":["Defense Impairment"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1207","sourceCount":3},{"id":"T1210","name":"Exploitation of Remote Services","tactics":["Lateral Movement"],"platforms":["Linux","Windows","macOS","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1210","sourceCount":7},{"id":"T1211","name":"Exploitation for Stealth","tactics":["Stealth"],"platforms":["Linux","Windows","macOS","SaaS","IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1211","sourceCount":3},{"id":"T1212","name":"Exploitation for Credential Access","tactics":["Credential Access"],"platforms":["Linux","Windows","macOS","Identity Provider"],"parent":null,"url":"https://attack.mitre.org/techniques/T1212","sourceCount":7},{"id":"T1213","name":"Data from Information Repositories","tactics":["Collection"],"platforms":["Linux","Windows","macOS","SaaS","IaaS","Office Suite"],"parent":null,"url":"https://attack.mitre.org/techniques/T1213","sourceCount":7},{"id":"T1213.001","name":"Confluence","tactics":["Collection"],"platforms":["SaaS"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/001","sourceCount":2},{"id":"T1213.002","name":"Sharepoint","tactics":["Collection"],"platforms":["Office Suite","Windows"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/002","sourceCount":2},{"id":"T1213.003","name":"Code Repositories","tactics":["Collection"],"platforms":["SaaS"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/003","sourceCount":3},{"id":"T1213.004","name":"Customer Relationship Management Software","tactics":["Collection"],"platforms":["SaaS"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/004","sourceCount":4},{"id":"T1213.005","name":"Messaging Applications","tactics":["Collection"],"platforms":["Office Suite","SaaS"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/005","sourceCount":6},{"id":"T1213.006","name":"Databases","tactics":["Collection"],"platforms":["IaaS","Linux","macOS","SaaS","Windows"],"parent":"T1213","url":"https://attack.mitre.org/techniques/T1213/006","sourceCount":2},{"id":"T1216","name":"System Script Proxy Execution","tactics":["Stealth"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1216","sourceCount":3},{"id":"T1216.001","name":"PubPrn","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1216","url":"https://attack.mitre.org/techniques/T1216/001","sourceCount":3},{"id":"T1216.002","name":"SyncAppvPublishingServer","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1216","url":"https://attack.mitre.org/techniques/T1216/002","sourceCount":8},{"id":"T1217","name":"Browser Information Discovery","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1217","sourceCount":3},{"id":"T1218","name":"System Binary Proxy Execution","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1218","sourceCount":4},{"id":"T1218.001","name":"Compiled HTML File","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/001","sourceCount":6},{"id":"T1218.002","name":"Control Panel","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/002","sourceCount":6},{"id":"T1218.003","name":"CMSTP","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/003","sourceCount":7},{"id":"T1218.004","name":"InstallUtil","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/004","sourceCount":3},{"id":"T1218.005","name":"Mshta","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/005","sourceCount":9},{"id":"T1218.007","name":"Msiexec","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/007","sourceCount":5},{"id":"T1218.008","name":"Odbcconf","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/008","sourceCount":5},{"id":"T1218.009","name":"Regsvcs/Regasm","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/009","sourceCount":5},{"id":"T1218.010","name":"Regsvr32","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/010","sourceCount":5},{"id":"T1218.011","name":"Rundll32","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/011","sourceCount":8},{"id":"T1218.012","name":"Verclsid","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/012","sourceCount":6},{"id":"T1218.013","name":"Mavinject","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/013","sourceCount":5},{"id":"T1218.014","name":"MMC","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/014","sourceCount":9},{"id":"T1218.015","name":"Electron Applications","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1218","url":"https://attack.mitre.org/techniques/T1218/015","sourceCount":6},{"id":"T1219","name":"Remote Access Tools","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1219","sourceCount":6},{"id":"T1219.001","name":"IDE Tunneling","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows"],"parent":"T1219","url":"https://attack.mitre.org/techniques/T1219/001","sourceCount":4},{"id":"T1219.002","name":"Remote Desktop Software","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows"],"parent":"T1219","url":"https://attack.mitre.org/techniques/T1219/002","sourceCount":6},{"id":"T1219.003","name":"Remote Access Hardware","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows"],"parent":"T1219","url":"https://attack.mitre.org/techniques/T1219/003","sourceCount":3},{"id":"T1220","name":"XSL Script Processing","tactics":["Stealth"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1220","sourceCount":7},{"id":"T1221","name":"Template Injection","tactics":["Stealth"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1221","sourceCount":10},{"id":"T1222","name":"File and Directory Permissions Modification","tactics":["Defense Impairment"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1222","sourceCount":8},{"id":"T1222.001","name":"Windows Permissions","tactics":["Defense Impairment"],"platforms":["Windows"],"parent":"T1222","url":"https://attack.mitre.org/techniques/T1222/001","sourceCount":5},{"id":"T1222.002","name":"Linux and Mac Permissions","tactics":["Defense Impairment"],"platforms":["Linux","macOS"],"parent":"T1222","url":"https://attack.mitre.org/techniques/T1222/002","sourceCount":4},{"id":"T1480","name":"Execution Guardrails","tactics":["Stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1480","sourceCount":4},{"id":"T1480.001","name":"Environmental Keying","tactics":["Stealth"],"platforms":["Linux","Windows","macOS"],"parent":"T1480","url":"https://attack.mitre.org/techniques/T1480/001","sourceCount":7},{"id":"T1480.002","name":"Mutual Exclusion","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1480","url":"https://attack.mitre.org/techniques/T1480/002","sourceCount":6},{"id":"T1482","name":"Domain Trust Discovery","tactics":["Discovery"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1482","sourceCount":6},{"id":"T1484","name":"Domain or Tenant Policy Modification","tactics":["Privilege Escalation","Defense Impairment"],"platforms":["Windows","Identity Provider"],"parent":null,"url":"https://attack.mitre.org/techniques/T1484","sourceCount":6},{"id":"T1484.001","name":"Group Policy Modification","tactics":["Privilege Escalation","Defense Impairment"],"platforms":["Windows"],"parent":"T1484","url":"https://attack.mitre.org/techniques/T1484/001","sourceCount":8},{"id":"T1484.002","name":"Trust Modification","tactics":["Privilege Escalation","Defense Impairment"],"platforms":["Identity Provider","Windows"],"parent":"T1484","url":"https://attack.mitre.org/techniques/T1484/002","sourceCount":5},{"id":"T1485","name":"Data Destruction","tactics":["Impact"],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1485","sourceCount":9},{"id":"T1485.001","name":"Lifecycle-Triggered Deletion","tactics":["Impact"],"platforms":["IaaS"],"parent":"T1485","url":"https://attack.mitre.org/techniques/T1485/001","sourceCount":7},{"id":"T1486","name":"Data Encrypted for Impact","tactics":["Impact"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1486","sourceCount":11},{"id":"T1489","name":"Service Stop","tactics":["Impact"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1489","sourceCount":7},{"id":"T1490","name":"Inhibit System Recovery","tactics":["Impact"],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1490","sourceCount":10},{"id":"T1491","name":"Defacement","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1491","sourceCount":1},{"id":"T1491.001","name":"Internal Defacement","tactics":["Impact"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1491","url":"https://attack.mitre.org/techniques/T1491/001","sourceCount":4},{"id":"T1491.002","name":"External Defacement","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS"],"parent":"T1491","url":"https://attack.mitre.org/techniques/T1491/002","sourceCount":5},{"id":"T1495","name":"Firmware Corruption","tactics":["Impact"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1495","sourceCount":5},{"id":"T1496","name":"Resource Hijacking","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS","Containers","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1496","sourceCount":2},{"id":"T1496.001","name":"Compute Hijacking","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS","Containers"],"parent":"T1496","url":"https://attack.mitre.org/techniques/T1496/001","sourceCount":6},{"id":"T1496.002","name":"Bandwidth Hijacking","tactics":["Impact"],"platforms":["Linux","Windows","macOS","IaaS","Containers"],"parent":"T1496","url":"https://attack.mitre.org/techniques/T1496/002","sourceCount":4},{"id":"T1496.003","name":"SMS Pumping","tactics":["Impact"],"platforms":["SaaS"],"parent":"T1496","url":"https://attack.mitre.org/techniques/T1496/003","sourceCount":4},{"id":"T1496.004","name":"Cloud Service Hijacking","tactics":["Impact"],"platforms":["SaaS"],"parent":"T1496","url":"https://attack.mitre.org/techniques/T1496/004","sourceCount":6},{"id":"T1497","name":"Virtualization/Sandbox Evasion","tactics":["Stealth","Discovery"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1497","sourceCount":3},{"id":"T1497.001","name":"System Checks","tactics":["Stealth","Discovery"],"platforms":["Linux","macOS","Windows"],"parent":"T1497","url":"https://attack.mitre.org/techniques/T1497/001","sourceCount":4},{"id":"T1497.002","name":"User Activity Based Checks","tactics":["Stealth","Discovery"],"platforms":["Linux","macOS","Windows"],"parent":"T1497","url":"https://attack.mitre.org/techniques/T1497/002","sourceCount":5},{"id":"T1497.003","name":"Time Based Checks","tactics":["Stealth","Discovery"],"platforms":["Linux","macOS","Windows"],"parent":"T1497","url":"https://attack.mitre.org/techniques/T1497/003","sourceCount":2},{"id":"T1498","name":"Network Denial of Service","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS","Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1498","sourceCount":5},{"id":"T1498.001","name":"Direct Network Flood","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS"],"parent":"T1498","url":"https://attack.mitre.org/techniques/T1498/001","sourceCount":3},{"id":"T1498.002","name":"Reflection Amplification","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS"],"parent":"T1498","url":"https://attack.mitre.org/techniques/T1498/002","sourceCount":7},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["Impact"],"platforms":["Windows","Linux","macOS","Containers","IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1499","sourceCount":7},{"id":"T1499.001","name":"OS Exhaustion Flood","tactics":["Impact"],"platforms":["Linux","macOS","Windows"],"parent":"T1499","url":"https://attack.mitre.org/techniques/T1499/001","sourceCount":5},{"id":"T1499.002","name":"Service Exhaustion Flood","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS"],"parent":"T1499","url":"https://attack.mitre.org/techniques/T1499/002","sourceCount":5},{"id":"T1499.003","name":"Application Exhaustion Flood","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS"],"parent":"T1499","url":"https://attack.mitre.org/techniques/T1499/003","sourceCount":3},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["Impact"],"platforms":["Windows","IaaS","Linux","macOS"],"parent":"T1499","url":"https://attack.mitre.org/techniques/T1499/004","sourceCount":2},{"id":"T1505","name":"Server Software Component","tactics":["Persistence"],"platforms":["Windows","Linux","macOS","Network Devices","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1505","sourceCount":3},{"id":"T1505.001","name":"SQL Stored Procedures","tactics":["Persistence"],"platforms":["Windows","Linux"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/001","sourceCount":6},{"id":"T1505.002","name":"Transport Agent","tactics":["Persistence"],"platforms":["Linux","Windows"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/002","sourceCount":3},{"id":"T1505.003","name":"Web Shell","tactics":["Persistence"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/003","sourceCount":5},{"id":"T1505.004","name":"IIS Components","tactics":["Persistence"],"platforms":["Windows"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/004","sourceCount":11},{"id":"T1505.005","name":"Terminal Services DLL","tactics":["Persistence"],"platforms":["Windows"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/005","sourceCount":6},{"id":"T1505.006","name":"vSphere Installation Bundles","tactics":["Persistence"],"platforms":["ESXi"],"parent":"T1505","url":"https://attack.mitre.org/techniques/T1505/006","sourceCount":3},{"id":"T1518","name":"Software Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1518","sourceCount":1},{"id":"T1518.001","name":"Security Software Discovery","tactics":["Discovery"],"platforms":["IaaS","Linux","macOS","Windows"],"parent":"T1518","url":"https://attack.mitre.org/techniques/T1518/001","sourceCount":1},{"id":"T1518.002","name":"Backup Software Discovery","tactics":["Discovery"],"platforms":["Windows","macOS","Linux"],"parent":"T1518","url":"https://attack.mitre.org/techniques/T1518/002","sourceCount":2},{"id":"T1525","name":"Implant Internal Image","tactics":["Persistence"],"platforms":["IaaS","Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1525","sourceCount":3},{"id":"T1526","name":"Cloud Service Discovery","tactics":["Discovery"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1526","sourceCount":5},{"id":"T1528","name":"Steal Application Access Token","tactics":["Credential Access"],"platforms":["Containers","IaaS","Identity Provider","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1528","sourceCount":13},{"id":"T1529","name":"System Shutdown/Reboot","tactics":["Impact"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1529","sourceCount":10},{"id":"T1530","name":"Data from Cloud Storage","tactics":["Collection"],"platforms":["IaaS","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1530","sourceCount":8},{"id":"T1531","name":"Account Access Removal","tactics":["Impact"],"platforms":["Linux","macOS","Windows","SaaS","IaaS","Office Suite","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1531","sourceCount":4},{"id":"T1534","name":"Internal Spearphishing","tactics":["Lateral Movement"],"platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1534","sourceCount":3},{"id":"T1535","name":"Unused/Unsupported Cloud Regions","tactics":["Stealth"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1535","sourceCount":2},{"id":"T1537","name":"Transfer Data to Cloud Account","tactics":["Exfiltration"],"platforms":["IaaS","Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1537","sourceCount":7},{"id":"T1538","name":"Cloud Service Dashboard","tactics":["Discovery"],"platforms":["IaaS","SaaS","Office Suite","Identity Provider"],"parent":null,"url":"https://attack.mitre.org/techniques/T1538","sourceCount":3},{"id":"T1539","name":"Steal Web Session Cookie","tactics":["Credential Access"],"platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1539","sourceCount":8},{"id":"T1542","name":"Pre-OS Boot","tactics":["Persistence","Stealth"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1542","sourceCount":2},{"id":"T1542.001","name":"System Firmware","tactics":["Persistence","Stealth"],"platforms":["Network Devices","Windows"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/001","sourceCount":4},{"id":"T1542.002","name":"Component Firmware","tactics":["Persistence","Stealth"],"platforms":["Windows","Linux","macOS"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/002","sourceCount":1},{"id":"T1542.003","name":"Bootkit","tactics":["Persistence","Stealth"],"platforms":["Linux","Windows"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/003","sourceCount":5},{"id":"T1542.004","name":"ROMMONkit","tactics":["Persistence","Stealth"],"platforms":["Network Devices"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/004","sourceCount":3},{"id":"T1542.005","name":"TFTP Boot","tactics":["Persistence","Stealth"],"platforms":["Network Devices"],"parent":"T1542","url":"https://attack.mitre.org/techniques/T1542/005","sourceCount":2},{"id":"T1543","name":"Create or Modify System Process","tactics":["Persistence","Privilege Escalation"],"platforms":["Containers","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1543","sourceCount":4},{"id":"T1543.001","name":"Launch Agent","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/001","sourceCount":9},{"id":"T1543.002","name":"Systemd Service","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/002","sourceCount":10},{"id":"T1543.003","name":"Windows Service","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/003","sourceCount":11},{"id":"T1543.004","name":"Launch Daemon","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/004","sourceCount":8},{"id":"T1543.005","name":"Container Service","tactics":["Persistence","Privilege Escalation"],"platforms":["Containers"],"parent":"T1543","url":"https://attack.mitre.org/techniques/T1543/005","sourceCount":9},{"id":"T1546","name":"Event Triggered Execution","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","macOS","Windows","SaaS","IaaS","Office Suite"],"parent":null,"url":"https://attack.mitre.org/techniques/T1546","sourceCount":7},{"id":"T1546.001","name":"Change Default File Association","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/001","sourceCount":5},{"id":"T1546.002","name":"Screensaver","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/002","sourceCount":3},{"id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/003","sourceCount":10},{"id":"T1546.004","name":"Unix Shell Configuration Modification","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","macOS"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/004","sourceCount":13},{"id":"T1546.005","name":"Trap","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS","Linux"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/005","sourceCount":3},{"id":"T1546.006","name":"LC_LOAD_DYLIB Addition","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/006","sourceCount":3},{"id":"T1546.007","name":"Netsh Helper DLL","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/007","sourceCount":4},{"id":"T1546.008","name":"Accessibility Features","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/008","sourceCount":5},{"id":"T1546.009","name":"AppCert DLLs","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/009","sourceCount":4},{"id":"T1546.010","name":"AppInit DLLs","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/010","sourceCount":5},{"id":"T1546.011","name":"Application Shimming","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/011","sourceCount":4},{"id":"T1546.012","name":"Image File Execution Options Injection","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/012","sourceCount":9},{"id":"T1546.013","name":"PowerShell Profile","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/013","sourceCount":6},{"id":"T1546.014","name":"Emond","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/014","sourceCount":4},{"id":"T1546.015","name":"Component Object Model Hijacking","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/015","sourceCount":5},{"id":"T1546.016","name":"Installer Packages","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","macOS","Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/016","sourceCount":7},{"id":"T1546.017","name":"Udev Rules","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/017","sourceCount":4},{"id":"T1546.018","name":"Python Startup Hooks","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","macOS","Windows"],"parent":"T1546","url":"https://attack.mitre.org/techniques/T1546/018","sourceCount":4},{"id":"T1547","name":"Boot or Logon Autostart Execution","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux","macOS","Windows","Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1547","sourceCount":7},{"id":"T1547.001","name":"Registry Run Keys / Startup Folder","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/001","sourceCount":6},{"id":"T1547.002","name":"Authentication Package","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/002","sourceCount":4},{"id":"T1547.003","name":"Time Providers","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/003","sourceCount":6},{"id":"T1547.004","name":"Winlogon Helper DLL","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/004","sourceCount":3},{"id":"T1547.005","name":"Security Support Provider","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/005","sourceCount":3},{"id":"T1547.006","name":"Kernel Modules and Extensions","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS","Linux"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/006","sourceCount":19},{"id":"T1547.007","name":"Re-opened Applications","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/007","sourceCount":4},{"id":"T1547.008","name":"LSASS Driver","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/008","sourceCount":5},{"id":"T1547.009","name":"Shortcut Modification","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/009","sourceCount":3},{"id":"T1547.010","name":"Port Monitors","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/010","sourceCount":4},{"id":"T1547.012","name":"Print Processors","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/012","sourceCount":4},{"id":"T1547.013","name":"XDG Autostart Entries","tactics":["Persistence","Privilege Escalation"],"platforms":["Linux"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/013","sourceCount":4},{"id":"T1547.014","name":"Active Setup","tactics":["Persistence","Privilege Escalation"],"platforms":["Windows"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/014","sourceCount":8},{"id":"T1547.015","name":"Login Items","tactics":["Persistence","Privilege Escalation"],"platforms":["macOS"],"parent":"T1547","url":"https://attack.mitre.org/techniques/T1547/015","sourceCount":16},{"id":"T1548","name":"Abuse Elevation Control Mechanism","tactics":["Privilege Escalation"],"platforms":["Linux","macOS","Windows","IaaS","Office Suite","Identity Provider"],"parent":null,"url":"https://attack.mitre.org/techniques/T1548","sourceCount":5},{"id":"T1548.001","name":"Setuid and Setgid","tactics":["Privilege Escalation"],"platforms":["Linux","macOS"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/001","sourceCount":4},{"id":"T1548.002","name":"Bypass User Account Control","tactics":["Privilege Escalation"],"platforms":["Windows"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/002","sourceCount":9},{"id":"T1548.003","name":"Sudo and Sudo Caching","tactics":["Privilege Escalation"],"platforms":["Linux","macOS"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/003","sourceCount":4},{"id":"T1548.004","name":"Elevated Execution with Prompt","tactics":["Privilege Escalation"],"platforms":["macOS"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/004","sourceCount":5},{"id":"T1548.005","name":"Temporary Elevated Cloud Access","tactics":["Privilege Escalation"],"platforms":["IaaS","Office Suite","Identity Provider"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/005","sourceCount":11},{"id":"T1548.006","name":"TCC Manipulation","tactics":["Privilege Escalation"],"platforms":["macOS"],"parent":"T1548","url":"https://attack.mitre.org/techniques/T1548/006","sourceCount":4},{"id":"T1550","name":"Use Alternate Authentication Material","tactics":["Lateral Movement"],"platforms":["Containers","IaaS","Identity Provider","Linux","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1550","sourceCount":3},{"id":"T1550.001","name":"Application Access Token","tactics":["Lateral Movement"],"platforms":["Containers","IaaS","Identity Provider","Office Suite","SaaS"],"parent":"T1550","url":"https://attack.mitre.org/techniques/T1550/001","sourceCount":9},{"id":"T1550.002","name":"Pass the Hash","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1550","url":"https://attack.mitre.org/techniques/T1550/002","sourceCount":2},{"id":"T1550.003","name":"Pass the Ticket","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1550","url":"https://attack.mitre.org/techniques/T1550/003","sourceCount":5},{"id":"T1550.004","name":"Web Session Cookie","tactics":["Lateral Movement"],"platforms":["IaaS","Office Suite","SaaS"],"parent":"T1550","url":"https://attack.mitre.org/techniques/T1550/004","sourceCount":3},{"id":"T1552","name":"Unsecured Credentials","tactics":["Credential Access"],"platforms":["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider"],"parent":null,"url":"https://attack.mitre.org/techniques/T1552","sourceCount":2},{"id":"T1552.001","name":"Credentials In Files","tactics":["Credential Access"],"platforms":["Containers","IaaS","Linux","macOS","Windows"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/001","sourceCount":6},{"id":"T1552.002","name":"Credentials in Registry","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/002","sourceCount":2},{"id":"T1552.003","name":"Shell History","tactics":["Credential Access"],"platforms":["Linux","macOS","Windows"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/003","sourceCount":4},{"id":"T1552.004","name":"Private Keys","tactics":["Credential Access"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/004","sourceCount":7},{"id":"T1552.005","name":"Cloud Instance Metadata API","tactics":["Credential Access"],"platforms":["IaaS"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/005","sourceCount":4},{"id":"T1552.006","name":"Group Policy Preferences","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/006","sourceCount":5},{"id":"T1552.007","name":"Container API","tactics":["Credential Access"],"platforms":["Containers"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/007","sourceCount":4},{"id":"T1552.008","name":"Chat Messages","tactics":["Credential Access"],"platforms":["SaaS","Office Suite"],"parent":"T1552","url":"https://attack.mitre.org/techniques/T1552/008","sourceCount":2},{"id":"T1553","name":"Subvert Trust Controls","tactics":["Defense Impairment"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1553","sourceCount":4},{"id":"T1553.001","name":"Gatekeeper Bypass","tactics":["Defense Impairment"],"platforms":["macOS"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/001","sourceCount":7},{"id":"T1553.002","name":"Code Signing","tactics":["Defense Impairment"],"platforms":["macOS","Windows"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/002","sourceCount":5},{"id":"T1553.003","name":"SIP and Trust Provider Hijacking","tactics":["Defense Impairment"],"platforms":["Windows"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/003","sourceCount":7},{"id":"T1553.004","name":"Install Root Certificate","tactics":["Defense Impairment"],"platforms":["Linux","macOS","Windows"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/004","sourceCount":6},{"id":"T1553.005","name":"Mark-of-the-Web Bypass","tactics":["Defense Impairment"],"platforms":["Windows"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/005","sourceCount":5},{"id":"T1553.006","name":"Code Signing Policy Modification","tactics":["Defense Impairment"],"platforms":["macOS","Windows"],"parent":"T1553","url":"https://attack.mitre.org/techniques/T1553/006","sourceCount":9},{"id":"T1554","name":"Compromise Host Software Binary","tactics":["Persistence"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1554","sourceCount":4},{"id":"T1555","name":"Credentials from Password Stores","tactics":["Credential Access"],"platforms":["IaaS","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1555","sourceCount":2},{"id":"T1555.001","name":"Keychain","tactics":["Credential Access"],"platforms":["macOS"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/001","sourceCount":6},{"id":"T1555.002","name":"Securityd Memory","tactics":["Credential Access"],"platforms":["Linux","macOS"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/002","sourceCount":5},{"id":"T1555.003","name":"Credentials from Web Browsers","tactics":["Credential Access"],"platforms":["Linux","macOS","Windows"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/003","sourceCount":6},{"id":"T1555.004","name":"Windows Credential Manager","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/004","sourceCount":7},{"id":"T1555.005","name":"Password Managers","tactics":["Credential Access"],"platforms":["Linux","macOS","Windows"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/005","sourceCount":6},{"id":"T1555.006","name":"Cloud Secrets Management Stores","tactics":["Credential Access"],"platforms":["IaaS"],"parent":"T1555","url":"https://attack.mitre.org/techniques/T1555/006","sourceCount":6},{"id":"T1556","name":"Modify Authentication Process","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1556","sourceCount":1},{"id":"T1556.001","name":"Domain Controller Authentication","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/001","sourceCount":2},{"id":"T1556.002","name":"Password Filter DLL","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/002","sourceCount":2},{"id":"T1556.003","name":"Pluggable Authentication Modules","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["Linux","macOS"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/003","sourceCount":6},{"id":"T1556.004","name":"Network Device Authentication","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["Network Devices"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/004","sourceCount":2},{"id":"T1556.005","name":"Reversible Encryption","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/005","sourceCount":5},{"id":"T1556.006","name":"Multi-Factor Authentication","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/006","sourceCount":4},{"id":"T1556.007","name":"Hybrid Identity","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["IaaS","Identity Provider","Office Suite","SaaS","Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/007","sourceCount":6},{"id":"T1556.008","name":"Network Provider DLL","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["Windows"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/008","sourceCount":6},{"id":"T1556.009","name":"Conditional Access Policies","tactics":["Persistence","Defense Impairment","Credential Access"],"platforms":["IaaS","Identity Provider"],"parent":"T1556","url":"https://attack.mitre.org/techniques/T1556/009","sourceCount":6},{"id":"T1557","name":"Adversary-in-the-Middle","tactics":["Credential Access","Collection"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1557","sourceCount":10},{"id":"T1557.001","name":"Name Resolution Poisoning and SMB Relay","tactics":["Credential Access","Collection"],"platforms":["Windows"],"parent":"T1557","url":"https://attack.mitre.org/techniques/T1557/001","sourceCount":10},{"id":"T1557.002","name":"ARP Cache Poisoning","tactics":["Credential Access","Collection"],"platforms":["Linux","Windows","macOS"],"parent":"T1557","url":"https://attack.mitre.org/techniques/T1557/002","sourceCount":4},{"id":"T1557.003","name":"DHCP Spoofing","tactics":["Credential Access","Collection"],"platforms":["Linux","Windows","macOS"],"parent":"T1557","url":"https://attack.mitre.org/techniques/T1557/003","sourceCount":7},{"id":"T1557.004","name":"Evil Twin","tactics":["Credential Access","Collection"],"platforms":["Network Devices"],"parent":"T1557","url":"https://attack.mitre.org/techniques/T1557/004","sourceCount":5},{"id":"T1558","name":"Steal or Forge Kerberos Tickets","tactics":["Credential Access"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1558","sourceCount":10},{"id":"T1558.001","name":"Golden Ticket","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/001","sourceCount":7},{"id":"T1558.002","name":"Silver Ticket","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/002","sourceCount":4},{"id":"T1558.003","name":"Kerberoasting","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/003","sourceCount":8},{"id":"T1558.004","name":"AS-REP Roasting","tactics":["Credential Access"],"platforms":["Windows"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/004","sourceCount":8},{"id":"T1558.005","name":"Ccache Files","tactics":["Credential Access"],"platforms":["Linux","macOS"],"parent":"T1558","url":"https://attack.mitre.org/techniques/T1558/005","sourceCount":7},{"id":"T1559","name":"Inter-Process Communication","tactics":["Execution"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1559","sourceCount":3},{"id":"T1559.001","name":"Component Object Model","tactics":["Execution"],"platforms":["Windows"],"parent":"T1559","url":"https://attack.mitre.org/techniques/T1559/001","sourceCount":6},{"id":"T1559.002","name":"Dynamic Data Exchange","tactics":["Execution"],"platforms":["Windows"],"parent":"T1559","url":"https://attack.mitre.org/techniques/T1559/002","sourceCount":12},{"id":"T1559.003","name":"XPC Services","tactics":["Execution"],"platforms":["macOS"],"parent":"T1559","url":"https://attack.mitre.org/techniques/T1559/003","sourceCount":5},{"id":"T1560","name":"Archive Collected Data","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1560","sourceCount":3},{"id":"T1560.001","name":"Archive via Utility","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":"T1560","url":"https://attack.mitre.org/techniques/T1560/001","sourceCount":6},{"id":"T1560.002","name":"Archive via Library","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":"T1560","url":"https://attack.mitre.org/techniques/T1560/002","sourceCount":5},{"id":"T1560.003","name":"Archive via Custom Method","tactics":["Collection"],"platforms":["Linux","macOS","Windows"],"parent":"T1560","url":"https://attack.mitre.org/techniques/T1560/003","sourceCount":2},{"id":"T1561","name":"Disk Wipe","tactics":["Impact"],"platforms":["Linux","macOS","Windows","Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1561","sourceCount":4},{"id":"T1561.001","name":"Disk Content Wipe","tactics":["Impact"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":"T1561","url":"https://attack.mitre.org/techniques/T1561/001","sourceCount":5},{"id":"T1561.002","name":"Disk Structure Wipe","tactics":["Impact"],"platforms":["Linux","macOS","Network Devices","Windows"],"parent":"T1561","url":"https://attack.mitre.org/techniques/T1561/002","sourceCount":8},{"id":"T1563","name":"Remote Service Session Hijacking","tactics":["Lateral Movement"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1563","sourceCount":3},{"id":"T1563.001","name":"SSH Hijacking","tactics":["Lateral Movement"],"platforms":["Linux","macOS"],"parent":"T1563","url":"https://attack.mitre.org/techniques/T1563/001","sourceCount":5},{"id":"T1563.002","name":"RDP Hijacking","tactics":["Lateral Movement"],"platforms":["Windows"],"parent":"T1563","url":"https://attack.mitre.org/techniques/T1563/002","sourceCount":5},{"id":"T1564","name":"Hide Artifacts","tactics":["Stealth"],"platforms":["ESXi","Linux","macOS","Office Suite","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1564","sourceCount":5},{"id":"T1564.001","name":"Hidden Files and Directories","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/001","sourceCount":4},{"id":"T1564.002","name":"Hidden Users","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/002","sourceCount":6},{"id":"T1564.003","name":"Hidden Window","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/003","sourceCount":9},{"id":"T1564.004","name":"NTFS File Attributes","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/004","sourceCount":7},{"id":"T1564.005","name":"Hidden File System","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/005","sourceCount":5},{"id":"T1564.006","name":"Run Virtual Instance","tactics":["Stealth"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/006","sourceCount":10},{"id":"T1564.007","name":"VBA Stomping","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/007","sourceCount":6},{"id":"T1564.008","name":"Email Hiding Rules","tactics":["Stealth"],"platforms":["Windows","Linux","macOS","Office Suite"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/008","sourceCount":7},{"id":"T1564.009","name":"Resource Forking","tactics":["Stealth"],"platforms":["macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/009","sourceCount":6},{"id":"T1564.010","name":"Process Argument Spoofing","tactics":["Stealth"],"platforms":["Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/010","sourceCount":6},{"id":"T1564.011","name":"Ignore Process Interrupts","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/011","sourceCount":4},{"id":"T1564.012","name":"File/Path Exclusions","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/012","sourceCount":2},{"id":"T1564.013","name":"Bind Mounts","tactics":["Stealth"],"platforms":["Linux"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/013","sourceCount":3},{"id":"T1564.014","name":"Extended Attributes","tactics":["Stealth"],"platforms":["Linux","macOS"],"parent":"T1564","url":"https://attack.mitre.org/techniques/T1564/014","sourceCount":3},{"id":"T1565","name":"Data Manipulation","tactics":["Impact"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1565","sourceCount":2},{"id":"T1565.001","name":"Stored Data Manipulation","tactics":["Impact"],"platforms":["Linux","macOS","Windows"],"parent":"T1565","url":"https://attack.mitre.org/techniques/T1565/001","sourceCount":3},{"id":"T1565.002","name":"Transmitted Data Manipulation","tactics":["Impact"],"platforms":["Linux","macOS","Windows"],"parent":"T1565","url":"https://attack.mitre.org/techniques/T1565/002","sourceCount":3},{"id":"T1565.003","name":"Runtime Data Manipulation","tactics":["Impact"],"platforms":["Linux","macOS","Windows"],"parent":"T1565","url":"https://attack.mitre.org/techniques/T1565/003","sourceCount":3},{"id":"T1566","name":"Phishing","tactics":["Initial Access"],"platforms":["Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1566","sourceCount":9},{"id":"T1566.001","name":"Spearphishing Attachment","tactics":["Initial Access"],"platforms":["Linux","macOS","Windows"],"parent":"T1566","url":"https://attack.mitre.org/techniques/T1566/001","sourceCount":5},{"id":"T1566.002","name":"Spearphishing Link","tactics":["Initial Access"],"platforms":["Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"parent":"T1566","url":"https://attack.mitre.org/techniques/T1566/002","sourceCount":10},{"id":"T1566.003","name":"Spearphishing via Service","tactics":["Initial Access"],"platforms":["Linux","macOS","Windows"],"parent":"T1566","url":"https://attack.mitre.org/techniques/T1566/003","sourceCount":2},{"id":"T1566.004","name":"Spearphishing Voice","tactics":["Initial Access"],"platforms":["Linux","macOS","Windows","Identity Provider"],"parent":"T1566","url":"https://attack.mitre.org/techniques/T1566/004","sourceCount":5},{"id":"T1567","name":"Exfiltration Over Web Service","tactics":["Exfiltration"],"platforms":["ESXi","Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1567","sourceCount":1},{"id":"T1567.001","name":"Exfiltration to Code Repository","tactics":["Exfiltration"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1567","url":"https://attack.mitre.org/techniques/T1567/001","sourceCount":1},{"id":"T1567.002","name":"Exfiltration to Cloud Storage","tactics":["Exfiltration"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1567","url":"https://attack.mitre.org/techniques/T1567/002","sourceCount":1},{"id":"T1567.003","name":"Exfiltration to Text Storage Sites","tactics":["Exfiltration"],"platforms":["Linux","macOS","Windows","ESXi"],"parent":"T1567","url":"https://attack.mitre.org/techniques/T1567/003","sourceCount":2},{"id":"T1567.004","name":"Exfiltration Over Webhook","tactics":["Exfiltration"],"platforms":["ESXi","Linux","macOS","Office Suite","SaaS","Windows"],"parent":"T1567","url":"https://attack.mitre.org/techniques/T1567/004","sourceCount":8},{"id":"T1568","name":"Dynamic Resolution","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1568","sourceCount":5},{"id":"T1568.001","name":"Fast Flux DNS","tactics":["Command and Control"],"platforms":["Linux","macOS","Windows","ESXi"],"parent":"T1568","url":"https://attack.mitre.org/techniques/T1568/001","sourceCount":4},{"id":"T1568.002","name":"Domain Generation Algorithms","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1568","url":"https://attack.mitre.org/techniques/T1568/002","sourceCount":11},{"id":"T1568.003","name":"DNS Calculation","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":"T1568","url":"https://attack.mitre.org/techniques/T1568/003","sourceCount":4},{"id":"T1569","name":"System Services","tactics":["Execution"],"platforms":["Windows","macOS","Linux"],"parent":null,"url":"https://attack.mitre.org/techniques/T1569","sourceCount":1},{"id":"T1569.001","name":"Launchctl","tactics":["Execution"],"platforms":["macOS"],"parent":"T1569","url":"https://attack.mitre.org/techniques/T1569/001","sourceCount":4},{"id":"T1569.002","name":"Service Execution","tactics":["Execution"],"platforms":["Windows"],"parent":"T1569","url":"https://attack.mitre.org/techniques/T1569/002","sourceCount":3},{"id":"T1569.003","name":"Systemctl","tactics":["Execution"],"platforms":["Linux"],"parent":"T1569","url":"https://attack.mitre.org/techniques/T1569/003","sourceCount":2},{"id":"T1570","name":"Lateral Tool Transfer","tactics":["Lateral Movement"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1570","sourceCount":3},{"id":"T1571","name":"Non-Standard Port","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1571","sourceCount":5},{"id":"T1572","name":"Protocol Tunneling","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1572","sourceCount":5},{"id":"T1573","name":"Encrypted Channel","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1573","sourceCount":4},{"id":"T1573.001","name":"Symmetric Cryptography","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1573","url":"https://attack.mitre.org/techniques/T1573/001","sourceCount":2},{"id":"T1573.002","name":"Asymmetric Cryptography","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":"T1573","url":"https://attack.mitre.org/techniques/T1573/002","sourceCount":4},{"id":"T1574","name":"Hijack Execution Flow","tactics":["Execution","Stealth"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1574","sourceCount":1},{"id":"T1574.001","name":"DLL","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/001","sourceCount":12},{"id":"T1574.004","name":"Dylib Hijacking","tactics":["Execution","Stealth"],"platforms":["macOS"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/004","sourceCount":8},{"id":"T1574.005","name":"Executable Installer File Permissions Weakness","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/005","sourceCount":3},{"id":"T1574.006","name":"Dynamic Linker Hijacking","tactics":["Execution","Stealth"],"platforms":["Linux","macOS"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/006","sourceCount":11},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","tactics":["Execution","Stealth"],"platforms":["Linux","macOS","Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/007","sourceCount":5},{"id":"T1574.008","name":"Path Interception by Search Order Hijacking","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/008","sourceCount":5},{"id":"T1574.009","name":"Path Interception by Unquoted Path","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/009","sourceCount":5},{"id":"T1574.010","name":"Services File Permissions Weakness","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/010","sourceCount":1},{"id":"T1574.011","name":"Services Registry Permissions Weakness","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/011","sourceCount":10},{"id":"T1574.012","name":"COR_PROFILER","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/012","sourceCount":8},{"id":"T1574.013","name":"KernelCallbackTable","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/013","sourceCount":5},{"id":"T1574.014","name":"AppDomainManager","tactics":["Execution","Stealth"],"platforms":["Windows"],"parent":"T1574","url":"https://attack.mitre.org/techniques/T1574/014","sourceCount":5},{"id":"T1578","name":"Modify Cloud Compute Infrastructure","tactics":["Defense Impairment"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1578","sourceCount":2},{"id":"T1578.001","name":"Create Snapshot","tactics":["Defense Impairment"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/001","sourceCount":2},{"id":"T1578.002","name":"Create Cloud Instance","tactics":["Defense Impairment"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/002","sourceCount":2},{"id":"T1578.003","name":"Delete Cloud Instance","tactics":["Defense Impairment"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/003","sourceCount":2},{"id":"T1578.004","name":"Revert Cloud Instance","tactics":["Defense Impairment"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/004","sourceCount":3},{"id":"T1578.005","name":"Modify Cloud Compute Configurations","tactics":["Defense Impairment"],"platforms":["IaaS"],"parent":"T1578","url":"https://attack.mitre.org/techniques/T1578/005","sourceCount":3},{"id":"T1580","name":"Cloud Infrastructure Discovery","tactics":["Discovery"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1580","sourceCount":11},{"id":"T1583","name":"Acquire Infrastructure","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1583","sourceCount":9},{"id":"T1583.001","name":"Domains","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/001","sourceCount":20},{"id":"T1583.002","name":"DNS Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/002","sourceCount":2},{"id":"T1583.003","name":"Virtual Private Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/003","sourceCount":5},{"id":"T1583.004","name":"Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/004","sourceCount":7},{"id":"T1583.005","name":"Botnet","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/005","sourceCount":7},{"id":"T1583.006","name":"Web Services","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/006","sourceCount":4},{"id":"T1583.007","name":"Serverless","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/007","sourceCount":5},{"id":"T1583.008","name":"Malvertising","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1583","url":"https://attack.mitre.org/techniques/T1583/008","sourceCount":6},{"id":"T1584","name":"Compromise Infrastructure","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1584","sourceCount":13},{"id":"T1584.001","name":"Domains","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/001","sourceCount":5},{"id":"T1584.002","name":"DNS Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/002","sourceCount":7},{"id":"T1584.003","name":"Virtual Private Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/003","sourceCount":5},{"id":"T1584.004","name":"Server","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/004","sourceCount":5},{"id":"T1584.005","name":"Botnet","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/005","sourceCount":4},{"id":"T1584.006","name":"Web Services","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/006","sourceCount":3},{"id":"T1584.007","name":"Serverless","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/007","sourceCount":5},{"id":"T1584.008","name":"Network Devices","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1584","url":"https://attack.mitre.org/techniques/T1584/008","sourceCount":4},{"id":"T1585","name":"Establish Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1585","sourceCount":5},{"id":"T1585.001","name":"Social Media Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1585","url":"https://attack.mitre.org/techniques/T1585/001","sourceCount":3},{"id":"T1585.002","name":"Email Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1585","url":"https://attack.mitre.org/techniques/T1585/002","sourceCount":4},{"id":"T1585.003","name":"Cloud Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1585","url":"https://attack.mitre.org/techniques/T1585/003","sourceCount":2},{"id":"T1586","name":"Compromise Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1586","sourceCount":3},{"id":"T1586.001","name":"Social Media Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1586","url":"https://attack.mitre.org/techniques/T1586/001","sourceCount":4},{"id":"T1586.002","name":"Email Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1586","url":"https://attack.mitre.org/techniques/T1586/002","sourceCount":3},{"id":"T1586.003","name":"Cloud Accounts","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1586","url":"https://attack.mitre.org/techniques/T1586/003","sourceCount":5},{"id":"T1587","name":"Develop Capabilities","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1587","sourceCount":6},{"id":"T1587.001","name":"Malware","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1587","url":"https://attack.mitre.org/techniques/T1587/001","sourceCount":9},{"id":"T1587.002","name":"Code Signing Certificates","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1587","url":"https://attack.mitre.org/techniques/T1587/002","sourceCount":2},{"id":"T1587.003","name":"Digital Certificates","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1587","url":"https://attack.mitre.org/techniques/T1587/003","sourceCount":2},{"id":"T1587.004","name":"Exploits","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1587","url":"https://attack.mitre.org/techniques/T1587/004","sourceCount":3},{"id":"T1588","name":"Obtain Capabilities","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1588","sourceCount":8},{"id":"T1588.001","name":"Malware","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/001","sourceCount":2},{"id":"T1588.002","name":"Tool","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/002","sourceCount":5},{"id":"T1588.003","name":"Code Signing Certificates","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/003","sourceCount":2},{"id":"T1588.004","name":"Digital Certificates","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/004","sourceCount":5},{"id":"T1588.005","name":"Exploits","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/005","sourceCount":6},{"id":"T1588.006","name":"Vulnerabilities","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/006","sourceCount":2},{"id":"T1588.007","name":"Artificial Intelligence","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1588","url":"https://attack.mitre.org/techniques/T1588/007","sourceCount":6},{"id":"T1589","name":"Gather Victim Identity Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1589","sourceCount":11},{"id":"T1589.001","name":"Credentials","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1589","url":"https://attack.mitre.org/techniques/T1589/001","sourceCount":13},{"id":"T1589.002","name":"Email Addresses","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1589","url":"https://attack.mitre.org/techniques/T1589/002","sourceCount":6},{"id":"T1589.003","name":"Employee Names","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1589","url":"https://attack.mitre.org/techniques/T1589/003","sourceCount":2},{"id":"T1590","name":"Gather Victim Network Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1590","sourceCount":4},{"id":"T1590.001","name":"Domain Properties","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/001","sourceCount":6},{"id":"T1590.002","name":"DNS","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/002","sourceCount":7},{"id":"T1590.003","name":"Network Trust Dependencies","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/003","sourceCount":2},{"id":"T1590.004","name":"Network Topology","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/004","sourceCount":2},{"id":"T1590.005","name":"IP Addresses","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/005","sourceCount":4},{"id":"T1590.006","name":"Network Security Appliances","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1590","url":"https://attack.mitre.org/techniques/T1590/006","sourceCount":2},{"id":"T1591","name":"Gather Victim Org Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1591","sourceCount":3},{"id":"T1591.001","name":"Determine Physical Locations","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1591","url":"https://attack.mitre.org/techniques/T1591/001","sourceCount":3},{"id":"T1591.002","name":"Business Relationships","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1591","url":"https://attack.mitre.org/techniques/T1591/002","sourceCount":2},{"id":"T1591.003","name":"Identify Business Tempo","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1591","url":"https://attack.mitre.org/techniques/T1591/003","sourceCount":2},{"id":"T1591.004","name":"Identify Roles","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1591","url":"https://attack.mitre.org/techniques/T1591/004","sourceCount":2},{"id":"T1592","name":"Gather Victim Host Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1592","sourceCount":4},{"id":"T1592.001","name":"Hardware","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1592","url":"https://attack.mitre.org/techniques/T1592/001","sourceCount":3},{"id":"T1592.002","name":"Software","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1592","url":"https://attack.mitre.org/techniques/T1592/002","sourceCount":4},{"id":"T1592.003","name":"Firmware","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1592","url":"https://attack.mitre.org/techniques/T1592/003","sourceCount":2},{"id":"T1592.004","name":"Client Configurations","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1592","url":"https://attack.mitre.org/techniques/T1592/004","sourceCount":3},{"id":"T1593","name":"Search Open Websites/Domains","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1593","sourceCount":4},{"id":"T1593.001","name":"Social Media","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1593","url":"https://attack.mitre.org/techniques/T1593/001","sourceCount":2},{"id":"T1593.002","name":"Search Engines","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1593","url":"https://attack.mitre.org/techniques/T1593/002","sourceCount":3},{"id":"T1593.003","name":"Code Repositories","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1593","url":"https://attack.mitre.org/techniques/T1593/003","sourceCount":2},{"id":"T1594","name":"Search Victim-Owned Websites","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1594","sourceCount":4},{"id":"T1595","name":"Active Scanning","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1595","sourceCount":3},{"id":"T1595.001","name":"Scanning IP Blocks","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1595","url":"https://attack.mitre.org/techniques/T1595/001","sourceCount":2},{"id":"T1595.002","name":"Vulnerability Scanning","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1595","url":"https://attack.mitre.org/techniques/T1595/002","sourceCount":2},{"id":"T1595.003","name":"Wordlist Scanning","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1595","url":"https://attack.mitre.org/techniques/T1595/003","sourceCount":4},{"id":"T1596","name":"Search Open Technical Databases","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1596","sourceCount":8},{"id":"T1596.001","name":"DNS/Passive DNS","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/001","sourceCount":3},{"id":"T1596.002","name":"WHOIS","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/002","sourceCount":2},{"id":"T1596.003","name":"Digital Certificates","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/003","sourceCount":3},{"id":"T1596.004","name":"CDNs","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/004","sourceCount":2},{"id":"T1596.005","name":"Scan Databases","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1596","url":"https://attack.mitre.org/techniques/T1596/005","sourceCount":2},{"id":"T1597","name":"Search Closed Sources","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1597","sourceCount":2},{"id":"T1597.001","name":"Threat Intel Vendors","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1597","url":"https://attack.mitre.org/techniques/T1597/001","sourceCount":2},{"id":"T1597.002","name":"Purchase Technical Data","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1597","url":"https://attack.mitre.org/techniques/T1597/002","sourceCount":2},{"id":"T1598","name":"Phishing for Information","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1598","sourceCount":11},{"id":"T1598.001","name":"Spearphishing Service","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1598","url":"https://attack.mitre.org/techniques/T1598/001","sourceCount":2},{"id":"T1598.002","name":"Spearphishing Attachment","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1598","url":"https://attack.mitre.org/techniques/T1598/002","sourceCount":6},{"id":"T1598.003","name":"Spearphishing Link","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1598","url":"https://attack.mitre.org/techniques/T1598/003","sourceCount":14},{"id":"T1598.004","name":"Spearphishing Voice","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":"T1598","url":"https://attack.mitre.org/techniques/T1598/004","sourceCount":3},{"id":"T1599","name":"Network Boundary Bridging","tactics":["Defense Impairment"],"platforms":["Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1599","sourceCount":2},{"id":"T1599.001","name":"Network Address Translation Traversal","tactics":["Defense Impairment"],"platforms":["Network Devices"],"parent":"T1599","url":"https://attack.mitre.org/techniques/T1599/001","sourceCount":2},{"id":"T1600","name":"Weaken Encryption","tactics":["Defense Impairment"],"platforms":["Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1600","sourceCount":3},{"id":"T1600.001","name":"Reduce Key Space","tactics":["Defense Impairment"],"platforms":["Network Devices"],"parent":"T1600","url":"https://attack.mitre.org/techniques/T1600/001","sourceCount":3},{"id":"T1600.002","name":"Disable Crypto Hardware","tactics":["Defense Impairment"],"platforms":["Network Devices"],"parent":"T1600","url":"https://attack.mitre.org/techniques/T1600/002","sourceCount":2},{"id":"T1601","name":"Modify System Image","tactics":["Defense Impairment"],"platforms":["Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1601","sourceCount":1},{"id":"T1601.001","name":"Patch System Image","tactics":["Defense Impairment"],"platforms":["Network Devices"],"parent":"T1601","url":"https://attack.mitre.org/techniques/T1601/001","sourceCount":6},{"id":"T1601.002","name":"Downgrade System Image","tactics":["Defense Impairment"],"platforms":["Network Devices"],"parent":"T1601","url":"https://attack.mitre.org/techniques/T1601/002","sourceCount":2},{"id":"T1602","name":"Data from Configuration Repository","tactics":["Collection"],"platforms":["Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1602","sourceCount":4},{"id":"T1602.001","name":"SNMP (MIB Dump)","tactics":["Collection"],"platforms":["Network Devices"],"parent":"T1602","url":"https://attack.mitre.org/techniques/T1602/001","sourceCount":5},{"id":"T1602.002","name":"Network Device Configuration Dump","tactics":["Collection"],"platforms":["Network Devices"],"parent":"T1602","url":"https://attack.mitre.org/techniques/T1602/002","sourceCount":4},{"id":"T1606","name":"Forge Web Credentials","tactics":["Credential Access"],"platforms":["SaaS","Windows","macOS","Linux","IaaS","Office Suite","Identity Provider"],"parent":null,"url":"https://attack.mitre.org/techniques/T1606","sourceCount":7},{"id":"T1606.001","name":"Web Cookies","tactics":["Credential Access"],"platforms":["Linux","macOS","Windows","SaaS","IaaS"],"parent":"T1606","url":"https://attack.mitre.org/techniques/T1606/001","sourceCount":4},{"id":"T1606.002","name":"SAML Tokens","tactics":["Credential Access"],"platforms":["SaaS","Windows","IaaS","Office Suite","Identity Provider"],"parent":"T1606","url":"https://attack.mitre.org/techniques/T1606/002","sourceCount":6},{"id":"T1608","name":"Stage Capabilities","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1608","sourceCount":12},{"id":"T1608.001","name":"Upload Malware","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/001","sourceCount":6},{"id":"T1608.002","name":"Upload Tool","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/002","sourceCount":5},{"id":"T1608.003","name":"Install Digital Certificate","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/003","sourceCount":3},{"id":"T1608.004","name":"Drive-by Target","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/004","sourceCount":4},{"id":"T1608.005","name":"Link Target","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/005","sourceCount":14},{"id":"T1608.006","name":"SEO Poisoning","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1608","url":"https://attack.mitre.org/techniques/T1608/006","sourceCount":8},{"id":"T1609","name":"Container Administration Command","tactics":["Execution"],"platforms":["Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1609","sourceCount":7},{"id":"T1610","name":"Deploy Container","tactics":["Execution"],"platforms":["Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1610","sourceCount":7},{"id":"T1611","name":"Escape to Host","tactics":["Privilege Escalation"],"platforms":["Windows","Linux","Containers","ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1611","sourceCount":10},{"id":"T1612","name":"Build Image on Host","tactics":["Stealth"],"platforms":["Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1612","sourceCount":4},{"id":"T1613","name":"Container and Resource Discovery","tactics":["Discovery"],"platforms":["Containers"],"parent":null,"url":"https://attack.mitre.org/techniques/T1613","sourceCount":3},{"id":"T1614","name":"System Location Discovery","tactics":["Discovery"],"platforms":["IaaS","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1614","sourceCount":7},{"id":"T1614.001","name":"System Language Discovery","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":"T1614","url":"https://attack.mitre.org/techniques/T1614/001","sourceCount":6},{"id":"T1615","name":"Group Policy Discovery","tactics":["Discovery"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1615","sourceCount":5},{"id":"T1619","name":"Cloud Storage Object Discovery","tactics":["Discovery"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1619","sourceCount":3},{"id":"T1620","name":"Reflective Code Loading","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1620","sourceCount":9},{"id":"T1621","name":"Multi-Factor Authentication Request Generation","tactics":["Credential Access"],"platforms":["Windows","Linux","macOS","IaaS","SaaS","Office Suite","Identity Provider"],"parent":null,"url":"https://attack.mitre.org/techniques/T1621","sourceCount":5},{"id":"T1622","name":"Debugger Evasion","tactics":["Stealth","Discovery"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1622","sourceCount":10},{"id":"T1647","name":"Plist File Modification","tactics":["Defense Impairment"],"platforms":["macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1647","sourceCount":4},{"id":"T1648","name":"Serverless Execution","tactics":["Execution"],"platforms":["SaaS","IaaS","Office Suite"],"parent":null,"url":"https://attack.mitre.org/techniques/T1648","sourceCount":9},{"id":"T1649","name":"Steal or Forge Authentication Certificates","tactics":["Credential Access"],"platforms":["Windows","Linux","macOS","Identity Provider"],"parent":null,"url":"https://attack.mitre.org/techniques/T1649","sourceCount":8},{"id":"T1650","name":"Acquire Access","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1650","sourceCount":5},{"id":"T1651","name":"Cloud Administration Command","tactics":["Execution"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1651","sourceCount":4},{"id":"T1652","name":"Device Driver Discovery","tactics":["Discovery"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1652","sourceCount":7},{"id":"T1653","name":"Power Settings","tactics":["Persistence"],"platforms":["Windows","Linux","macOS","Network Devices"],"parent":null,"url":"https://attack.mitre.org/techniques/T1653","sourceCount":8},{"id":"T1654","name":"Log Enumeration","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1654","sourceCount":5},{"id":"T1657","name":"Financial Theft","tactics":["Impact"],"platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1657","sourceCount":12},{"id":"T1659","name":"Content Injection","tactics":["Initial Access","Command and Control"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1659","sourceCount":5},{"id":"T1665","name":"Hide Infrastructure","tactics":["Command and Control"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1665","sourceCount":11},{"id":"T1666","name":"Modify Cloud Resource Hierarchy","tactics":["Defense Impairment"],"platforms":["IaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1666","sourceCount":6},{"id":"T1667","name":"Email Bombing","tactics":["Impact"],"platforms":["Linux","Office Suite","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1667","sourceCount":5},{"id":"T1668","name":"Exclusive Control","tactics":["Persistence"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1668","sourceCount":6},{"id":"T1669","name":"Wi-Fi Networks","tactics":["Initial Access"],"platforms":["Linux","Network Devices","Windows","macOS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1669","sourceCount":3},{"id":"T1671","name":"Cloud Application Integration","tactics":["Persistence"],"platforms":["Office Suite","SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1671","sourceCount":9},{"id":"T1673","name":"Virtual Machine Discovery","tactics":["Discovery"],"platforms":["ESXi","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1673","sourceCount":3},{"id":"T1674","name":"Input Injection","tactics":["Execution"],"platforms":["Windows","macOS","Linux"],"parent":null,"url":"https://attack.mitre.org/techniques/T1674","sourceCount":4},{"id":"T1675","name":"ESXi Administration Command","tactics":["Execution"],"platforms":["ESXi"],"parent":null,"url":"https://attack.mitre.org/techniques/T1675","sourceCount":4},{"id":"T1677","name":"Poisoned Pipeline Execution","tactics":["Execution"],"platforms":["SaaS"],"parent":null,"url":"https://attack.mitre.org/techniques/T1677","sourceCount":8},{"id":"T1678","name":"Delay Execution","tactics":["Stealth"],"platforms":["Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1678","sourceCount":5},{"id":"T1679","name":"Selective Exclusion","tactics":["Stealth"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1679","sourceCount":2},{"id":"T1680","name":"Local Storage Discovery","tactics":["Discovery"],"platforms":["ESXi","IaaS","Linux","macOS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1680","sourceCount":8},{"id":"T1681","name":"Search Threat Vendor Data","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1681","sourceCount":3},{"id":"T1682","name":"Query Public AI Services","tactics":["Reconnaissance"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1682","sourceCount":3},{"id":"T1683","name":"Generate Content","tactics":["Resource Development"],"platforms":["PRE"],"parent":null,"url":"https://attack.mitre.org/techniques/T1683","sourceCount":2},{"id":"T1683.001","name":"Written Content","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1683","url":"https://attack.mitre.org/techniques/T1683/001","sourceCount":3},{"id":"T1683.002","name":"Audio-Visual Content","tactics":["Resource Development"],"platforms":["PRE"],"parent":"T1683","url":"https://attack.mitre.org/techniques/T1683/002","sourceCount":4},{"id":"T1684","name":"Social Engineering","tactics":["Stealth"],"platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1684","sourceCount":7},{"id":"T1684.001","name":"Impersonation","tactics":["Stealth"],"platforms":["Linux","macOS","Office Suite","SaaS","Windows"],"parent":"T1684","url":"https://attack.mitre.org/techniques/T1684/001","sourceCount":3},{"id":"T1684.002","name":"Email Spoofing","tactics":["Stealth"],"platforms":["Linux","macOS","Office Suite","Windows"],"parent":"T1684","url":"https://attack.mitre.org/techniques/T1684/002","sourceCount":7},{"id":"T1685","name":"Disable or Modify Tools","tactics":["Defense Impairment"],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1685","sourceCount":5},{"id":"T1685.001","name":"Disable or Modify Windows Event Log","tactics":["Defense Impairment"],"platforms":["Windows"],"parent":"T1685","url":"https://attack.mitre.org/techniques/T1685/001","sourceCount":10},{"id":"T1685.002","name":"Disable or Modify Cloud Log","tactics":["Defense Impairment"],"platforms":["IaaS","SaaS","Identity Provider","Office Suite"],"parent":"T1685","url":"https://attack.mitre.org/techniques/T1685/002","sourceCount":4},{"id":"T1685.003","name":"Modify or Spoof Tool UI","tactics":["Defense Impairment"],"platforms":["Linux","macOS","Windows"],"parent":"T1685","url":"https://attack.mitre.org/techniques/T1685/003","sourceCount":2},{"id":"T1685.004","name":"Disable or Modify Linux Audit System Log","tactics":["Defense Impairment"],"platforms":["Linux"],"parent":"T1685","url":"https://attack.mitre.org/techniques/T1685/004","sourceCount":4},{"id":"T1685.005","name":"Clear Windows Event Logs","tactics":["Defense Impairment"],"platforms":["Windows"],"parent":"T1685","url":"https://attack.mitre.org/techniques/T1685/005","sourceCount":2},{"id":"T1685.006","name":"Clear Linux or Mac System Logs","tactics":["Defense Impairment"],"platforms":["Linux","macOS"],"parent":"T1685","url":"https://attack.mitre.org/techniques/T1685/006","sourceCount":2},{"id":"T1686","name":"Disable or Modify System Firewall","tactics":["Defense Impairment"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1686","sourceCount":4},{"id":"T1686.001","name":"Cloud Firewall","tactics":["Defense Impairment"],"platforms":["IaaS"],"parent":"T1686","url":"https://attack.mitre.org/techniques/T1686/001","sourceCount":3},{"id":"T1686.002","name":"Network Device Firewall","tactics":["Defense Impairment"],"platforms":["Network Devices"],"parent":"T1686","url":"https://attack.mitre.org/techniques/T1686/002","sourceCount":2},{"id":"T1686.003","name":"Windows Host Firewall","tactics":["Defense Impairment"],"platforms":["Windows"],"parent":"T1686","url":"https://attack.mitre.org/techniques/T1686/003","sourceCount":2},{"id":"T1687","name":"Exploitation for Defense Impairment","tactics":["Defense Impairment"],"platforms":["IaaS","Linux","macOS","SaaS","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1687","sourceCount":2},{"id":"T1688","name":"Safe Mode Boot","tactics":["Defense Impairment"],"platforms":["Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1688","sourceCount":7},{"id":"T1689","name":"Downgrade Attack","tactics":["Defense Impairment"],"platforms":["macOS","Windows","Linux"],"parent":null,"url":"https://attack.mitre.org/techniques/T1689","sourceCount":8},{"id":"T1690","name":"Prevent Command History Logging","tactics":["Defense Impairment"],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"parent":null,"url":"https://attack.mitre.org/techniques/T1690","sourceCount":4}],"entities":[{"id":"C0001","name":"Frankenstein","type":"campaign","techniques":["T1005","T1016","T1020","T1027.010","T1033","T1036.004","T1041","T1047","T1053.005","T1057","T1059.001","T1059.003","T1059.005","T1071.001","T1082","T1105","T1119","T1127.001","T1140","T1203","T1204.002","T1221","T1497.001","T1518.001","T1566.001","T1573.001","T1588.002"]},{"id":"C0002","name":"Night Dragon","type":"campaign","techniques":["T1003.002","T1005","T1008","T1027.002","T1027.013","T1033","T1059.003","T1071.001","T1074.002","T1078","T1078.002","T1083","T1105","T1110.002","T1112","T1114.001","T1133","T1190","T1204.001","T1219","T1550.002","T1566.002","T1568","T1583.004","T1584.004","T1588.001","T1588.002","T1608.001","T1685"]},{"id":"C0004","name":"CostaRicto","type":"campaign","techniques":["T1005","T1046","T1053.005","T1090.003","T1105","T1133","T1572","T1583.001","T1587.001","T1588.002"]},{"id":"C0005","name":"Operation Spalax","type":"campaign","techniques":["T1027.002","T1027.003","T1027.013","T1059","T1102","T1140","T1204.001","T1204.002","T1218.011","T1497","T1566.001","T1566.002","T1568","T1583.001","T1588.001","T1588.002","T1608.001"]},{"id":"C0006","name":"Operation Honeybee","type":"campaign","techniques":["T1005","T1027.013","T1036","T1036.005","T1041","T1057","T1059.003","T1059.005","T1070.004","T1071.002","T1074.001","T1082","T1083","T1105","T1106","T1112","T1140","T1204.002","T1543.003","T1548.002","T1553.002","T1560.001","T1569.002","T1574.011","T1583.001","T1583.004","T1585.002","T1588.004"]},{"id":"C0007","name":"FunnyDream","type":"campaign","techniques":["T1016","T1018","T1047","T1049","T1057","T1059.003","T1059.005","T1082","T1105","T1560.001","T1583.001","T1585.002","T1588.001","T1588.002"]},{"id":"C0010","name":"C0010","type":"campaign","techniques":["T1105","T1189","T1583.001","T1584.001","T1587.001","T1588.002","T1608.001","T1608.002","T1608.004"]},{"id":"C0011","name":"C0011","type":"campaign","techniques":["T1059.005","T1204.001","T1204.002","T1566.001","T1566.002","T1583.001","T1587.003","T1608.001"]},{"id":"C0012","name":"Operation CuckooBees","type":"campaign","techniques":["T1003.002","T1005","T1007","T1016","T1018","T1027.010","T1027.011","T1033","T1036.005","T1049","T1053.005","T1057","T1059.003","T1059.005","T1069.001","T1071.001","T1078.002","T1082","T1083","T1087.001","T1087.002","T1120","T1124","T1133","T1135","T1190","T1201","T1505.003","T1543.003","T1547.006","T1560.001","T1574.001","T1588.002"]},{"id":"C0013","name":"Operation Sharpshooter","type":"campaign","techniques":["T1036.005","T1055","T1059.005","T1090","T1105","T1106","T1204.002","T1547.001","T1559.002","T1583.006","T1584.004","T1587.001","T1608.001"]},{"id":"C0014","name":"Operation Wocao","type":"campaign","techniques":["T1001","T1003.001","T1003.006","T1005","T1007","T1012","T1016","T1016.001","T1018","T1021.002","T1027.005","T1027.010","T1033","T1036.005","T1041","T1046","T1047","T1049","T1053.005","T1055","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1069.001","T1070.004","T1071.001","T1074.001","T1078","T1078.002","T1078.003","T1082","T1083","T1087.002","T1090","T1090.001","T1090.003","T1095","T1105","T1106","T1111","T1112","T1115","T1119","T1120","T1124","T1133","T1135","T1190","T1505.003","T1518","T1518.001","T1552.004","T1555.005","T1558.003","T1560.001","T1569.002","T1570","T1571","T1573.002","T1583.004","T1585.002","T1587.001","T1588.002","T1589","T1680","T1685.005","T1686.003"]},{"id":"C0015","name":"C0015","type":"campaign","techniques":["T1005","T1016","T1018","T1021.001","T1027","T1030","T1036","T1039","T1047","T1055.001","T1057","T1059.003","T1059.005","T1059.007","T1069.001","T1069.002","T1074.001","T1083","T1105","T1124","T1135","T1204.002","T1218.005","T1218.010","T1218.011","T1219.002","T1482","T1486","T1553.002","T1566.001","T1567.002","T1570","T1588.001","T1588.002"]},{"id":"C0016","name":"Operation Dust Storm","type":"campaign","techniques":["T1027.002","T1027.013","T1036","T1059.005","T1059.007","T1140","T1189","T1203","T1204.001","T1204.002","T1218.005","T1518","T1566.001","T1566.002","T1568","T1583.001","T1585.002"]},{"id":"C0017","name":"C0017","type":"campaign","techniques":["T1001.003","T1003.002","T1005","T1016","T1027","T1027.002","T1033","T1036.004","T1036.005","T1041","T1048.003","T1053.005","T1059.003","T1059.007","T1071.001","T1074.001","T1090","T1102","T1102.001","T1105","T1134","T1140","T1190","T1505.003","T1560.003","T1567","T1574","T1588.002","T1680"]},{"id":"C0018","name":"C0018","type":"campaign","techniques":["T1016","T1021.001","T1027.010","T1033","T1036","T1036.005","T1046","T1047","T1059.001","T1071.001","T1072","T1105","T1190","T1218.011","T1219.002","T1486","T1570","T1571","T1588.002"]},{"id":"C0021","name":"C0021","type":"campaign","techniques":["T1027.009","T1027.010","T1059.001","T1071.001","T1095","T1105","T1140","T1204.001","T1218.011","T1566.002","T1573.002","T1583.001","T1584.001","T1588.002","T1608.001"]},{"id":"C0022","name":"Operation Dream Job","type":"campaign","techniques":["T1005","T1027.002","T1027.013","T1036.008","T1041","T1047","T1053.005","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1083","T1087.002","T1105","T1106","T1110","T1204.001","T1204.002","T1218.010","T1218.011","T1220","T1221","T1497.001","T1497.003","T1505.004","T1534","T1547.001","T1553.002","T1560.001","T1566.001","T1566.002","T1566.003","T1567.002","T1573.001","T1583.001","T1583.004","T1583.006","T1584.001","T1584.004","T1585.001","T1585.002","T1587.001","T1587.002","T1588.002","T1588.003","T1589","T1591","T1591.004","T1593.001","T1608.001","T1608.002","T1614.001","T1622","T1684.001"]},{"id":"C0023","name":"Operation Ghost","type":"campaign","techniques":["T1001.002","T1027.003","T1078.002","T1102.002","T1546.003","T1583.001","T1585.001","T1587.001"]},{"id":"C0024","name":"SolarWinds Compromise","type":"campaign","techniques":["T1003.006","T1005","T1016.001","T1018","T1021.001","T1021.002","T1021.006","T1036.004","T1036.005","T1047","T1048.002","T1053.005","T1057","T1059.001","T1059.003","T1059.005","T1069","T1069.002","T1070","T1070.004","T1070.006","T1070.008","T1071.001","T1074.002","T1078","T1078.002","T1078.003","T1078.004","T1083","T1087","T1087.002","T1090.001","T1098.001","T1098.002","T1098.003","T1098.005","T1105","T1114.002","T1133","T1140","T1190","T1195.002","T1199","T1213","T1213.003","T1218.011","T1482","T1484.002","T1539","T1546.003","T1550","T1550.001","T1550.004","T1552.004","T1553.002","T1555","T1555.003","T1558.003","T1560.001","T1568","T1583.001","T1584.001","T1587.001","T1589.001","T1606.001","T1606.002","T1665","T1680","T1685","T1685.001","T1686"]},{"id":"C0025","name":"2016 Ukraine Electric Power Attack","type":"campaign","techniques":["T1003.001","T1018","T1021.002","T1027","T1027.002","T1036.005","T1036.008","T1036.010","T1047","T1059.001","T1059.003","T1059.005","T1098","T1110","T1136","T1136.002","T1505.001","T1543.003","T1554","T1570","T1685.001"]},{"id":"C0026","name":"C0026","type":"campaign","techniques":["T1005","T1030","T1105","T1560.001","T1568","T1583.001"]},{"id":"C0027","name":"C0027","type":"campaign","techniques":["T1003.006","T1021.007","T1046","T1047","T1069.003","T1078.004","T1087.003","T1087.004","T1090","T1098.001","T1098.003","T1098.005","T1102","T1105","T1133","T1190","T1213.002","T1219.002","T1530","T1566.004","T1572","T1578.002","T1588.002","T1589.001","T1598.001","T1598.004","T1621","T1684.001"]},{"id":"C0028","name":"2015 Ukraine Electric Power Attack","type":"campaign","techniques":["T1018","T1040","T1055","T1056.001","T1059.005","T1070.004","T1071.001","T1078","T1105","T1112","T1133","T1136.002","T1204.002","T1218.011","T1566.001","T1570","T1685"]},{"id":"C0029","name":"Cutting Edge","type":"campaign","techniques":["T1003.001","T1003.003","T1005","T1021.001","T1021.002","T1021.004","T1027.013","T1055","T1056.001","T1056.003","T1059","T1059.006","T1070","T1070.004","T1070.006","T1071.004","T1078.002","T1082","T1095","T1105","T1190","T1205","T1505.003","T1554","T1560.001","T1572","T1584.008","T1588.002","T1594","T1595.002","T1685"]},{"id":"C0030","name":"Triton Safety Instrumented System Attack","type":"campaign","techniques":["T1003.001","T1027.005","T1036.005","T1053.005","T1056.003","T1059.001","T1573","T1587.001","T1588.002","T1595"]},{"id":"C0032","name":"C0032","type":"campaign","techniques":["T1003.001","T1021.001","T1021.004","T1036.005","T1053.005","T1059.001","T1070.004","T1070.006","T1074.001","T1078","T1133","T1505.003","T1546.012","T1571","T1572","T1583.003","T1588.002"]},{"id":"C0033","name":"C0033","type":"campaign","techniques":[]},{"id":"C0034","name":"2022 Ukraine Electric Power Attack","type":"campaign","techniques":["T1036.004","T1053.005","T1059.001","T1095","T1484.001","T1485","T1505.003","T1543.002","T1570","T1572"]},{"id":"C0035","name":"KV Botnet Activity","type":"campaign","techniques":["T1016","T1036","T1036.004","T1055.009","T1057","T1059.004","T1070.004","T1082","T1083","T1095","T1105","T1222.002","T1518.001","T1546","T1564.013","T1571","T1573","T1583.003","T1584.008","T1685"]},{"id":"C0036","name":"Pikabot Distribution February 2024","type":"campaign","techniques":["T1059.001","T1059.007","T1566.002","T1574"]},{"id":"C0037","name":"Water Curupira Pikabot Distribution","type":"campaign","techniques":["T1059.003","T1059.007","T1105","T1140","T1204","T1204.001","T1204.002","T1218.011","T1566.001","T1589.002"]},{"id":"C0038","name":"HomeLand Justice","type":"campaign","techniques":["T1003.001","T1021.001","T1021.002","T1036.005","T1041","T1046","T1047","T1059.001","T1059.003","T1078","T1078.001","T1087.003","T1098.002","T1105","T1114.002","T1134.001","T1190","T1486","T1505.003","T1561.002","T1570","T1588.002","T1588.003","T1685","T1685.001"]},{"id":"C0039","name":"Versa Director Zero Day Exploitation","type":"campaign","techniques":["T1056","T1071.001","T1095","T1190","T1505.003","T1573.002","T1584.008","T1587.001"]},{"id":"C0040","name":"APT41 DUST","type":"campaign","techniques":["T1027.013","T1036.004","T1070.004","T1071.001","T1074.001","T1102","T1105","T1119","T1213.006","T1505.003","T1543.003","T1553.002","T1560.001","T1567.002","T1569.002","T1573.002","T1574.001","T1583.007","T1586.003","T1588.003","T1593.002","T1594","T1596.005"]},{"id":"C0041","name":"FrostyGoop Incident","type":"campaign","techniques":["T1003.002","T1071","T1190","T1505.003","T1689"]},{"id":"C0042","name":"Outer Space","type":"campaign","techniques":["T1027.013","T1059.005","T1071.001","T1105","T1217","T1584.004","T1585.003","T1587.001"]},{"id":"C0043","name":"Indian Critical Infrastructure Intrusions","type":"campaign","techniques":["T1071.001","T1568","T1571","T1573.002","T1583.001","T1584","T1588.004","T1599"]},{"id":"C0044","name":"Juicy Mix","type":"campaign","techniques":["T1053.005","T1059.001","T1059.005","T1071.001","T1074.001","T1082","T1132.001","T1140","T1217","T1518","T1555.003","T1555.004","T1584.004","T1587.001"]},{"id":"C0045","name":"ShadowRay","type":"campaign","techniques":["T1003.008","T1016","T1027.013","T1059.006","T1068","T1105","T1190","T1496.001","T1546.004","T1588.002"]},{"id":"C0046","name":"ArcaneDoor","type":"campaign","techniques":["T1014","T1020","T1036","T1037","T1040","T1041","T1055","T1059","T1070.004","T1071.001","T1082","T1102.003","T1119","T1133","T1140","T1190","T1556","T1557","T1583.003","T1583.006","T1587.001","T1587.003","T1653","T1685","T1690"]},{"id":"C0047","name":"RedDelta Modified PlugX Infection Chain Operations","type":"campaign","techniques":["T1027.013","T1036.004","T1059.001","T1071.001","T1082","T1090","T1095","T1203","T1204.001","T1204.002","T1218.007","T1218.014","T1480","T1547.001","T1553.002","T1564.001","T1566.001","T1566.002","T1574.001","T1583.001","T1588.004","T1608.001"]},{"id":"C0048","name":"Operation MidnightEclipse","type":"campaign","techniques":["T1003.003","T1005","T1021.002","T1021.006","T1053.003","T1059.004","T1071.001","T1074.001","T1078","T1078.002","T1090","T1105","T1190","T1559","T1584.003","T1584.006","T1588.002"]},{"id":"C0049","name":"Leviathan Australian Intrusions","type":"campaign","techniques":["T1018","T1021.002","T1021.004","T1041","T1056","T1068","T1074.001","T1078","T1078.002","T1078.003","T1082","T1111","T1135","T1190","T1212","T1213.006","T1482","T1505.003","T1528","T1552","T1552.001","T1558.003","T1588.006","T1594","T1615","T1686"]},{"id":"C0050","name":"J-magic Campaign","type":"campaign","techniques":["T1036.005","T1583.003","T1587.003","T1588.001"]},{"id":"C0051","name":"APT28 Nearest Neighbor Campaign","type":"campaign","techniques":["T1003.002","T1003.003","T1006","T1016.002","T1021.001","T1021.002","T1059.001","T1059.003","T1074.001","T1090.001","T1110.003","T1140","T1560.001","T1561.001","T1567","T1584","T1669","T1686.003"]},{"id":"C0052","name":"SPACEHOP Activity","type":"campaign","techniques":["T1090.003","T1190","T1583.003","T1588.002"]},{"id":"C0053","name":"FLORAHOX Activity","type":"campaign","techniques":["T1059","T1059.004","T1090.003","T1190","T1583.003","T1584.008"]},{"id":"C0055","name":"Quad7 Activity","type":"campaign","techniques":["T1027.011","T1059.004","T1071.001","T1071.002","T1090.002","T1090.003","T1105","T1110.003","T1190","T1571","T1584.005","T1584.008","T1589.002","T1665","T1685"]},{"id":"C0056","name":"RedPenguin","type":"campaign","techniques":["T1014","T1016","T1027.013","T1036.005","T1040","T1041","T1055","T1057","T1059.004","T1059.008","T1070.004","T1070.007","T1078","T1090","T1090.003","T1095","T1104","T1105","T1140","T1203","T1205","T1554","T1571","T1573.001","T1587.001","T1690"]},{"id":"C0057","name":"3CX Supply Chain Attack","type":"campaign","techniques":["T1027","T1027.009","T1027.013","T1055","T1055.002","T1071.001","T1078","T1102.001","T1189","T1195.002","T1203","T1217","T1218.007","T1218.015","T1543.004","T1546.016","T1553.002","T1559","T1573.001","T1574.001","T1620","T1678"]},{"id":"C0058","name":"SharePoint ToolShell Exploitation","type":"campaign","techniques":["T1003.001","T1005","T1027.002","T1027.010","T1033","T1041","T1047","T1053.005","T1059.001","T1059.003","T1071.001","T1074.001","T1082","T1083","T1090","T1105","T1112","T1119","T1140","T1190","T1484.001","T1486","T1505.003","T1505.004","T1552.001","T1569.002","T1570","T1572","T1583.001","T1585.002","T1588.002","T1595.002","T1620","T1657","T1685"]},{"id":"C0059","name":"Salesforce Data Exfiltration","type":"campaign","techniques":["T1020","T1036","T1059.006","T1078.002","T1083","T1090","T1090.003","T1213.004","T1567","T1585","T1585.002","T1586.002","T1587.001","T1588.002","T1598.004","T1608.005","T1671","T1684.001"]},{"id":"C0060","name":"Operation AkaiRyū","type":"campaign","techniques":["T1016","T1036.008","T1047","T1059.001","T1059.003","T1059.005","T1070.004","T1082","T1083","T1127.001","T1137.001","T1204.001","T1204.002","T1217","T1219","T1219.001","T1553.002","T1566.001","T1566.002","T1585.002","T1585.003","T1586.002","T1587.001","T1588.002","T1608.005","T1685.005"]},{"id":"C0061","name":"Operation Digital Eye","type":"campaign","techniques":["T1003.001","T1003.002","T1018","T1021.001","T1033","T1036.005","T1059.003","T1069.001","T1070.004","T1087.001","T1098.004","T1106","T1190","T1219.001","T1505.003","T1543.003","T1550.002","T1569.002","T1588.002","T1591","T1614.001","T1665"]},{"id":"C0062","name":"Anthropic AI-orchestrated Campaign","type":"campaign","techniques":["T1005","T1016","T1046","T1049","T1074.001","T1078","T1078.003","T1082","T1083","T1087","T1119","T1136.001","T1190","T1213.006","T1552.001","T1567","T1584.004","T1587.004","T1588.002","T1588.007","T1590.004","T1592.002","T1592.004","T1595.001","T1595.002","T1683"]},{"id":"C0063","name":"2025 Poland Wiper Attacks","type":"campaign","techniques":["T1003.001","T1003.002","T1003.003","T1006","T1016","T1021.001","T1027.013","T1036.005","T1046","T1048.003","T1049","T1053","T1057","T1059.003","T1059.004","T1059.008","T1074.001","T1078.002","T1078.004","T1083","T1090","T1090.003","T1102.002","T1105","T1110.002","T1113","T1114.002","T1133","T1140","T1484.001","T1485","T1490","T1495","T1529","T1530","T1550.002","T1555","T1556.006","T1558","T1560.001","T1567.004","T1570","T1571","T1583.006","T1584.001","T1584.003","T1584.008","T1587.001","T1588.007","T1590.006","T1602.002","T1608.002","T1686.002"]},{"id":"G0001","name":"Axiom","type":"group","techniques":["T1001.002","T1003","T1005","T1021.001","T1078","T1189","T1190","T1203","T1546.008","T1553","T1560","T1563.002","T1566","T1583.002","T1583.003","T1584.005"]},{"id":"G0002","name":"Moafee","type":"group","techniques":["T1027.001"]},{"id":"G0003","name":"Cleaver","type":"group","techniques":["T1003.001","T1557.002","T1585.001","T1587.001","T1588.002"]},{"id":"G0004","name":"Ke3chang","type":"group","techniques":["T1003.001","T1003.002","T1003.003","T1003.004","T1005","T1007","T1016","T1018","T1020","T1021.002","T1027","T1033","T1036.002","T1036.005","T1041","T1049","T1056.001","T1057","T1059","T1059.003","T1069.002","T1071.001","T1071.004","T1078","T1078.004","T1082","T1083","T1087.001","T1087.002","T1105","T1114.002","T1119","T1133","T1140","T1190","T1213.002","T1543.003","T1547.001","T1558.001","T1560","T1560.001","T1569.002","T1583.005","T1587.001","T1588.002","T1614.001"]},{"id":"G0005","name":"APT12","type":"group","techniques":["T1102.002","T1203","T1204.002","T1566.001","T1568.003"]},{"id":"G0006","name":"APT1","type":"group","techniques":["T1003.001","T1005","T1007","T1016","T1021.001","T1036.005","T1049","T1057","T1059.003","T1087.001","T1114.001","T1114.002","T1119","T1135","T1550.002","T1560.001","T1566.001","T1566.002","T1583.001","T1584.001","T1585.002","T1588.001","T1588.002"]},{"id":"G0007","name":"APT28","type":"group","techniques":["T1001.001","T1003","T1003.001","T1003.003","T1005","T1014","T1021.002","T1025","T1027.013","T1030","T1036","T1036.005","T1037.001","T1039","T1040","T1048.002","T1056.001","T1057","T1059.001","T1059.003","T1068","T1070.004","T1070.006","T1071.001","T1071.003","T1074.001","T1074.002","T1078","T1078.004","T1083","T1090.002","T1090.003","T1091","T1092","T1098.002","T1102.002","T1105","T1110","T1110.001","T1110.003","T1113","T1114.002","T1119","T1120","T1133","T1134.001","T1137.002","T1140","T1189","T1190","T1199","T1203","T1204.001","T1204.002","T1210","T1211","T1213","T1213.002","T1218.011","T1221","T1498","T1505.003","T1528","T1542.003","T1546.015","T1547.001","T1550.001","T1550.002","T1557.004","T1559.002","T1560","T1560.001","T1564.001","T1564.003","T1566.001","T1567","T1573.001","T1583.001","T1583.003","T1583.006","T1584.008","T1586.002","T1588.002","T1588.007","T1589.001","T1591","T1595.002","T1596","T1598","T1598.003","T1669","T1684.001","T1685.005"]},{"id":"G0008","name":"Carbanak","type":"group","techniques":["T1036.004","T1036.005","T1078","T1102.002","T1218.011","T1219","T1543.003","T1588.002","T1686"]},{"id":"G0009","name":"Deep Panda","type":"group","techniques":["T1018","T1021.002","T1027.005","T1047","T1057","T1059.001","T1218.010","T1505.003","T1546.008","T1564.003"]},{"id":"G0010","name":"Turla","type":"group","techniques":["T1005","T1007","T1012","T1016","T1016.001","T1018","T1021.002","T1025","T1027.005","T1027.010","T1027.011","T1036.005","T1049","T1055","T1055.001","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1068","T1069.001","T1069.002","T1071.001","T1071.003","T1078.003","T1082","T1083","T1087.001","T1087.002","T1090","T1090.001","T1102","T1102.002","T1105","T1106","T1110","T1112","T1120","T1124","T1134.002","T1140","T1189","T1201","T1204.001","T1213.006","T1518.001","T1546.003","T1546.013","T1547.001","T1547.004","T1553.006","T1555.004","T1560.001","T1564.012","T1566.002","T1567.002","T1570","T1583.006","T1584.003","T1584.004","T1584.006","T1587.001","T1588.001","T1588.002","T1615","T1685"]},{"id":"G0011","name":"PittyTiger","type":"group","techniques":["T1078","T1588.002"]},{"id":"G0012","name":"Darkhotel","type":"group","techniques":["T1016","T1027.013","T1036.005","T1056.001","T1057","T1059.003","T1080","T1082","T1083","T1091","T1105","T1124","T1140","T1189","T1203","T1204.002","T1497","T1497.001","T1497.002","T1518.001","T1547.001","T1553.002","T1566.001","T1573.001"]},{"id":"G0013","name":"APT30","type":"group","techniques":["T1204.002","T1566.001"]},{"id":"G0016","name":"APT29","type":"group","techniques":["T1003.002","T1003.004","T1005","T1016.001","T1021.007","T1027.001","T1027.002","T1027.006","T1036.005","T1037","T1037.004","T1047","T1053.005","T1059.001","T1059.006","T1059.009","T1068","T1070.004","T1070.006","T1078","T1078.003","T1078.004","T1087.004","T1090.002","T1090.003","T1090.004","T1098.002","T1098.005","T1105","T1110.001","T1110.003","T1114.002","T1133","T1136.003","T1190","T1199","T1203","T1204.001","T1204.002","T1218.005","T1505.003","T1528","T1546.003","T1546.008","T1547.001","T1548.002","T1550.003","T1553.005","T1556.007","T1566.001","T1566.002","T1566.003","T1568","T1573","T1583.006","T1586.002","T1586.003","T1587.001","T1587.003","T1588.002","T1595.002","T1621","T1649","T1651","T1665","T1685.002"]},{"id":"G0017","name":"DragonOK","type":"group","techniques":[]},{"id":"G0018","name":"admin@338","type":"group","techniques":["T1007","T1016","T1036.005","T1049","T1059.003","T1069.001","T1082","T1083","T1087.001","T1203","T1204.002","T1566.001"]},{"id":"G0019","name":"Naikon","type":"group","techniques":["T1016","T1018","T1036.004","T1036.005","T1046","T1047","T1053.005","T1078.002","T1137.006","T1204.002","T1518.001","T1547.001","T1566.001","T1574.001"]},{"id":"G0020","name":"Equation","type":"group","techniques":["T1120","T1480.001","T1542.002","T1564.005"]},{"id":"G0021","name":"Molerats","type":"group","techniques":["T1027.015","T1053.005","T1057","T1059.001","T1059.005","T1059.007","T1105","T1140","T1204.001","T1204.002","T1218.007","T1547.001","T1553.002","T1555.003","T1566.001","T1566.002"]},{"id":"G0022","name":"APT3","type":"group","techniques":["T1003.001","T1005","T1016","T1018","T1021.001","T1021.002","T1027","T1027.002","T1027.005","T1033","T1036.010","T1041","T1049","T1053.005","T1056.001","T1057","T1059.001","T1059.003","T1069","T1070.004","T1074.001","T1078.002","T1082","T1083","T1087.001","T1090.002","T1095","T1098.007","T1104","T1105","T1110.002","T1136.001","T1203","T1204.001","T1218.011","T1543.003","T1546.008","T1547.001","T1552.001","T1555.003","T1560.001","T1564.003","T1566.002","T1574.001"]},{"id":"G0023","name":"APT16","type":"group","techniques":["T1584.004"]},{"id":"G0024","name":"Putter Panda","type":"group","techniques":["T1027.013","T1055.001","T1547.001","T1685"]},{"id":"G0025","name":"APT17","type":"group","techniques":["T1583.006","T1585"]},{"id":"G0026","name":"APT18","type":"group","techniques":["T1027.013","T1053.002","T1059.003","T1070.004","T1071.001","T1071.004","T1078","T1082","T1083","T1105","T1133","T1547.001"]},{"id":"G0027","name":"Threat Group-3390","type":"group","techniques":["T1003.001","T1003.002","T1003.004","T1005","T1012","T1016","T1018","T1021.006","T1027.002","T1027.013","T1027.015","T1030","T1033","T1046","T1047","T1049","T1053.002","T1055.012","T1056.001","T1059.001","T1059.003","T1068","T1070.004","T1070.005","T1071.001","T1074.001","T1074.002","T1078","T1087.001","T1105","T1112","T1119","T1133","T1140","T1189","T1190","T1195.002","T1199","T1203","T1204.002","T1210","T1505.003","T1543.003","T1547.001","T1548.002","T1555.005","T1560.002","T1566.001","T1567.002","T1574.001","T1583.001","T1588.002","T1588.003","T1608.001","T1608.002","T1608.004","T1685.001"]},{"id":"G0028","name":"Threat Group-1314","type":"group","techniques":["T1021.002","T1059.003","T1072","T1078.002"]},{"id":"G0029","name":"Scarlet Mimic","type":"group","techniques":["T1036.002"]},{"id":"G0030","name":"Lotus Blossom","type":"group","techniques":["T1012","T1016","T1016.001","T1018","T1046","T1047","T1049","T1074.001","T1083","T1087.001","T1087.002","T1090.001","T1090.003","T1112","T1134","T1482","T1539","T1543.003","T1560.001","T1560.003","T1588.002"]},{"id":"G0032","name":"Lazarus Group","type":"group","techniques":["T1001.003","T1005","T1008","T1010","T1012","T1016","T1021.001","T1021.002","T1021.004","T1027.007","T1027.009","T1027.013","T1033","T1036.003","T1036.004","T1036.005","T1041","T1046","T1047","T1048.003","T1049","T1053.005","T1055.001","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1070","T1070.003","T1070.004","T1070.006","T1071.001","T1074.001","T1078","T1082","T1083","T1090.001","T1090.002","T1098","T1102.002","T1104","T1105","T1106","T1110.003","T1124","T1132.001","T1134.002","T1140","T1189","T1202","T1203","T1204.002","T1218","T1218.005","T1218.011","T1485","T1489","T1491.001","T1529","T1542.003","T1543.003","T1547.001","T1547.009","T1553.002","T1557.001","T1560","T1560.002","T1560.003","T1561.001","T1561.002","T1564.001","T1566.001","T1566.002","T1566.003","T1571","T1573.001","T1574.001","T1574.013","T1583.001","T1583.006","T1584.004","T1585.001","T1585.002","T1587.001","T1588.002","T1588.004","T1589.002","T1591","T1620","T1680","T1685","T1686.003"]},{"id":"G0033","name":"Poseidon Group","type":"group","techniques":["T1003","T1007","T1036.005","T1049","T1057","T1059.001","T1087.001","T1087.002"]},{"id":"G0034","name":"Sandworm Team","type":"group","techniques":["T1003.001","T1003.003","T1005","T1018","T1021.002","T1027","T1027.010","T1033","T1036","T1036.005","T1040","T1041","T1047","T1049","T1053.005","T1056.001","T1059.001","T1059.005","T1070.004","T1071.001","T1072","T1078","T1078.002","T1082","T1083","T1087.002","T1087.003","T1090","T1102.002","T1105","T1106","T1132.001","T1133","T1140","T1190","T1195","T1195.002","T1199","T1203","T1204.001","T1204.002","T1213.006","T1218.011","T1219","T1485","T1486","T1489","T1490","T1491.002","T1499","T1505.003","T1539","T1555.003","T1561.002","T1566.001","T1566.002","T1570","T1571","T1583","T1583.001","T1583.004","T1584.004","T1584.005","T1585.001","T1585.002","T1586.001","T1587.001","T1588.002","T1588.006","T1589.002","T1589.003","T1590.001","T1591.002","T1592.002","T1593","T1594","T1595.002","T1598.003","T1608.001"]},{"id":"G0035","name":"Dragonfly","type":"group","techniques":["T1003.002","T1003.003","T1003.004","T1005","T1012","T1016","T1018","T1021.001","T1033","T1036.010","T1053.005","T1059","T1059.001","T1059.003","T1059.006","T1069.002","T1070.004","T1071.002","T1074.001","T1078","T1083","T1087.002","T1098.007","T1105","T1110","T1110.002","T1112","T1113","T1114.002","T1133","T1135","T1136.001","T1187","T1189","T1190","T1195.002","T1203","T1204.002","T1210","T1221","T1505.003","T1547.001","T1560","T1564.002","T1566.001","T1583.001","T1583.003","T1584.004","T1588.002","T1591.002","T1595.002","T1598.002","T1598.003","T1608.004","T1685.005","T1686"]},{"id":"G0036","name":"GCMAN","type":"group","techniques":["T1021.004","T1021.005"]},{"id":"G0037","name":"FIN6","type":"group","techniques":["T1003.001","T1003.003","T1005","T1018","T1021.001","T1027.010","T1036.004","T1046","T1047","T1048.003","T1053.005","T1059","T1059.001","T1059.003","T1059.007","T1068","T1070.004","T1074.002","T1078","T1087.002","T1095","T1102","T1110.002","T1119","T1134","T1204.002","T1213.006","T1547.001","T1553.002","T1555","T1555.003","T1560","T1560.003","T1566.001","T1566.003","T1569.002","T1572","T1573.002","T1588.002","T1685"]},{"id":"G0038","name":"Stealth Falcon","type":"group","techniques":["T1005","T1012","T1016","T1033","T1041","T1047","T1053.005","T1057","T1059","T1059.001","T1071.001","T1082","T1555","T1555.003","T1555.004","T1573.001"]},{"id":"G0039","name":"Suckfly","type":"group","techniques":["T1003","T1046","T1059.003","T1078","T1553.002"]},{"id":"G0040","name":"Patchwork","type":"group","techniques":["T1005","T1021.001","T1027.001","T1027.002","T1027.005","T1027.010","T1033","T1036.005","T1053.005","T1055.012","T1059.001","T1059.003","T1059.005","T1070.004","T1074.001","T1082","T1083","T1102.001","T1105","T1112","T1119","T1132.001","T1189","T1197","T1203","T1204.001","T1204.002","T1518.001","T1547.001","T1548.002","T1553.002","T1555.003","T1559.002","T1560","T1566.001","T1566.002","T1574.001","T1587.002","T1588.002","T1598.003","T1680"]},{"id":"G0041","name":"Strider","type":"group","techniques":["T1090.001","T1556.002","T1564.005"]},{"id":"G0043","name":"Group5","type":"group","techniques":["T1027.013","T1056.001","T1070.004","T1113"]},{"id":"G0044","name":"Winnti Group","type":"group","techniques":["T1014","T1057","T1083","T1105","T1553.002","T1583.001"]},{"id":"G0045","name":"menuPass","type":"group","techniques":["T1003.002","T1003.003","T1003.004","T1005","T1016","T1018","T1021.001","T1021.004","T1027.013","T1036","T1036.003","T1036.005","T1039","T1046","T1047","T1049","T1053.005","T1055.012","T1056.001","T1059.001","T1059.003","T1070.003","T1070.004","T1074.001","T1074.002","T1078","T1083","T1087.002","T1090.002","T1105","T1106","T1119","T1140","T1190","T1199","T1204.002","T1210","T1218.004","T1553.002","T1560","T1560.001","T1566.001","T1568.001","T1574.001","T1583.001","T1588.002"]},{"id":"G0046","name":"FIN7","type":"group","techniques":["T1005","T1008","T1021.001","T1021.004","T1021.005","T1027.010","T1027.016","T1033","T1036.004","T1036.005","T1047","T1053.005","T1057","T1059","T1059.001","T1059.003","T1059.005","T1059.007","T1069.002","T1071.004","T1078","T1078.003","T1082","T1087.002","T1091","T1102.002","T1105","T1113","T1124","T1125","T1140","T1190","T1195.002","T1204.001","T1204.002","T1210","T1218.005","T1218.011","T1219","T1486","T1497.002","T1543.003","T1546.011","T1547.001","T1553.002","T1558.003","T1559.002","T1564.001","T1564.003","T1566.001","T1566.002","T1567.002","T1569.002","T1571","T1572","T1583.001","T1583.006","T1587.001","T1588.002","T1591","T1591.004","T1608.001","T1608.004","T1608.005","T1620","T1674","T1686"]},{"id":"G0047","name":"Gamaredon Group","type":"group","techniques":["T1001","T1005","T1012","T1016.001","T1020","T1021.005","T1025","T1027","T1027.004","T1027.010","T1027.012","T1027.015","T1027.016","T1033","T1036.005","T1039","T1041","T1047","T1053.005","T1055","T1057","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1080","T1082","T1083","T1090","T1090.003","T1091","T1095","T1102","T1102.002","T1102.003","T1105","T1106","T1112","T1113","T1119","T1120","T1137","T1140","T1204.001","T1204.002","T1218.005","T1218.011","T1221","T1480","T1491.001","T1497.001","T1518.001","T1534","T1547.001","T1559.001","T1561.001","T1564.003","T1566.001","T1568","T1568.001","T1571","T1583.001","T1583.003","T1583.006","T1587.003","T1588.002","T1608.001","T1620","T1685"]},{"id":"G0048","name":"RTM","type":"group","techniques":["T1102.001","T1189","T1204.002","T1219.002","T1547.001","T1566.001","T1574.001"]},{"id":"G0049","name":"OilRig","type":"group","techniques":["T1003.001","T1003.004","T1003.005","T1005","T1007","T1008","T1012","T1016","T1021.001","T1021.004","T1025","T1027.005","T1027.013","T1033","T1036","T1036.005","T1046","T1047","T1048.003","T1049","T1053.005","T1056.001","T1057","T1059","T1059.001","T1059.003","T1059.005","T1068","T1069.001","T1069.002","T1070.004","T1071.001","T1071.004","T1078","T1078.002","T1082","T1087.001","T1087.002","T1105","T1110","T1112","T1113","T1115","T1119","T1120","T1133","T1137.004","T1140","T1195","T1201","T1203","T1204.001","T1204.002","T1218.001","T1219","T1497.001","T1505.003","T1543.003","T1552.001","T1553.002","T1555","T1555.003","T1555.004","T1556.002","T1566.001","T1566.002","T1566.003","T1572","T1573.002","T1583.001","T1586.002","T1587.001","T1588.002","T1588.003","T1608.001","T1686.003"]},{"id":"G0050","name":"APT32","type":"group","techniques":["T1003","T1003.001","T1012","T1016","T1018","T1021.002","T1027.010","T1027.011","T1027.013","T1027.016","T1033","T1036","T1036.003","T1036.004","T1036.005","T1041","T1046","T1047","T1048.003","T1049","T1053.005","T1055","T1056.001","T1059","T1059.001","T1059.003","T1059.005","T1059.007","T1068","T1070.004","T1070.006","T1071.001","T1071.003","T1072","T1078.003","T1082","T1083","T1087.001","T1102","T1105","T1112","T1135","T1137","T1189","T1203","T1204.001","T1204.002","T1216.001","T1218.005","T1218.010","T1218.011","T1222.002","T1505.003","T1543.003","T1547.001","T1550.002","T1550.003","T1552.002","T1560","T1564.001","T1564.003","T1564.004","T1566.001","T1566.002","T1569.002","T1570","T1571","T1574.001","T1583.001","T1583.006","T1585.001","T1588.002","T1589","T1589.002","T1598.003","T1608.001","T1608.004","T1685.005"]},{"id":"G0051","name":"FIN10","type":"group","techniques":["T1021.001","T1033","T1053.005","T1059.001","T1059.003","T1070.004","T1078","T1078.003","T1547.001","T1570","T1588.002"]},{"id":"G0052","name":"CopyKittens","type":"group","techniques":["T1059.001","T1090","T1218.011","T1553.002","T1560.001","T1560.003","T1564.003","T1588.002"]},{"id":"G0053","name":"FIN5","type":"group","techniques":["T1018","T1059","T1070.004","T1074.001","T1078","T1090.002","T1110","T1119","T1133","T1588.002","T1685.005"]},{"id":"G0054","name":"Sowbug","type":"group","techniques":["T1003","T1036.005","T1039","T1056.001","T1059.003","T1082","T1083","T1135","T1560.001"]},{"id":"G0055","name":"NEODYMIUM","type":"group","techniques":[]},{"id":"G0056","name":"PROMETHIUM","type":"group","techniques":["T1036.004","T1036.005","T1078.003","T1189","T1204.002","T1205.001","T1543.003","T1547.001","T1553.002","T1587.002","T1587.003"]},{"id":"G0059","name":"Magic Hound","type":"group","techniques":["T1003.001","T1005","T1016","T1016.001","T1016.002","T1018","T1021.001","T1027.010","T1027.013","T1033","T1036.004","T1036.005","T1036.010","T1046","T1047","T1049","T1053.005","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1070.003","T1070.004","T1071","T1071.001","T1078.001","T1078.002","T1082","T1083","T1087.003","T1090","T1098.002","T1098.007","T1102.002","T1105","T1112","T1113","T1114","T1114.001","T1114.002","T1136.001","T1189","T1190","T1204.001","T1204.002","T1218.011","T1482","T1486","T1505.003","T1547.001","T1560.001","T1564.003","T1566.002","T1566.003","T1567","T1570","T1571","T1572","T1573","T1583.001","T1583.006","T1584.001","T1585.001","T1585.002","T1586.002","T1588.002","T1589","T1589.001","T1589.002","T1590.005","T1591.001","T1592.002","T1595.002","T1598.003","T1685","T1685.001","T1686.003"]},{"id":"G0060","name":"BRONZE BUTLER","type":"group","techniques":["T1003.001","T1005","T1007","T1018","T1027.001","T1027.003","T1036","T1036.002","T1036.005","T1039","T1053.002","T1053.005","T1059.001","T1059.003","T1059.005","T1059.006","T1070.004","T1071.001","T1080","T1083","T1087.002","T1102.001","T1105","T1113","T1124","T1132.001","T1140","T1189","T1203","T1204.002","T1518","T1547.001","T1548.002","T1550.003","T1560.001","T1566.001","T1573.001","T1574.001","T1588.002","T1685"]},{"id":"G0061","name":"FIN8","type":"group","techniques":["T1003.001","T1016.001","T1018","T1021.001","T1021.002","T1027.010","T1033","T1047","T1048.003","T1053.005","T1055.004","T1059.001","T1059.003","T1068","T1070.004","T1071.001","T1074.002","T1078","T1082","T1102","T1105","T1112","T1134.001","T1204.001","T1204.002","T1482","T1486","T1518.001","T1546.003","T1560.001","T1566.001","T1566.002","T1573.002","T1588.002","T1588.003","T1685.005"]},{"id":"G0062","name":"TA459","type":"group","techniques":["T1059.001","T1059.005","T1203","T1204.002","T1566.001"]},{"id":"G0063","name":"BlackOasis","type":"group","techniques":["T1027"]},{"id":"G0064","name":"APT33","type":"group","techniques":["T1003.001","T1003.004","T1003.005","T1027.013","T1040","T1048.003","T1053.005","T1059.001","T1059.005","T1068","T1071.001","T1078","T1078.004","T1105","T1110.003","T1132.001","T1203","T1204.001","T1204.002","T1546.003","T1547.001","T1552.001","T1552.006","T1555","T1555.003","T1560.001","T1566.001","T1566.002","T1571","T1573.001","T1588.002"]},{"id":"G0065","name":"Leviathan","type":"group","techniques":["T1003","T1003.001","T1021.001","T1021.004","T1027.001","T1027.003","T1027.013","T1027.015","T1041","T1047","T1055.001","T1059.001","T1059.005","T1074.001","T1074.002","T1078","T1090.003","T1102.003","T1105","T1133","T1140","T1189","T1190","T1197","T1203","T1204.001","T1204.002","T1218.010","T1505.003","T1534","T1546.003","T1547.001","T1547.009","T1553.002","T1559.002","T1560","T1566.001","T1566.002","T1567.002","T1572","T1583.001","T1584.004","T1584.008","T1585.001","T1585.002","T1586.001","T1586.002","T1587.004","T1589.001","T1595.002"]},{"id":"G0066","name":"Elderwood","type":"group","techniques":["T1027.002","T1027.013","T1105","T1189","T1203","T1204.001","T1204.002","T1566.001","T1566.002"]},{"id":"G0067","name":"APT37","type":"group","techniques":["T1005","T1027","T1027.003","T1033","T1036.001","T1053.005","T1055","T1057","T1059","T1059.003","T1059.005","T1059.006","T1071.001","T1082","T1102.002","T1105","T1106","T1120","T1123","T1189","T1203","T1204.002","T1529","T1547.001","T1548.002","T1555.003","T1559.002","T1561.002","T1566.001"]},{"id":"G0068","name":"PLATINUM","type":"group","techniques":["T1003.001","T1036","T1055","T1056.001","T1056.004","T1068","T1095","T1105","T1189","T1204.002","T1566.001"]},{"id":"G0069","name":"MuddyWater","type":"group","techniques":["T1003.001","T1003.004","T1003.005","T1016","T1027.003","T1027.004","T1027.010","T1033","T1036.005","T1041","T1047","T1049","T1053.005","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1071.001","T1074.001","T1082","T1083","T1087.002","T1090","T1090.002","T1102.002","T1104","T1105","T1113","T1132.001","T1137.001","T1140","T1190","T1203","T1204.001","T1204.002","T1204.004","T1210","T1218.003","T1218.005","T1218.011","T1219.002","T1518","T1518.001","T1534","T1547.001","T1548.002","T1552.001","T1555","T1555.003","T1559.001","T1559.002","T1560.001","T1566","T1566.001","T1566.002","T1567.002","T1571","T1573.001","T1574.001","T1583.001","T1583.006","T1588.001","T1588.002","T1590.004","T1684.001","T1685"]},{"id":"G0070","name":"Dark Caracal","type":"group","techniques":["T1005","T1027.002","T1027.013","T1059.003","T1071.001","T1083","T1113","T1189","T1204.002","T1218.001","T1547.001","T1566.003"]},{"id":"G0071","name":"Orangeworm","type":"group","techniques":["T1021.002","T1071.001"]},{"id":"G0073","name":"APT19","type":"group","techniques":["T1016","T1027.010","T1027.013","T1033","T1059","T1059.001","T1071.001","T1082","T1112","T1132.001","T1140","T1189","T1204.002","T1218.010","T1218.011","T1543.003","T1547.001","T1564.003","T1566.001","T1574.001","T1588.002"]},{"id":"G0075","name":"Rancor","type":"group","techniques":["T1053.005","T1059.003","T1059.005","T1071.001","T1105","T1204.002","T1218.007","T1546.003","T1566.001"]},{"id":"G0076","name":"Thrip","type":"group","techniques":["T1048.003","T1059.001","T1219.002","T1588.002"]},{"id":"G0077","name":"Leafminer","type":"group","techniques":["T1003.001","T1003.004","T1003.005","T1018","T1027.010","T1046","T1055.013","T1059.007","T1083","T1110.003","T1114.002","T1136.001","T1189","T1552.001","T1555","T1555.003","T1588.002"]},{"id":"G0078","name":"Gorgon Group","type":"group","techniques":["T1055.002","T1055.012","T1059.001","T1059.003","T1059.005","T1105","T1106","T1112","T1140","T1204.002","T1547.001","T1547.009","T1564.003","T1566.001","T1588.002","T1685"]},{"id":"G0079","name":"DarkHydrus","type":"group","techniques":["T1059.001","T1187","T1204.002","T1221","T1564.003","T1566.001","T1588.002"]},{"id":"G0080","name":"Cobalt Group","type":"group","techniques":["T1021.001","T1027.010","T1037.001","T1046","T1053.005","T1055","T1059.001","T1059.003","T1059.005","T1059.007","T1068","T1070.004","T1071.001","T1071.004","T1105","T1195.002","T1203","T1204.001","T1204.002","T1218.003","T1218.008","T1218.010","T1219","T1220","T1518.001","T1543.003","T1547.001","T1548.002","T1559.002","T1566.001","T1566.002","T1572","T1573.002","T1588.002"]},{"id":"G0081","name":"Tropic Trooper","type":"group","techniques":["T1016","T1020","T1027.003","T1027.013","T1033","T1036.005","T1046","T1049","T1052.001","T1055.001","T1057","T1059.003","T1070.004","T1071.001","T1071.004","T1078.003","T1082","T1083","T1091","T1105","T1106","T1119","T1132.001","T1135","T1140","T1203","T1204.002","T1221","T1505.003","T1518","T1518.001","T1543.003","T1547.001","T1547.004","T1564.001","T1566.001","T1573","T1573.002","T1574.001","T1680"]},{"id":"G0082","name":"APT38","type":"group","techniques":["T1005","T1027.002","T1033","T1036.003","T1036.006","T1049","T1053.003","T1053.005","T1055","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1070.004","T1070.006","T1071.001","T1082","T1083","T1105","T1106","T1110","T1112","T1115","T1135","T1140","T1189","T1204.001","T1204.002","T1217","T1218.001","T1218.005","T1218.007","T1218.011","T1480.002","T1485","T1486","T1505.003","T1518.001","T1529","T1543.003","T1548.002","T1553.005","T1561.002","T1565.001","T1565.002","T1565.003","T1566.001","T1569.002","T1583.001","T1588.002","T1685","T1685.005","T1686","T1686.002","T1690"]},{"id":"G0083","name":"SilverTerrier","type":"group","techniques":["T1071.001","T1071.002","T1071.003","T1657"]},{"id":"G0084","name":"Gallmaker","type":"group","techniques":["T1027","T1059.001","T1204.002","T1559.002","T1560.001","T1566.001"]},{"id":"G0085","name":"FIN4","type":"group","techniques":["T1056.001","T1056.002","T1059.005","T1071.001","T1078","T1090.003","T1114.002","T1204.001","T1204.002","T1564.008","T1566.001","T1566.002"]},{"id":"G0087","name":"APT39","type":"group","techniques":["T1003","T1003.001","T1005","T1012","T1018","T1021.001","T1021.002","T1021.004","T1027.002","T1027.013","T1033","T1036.005","T1041","T1046","T1053.005","T1056","T1056.001","T1059","T1059.001","T1059.005","T1059.006","T1059.010","T1070.004","T1071.001","T1071.004","T1074.001","T1078","T1083","T1090.001","T1090.002","T1102.002","T1105","T1110","T1113","T1115","T1135","T1136.001","T1140","T1190","T1197","T1204.001","T1204.002","T1505.003","T1546.010","T1547.001","T1547.009","T1553.006","T1555","T1560.001","T1566.001","T1566.002","T1569.002","T1588.002"]},{"id":"G0088","name":"TEMP.Veles","type":"group","techniques":[]},{"id":"G0089","name":"The White Company","type":"group","techniques":["T1027.002","T1070.004","T1124","T1203","T1204.002","T1518.001","T1566.001"]},{"id":"G0090","name":"WIRTE","type":"group","techniques":["T1027.010","T1027.015","T1036.005","T1041","T1059.001","T1059.003","T1059.005","T1071.001","T1074.001","T1105","T1106","T1114.001","T1140","T1204.001","T1204.002","T1218.010","T1497.001","T1566.001","T1566.002","T1571","T1574.001","T1583.001","T1586.002","T1588.002","T1608.001","T1684.001"]},{"id":"G0091","name":"Silence","type":"group","techniques":["T1003.001","T1018","T1021.001","T1027.010","T1036.005","T1053.005","T1055","T1059.001","T1059.003","T1059.005","T1059.007","T1070.004","T1072","T1078","T1090.002","T1105","T1106","T1112","T1113","T1125","T1204.002","T1218.001","T1547.001","T1553.002","T1566.001","T1569.002","T1571","T1588.002"]},{"id":"G0092","name":"TA505","type":"group","techniques":["T1027.002","T1027.010","T1027.013","T1055.001","T1059.001","T1059.003","T1059.005","T1059.007","T1069","T1071.001","T1078.002","T1087.003","T1105","T1106","T1112","T1140","T1204.001","T1204.002","T1218.007","T1218.011","T1486","T1552.001","T1553.002","T1553.005","T1555.003","T1559.002","T1566.001","T1566.002","T1568.001","T1583.001","T1588.001","T1588.002","T1608.001","T1685"]},{"id":"G0093","name":"GALLIUM","type":"group","techniques":["T1003.001","T1003.002","T1005","T1016","T1018","T1027","T1027.002","T1027.005","T1033","T1036.003","T1041","T1047","T1049","T1053.005","T1059.001","T1059.003","T1074.001","T1078","T1090.002","T1105","T1133","T1136.002","T1190","T1505.003","T1550.002","T1553.002","T1560.001","T1570","T1574.001","T1583.004","T1588.002"]},{"id":"G0094","name":"Kimsuky","type":"group","techniques":["T1003.001","T1005","T1007","T1012","T1016","T1020","T1021.001","T1027","T1027.001","T1027.002","T1027.007","T1027.010","T1027.012","T1027.013","T1027.015","T1027.016","T1033","T1036.004","T1036.005","T1036.007","T1040","T1041","T1053.005","T1055","T1055.001","T1055.012","T1056.001","T1056.003","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1070.004","T1070.006","T1071.001","T1071.002","T1071.003","T1074.001","T1078.003","T1082","T1083","T1098.007","T1102.001","T1102.002","T1105","T1106","T1111","T1112","T1113","T1114.002","T1114.003","T1115","T1124","T1132.002","T1133","T1136.001","T1140","T1176.001","T1185","T1190","T1204.001","T1204.002","T1204.004","T1205","T1217","T1218.005","T1218.010","T1218.011","T1219.002","T1480.002","T1489","T1497.001","T1505.003","T1518.001","T1534","T1539","T1543.003","T1546.001","T1547.001","T1550.002","T1552.001","T1552.004","T1553.002","T1555.003","T1557","T1559.001","T1560.001","T1560.003","T1564.002","T1564.003","T1564.011","T1566","T1566.001","T1566.002","T1567.002","T1568","T1583","T1583.001","T1583.004","T1583.006","T1584.001","T1585","T1585.001","T1585.002","T1586.002","T1587","T1587.001","T1588.002","T1588.003","T1588.005","T1589.002","T1589.003","T1591","T1593.001","T1593.002","T1594","T1596","T1598","T1598.003","T1608.001","T1620","T1657","T1678","T1680","T1682","T1684.001","T1685","T1686"]},{"id":"G0095","name":"Machete","type":"group","techniques":["T1036.005","T1053.005","T1059.003","T1059.005","T1059.006","T1189","T1204.001","T1204.002","T1218.007","T1566.001","T1566.002"]},{"id":"G0096","name":"APT41","type":"group","techniques":["T1003.001","T1003.002","T1003.003","T1005","T1008","T1012","T1014","T1016","T1018","T1021.001","T1021.002","T1027","T1027.002","T1030","T1033","T1036.004","T1036.005","T1037","T1046","T1047","T1049","T1053.005","T1055","T1056.001","T1059.001","T1059.003","T1059.004","T1069","T1070.003","T1070.004","T1071.001","T1071.002","T1071.004","T1078","T1082","T1083","T1087.001","T1087.002","T1090","T1098.007","T1102.001","T1104","T1105","T1110","T1112","T1133","T1135","T1136.001","T1190","T1195.002","T1197","T1203","T1213.003","T1218.001","T1218.011","T1480.001","T1484.001","T1486","T1496.001","T1542.003","T1543.003","T1546.008","T1547.001","T1550.002","T1553.002","T1555","T1555.003","T1560.001","T1566.001","T1568.002","T1569.002","T1570","T1574.001","T1574.006","T1588.002","T1595.002","T1595.003","T1596.005","T1599","T1684.001","T1685","T1685.005"]},{"id":"G0098","name":"BlackTech","type":"group","techniques":["T1021.004","T1036.002","T1046","T1106","T1190","T1203","T1204.001","T1204.002","T1566.001","T1566.002","T1574.001","T1588.002","T1588.003","T1588.004"]},{"id":"G0099","name":"APT-C-36","type":"group","techniques":["T1027","T1027.003","T1027.013","T1027.016","T1036.004","T1036.005","T1047","T1053.005","T1055.012","T1059.001","T1059.005","T1059.007","T1105","T1133","T1204.001","T1204.002","T1480","T1534","T1564.003","T1566.001","T1566.002","T1568","T1571","T1574.001","T1583.001","T1583.003","T1583.006","T1584.005","T1586.002","T1586.003","T1587.001","T1588.001","T1588.002","T1593","T1608.001","T1683.001","T1683.002","T1684.001"]},{"id":"G0100","name":"Inception","type":"group","techniques":["T1005","T1027.013","T1057","T1059.001","T1059.005","T1069.002","T1071.001","T1082","T1083","T1090.003","T1102","T1203","T1204.002","T1218.005","T1218.010","T1221","T1518","T1547.001","T1555.003","T1566.001","T1573.001","T1588.002"]},{"id":"G0102","name":"Wizard Spider","type":"group","techniques":["T1003.001","T1003.002","T1003.003","T1005","T1016","T1018","T1021","T1021.001","T1021.002","T1021.006","T1027.010","T1033","T1036.004","T1041","T1047","T1048.003","T1053.005","T1055","T1055.001","T1059.001","T1059.003","T1070.004","T1071.001","T1074","T1074.001","T1078","T1078.002","T1082","T1087.002","T1105","T1112","T1133","T1135","T1136.001","T1136.002","T1197","T1204.001","T1204.002","T1210","T1218.011","T1222.001","T1489","T1490","T1518.001","T1518.002","T1543.003","T1547.001","T1547.004","T1550.002","T1552.006","T1553.002","T1555.004","T1557.001","T1558.003","T1560.001","T1566.001","T1566.002","T1567.002","T1569.002","T1570","T1585.002","T1588.002","T1588.003","T1685"]},{"id":"G0103","name":"Mofang","type":"group","techniques":["T1027.013","T1027.015","T1204.001","T1204.002","T1566.001","T1566.002"]},{"id":"G0105","name":"DarkVishnya","type":"group","techniques":["T1040","T1046","T1059.001","T1110","T1135","T1200","T1219","T1543.003","T1571","T1588.002"]},{"id":"G0106","name":"Rocke","type":"group","techniques":["T1014","T1018","T1021.004","T1027","T1027.002","T1027.004","T1036.005","T1037","T1046","T1053.003","T1055.002","T1057","T1059.004","T1059.006","T1070.004","T1070.006","T1071","T1071.001","T1082","T1102","T1102.001","T1105","T1140","T1190","T1222.002","T1496.001","T1518.001","T1543.002","T1547.001","T1552.004","T1564.001","T1571","T1574.006","T1685","T1685.006","T1686"]},{"id":"G0107","name":"Whitefly","type":"group","techniques":["T1003.001","T1027.013","T1036.005","T1059","T1068","T1105","T1204.002","T1574.001","T1588.002"]},{"id":"G0108","name":"Blue Mockingbird","type":"group","techniques":["T1003.001","T1021.001","T1021.002","T1027.013","T1036.005","T1047","T1053.005","T1059.001","T1059.003","T1082","T1090","T1112","T1134","T1190","T1218.010","T1218.011","T1496.001","T1543.003","T1546.003","T1569.002","T1574.012","T1588.002"]},{"id":"G0112","name":"Windshift","type":"group","techniques":["T1027","T1033","T1036","T1036.001","T1047","T1057","T1059.005","T1071.001","T1082","T1105","T1189","T1204.001","T1204.002","T1518","T1518.001","T1547.001","T1566.001","T1566.002","T1566.003"]},{"id":"G0114","name":"Chimera","type":"group","techniques":["T1003.003","T1007","T1012","T1016","T1018","T1021.001","T1021.002","T1021.006","T1027.010","T1033","T1036.005","T1039","T1041","T1046","T1047","T1049","T1053.005","T1057","T1059.001","T1059.003","T1069.001","T1070.004","T1070.006","T1071.001","T1071.004","T1074.001","T1074.002","T1078","T1078.002","T1083","T1087.001","T1087.002","T1105","T1106","T1110.003","T1110.004","T1111","T1114.001","T1114.002","T1119","T1124","T1133","T1135","T1201","T1213.002","T1217","T1482","T1550.002","T1556.001","T1560.001","T1567.002","T1569.002","T1570","T1572","T1574.001","T1588.002","T1589.001","T1680","T1685.005"]},{"id":"G0115","name":"GOLD SOUTHFIELD","type":"group","techniques":["T1027.010","T1059.001","T1113","T1133","T1190","T1195.002","T1199","T1219","T1566"]},{"id":"G0117","name":"Fox Kitten","type":"group","techniques":["T1003.001","T1003.003","T1005","T1012","T1018","T1021.001","T1021.002","T1021.004","T1021.005","T1027.010","T1027.013","T1036.004","T1036.005","T1039","T1046","T1053.005","T1059","T1059.001","T1059.003","T1078","T1083","T1087.001","T1087.002","T1090","T1102","T1105","T1110","T1136.001","T1190","T1210","T1213.005","T1217","T1505.003","T1530","T1546.008","T1552.001","T1555.005","T1560.001","T1572","T1585","T1585.001"]},{"id":"G0119","name":"Indrik Spider","type":"group","techniques":["T1003.001","T1007","T1012","T1018","T1021.001","T1021.004","T1036.005","T1047","T1059.001","T1059.003","T1059.007","T1074.001","T1078","T1078.002","T1105","T1112","T1136","T1136.001","T1204.002","T1484.001","T1486","T1489","T1552.001","T1555.005","T1558.003","T1567.002","T1583","T1584.004","T1585.002","T1587.001","T1590","T1685","T1685.005"]},{"id":"G0120","name":"Evilnum","type":"group","techniques":["T1059.007","T1070.004","T1105","T1204.001","T1219.002","T1497.001","T1539","T1548.002","T1555","T1566.002","T1574.001"]},{"id":"G0121","name":"Sidewinder","type":"group","techniques":["T1016","T1020","T1027.010","T1027.013","T1033","T1036.005","T1057","T1059.001","T1059.005","T1059.007","T1071.001","T1074.001","T1082","T1083","T1105","T1119","T1124","T1203","T1204.001","T1204.002","T1218.005","T1518","T1518.001","T1547.001","T1559.002","T1566.001","T1566.002","T1574.001","T1598.002","T1598.003"]},{"id":"G0122","name":"Silent Librarian","type":"group","techniques":["T1078","T1110.003","T1114","T1114.003","T1583.001","T1585.002","T1588.002","T1588.004","T1589.002","T1589.003","T1594","T1598.003","T1608.005"]},{"id":"G0123","name":"Volatile Cedar","type":"group","techniques":["T1105","T1190","T1505.003","T1595.002","T1595.003"]},{"id":"G0124","name":"Windigo","type":"group","techniques":["T1005","T1059","T1082","T1083","T1090","T1189","T1518"]},{"id":"G0125","name":"HAFNIUM","type":"group","techniques":["T1003.001","T1003.003","T1005","T1016","T1016.001","T1018","T1033","T1057","T1059.001","T1059.003","T1068","T1071.001","T1078.003","T1078.004","T1083","T1095","T1098","T1105","T1110.003","T1114.002","T1119","T1132.001","T1136.002","T1190","T1199","T1213.002","T1218.011","T1505.003","T1530","T1550.001","T1555.006","T1560.001","T1564.001","T1567.002","T1583.003","T1583.005","T1583.006","T1584.005","T1589.002","T1590","T1590.005","T1592.004","T1593.003","T1685.005"]},{"id":"G0126","name":"Higaisa","type":"group","techniques":["T1001.003","T1016","T1027.001","T1027.013","T1027.015","T1029","T1036.004","T1041","T1053.005","T1057","T1059.003","T1059.005","T1059.007","T1071.001","T1082","T1090.001","T1106","T1124","T1140","T1203","T1204.002","T1220","T1547.001","T1564.003","T1566.001","T1573.001","T1574.001","T1680"]},{"id":"G0127","name":"TA551","type":"group","techniques":["T1027.003","T1027.010","T1036","T1059.003","T1071.001","T1105","T1132.001","T1204.002","T1218.005","T1218.010","T1218.011","T1566.001","T1568.002","T1589.002"]},{"id":"G0128","name":"ZIRCONIUM","type":"group","techniques":["T1012","T1016","T1027.002","T1033","T1036","T1036.004","T1041","T1059.003","T1059.006","T1068","T1082","T1090.003","T1102.002","T1105","T1124","T1140","T1204.001","T1218.007","T1547.001","T1555.003","T1566.002","T1567.002","T1573.001","T1583.001","T1583.006","T1584.008","T1598","T1598.003","T1665"]},{"id":"G0129","name":"Mustang Panda","type":"group","techniques":["T1001.003","T1003","T1003.001","T1003.003","T1003.006","T1016","T1018","T1027","T1027.007","T1027.012","T1027.016","T1036.005","T1036.007","T1036.008","T1041","T1046","T1047","T1048.003","T1049","T1052.001","T1053.005","T1057","T1059","T1059.001","T1059.003","T1059.005","T1059.007","T1069.002","T1070","T1070.004","T1070.006","T1071.001","T1072","T1074.001","T1082","T1083","T1087.002","T1091","T1095","T1102","T1105","T1106","T1119","T1129","T1140","T1176.002","T1203","T1204.001","T1204.002","T1205","T1218.004","T1218.005","T1219.001","T1219.002","T1505.003","T1518","T1546.003","T1547.001","T1553.002","T1557","T1560.001","T1560.003","T1564.001","T1566.001","T1566.002","T1567.002","T1572","T1573.001","T1574.001","T1574.005","T1583.001","T1583.006","T1585.002","T1586.002","T1587.001","T1588.002","T1588.003","T1588.004","T1593","T1598.003","T1608","T1608.001","T1622","T1654","T1678"]},{"id":"G0130","name":"Ajax Security Team","type":"group","techniques":["T1056.001","T1105","T1204.002","T1555.003","T1566.001","T1566.003"]},{"id":"G0131","name":"Tonto Team","type":"group","techniques":["T1003","T1056.001","T1059.001","T1059.006","T1068","T1069.001","T1090.002","T1105","T1135","T1203","T1204.002","T1210","T1505.003","T1566.001","T1574.001"]},{"id":"G0133","name":"Nomadic Octopus","type":"group","techniques":["T1036","T1059.001","T1059.003","T1105","T1204.002","T1564.003","T1566.001"]},{"id":"G0134","name":"Transparent Tribe","type":"group","techniques":["T1027.013","T1036.005","T1059.005","T1189","T1203","T1204.001","T1204.002","T1564.001","T1566.001","T1566.002","T1568","T1583.001","T1584.001","T1608.004"]},{"id":"G0135","name":"BackdoorDiplomacy","type":"group","techniques":["T1027","T1036.004","T1036.005","T1046","T1049","T1055.001","T1074.001","T1095","T1105","T1120","T1190","T1505.003","T1574.001","T1588.001","T1588.002"]},{"id":"G0136","name":"IndigoZebra","type":"group","techniques":["T1105","T1204.002","T1566.001","T1583.001","T1583.006","T1586.002","T1588.002"]},{"id":"G0137","name":"Ferocious Kitten","type":"group","techniques":["T1036.002","T1036.005","T1204.002","T1566.001","T1583.001","T1588.002"]},{"id":"G0138","name":"Andariel","type":"group","techniques":["T1005","T1027.003","T1049","T1057","T1105","T1189","T1203","T1204.002","T1566.001","T1588.001","T1590.005","T1592.002"]},{"id":"G0139","name":"TeamTNT","type":"group","techniques":["T1007","T1014","T1016","T1021.004","T1027.002","T1027.013","T1036","T1036.005","T1046","T1048","T1049","T1057","T1059.001","T1059.003","T1059.004","T1059.009","T1059.013","T1070.003","T1070.004","T1071","T1071.001","T1074.001","T1082","T1083","T1098.004","T1102","T1105","T1120","T1133","T1136.001","T1140","T1204.003","T1219","T1222.002","T1496.001","T1518.001","T1543.002","T1543.003","T1547.001","T1552.001","T1552.004","T1552.005","T1569.003","T1583.001","T1587.001","T1595.001","T1595.002","T1608.001","T1609","T1610","T1611","T1613","T1680","T1685","T1685.006","T1686"]},{"id":"G0140","name":"LazyScripter","type":"group","techniques":["T1027.010","T1036","T1059.001","T1059.003","T1059.005","T1059.007","T1071.004","T1102","T1105","T1204.001","T1204.002","T1218.005","T1218.011","T1547.001","T1566.001","T1566.002","T1583.001","T1583.006","T1588.001","T1608.001"]},{"id":"G0142","name":"Confucius","type":"group","techniques":["T1041","T1053.005","T1059.001","T1059.005","T1071.001","T1083","T1105","T1119","T1203","T1204.001","T1204.002","T1218.005","T1221","T1547.001","T1566.001","T1566.002","T1567.002","T1583.006","T1680"]},{"id":"G0143","name":"Aquatic Panda","type":"group","techniques":["T1003.001","T1005","T1007","T1021","T1021.001","T1021.002","T1021.004","T1027.010","T1033","T1036.004","T1036.005","T1047","T1059.001","T1059.003","T1059.004","T1070.003","T1070.004","T1078.002","T1082","T1087","T1105","T1112","T1218.011","T1518.001","T1543.003","T1550.002","T1560.001","T1574.001","T1574.006","T1588.001","T1588.002","T1595.002","T1654","T1685","T1685.005"]},{"id":"G1001","name":"HEXANE","type":"group","techniques":["T1010","T1016","T1016.001","T1018","T1021.001","T1027.010","T1033","T1049","T1053.005","T1056.001","T1057","T1059.001","T1059.005","T1069.001","T1082","T1102.002","T1105","T1110","T1110.003","T1204.002","T1518","T1534","T1546.003","T1555","T1555.003","T1567.002","T1583.001","T1583.002","T1585.001","T1585.002","T1586.002","T1588.002","T1589","T1589.002","T1591.004","T1608.001"]},{"id":"G1002","name":"BITTER","type":"group","techniques":["T1027.013","T1036.004","T1053.005","T1068","T1071.001","T1095","T1105","T1203","T1204.002","T1559.002","T1566.001","T1568","T1573","T1583.001","T1588.002","T1608.001"]},{"id":"G1003","name":"Ember Bear","type":"group","techniques":["T1003","T1003.001","T1003.002","T1003.004","T1005","T1018","T1021","T1036","T1036.005","T1046","T1047","T1053.005","T1059.001","T1070.004","T1071.004","T1078.001","T1090.003","T1095","T1110","T1110.003","T1112","T1114","T1119","T1125","T1133","T1190","T1195","T1203","T1210","T1491.002","T1505.003","T1550.002","T1552.001","T1560","T1561.002","T1567.002","T1570","T1571","T1572","T1583","T1583.003","T1585","T1588.001","T1588.005","T1595.001","T1595.002","T1654"]},{"id":"G1004","name":"LAPSUS$","type":"group","techniques":["T1003.003","T1003.006","T1005","T1068","T1069.002","T1078","T1078.004","T1087.002","T1090","T1098.003","T1111","T1114.003","T1133","T1136.003","T1199","T1204","T1213.001","T1213.002","T1213.003","T1213.005","T1485","T1489","T1531","T1552.008","T1555.003","T1555.005","T1578.002","T1578.003","T1583.003","T1584.002","T1586.002","T1588.001","T1588.002","T1589","T1589.001","T1589.002","T1591.002","T1591.004","T1593.003","T1597.002","T1598.004","T1621","T1684.001"]},{"id":"G1005","name":"POLONIUM","type":"group","techniques":["T1078","T1090","T1102.002","T1199","T1567.002","T1583.006","T1588.002"]},{"id":"G1006","name":"Earth Lusca","type":"group","techniques":["T1003.001","T1003.006","T1007","T1016","T1018","T1027","T1027.003","T1033","T1036.005","T1047","T1049","T1053.005","T1057","T1059.001","T1059.005","T1059.006","T1059.007","T1090","T1098.004","T1112","T1140","T1189","T1190","T1204.001","T1204.002","T1210","T1218.005","T1482","T1543.003","T1547.012","T1548.002","T1560.001","T1566.002","T1567.002","T1574.001","T1583.001","T1583.004","T1583.006","T1584.004","T1584.006","T1588.001","T1588.002","T1595.002","T1608.001"]},{"id":"G1007","name":"Aoqin Dragon","type":"group","techniques":["T1027.002","T1036","T1083","T1091","T1203","T1204.002","T1570","T1587.001","T1588.002"]},{"id":"G1008","name":"SideCopy","type":"group","techniques":["T1016","T1036.005","T1059.005","T1082","T1105","T1106","T1204.002","T1218.005","T1518","T1518.001","T1566.001","T1574.001","T1584.001","T1598.002","T1608.001","T1614"]},{"id":"G1009","name":"Moses Staff","type":"group","techniques":["T1016","T1021.002","T1027.013","T1082","T1087.001","T1105","T1190","T1505.003","T1553.002","T1587.001","T1588.002","T1686.003"]},{"id":"G1011","name":"EXOTIC LILY","type":"group","techniques":["T1102","T1203","T1204.001","T1204.002","T1566.001","T1566.002","T1566.003","T1583.001","T1585.001","T1585.002","T1589.002","T1593.001","T1594","T1597","T1608.001"]},{"id":"G1012","name":"CURIUM","type":"group","techniques":["T1005","T1041","T1048.002","T1059.001","T1082","T1124","T1189","T1204.002","T1505.003","T1566.001","T1566.003","T1583.001","T1583.003","T1583.004","T1584.006","T1585.001","T1585.002","T1598.003","T1608.004"]},{"id":"G1013","name":"Metador","type":"group","techniques":["T1027.013","T1059.003","T1070.004","T1071.001","T1095","T1105","T1546.003","T1588.001","T1588.002"]},{"id":"G1014","name":"LuminousMoth","type":"group","techniques":["T1005","T1030","T1033","T1036.005","T1041","T1053.005","T1071.001","T1083","T1091","T1105","T1112","T1204.001","T1539","T1547.001","T1553.002","T1557.002","T1560","T1564.001","T1566.002","T1567.002","T1574.001","T1587.001","T1588.001","T1588.002","T1588.004","T1608.001","T1608.004","T1608.005"]},{"id":"G1015","name":"Scattered Spider","type":"group","techniques":["T1003.003","T1006","T1016","T1018","T1021.001","T1021.004","T1021.007","T1041","T1059.001","T1059.004","T1068","T1069","T1069.002","T1070.008","T1074","T1078","T1078.004","T1082","T1083","T1087","T1087.002","T1090","T1098","T1098.003","T1105","T1114","T1114.003","T1133","T1136","T1204","T1213.003","T1213.005","T1217","T1219.002","T1484.002","T1486","T1490","T1530","T1538","T1539","T1543.002","T1552.001","T1552.004","T1553.002","T1555.005","T1556.006","T1556.009","T1564.008","T1567.002","T1572","T1578.002","T1580","T1583.001","T1585.001","T1588.001","T1588.002","T1589","T1598","T1598.003","T1598.004","T1621","T1657","T1684.001","T1685"]},{"id":"G1016","name":"FIN13","type":"group","techniques":["T1003.001","T1003.002","T1003.003","T1005","T1016","T1016.001","T1021.001","T1021.002","T1021.004","T1021.006","T1036","T1036.004","T1036.005","T1046","T1047","T1049","T1053.005","T1056.001","T1059.001","T1059.003","T1059.005","T1069","T1071.001","T1074.001","T1078.001","T1082","T1083","T1087","T1087.002","T1090.001","T1098.007","T1105","T1133","T1134.003","T1135","T1136.001","T1140","T1190","T1505.003","T1547.001","T1550.002","T1552.001","T1556","T1560.001","T1564.001","T1565","T1572","T1574.001","T1587.001","T1588.002","T1589","T1590.004","T1657"]},{"id":"G1017","name":"Volt Typhoon","type":"group","techniques":["T1003.001","T1003.003","T1005","T1006","T1007","T1010","T1012","T1016","T1016.001","T1018","T1021.001","T1027.002","T1033","T1036.005","T1036.008","T1046","T1047","T1049","T1056.001","T1057","T1059.001","T1059.003","T1059.004","T1068","T1069","T1069.001","T1069.002","T1070.004","T1070.007","T1074","T1074.001","T1078","T1078.002","T1083","T1087.001","T1087.002","T1090","T1090.001","T1090.003","T1105","T1112","T1113","T1120","T1124","T1133","T1140","T1190","T1217","T1218","T1497.001","T1505.003","T1518","T1552","T1552.004","T1555","T1555.003","T1560.001","T1570","T1573.001","T1584.003","T1584.004","T1584.005","T1584.008","T1587.004","T1588.002","T1588.006","T1589","T1589.002","T1590","T1590.004","T1590.006","T1591","T1591.004","T1592","T1593","T1594","T1596.005","T1614","T1654","T1680","T1685.005"]},{"id":"G1018","name":"TA2541","type":"group","techniques":["T1016.001","T1027.002","T1027.013","T1027.015","T1036.005","T1047","T1053.005","T1055","T1055.012","T1059.001","T1059.005","T1082","T1105","T1204.001","T1204.002","T1218.005","T1518.001","T1547.001","T1566.001","T1566.002","T1568","T1573.002","T1583.001","T1583.006","T1588.001","T1588.002","T1608.001","T1685"]},{"id":"G1019","name":"MoustachedBouncer","type":"group","techniques":["T1027.002","T1059.001","T1059.007","T1068","T1074.002","T1090","T1113","T1659"]},{"id":"G1020","name":"Mustard Tempest","type":"group","techniques":["T1036.005","T1082","T1105","T1189","T1204.001","T1566.002","T1583.004","T1583.008","T1584.001","T1608.001","T1608.004","T1608.006"]},{"id":"G1021","name":"Cinnamon Tempest","type":"group","techniques":["T1021.002","T1047","T1059.001","T1059.003","T1059.006","T1078","T1078.002","T1080","T1090","T1105","T1140","T1190","T1484.001","T1543.003","T1567.002","T1572","T1574.001","T1588.002","T1657"]},{"id":"G1022","name":"ToddyCat","type":"group","techniques":["T1005","T1018","T1021.002","T1036.005","T1047","T1049","T1053.005","T1057","T1059.001","T1059.003","T1069.002","T1074.002","T1078.002","T1083","T1087.002","T1095","T1106","T1190","T1518.001","T1560.001","T1564.003","T1566.003","T1567.002","T1680","T1686"]},{"id":"G1023","name":"APT5","type":"group","techniques":["T1003.001","T1003.002","T1021.001","T1021.004","T1036.005","T1049","T1053.003","T1055","T1056.001","T1057","T1059.001","T1059.003","T1070","T1070.003","T1070.004","T1070.006","T1074.001","T1078.002","T1078.004","T1083","T1098.007","T1136.001","T1190","T1505.003","T1554","T1560.001","T1583.005","T1654","T1685"]},{"id":"G1024","name":"Akira","type":"group","techniques":["T1018","T1021.001","T1027.001","T1036.005","T1059.001","T1078","T1133","T1213.002","T1219","T1482","T1486","T1531","T1558","T1560.001","T1567.002","T1657","T1685"]},{"id":"G1026","name":"Malteiro","type":"group","techniques":["T1027.013","T1055.001","T1059.005","T1082","T1140","T1204.002","T1518.001","T1555","T1555.003","T1566.001","T1614.001","T1657"]},{"id":"G1028","name":"APT-C-23","type":"group","techniques":[]},{"id":"G1030","name":"Agrius","type":"group","techniques":["T1003.001","T1003.002","T1005","T1018","T1021.001","T1036","T1041","T1046","T1059.003","T1074.001","T1078.002","T1110","T1110.003","T1119","T1140","T1190","T1505.003","T1543.003","T1560.001","T1570","T1583","T1685"]},{"id":"G1031","name":"Saint Bear","type":"group","techniques":["T1027.002","T1027.013","T1059","T1059.001","T1059.003","T1059.007","T1112","T1203","T1204.001","T1204.002","T1497","T1553.002","T1566.001","T1583.006","T1589.002","T1608.001","T1684.001","T1685"]},{"id":"G1032","name":"INC Ransom","type":"group","techniques":["T1021.001","T1036.005","T1046","T1047","T1049","T1059.003","T1069.002","T1070.004","T1071","T1074","T1078","T1087.002","T1105","T1135","T1190","T1219","T1486","T1537","T1560.001","T1566","T1569.002","T1570","T1588.002","T1657","T1685"]},{"id":"G1033","name":"Star Blizzard","type":"group","techniques":["T1059.007","T1078","T1114.002","T1114.003","T1204.002","T1539","T1550.004","T1566.001","T1583","T1583.001","T1585.001","T1585.002","T1586.002","T1588.002","T1589","T1593","T1598.002","T1598.003","T1608.001","T1684.001"]},{"id":"G1034","name":"Daggerfly","type":"group","techniques":["T1003.002","T1012","T1036.003","T1053.005","T1059.001","T1071.001","T1082","T1105","T1136.001","T1189","T1195.002","T1204.001","T1218.011","T1553.002","T1574.001","T1584.004","T1587.002"]},{"id":"G1035","name":"Winter Vivern","type":"group","techniques":["T1020","T1033","T1036","T1036.004","T1041","T1053.005","T1056.003","T1059","T1059.001","T1059.003","T1059.007","T1071.001","T1082","T1083","T1105","T1113","T1114.001","T1119","T1140","T1189","T1190","T1204.001","T1566.001","T1583.001","T1583.003","T1584.006","T1595.002"]},{"id":"G1036","name":"Moonstone Sleet","type":"group","techniques":["T1003.001","T1016","T1027","T1027.009","T1027.013","T1033","T1053.005","T1071.001","T1082","T1105","T1140","T1195.002","T1204.002","T1217","T1486","T1547.001","T1566.001","T1566.003","T1569.002","T1583.001","T1583.003","T1585.001","T1585.002","T1587","T1587.001","T1589.002","T1591","T1598","T1598.003","T1608.001"]},{"id":"G1037","name":"TA577","type":"group","techniques":["T1027.009","T1059.003","T1059.007","T1204.001","T1566.002","T1586.002"]},{"id":"G1038","name":"TA578","type":"group","techniques":["T1059.007","T1204.001","T1583.006","T1594"]},{"id":"G1039","name":"RedCurl","type":"group","techniques":["T1003.001","T1005","T1020","T1027","T1036.005","T1039","T1046","T1053.005","T1056.002","T1059.001","T1059.003","T1059.005","T1059.006","T1070.004","T1071.001","T1080","T1082","T1083","T1087.001","T1087.002","T1087.003","T1102","T1114.001","T1119","T1199","T1202","T1204.001","T1204.002","T1218.011","T1537","T1547.001","T1552.001","T1552.002","T1555.003","T1560.001","T1564.001","T1566.001","T1566.002","T1573.001","T1573.002","T1587.001"]},{"id":"G1040","name":"Play","type":"group","techniques":["T1003.001","T1016","T1018","T1021.002","T1027.010","T1030","T1048","T1057","T1059.001","T1059.003","T1070.004","T1078","T1078.002","T1078.003","T1082","T1083","T1105","T1133","T1190","T1518.001","T1560.001","T1587.001","T1588.002","T1657","T1685","T1685.005"]},{"id":"G1041","name":"Sea Turtle","type":"group","techniques":["T1027.004","T1059.004","T1071.001","T1074.002","T1078","T1078.003","T1114.001","T1133","T1190","T1199","T1203","T1213.006","T1505.003","T1557","T1560.001","T1564.011","T1566","T1583","T1583.001","T1583.002","T1583.003","T1584.002","T1588.002","T1588.004","T1608.003","T1685.006","T1690"]},{"id":"G1042","name":"RedEcho","type":"group","techniques":["T1071.001","T1568","T1571","T1573.002","T1583.001"]},{"id":"G1043","name":"BlackByte","type":"group","techniques":["T1003","T1012","T1016","T1018","T1021.001","T1021.002","T1036.008","T1041","T1046","T1047","T1053.005","T1055","T1055.012","T1059.001","T1059.003","T1068","T1070.004","T1071.001","T1078","T1078.002","T1082","T1087.002","T1105","T1112","T1134.003","T1135","T1136.002","T1140","T1190","T1219","T1480","T1482","T1486","T1490","T1491.001","T1505.003","T1518.001","T1543.003","T1547.001","T1560","T1567","T1569.002","T1570","T1583.003","T1608.001","T1614.001","T1685","T1686"]},{"id":"G1044","name":"APT42","type":"group","techniques":["T1016","T1036.005","T1047","T1053.005","T1056","T1056.001","T1059.001","T1059.005","T1070","T1070.008","T1071.001","T1082","T1087.001","T1102","T1111","T1112","T1113","T1132.001","T1518.001","T1530","T1539","T1547","T1555.003","T1566.002","T1573.002","T1583.001","T1583.003","T1585.002","T1588.002","T1608.001","T1682","T1684.001"]},{"id":"G1045","name":"Salt Typhoon","type":"group","techniques":["T1021.004","T1040","T1048.003","T1098.004","T1110.002","T1136","T1190","T1572","T1587.001","T1588.002","T1590.004","T1602.002","T1685.006","T1686"]},{"id":"G1046","name":"Storm-1811","type":"group","techniques":["T1021.002","T1021.004","T1027.013","T1033","T1036","T1036.005","T1036.010","T1048.002","T1056","T1059.001","T1059.003","T1074.001","T1087.002","T1105","T1140","T1204.002","T1219.002","T1222.001","T1482","T1486","T1547.001","T1566.002","T1566.003","T1566.004","T1570","T1574.001","T1583.001","T1585.003","T1588.002","T1667","T1684.001"]},{"id":"G1047","name":"Velvet Ant","type":"group","techniques":["T1021.002","T1036.005","T1037.004","T1040","T1047","T1049","T1055","T1059.004","T1071","T1078.003","T1083","T1090.001","T1132","T1133","T1211","T1569.002","T1570","T1571","T1573.002","T1574.001","T1685","T1686"]},{"id":"G1048","name":"UNC3886","type":"group","techniques":["T1003.001","T1008","T1014","T1021.004","T1027.005","T1036.004","T1037","T1037.004","T1040","T1057","T1059.001","T1059.003","T1059.004","T1059.006","T1059.012","T1068","T1070.004","T1070.006","T1070.007","T1074.001","T1078","T1078.001","T1083","T1095","T1124","T1190","T1203","T1205","T1205.001","T1212","T1218.011","T1505.006","T1548","T1554","T1555.005","T1560.001","T1560.003","T1564.011","T1570","T1587.001","T1587.004","T1588.001","T1588.004","T1673","T1675","T1681","T1685","T1686","T1690"]},{"id":"G1049","name":"AppleJeus","type":"group","techniques":["T1566","T1657"]},{"id":"G1050","name":"Water Galura","type":"group","techniques":["T1486","T1585.001","T1657"]},{"id":"G1051","name":"Medusa Group","type":"group","techniques":["T1003.001","T1003.003","T1016","T1018","T1021.001","T1027.002","T1027.010","T1033","T1046","T1047","T1057","T1059.001","T1059.003","T1069.002","T1070.003","T1070.004","T1071.001","T1072","T1078","T1082","T1083","T1087.001","T1090.003","T1105","T1106","T1112","T1135","T1136.002","T1190","T1218.014","T1219","T1486","T1489","T1490","T1505.003","T1518.001","T1529","T1543.003","T1548.002","T1553.002","T1559.001","T1564.003","T1567.002","T1569.002","T1570","T1573.002","T1583.006","T1585.001","T1585.002","T1588.002","T1608.002","T1650","T1652","T1657","T1685","T1686","T1690"]},{"id":"G1052","name":"Contagious Interview","type":"group","techniques":["T1027.010","T1027.013","T1036","T1041","T1048.003","T1059.003","T1059.004","T1059.005","T1059.006","T1059.007","T1070.004","T1071.003","T1082","T1083","T1090","T1204.001","T1204.002","T1204.004","T1204.005","T1219.002","T1480","T1497","T1543.001","T1546.004","T1547.001","T1547.013","T1555.001","T1566.003","T1567","T1567.002","T1571","T1573.001","T1583","T1583.001","T1583.003","T1583.006","T1585","T1585.001","T1585.002","T1587","T1587.001","T1588.002","T1588.007","T1589","T1593","T1593.001","T1593.003","T1608.001","T1657","T1681","T1683.001","T1683.002","T1684.001","T1685"]},{"id":"G1053","name":"Storm-0501","type":"group","techniques":["T1003","T1003.006","T1021.006","T1021.007","T1027.002","T1036.004","T1053.005","T1057","T1059.001","T1059.009","T1078.004","T1082","T1087.002","T1087.004","T1098.001","T1098.003","T1110","T1190","T1218.010","T1218.011","T1219.002","T1482","T1484.001","T1484.002","T1485","T1486","T1490","T1518.001","T1526","T1530","T1537","T1552.004","T1555.005","T1555.006","T1556.009","T1567.002","T1578.003","T1580","T1587.003","T1588.006","T1614.001","T1657"]},{"id":"G1054","name":"MirrorFace","type":"group","techniques":["T1003.001","T1003.002","T1003.003","T1005","T1007","T1016","T1018","T1021.001","T1021.002","T1027.013","T1033","T1036.008","T1047","T1048.002","T1057","T1059.003","T1059.005","T1070.004","T1071.002","T1074.002","T1082","T1083","T1087.002","T1090","T1114.001","T1190","T1204.002","T1221","T1482","T1553.002","T1556.002","T1560.001","T1566.001","T1566.002","T1574.001","T1587.001","T1588.002","T1591","T1614.001","T1684.001","T1685","T1685.005","T1686.003"]},{"id":"G1055","name":"VOID MANTICORE","type":"group","techniques":["T1003.001","T1005","T1021.001","T1027.015","T1036.004","T1036.005","T1041","T1047","T1059.001","T1059.006","T1071.001","T1072","T1074","T1078","T1078.002","T1078.004","T1082","T1087.002","T1098","T1102","T1105","T1110","T1110.001","T1110.004","T1113","T1114.002","T1119","T1123","T1125","T1133","T1190","T1199","T1204.002","T1213.002","T1219.002","T1484.001","T1485","T1486","T1490","T1547.001","T1552.002","T1560.001","T1561.001","T1561.002","T1564.003","T1566","T1572","T1583.001","T1583.003","T1583.004","T1583.006","T1585.001","T1585.002","T1587.001","T1588.001","T1588.002","T1589","T1595.002","T1651","T1657","T1679","T1684.001","T1686.003"]},{"id":"G1056","name":"TeamPCP","type":"group","techniques":["T1005","T1027.003","T1036.005","T1059.004","T1059.006","T1059.007","T1059.013","T1078","T1078.004","T1098","T1105","T1176.002","T1190","T1195.001","T1485","T1486","T1528","T1543.002","T1546.016","T1547.001","T1550.001","T1552.004","T1553.002","T1555.006","T1564.001","T1583","T1583.001","T1583.004","T1583.006","T1585.001","T1587.001","T1608.001","T1657","T1677","T1683.001","T1684.001"]},{"id":"G1057","name":"ShinyHunters","type":"group","techniques":["T1016","T1018","T1036.005","T1059.007","T1059.009","T1069.003","T1072","T1078","T1078.002","T1078.004","T1082","T1083","T1090.003","T1105","T1110","T1190","T1195.001","T1203","T1210","T1213.003","T1213.006","T1219","T1485","T1491.001","T1528","T1530","T1550.001","T1552.001","T1560.002","T1567","T1573.002","T1580","T1583.001","T1583.004","T1585.002","T1587.004","T1588.002","T1588.007","T1589.001","T1593.003","T1595.002","T1598","T1598.003","T1619","T1657","T1684"]},{"id":"S0001","name":"Trojan.Mebromi","type":"software","techniques":["T1542.001"]},{"id":"S0002","name":"Mimikatz","type":"software","techniques":["T1003.001","T1003.002","T1003.004","T1003.006","T1098","T1134.005","T1207","T1547.005","T1550.002","T1550.003","T1552.004","T1555","T1555.003","T1555.004","T1558.001","T1558.002","T1649"]},{"id":"S0003","name":"RIPTIDE","type":"software","techniques":["T1071.001","T1573.001"]},{"id":"S0004","name":"TinyZBot","type":"software","techniques":["T1056.001","T1059.003","T1113","T1115","T1543.003","T1547.001","T1547.009","T1685"]},{"id":"S0005","name":"Windows Credential Editor","type":"software","techniques":["T1003.001"]},{"id":"S0006","name":"pwdump","type":"software","techniques":["T1003.002"]},{"id":"S0007","name":"Skeleton Key","type":"software","techniques":["T1556.001"]},{"id":"S0008","name":"gsecdump","type":"software","techniques":["T1003.002","T1003.004"]},{"id":"S0009","name":"Hikit","type":"software","techniques":["T1005","T1014","T1059.003","T1071.001","T1090.001","T1105","T1553.004","T1553.006","T1566","T1573.001","T1574.001"]},{"id":"S0010","name":"Lurid","type":"software","techniques":["T1560","T1573.001"]},{"id":"S0011","name":"Taidoor","type":"software","techniques":["T1005","T1012","T1016","T1027.013","T1055.001","T1057","T1059.003","T1070.004","T1071.001","T1083","T1095","T1105","T1106","T1112","T1124","T1140","T1204.002","T1547.001","T1566.001","T1573.001"]},{"id":"S0012","name":"PoisonIvy","type":"software","techniques":["T1005","T1010","T1014","T1027","T1055.001","T1056.001","T1059.003","T1074.001","T1105","T1112","T1480.002","T1543.003","T1547.001","T1547.014","T1573.001"]},{"id":"S0013","name":"PlugX","type":"software","techniques":["T1012","T1016","T1027","T1027.001","T1027.007","T1027.013","T1033","T1036.004","T1036.005","T1041","T1049","T1053.005","T1056.001","T1057","T1059.003","T1070.004","T1070.009","T1071.001","T1071.004","T1074.001","T1082","T1083","T1091","T1095","T1102.001","T1105","T1106","T1112","T1113","T1120","T1124","T1127.001","T1135","T1140","T1204.002","T1480.002","T1497.001","T1543.003","T1547.001","T1564.001","T1564.003","T1571","T1573.001","T1574.001","T1614","T1620","T1622","T1680","T1686"]},{"id":"S0014","name":"BS2005","type":"software","techniques":["T1132.001"]},{"id":"S0015","name":"Ixeshe","type":"software","techniques":["T1005","T1007","T1016","T1033","T1036.005","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1132.001","T1547.001","T1564.001"]},{"id":"S0016","name":"P2P ZeuS","type":"software","techniques":["T1001.001"]},{"id":"S0017","name":"BISCUIT","type":"software","techniques":["T1008","T1033","T1056.001","T1057","T1059.003","T1082","T1105","T1113","T1124","T1573.002"]},{"id":"S0018","name":"Sykipot","type":"software","techniques":["T1007","T1016","T1018","T1049","T1055.001","T1056.001","T1057","T1087.002","T1111","T1547.001","T1573.002"]},{"id":"S0019","name":"Regin","type":"software","techniques":["T1021.002","T1036.001","T1040","T1056.001","T1071.001","T1071.002","T1090.002","T1095","T1112","T1564.004","T1564.005"]},{"id":"S0020","name":"China Chopper","type":"software","techniques":["T1005","T1027.002","T1046","T1059.003","T1070.006","T1071.001","T1083","T1105","T1110.001","T1505.003"]},{"id":"S0021","name":"Derusbi","type":"software","techniques":["T1008","T1012","T1033","T1055.001","T1056.001","T1057","T1059.004","T1070.004","T1070.006","T1082","T1083","T1095","T1113","T1123","T1125","T1218.010","T1571","T1573.001"]},{"id":"S0022","name":"Uroburos","type":"software","techniques":["T1001.001","T1001.003","T1005","T1008","T1012","T1014","T1027.002","T1027.009","T1027.011","T1027.013","T1036.004","T1055.001","T1057","T1059.003","T1070.004","T1071.001","T1071.003","T1071.004","T1082","T1083","T1090.003","T1095","T1104","T1105","T1106","T1112","T1132.002","T1140","T1205","T1543.003","T1559","T1564.005","T1572","T1573.001","T1573.002","T1620"]},{"id":"S0023","name":"CHOPSTICK","type":"software","techniques":["T1008","T1012","T1027.011","T1056.001","T1059","T1071.001","T1071.003","T1083","T1090.001","T1091","T1092","T1105","T1112","T1113","T1497","T1518.001","T1568.002","T1573.001","T1573.002"]},{"id":"S0024","name":"Dyre","type":"software","techniques":["T1007","T1016","T1027.002","T1033","T1041","T1053.005","T1055","T1055.001","T1071.001","T1074.001","T1082","T1105","T1140","T1497.001","T1518","T1543.003"]},{"id":"S0025","name":"CALENDAR","type":"software","techniques":["T1059.003","T1102.002"]},{"id":"S0026","name":"GLOOXMAIL","type":"software","techniques":["T1071.005","T1102.002"]},{"id":"S0027","name":"Zeroaccess","type":"software","techniques":["T1014","T1564.004"]},{"id":"S0028","name":"SHIPSHAPE","type":"software","techniques":["T1091","T1547.001","T1547.009"]},{"id":"S0029","name":"PsExec","type":"software","techniques":["T1021.002","T1136.002","T1543.003","T1569.002","T1570"]},{"id":"S0030","name":"Carbanak","type":"software","techniques":["T1003","T1012","T1021.001","T1027","T1030","T1055.002","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1113","T1114.001","T1132.001","T1136.001","T1219","T1547.001","T1573.001"]},{"id":"S0031","name":"BACKSPACE","type":"software","techniques":["T1012","T1041","T1057","T1059.003","T1071.001","T1082","T1083","T1090.001","T1104","T1112","T1132.002","T1547.001","T1547.009","T1686"]},{"id":"S0032","name":"gh0st RAT","type":"software","techniques":["T1012","T1055","T1056.001","T1057","T1059","T1070.004","T1082","T1095","T1105","T1106","T1112","T1113","T1129","T1132.001","T1140","T1218.011","T1543.003","T1547.001","T1568.001","T1569.002","T1573","T1573.001","T1574.001","T1685.005"]},{"id":"S0033","name":"NetTraveler","type":"software","techniques":["T1010","T1056.001"]},{"id":"S0034","name":"NETEAGLE","type":"software","techniques":["T1008","T1041","T1057","T1059.003","T1071","T1071.001","T1083","T1095","T1547.001","T1568","T1573.001"]},{"id":"S0035","name":"SPACESHIP","type":"software","techniques":["T1052.001","T1074.001","T1083","T1547.001","T1547.009","T1560.003"]},{"id":"S0036","name":"FLASHFLOOD","type":"software","techniques":["T1005","T1025","T1074.001","T1083","T1547.001","T1560.003"]},{"id":"S0037","name":"HAMMERTOSS","type":"software","techniques":["T1001.002","T1059.001","T1071.001","T1102.003","T1564.003","T1567.002","T1573.001"]},{"id":"S0038","name":"Duqu","type":"software","techniques":["T1001.002","T1010","T1016","T1021.002","T1049","T1053.005","T1055.001","T1055.012","T1056.001","T1057","T1071","T1074.001","T1078","T1087.001","T1090.001","T1134","T1218.007","T1543.003","T1560.003","T1572","T1573.001"]},{"id":"S0039","name":"Net","type":"software","techniques":["T1007","T1018","T1021.002","T1049","T1069.001","T1069.002","T1070.005","T1087.001","T1087.002","T1098.007","T1124","T1135","T1136.001","T1136.002","T1201","T1569.002"]},{"id":"S0040","name":"HTRAN","type":"software","techniques":["T1014","T1055","T1090"]},{"id":"S0041","name":"Wiper","type":"software","techniques":["T1072"]},{"id":"S0042","name":"LOWBALL","type":"software","techniques":["T1071.001","T1102.002","T1105"]},{"id":"S0043","name":"BUBBLEWRAP","type":"software","techniques":["T1071.001","T1082","T1095"]},{"id":"S0044","name":"JHUHUGIT","type":"software","techniques":["T1008","T1016","T1027.013","T1037.001","T1053.005","T1055","T1057","T1059.003","T1068","T1070.004","T1071.001","T1105","T1113","T1115","T1132.001","T1218.011","T1543.003","T1546.015","T1547.001","T1680"]},{"id":"S0045","name":"ADVSTORESHELL","type":"software","techniques":["T1012","T1027","T1029","T1041","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1074.001","T1082","T1083","T1106","T1112","T1120","T1132.001","T1218.011","T1546.015","T1547.001","T1560","T1560.003","T1573.001","T1573.002"]},{"id":"S0046","name":"CozyCar","type":"software","techniques":["T1003.001","T1003.002","T1027.013","T1036.003","T1053.005","T1059.003","T1071.001","T1082","T1102.002","T1218.011","T1497","T1518.001","T1543.003","T1547.001"]},{"id":"S0047","name":"Hacking Team UEFI Rootkit","type":"software","techniques":["T1014","T1542.001"]},{"id":"S0048","name":"PinchDuke","type":"software","techniques":["T1003","T1005","T1071.001","T1082","T1083","T1555","T1555.003"]},{"id":"S0049","name":"GeminiDuke","type":"software","techniques":["T1007","T1016","T1057","T1071.001","T1083","T1087.001"]},{"id":"S0050","name":"CosmicDuke","type":"software","techniques":["T1003.002","T1003.004","T1005","T1020","T1025","T1039","T1048.003","T1053.005","T1056.001","T1068","T1071.001","T1083","T1113","T1114.001","T1115","T1543.003","T1555","T1555.003","T1573.001"]},{"id":"S0051","name":"MiniDuke","type":"software","techniques":["T1008","T1027","T1071.001","T1082","T1083","T1090.001","T1102.001","T1105","T1568.002"]},{"id":"S0052","name":"OnionDuke","type":"software","techniques":["T1003","T1071.001","T1102.003","T1140","T1499"]},{"id":"S0053","name":"SeaDuke","type":"software","techniques":["T1027.002","T1059.001","T1059.003","T1070.004","T1071.001","T1078","T1105","T1114.002","T1132.001","T1546.003","T1547.001","T1547.009","T1550.003","T1560.002","T1573.001"]},{"id":"S0054","name":"CloudDuke","type":"software","techniques":["T1071.001","T1102.002","T1105"]},{"id":"S0055","name":"RARSTONE","type":"software","techniques":["T1055.001","T1083","T1095","T1105"]},{"id":"S0056","name":"Net Crawler","type":"software","techniques":["T1003.001","T1021.002","T1110.002","T1569.002"]},{"id":"S0057","name":"Tasklist","type":"software","techniques":["T1007","T1057","T1518.001"]},{"id":"S0058","name":"SslMM","type":"software","techniques":["T1008","T1033","T1036.005","T1056.001","T1082","T1134","T1547.001","T1547.009","T1685"]},{"id":"S0059","name":"WinMM","type":"software","techniques":["T1008","T1033","T1057","T1071.001","T1082","T1083"]},{"id":"S0060","name":"Sys10","type":"software","techniques":["T1016","T1033","T1069.001","T1071.001","T1082","T1573.001"]},{"id":"S0061","name":"HDoor","type":"software","techniques":["T1046","T1685"]},{"id":"S0062","name":"DustySky","type":"software","techniques":["T1008","T1027","T1041","T1047","T1056.001","T1057","T1070.004","T1071.001","T1074.001","T1082","T1083","T1091","T1113","T1120","T1518","T1518.001","T1547.001","T1560.001","T1570"]},{"id":"S0063","name":"SHOTPUT","type":"software","techniques":["T1018","T1027","T1049","T1057","T1083","T1087.001"]},{"id":"S0064","name":"ELMER","type":"software","techniques":["T1057","T1071.001","T1083"]},{"id":"S0065","name":"4H RAT","type":"software","techniques":["T1057","T1059.003","T1071.001","T1082","T1083","T1573.001"]},{"id":"S0066","name":"3PARA RAT","type":"software","techniques":["T1070.006","T1071.001","T1083","T1573.001"]},{"id":"S0067","name":"pngdowner","type":"software","techniques":["T1070.004","T1071.001","T1552.001"]},{"id":"S0068","name":"httpclient","type":"software","techniques":["T1059.003","T1071.001","T1573.001"]},{"id":"S0069","name":"BLACKCOFFEE","type":"software","techniques":["T1057","T1059.003","T1070.004","T1083","T1102.001","T1102.002","T1104"]},{"id":"S0070","name":"HTTPBrowser","type":"software","techniques":["T1027","T1036.005","T1056.001","T1059.003","T1070.004","T1071.001","T1071.004","T1083","T1105","T1547.001","T1574.001"]},{"id":"S0071","name":"hcdLoader","type":"software","techniques":["T1059.003","T1543.003"]},{"id":"S0072","name":"OwaAuth","type":"software","techniques":["T1036.005","T1056.001","T1070.006","T1071.001","T1083","T1505.003","T1505.004","T1560.003"]},{"id":"S0073","name":"ASPXSpy","type":"software","techniques":["T1505.003"]},{"id":"S0074","name":"Sakula","type":"software","techniques":["T1027.013","T1059.003","T1070.004","T1071.001","T1105","T1218.011","T1543.003","T1547.001","T1548.002","T1573.001","T1574.001"]},{"id":"S0075","name":"Reg","type":"software","techniques":["T1012","T1112","T1552.002"]},{"id":"S0076","name":"FakeM","type":"software","techniques":["T1001.003","T1056.001","T1095","T1573.001"]},{"id":"S0077","name":"CallMe","type":"software","techniques":["T1041","T1059.004","T1105","T1573.001"]},{"id":"S0078","name":"Psylo","type":"software","techniques":["T1041","T1070.006","T1071.001","T1083","T1105"]},{"id":"S0079","name":"MobileOrder","type":"software","techniques":["T1005","T1041","T1057","T1082","T1083","T1105","T1217"]},{"id":"S0080","name":"Mivast","type":"software","techniques":["T1003.002","T1059.003","T1105","T1547.001"]},{"id":"S0081","name":"Elise","type":"software","techniques":["T1007","T1016","T1027.013","T1036.005","T1055.001","T1057","T1070.004","T1070.006","T1071.001","T1074.001","T1082","T1083","T1087.001","T1105","T1132.001","T1218.011","T1543.003","T1547.001","T1573.001"]},{"id":"S0082","name":"Emissary","type":"software","techniques":["T1007","T1016","T1027.001","T1027.013","T1055.001","T1059.003","T1069.001","T1071.001","T1082","T1105","T1218.011","T1543.003","T1547.001","T1573.001","T1615"]},{"id":"S0083","name":"Misdat","type":"software","techniques":["T1005","T1027.002","T1036.005","T1041","T1059.003","T1070.004","T1070.006","T1070.009","T1082","T1083","T1095","T1105","T1106","T1132.001","T1547","T1614.001"]},{"id":"S0084","name":"Mis-Type","type":"software","techniques":["T1005","T1008","T1016","T1033","T1036.005","T1041","T1055","T1059.003","T1071.001","T1074.001","T1082","T1087.001","T1095","T1105","T1106","T1132.001","T1136.001","T1547"]},{"id":"S0085","name":"S-Type","type":"software","techniques":["T1007","T1008","T1016","T1027.002","T1033","T1036.005","T1041","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1087.001","T1105","T1106","T1132.001","T1136.001","T1547.001","T1547.009","T1614.001"]},{"id":"S0086","name":"ZLib","type":"software","techniques":["T1007","T1036.005","T1041","T1059.003","T1071.001","T1082","T1083","T1105","T1113","T1543.003","T1560.002"]},{"id":"S0087","name":"Hi-Zor","type":"software","techniques":["T1027.013","T1059.003","T1070.004","T1071.001","T1105","T1218.010","T1547.001","T1573.001","T1573.002"]},{"id":"S0088","name":"Kasidet","type":"software","techniques":["T1056.001","T1057","T1059.003","T1082","T1083","T1105","T1113","T1518.001","T1547.001","T1686"]},{"id":"S0089","name":"BlackEnergy","type":"software","techniques":["T1008","T1016","T1021.002","T1046","T1047","T1049","T1055.001","T1056.001","T1057","T1070","T1071.001","T1082","T1083","T1113","T1120","T1485","T1543.003","T1547.001","T1547.009","T1548.002","T1552.001","T1553.006","T1555.003","T1574.010","T1685.005"]},{"id":"S0090","name":"Rover","type":"software","techniques":["T1005","T1020","T1025","T1056.001","T1074.001","T1083","T1112","T1113","T1119","T1547.001"]},{"id":"S0091","name":"Epic","type":"software","techniques":["T1007","T1012","T1016","T1018","T1027","T1033","T1049","T1055.011","T1057","T1069.001","T1070.004","T1071.001","T1082","T1083","T1087.001","T1124","T1518.001","T1553.002","T1560","T1560.002","T1573.001","T1680"]},{"id":"S0092","name":"Agent.btz","type":"software","techniques":["T1016","T1033","T1052.001","T1091","T1105","T1560.003"]},{"id":"S0093","name":"Backdoor.Oldrea","type":"software","techniques":["T1016","T1018","T1033","T1046","T1055","T1057","T1070.004","T1082","T1083","T1087.003","T1105","T1132.001","T1218.011","T1547.001","T1555.003","T1560"]},{"id":"S0094","name":"Trojan.Karagany","type":"software","techniques":["T1003","T1010","T1016","T1027","T1027.002","T1033","T1049","T1055.003","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1074.001","T1082","T1083","T1105","T1113","T1497.001","T1547.001","T1555.003","T1573.002"]},{"id":"S0095","name":"ftp","type":"software","techniques":["T1048.003","T1105","T1570"]},{"id":"S0096","name":"Systeminfo","type":"software","techniques":["T1082"]},{"id":"S0097","name":"Ping","type":"software","techniques":["T1018"]},{"id":"S0098","name":"T9000","type":"software","techniques":["T1016","T1033","T1082","T1113","T1119","T1120","T1123","T1124","T1125","T1518.001","T1546.010","T1560.003","T1574.001"]},{"id":"S0099","name":"Arp","type":"software","techniques":["T1016","T1018"]},{"id":"S0100","name":"ipconfig","type":"software","techniques":["T1016"]},{"id":"S0101","name":"ifconfig","type":"software","techniques":["T1016"]},{"id":"S0102","name":"nbtstat","type":"software","techniques":["T1016","T1049"]},{"id":"S0103","name":"route","type":"software","techniques":["T1016"]},{"id":"S0104","name":"netstat","type":"software","techniques":["T1049"]},{"id":"S0105","name":"dsquery","type":"software","techniques":["T1069.002","T1082","T1087.002","T1482"]},{"id":"S0106","name":"cmd","type":"software","techniques":["T1059.003","T1070.004","T1082","T1083","T1105","T1570"]},{"id":"S0107","name":"Cherry Picker","type":"software","techniques":["T1048.003","T1070.004","T1546.010"]},{"id":"S0108","name":"netsh","type":"software","techniques":["T1090","T1518.001","T1546.007","T1686"]},{"id":"S0109","name":"WEBC2","type":"software","techniques":["T1059.003","T1105","T1574.001"]},{"id":"S0110","name":"at","type":"software","techniques":["T1053.002"]},{"id":"S0111","name":"schtasks","type":"software","techniques":["T1053.005"]},{"id":"S0112","name":"ROCKBOOT","type":"software","techniques":["T1542.003"]},{"id":"S0113","name":"Prikormka","type":"software","techniques":["T1016","T1025","T1027.013","T1033","T1056.001","T1070.004","T1074.001","T1082","T1083","T1113","T1120","T1132.001","T1218.011","T1518.001","T1547.001","T1555","T1555.003","T1560","T1573.001","T1574.001"]},{"id":"S0114","name":"BOOTRASH","type":"software","techniques":["T1542.003","T1564.005"]},{"id":"S0115","name":"Crimson","type":"software","techniques":["T1005","T1012","T1016","T1025","T1033","T1041","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1091","T1095","T1105","T1112","T1113","T1114.001","T1120","T1123","T1124","T1125","T1140","T1497.003","T1518.001","T1547.001","T1555.003","T1614","T1680"]},{"id":"S0116","name":"UACMe","type":"software","techniques":["T1548.002"]},{"id":"S0117","name":"XTunnel","type":"software","techniques":["T1008","T1027","T1027.016","T1046","T1059.003","T1090","T1552.001","T1573.002"]},{"id":"S0118","name":"Nidiran","type":"software","techniques":["T1036.004","T1105","T1543.003"]},{"id":"S0119","name":"Cachedump","type":"software","techniques":["T1003.005"]},{"id":"S0120","name":"Fgdump","type":"software","techniques":["T1003.002"]},{"id":"S0121","name":"Lslsass","type":"software","techniques":["T1003.001"]},{"id":"S0122","name":"Pass-The-Hash Toolkit","type":"software","techniques":["T1550.002"]},{"id":"S0123","name":"xCmd","type":"software","techniques":["T1569.002"]},{"id":"S0124","name":"Pisloader","type":"software","techniques":["T1016","T1027","T1059.003","T1071.004","T1082","T1083","T1105","T1132.001","T1547.001"]},{"id":"S0125","name":"Remsec","type":"software","techniques":["T1003.002","T1016","T1018","T1025","T1027.013","T1033","T1036.005","T1046","T1048.003","T1049","T1052.001","T1053.005","T1055.001","T1056.001","T1057","T1059.011","T1068","T1070.004","T1071.001","T1071.003","T1071.004","T1082","T1083","T1087.001","T1095","T1105","T1518.001","T1556.002","T1652","T1686.003"]},{"id":"S0126","name":"ComRAT","type":"software","techniques":["T1012","T1027","T1027.009","T1027.010","T1027.011","T1029","T1036.004","T1053.005","T1055.001","T1059.001","T1059.003","T1071.001","T1071.003","T1102.002","T1106","T1112","T1124","T1140","T1518","T1546.015","T1564.005","T1573.002"]},{"id":"S0127","name":"BBSRAT","type":"software","techniques":["T1007","T1055.012","T1057","T1070.004","T1071.001","T1083","T1140","T1543.003","T1546.015","T1547.001","T1560.002","T1569.002","T1573.001","T1574.001"]},{"id":"S0128","name":"BADNEWS","type":"software","techniques":["T1005","T1025","T1036.001","T1036.005","T1039","T1053.005","T1055.012","T1056.001","T1059.003","T1071.001","T1074.001","T1083","T1102.001","T1102.002","T1105","T1106","T1113","T1119","T1120","T1132","T1132.001","T1547.001","T1573.001","T1574.001"]},{"id":"S0129","name":"AutoIt backdoor","type":"software","techniques":["T1059.001","T1083","T1132.001","T1548.002"]},{"id":"S0130","name":"Unknown Logger","type":"software","techniques":["T1016","T1033","T1056.001","T1082","T1091","T1105","T1555.003","T1685"]},{"id":"S0131","name":"TINYTYPHON","type":"software","techniques":["T1020","T1027.013","T1083","T1547.001"]},{"id":"S0132","name":"H1N1","type":"software","techniques":["T1027","T1027.002","T1059.003","T1080","T1091","T1105","T1132","T1490","T1548.002","T1555.003","T1573.001","T1685","T1686.003"]},{"id":"S0133","name":"Miner-C","type":"software","techniques":["T1080"]},{"id":"S0134","name":"Downdelph","type":"software","techniques":["T1001.001","T1105","T1548.002","T1573.001","T1574.001"]},{"id":"S0135","name":"HIDEDRV","type":"software","techniques":["T1014","T1055.001"]},{"id":"S0136","name":"USBStealer","type":"software","techniques":["T1020","T1025","T1027.013","T1036.005","T1052.001","T1070.004","T1070.006","T1074.001","T1083","T1091","T1092","T1119","T1120","T1547.001"]},{"id":"S0137","name":"CORESHELL","type":"software","techniques":["T1027","T1027.016","T1071.001","T1071.003","T1082","T1105","T1132.001","T1218.011","T1547.001","T1573.001","T1680"]},{"id":"S0138","name":"OLDBAIT","type":"software","techniques":["T1027","T1036.005","T1071.001","T1071.003","T1555","T1555.003"]},{"id":"S0139","name":"PowerDuke","type":"software","techniques":["T1010","T1016","T1027.003","T1033","T1057","T1059.003","T1070.004","T1082","T1083","T1105","T1124","T1218.011","T1485","T1547.001","T1564.004"]},{"id":"S0140","name":"Shamoon","type":"software","techniques":["T1012","T1016","T1018","T1021.002","T1027","T1036.004","T1053.005","T1070.006","T1071.001","T1078.002","T1082","T1105","T1112","T1124","T1134.001","T1140","T1485","T1486","T1529","T1543.003","T1548.002","T1561.002","T1569.002","T1570"]},{"id":"S0141","name":"Winnti for Windows","type":"software","techniques":["T1027.013","T1027.015","T1036.005","T1057","T1070.004","T1070.006","T1071.001","T1082","T1083","T1090.001","T1090.002","T1095","T1105","T1106","T1140","T1218.011","T1480.001","T1543.003","T1547.001","T1548.002","T1569.002","T1573.001"]},{"id":"S0142","name":"StreamEx","type":"software","techniques":["T1027","T1057","T1059.003","T1082","T1083","T1112","T1218.011","T1518.001","T1543.003"]},{"id":"S0143","name":"Flame","type":"software","techniques":["T1011.001","T1036.010","T1091","T1113","T1123","T1136.001","T1210","T1218.011","T1518.001","T1547.002"]},{"id":"S0144","name":"ChChes","type":"software","techniques":["T1036.005","T1057","T1071.001","T1082","T1083","T1105","T1132.001","T1547.001","T1553.002","T1555.003","T1573.001","T1685"]},{"id":"S0145","name":"POWERSOURCE","type":"software","techniques":["T1012","T1059.001","T1071.004","T1105","T1547.001","T1564.004"]},{"id":"S0146","name":"TEXTMATE","type":"software","techniques":["T1059.003","T1071.004"]},{"id":"S0147","name":"Pteranodon","type":"software","techniques":["T1027.007","T1041","T1053.005","T1059.003","T1059.005","T1070.004","T1071.001","T1074.001","T1083","T1105","T1106","T1113","T1140","T1218.005","T1218.011","T1497","T1547.001"]},{"id":"S0148","name":"RTM","type":"software","techniques":["T1027","T1027.015","T1033","T1036","T1036.004","T1053.005","T1056.001","T1057","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1083","T1102.001","T1105","T1106","T1112","T1113","T1115","T1119","T1120","T1124","T1204.002","T1218.011","T1219","T1497","T1518","T1518.001","T1547.001","T1548.002","T1553.002","T1553.004","T1559.002","T1566.001","T1568","T1571","T1573.001"]},{"id":"S0149","name":"MoonWind","type":"software","techniques":["T1016","T1033","T1056.001","T1057","T1059.003","T1070.004","T1074.001","T1082","T1083","T1095","T1120","T1124","T1543.003","T1571","T1573.001"]},{"id":"S0150","name":"POSHSPY","type":"software","techniques":["T1027","T1030","T1059.001","T1070.006","T1105","T1546.003","T1568.002","T1573.002"]},{"id":"S0151","name":"HALFBAKED","type":"software","techniques":["T1047","T1057","T1059.001","T1070.004","T1082","T1113"]},{"id":"S0152","name":"EvilGrab","type":"software","techniques":["T1056.001","T1113","T1123","T1125","T1547.001"]},{"id":"S0153","name":"RedLeaves","type":"software","techniques":["T1016","T1027.013","T1033","T1049","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1113","T1547.001","T1547.009","T1555.003","T1571","T1573.001","T1574.001"]},{"id":"S0154","name":"Cobalt Strike","type":"software","techniques":["T1001.003","T1003.001","T1003.002","T1005","T1007","T1012","T1016","T1018","T1021.001","T1021.002","T1021.003","T1021.004","T1021.006","T1027","T1027.005","T1029","T1030","T1046","T1047","T1049","T1055","T1055.001","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007","T1068","T1069.001","T1069.002","T1070.006","T1071.001","T1071.002","T1071.004","T1078.002","T1078.003","T1083","T1087.002","T1090.001","T1090.004","T1095","T1105","T1106","T1112","T1113","T1132.001","T1134.001","T1134.003","T1134.004","T1135","T1137.001","T1140","T1185","T1197","T1203","T1218.011","T1497.002","T1518","T1543.003","T1548.002","T1548.003","T1550.002","T1553.002","T1564.010","T1569.002","T1572","T1573.001","T1573.002","T1620","T1685"]},{"id":"S0155","name":"WINDSHIELD","type":"software","techniques":["T1012","T1033","T1070.004","T1082","T1095"]},{"id":"S0156","name":"KOMPROGO","type":"software","techniques":["T1047","T1059.003","T1082"]},{"id":"S0157","name":"SOUNDBITE","type":"software","techniques":["T1010","T1071.004","T1082","T1083","T1112"]},{"id":"S0158","name":"PHOREAL","type":"software","techniques":["T1059.003","T1095","T1112"]},{"id":"S0159","name":"SNUGRIDE","type":"software","techniques":["T1059.003","T1071.001","T1547.001","T1573.001"]},{"id":"S0160","name":"certutil","type":"software","techniques":["T1105","T1140","T1553.004","T1560.001"]},{"id":"S0161","name":"XAgentOSX","type":"software","techniques":["T1033","T1056.001","T1057","T1070.004","T1071.002","T1082","T1083","T1106","T1113","T1555.003"]},{"id":"S0162","name":"Komplex","type":"software","techniques":["T1033","T1057","T1070.004","T1071.001","T1543.001","T1564.001","T1573.001"]},{"id":"S0163","name":"Janicab","type":"software","techniques":["T1053.003","T1113","T1123","T1553.002"]},{"id":"S0164","name":"TDTESS","type":"software","techniques":["T1059.003","T1070.004","T1070.006","T1105","T1543.003"]},{"id":"S0165","name":"OSInfo","type":"software","techniques":["T1012","T1016","T1018","T1049","T1069.001","T1069.002","T1082","T1087.001","T1087.002","T1135"]},{"id":"S0166","name":"RemoteCMD","type":"software","techniques":["T1053.005","T1105","T1569.002"]},{"id":"S0167","name":"Matryoshka","type":"software","techniques":["T1027","T1053.005","T1055.001","T1056.001","T1059","T1071.004","T1113","T1218.011","T1547.001","T1555"]},{"id":"S0168","name":"Gazer","type":"software","techniques":["T1027.013","T1033","T1053.005","T1055","T1055.003","T1070.004","T1070.006","T1071.001","T1105","T1480.002","T1546.002","T1547.001","T1547.004","T1547.009","T1553.002","T1564.004","T1573.001","T1573.002"]},{"id":"S0169","name":"RawPOS","type":"software","techniques":["T1005","T1036.004","T1074.001","T1543.003","T1560.003"]},{"id":"S0170","name":"Helminth","type":"software","techniques":["T1027.013","T1030","T1053.005","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1069.001","T1069.002","T1071.001","T1071.004","T1074.001","T1105","T1115","T1119","T1132.001","T1547.001","T1547.009","T1553.002","T1573.001"]},{"id":"S0171","name":"Felismus","type":"software","techniques":["T1016","T1033","T1036.005","T1059.003","T1071.001","T1082","T1105","T1132.001","T1518.001","T1573.001"]},{"id":"S0172","name":"Reaver","type":"software","techniques":["T1012","T1016","T1027.013","T1033","T1070.004","T1071.001","T1082","T1095","T1218.002","T1543.003","T1547.001","T1547.009","T1560.003","T1680"]},{"id":"S0173","name":"FLIPSIDE","type":"software","techniques":["T1572"]},{"id":"S0174","name":"Responder","type":"software","techniques":["T1040","T1557.001"]},{"id":"S0175","name":"meek","type":"software","techniques":["T1090.004"]},{"id":"S0176","name":"Wingbird","type":"software","techniques":["T1055","T1068","T1070.004","T1082","T1518.001","T1543.003","T1547.008","T1569.002","T1574.001"]},{"id":"S0177","name":"Power Loader","type":"software","techniques":["T1055.011"]},{"id":"S0178","name":"Truvasys","type":"software","techniques":["T1036.004","T1547.001"]},{"id":"S0179","name":"MimiPenguin","type":"software","techniques":["T1003.007"]},{"id":"S0180","name":"Volgmer","type":"software","techniques":["T1007","T1012","T1016","T1027.011","T1027.013","T1036.004","T1049","T1057","T1059.003","T1070.004","T1082","T1083","T1105","T1106","T1112","T1140","T1543.003","T1573.001","T1573.002"]},{"id":"S0181","name":"FALLCHILL","type":"software","techniques":["T1001.003","T1016","T1070.004","T1070.006","T1082","T1083","T1543.003","T1573.001","T1680"]},{"id":"S0182","name":"FinFisher","type":"software","techniques":["T1012","T1027","T1027.002","T1027.016","T1036.005","T1055.001","T1056.004","T1057","T1082","T1083","T1113","T1134.001","T1140","T1497.001","T1518.001","T1542.003","T1543.003","T1547.001","T1548.002","T1574.001","T1574.013","T1685.005"]},{"id":"S0183","name":"Tor","type":"software","techniques":["T1090.003","T1573.002"]},{"id":"S0184","name":"POWRUNER","type":"software","techniques":["T1012","T1016","T1033","T1047","T1049","T1053.005","T1057","T1059.001","T1059.003","T1069.001","T1069.002","T1071.001","T1071.004","T1082","T1083","T1087.002","T1105","T1113","T1132.001","T1518.001"]},{"id":"S0185","name":"SEASHARPEE","type":"software","techniques":["T1059.003","T1070.006","T1105","T1505.003"]},{"id":"S0186","name":"DownPaper","type":"software","techniques":["T1012","T1033","T1059.001","T1059.003","T1071.001","T1082","T1547.001"]},{"id":"S0187","name":"Daserf","type":"software","techniques":["T1001.002","T1003.001","T1027","T1027.002","T1027.005","T1036.005","T1056.001","T1059.003","T1071.001","T1105","T1113","T1132.001","T1553.002","T1560","T1560.001","T1573.001"]},{"id":"S0188","name":"Starloader","type":"software","techniques":["T1036.005","T1140"]},{"id":"S0189","name":"ISMInjector","type":"software","techniques":["T1027","T1053.005","T1055.012","T1140"]},{"id":"S0190","name":"BITSAdmin","type":"software","techniques":["T1048.003","T1105","T1197","T1570"]},{"id":"S0191","name":"Winexe","type":"software","techniques":["T1569.002"]},{"id":"S0192","name":"Pupy","type":"software","techniques":["T1003.001","T1003.004","T1003.005","T1016","T1021.001","T1033","T1041","T1046","T1049","T1055.001","T1056.001","T1057","T1059.001","T1059.006","T1071.001","T1082","T1083","T1087.001","T1105","T1113","T1114.001","T1123","T1125","T1134.001","T1135","T1136.001","T1136.002","T1497.001","T1543.002","T1547.001","T1547.013","T1548.002","T1550.003","T1552.001","T1555","T1555.003","T1557.001","T1560.001","T1569.002","T1573.002","T1685.005"]},{"id":"S0193","name":"Forfiles","type":"software","techniques":["T1005","T1083","T1202"]},{"id":"S0194","name":"PowerSploit","type":"software","techniques":["T1003.001","T1005","T1012","T1027.005","T1027.010","T1047","T1053.005","T1055.001","T1056.001","T1057","T1059.001","T1087.001","T1113","T1123","T1134","T1482","T1543.003","T1547.001","T1547.005","T1552.002","T1552.006","T1555.004","T1558.003","T1574.001","T1574.007","T1574.008","T1574.009","T1620"]},{"id":"S0195","name":"SDelete","type":"software","techniques":["T1070.004","T1485"]},{"id":"S0196","name":"PUNCHBUGGY","type":"software","techniques":["T1027","T1036.005","T1059.001","T1059.006","T1070.004","T1071.001","T1074.001","T1082","T1087.001","T1105","T1129","T1140","T1218.011","T1518.001","T1546.009","T1547.001","T1560.001"]},{"id":"S0197","name":"PUNCHTRACK","type":"software","techniques":["T1005","T1027","T1074.001"]},{"id":"S0198","name":"NETWIRE","type":"software","techniques":["T1010","T1016","T1027","T1027.002","T1027.011","T1036.001","T1036.005","T1049","T1053.003","T1053.005","T1055","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1059.004","T1059.005","T1071.001","T1074.001","T1082","T1083","T1090","T1095","T1102","T1105","T1106","T1112","T1113","T1119","T1204.001","T1204.002","T1543.001","T1547.001","T1547.013","T1547.015","T1555","T1555.003","T1560","T1560.003","T1564.001","T1566.001","T1566.002","T1573","T1573.001"]},{"id":"S0199","name":"TURNEDUP","type":"software","techniques":["T1055.004","T1059.003","T1082","T1105","T1113","T1547.001"]},{"id":"S0200","name":"Dipsind","type":"software","techniques":["T1029","T1059.003","T1071.001","T1105","T1132.001","T1547.004","T1573.001"]},{"id":"S0201","name":"JPIN","type":"software","techniques":["T1007","T1012","T1016","T1027","T1033","T1055","T1056.001","T1057","T1059.003","T1069.001","T1070.004","T1071.002","T1071.003","T1082","T1083","T1105","T1197","T1222.001","T1518.001","T1685"]},{"id":"S0202","name":"adbupd","type":"software","techniques":["T1059.003","T1546.003","T1573.002"]},{"id":"S0203","name":"Hydraq","type":"software","techniques":["T1005","T1007","T1012","T1016","T1027","T1048","T1057","T1070.004","T1082","T1083","T1105","T1112","T1113","T1129","T1134","T1543.003","T1569.002","T1573.001","T1685.005"]},{"id":"S0204","name":"Briba","type":"software","techniques":["T1105","T1218.011","T1543.003","T1547.001"]},{"id":"S0205","name":"Naid","type":"software","techniques":["T1016","T1082","T1112","T1543.003"]},{"id":"S0206","name":"Wiarp","type":"software","techniques":["T1055","T1059.003","T1105","T1543.003"]},{"id":"S0207","name":"Vasport","type":"software","techniques":["T1071.001","T1090","T1105","T1547.001"]},{"id":"S0208","name":"Pasam","type":"software","techniques":["T1005","T1057","T1070.004","T1082","T1083","T1105","T1547.008","T1680"]},{"id":"S0210","name":"Nerex","type":"software","techniques":["T1105","T1112","T1543.003","T1553.002"]},{"id":"S0211","name":"Linfo","type":"software","techniques":["T1005","T1008","T1029","T1057","T1059.003","T1070.004","T1082","T1083","T1105"]},{"id":"S0212","name":"CORALDECK","type":"software","techniques":["T1048.003","T1083","T1560.001"]},{"id":"S0213","name":"DOGCALL","type":"software","techniques":["T1027.013","T1056.001","T1102.002","T1105","T1113","T1123"]},{"id":"S0214","name":"HAPPYWORK","type":"software","techniques":["T1033","T1082","T1105"]},{"id":"S0215","name":"KARAE","type":"software","techniques":["T1082","T1102.002","T1105","T1189"]},{"id":"S0216","name":"POORAIM","type":"software","techniques":["T1057","T1082","T1083","T1102.002","T1113","T1189"]},{"id":"S0217","name":"SHUTTERSPEED","type":"software","techniques":["T1082","T1105","T1113"]},{"id":"S0218","name":"SLOWDRIFT","type":"software","techniques":["T1082","T1102.002","T1105"]},{"id":"S0219","name":"WINERACK","type":"software","techniques":["T1007","T1010","T1033","T1057","T1059","T1082","T1083"]},{"id":"S0220","name":"Chaos","type":"software","techniques":["T1059.004","T1104","T1110","T1205","T1573.001"]},{"id":"S0221","name":"Umbreon","type":"software","techniques":["T1014","T1059.003","T1078.003","T1095","T1205"]},{"id":"S0222","name":"CCBkdr","type":"software","techniques":["T1195.002","T1568.002"]},{"id":"S0223","name":"POWERSTATS","type":"software","techniques":["T1005","T1016","T1027.010","T1027.016","T1029","T1033","T1036.004","T1047","T1053.005","T1057","T1059.001","T1059.005","T1059.007","T1070.004","T1082","T1087.001","T1090.002","T1105","T1113","T1132.001","T1140","T1218.005","T1518.001","T1559.001","T1559.002","T1573.002","T1685"]},{"id":"S0224","name":"Havij","type":"software","techniques":["T1190"]},{"id":"S0225","name":"sqlmap","type":"software","techniques":["T1190"]},{"id":"S0226","name":"Smoke Loader","type":"software","techniques":["T1027.013","T1053.005","T1055","T1055.012","T1059.005","T1071.001","T1083","T1105","T1114.001","T1140","T1497.001","T1547.001","T1552.001","T1555.003"]},{"id":"S0227","name":"spwebmember","type":"software","techniques":["T1213.002"]},{"id":"S0228","name":"NanHaiShu","type":"software","techniques":["T1016","T1027.013","T1033","T1059.005","T1059.007","T1070.004","T1071.004","T1082","T1105","T1218.005","T1547.001","T1685"]},{"id":"S0229","name":"Orz","type":"software","techniques":["T1016","T1027","T1055.012","T1057","T1059.003","T1070","T1082","T1083","T1102.002","T1105","T1112","T1218.010","T1518"]},{"id":"S0230","name":"ZeroT","type":"software","techniques":["T1001.002","T1016","T1027.002","T1027.013","T1027.016","T1071.001","T1082","T1105","T1140","T1543.003","T1548.002","T1573.001","T1574.001"]},{"id":"S0231","name":"Invoke-PSImage","type":"software","techniques":["T1027.003","T1027.009"]},{"id":"S0232","name":"HOMEFRY","type":"software","techniques":["T1003","T1027.013","T1059.003"]},{"id":"S0233","name":"MURKYTOP","type":"software","techniques":["T1018","T1046","T1053.002","T1059.003","T1069","T1070.004","T1082","T1087.001","T1135"]},{"id":"S0234","name":"Bandook","type":"software","techniques":["T1005","T1016","T1027.003","T1041","T1055.012","T1056.001","T1059","T1059.001","T1059.003","T1059.005","T1059.006","T1070.004","T1083","T1095","T1105","T1106","T1113","T1120","T1123","T1125","T1140","T1204.002","T1553.002","T1566.001","T1573.001","T1680"]},{"id":"S0235","name":"CrossRAT","type":"software","techniques":["T1083","T1113","T1543.001","T1547.001","T1547.013"]},{"id":"S0236","name":"Kwampirs","type":"software","techniques":["T1007","T1008","T1016","T1018","T1021.002","T1027.001","T1027.013","T1033","T1036.004","T1049","T1057","T1069.001","T1069.002","T1082","T1083","T1087.001","T1105","T1135","T1140","T1201","T1218.011","T1543.003"]},{"id":"S0237","name":"GravityRAT","type":"software","techniques":["T1005","T1007","T1016","T1025","T1027.005","T1027.013","T1033","T1047","T1049","T1053.005","T1057","T1059.003","T1071.001","T1082","T1083","T1124","T1497.001","T1559.002","T1571"]},{"id":"S0238","name":"Proxysvc","type":"software","techniques":["T1005","T1012","T1016","T1041","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1119","T1124","T1485","T1569.002","T1680"]},{"id":"S0239","name":"Bankshot","type":"software","techniques":["T1001.003","T1005","T1012","T1041","T1057","T1059.003","T1070","T1070.004","T1070.006","T1071.001","T1082","T1083","T1087.001","T1087.002","T1105","T1106","T1112","T1119","T1132.002","T1134.002","T1140","T1203","T1543.003","T1571","T1680"]},{"id":"S0240","name":"ROKRAT","type":"software","techniques":["T1005","T1010","T1012","T1027","T1033","T1041","T1055","T1056.001","T1057","T1059.005","T1070.004","T1071.001","T1082","T1083","T1102.002","T1105","T1106","T1112","T1113","T1115","T1123","T1140","T1204.002","T1480.001","T1497.001","T1555.003","T1555.004","T1566.001","T1567.002","T1622"]},{"id":"S0241","name":"RATANKBA","type":"software","techniques":["T1007","T1012","T1016","T1018","T1033","T1047","T1049","T1055.001","T1057","T1059.001","T1059.003","T1071.001","T1082","T1087.001","T1105"]},{"id":"S0242","name":"SynAck","type":"software","techniques":["T1007","T1012","T1027","T1033","T1055.013","T1057","T1082","T1083","T1106","T1112","T1486","T1497.001","T1614.001","T1685.005"]},{"id":"S0243","name":"DealersChoice","type":"software","techniques":["T1059.003","T1071.001","T1203"]},{"id":"S0244","name":"Comnie","type":"software","techniques":["T1007","T1016","T1018","T1027","T1027.001","T1049","T1057","T1059.003","T1059.005","T1071.001","T1082","T1087.001","T1102.002","T1119","T1218.011","T1518.001","T1547.001","T1547.009","T1573.001"]},{"id":"S0245","name":"BADCALL","type":"software","techniques":["T1001.003","T1016","T1082","T1090","T1112","T1571","T1573.001","T1686.003"]},{"id":"S0246","name":"HARDRAIN","type":"software","techniques":["T1001.003","T1059.003","T1090","T1571","T1686.003"]},{"id":"S0247","name":"NavRAT","type":"software","techniques":["T1055","T1056.001","T1057","T1059.003","T1071.003","T1074.001","T1082","T1105","T1547.001"]},{"id":"S0248","name":"yty","type":"software","techniques":["T1005","T1016","T1018","T1027.002","T1027.016","T1033","T1053.005","T1056.001","T1057","T1082","T1083","T1102.002","T1113","T1497.001","T1680"]},{"id":"S0249","name":"Gold Dragon","type":"software","techniques":["T1012","T1033","T1057","T1059.003","T1070.004","T1071.001","T1074.001","T1082","T1083","T1105","T1518.001","T1547.001","T1560","T1685"]},{"id":"S0250","name":"Koadic","type":"software","techniques":["T1003.002","T1003.003","T1005","T1016","T1021.001","T1033","T1046","T1047","T1053.005","T1055.001","T1059.001","T1059.003","T1059.005","T1071.001","T1082","T1083","T1105","T1115","T1135","T1218.005","T1218.010","T1218.011","T1547.001","T1548.002","T1564.003","T1569.002","T1573.002"]},{"id":"S0251","name":"Zebrocy","type":"software","techniques":["T1012","T1016","T1027.002","T1033","T1037.001","T1041","T1047","T1049","T1053.005","T1056.004","T1057","T1059.003","T1070.004","T1071.001","T1071.003","T1074.001","T1082","T1083","T1105","T1113","T1119","T1120","T1124","T1132.001","T1135","T1140","T1547.001","T1555.003","T1560","T1573.002","T1680"]},{"id":"S0252","name":"Brave Prince","type":"software","techniques":["T1012","T1016","T1048.003","T1057","T1082","T1083","T1685"]},{"id":"S0253","name":"RunningRAT","type":"software","techniques":["T1056.001","T1059.003","T1070.004","T1082","T1115","T1547.001","T1560","T1680","T1685","T1685.005"]},{"id":"S0254","name":"PLAINTEE","type":"software","techniques":["T1016","T1057","T1059.003","T1082","T1105","T1112","T1547.001","T1548.002","T1573.001"]},{"id":"S0255","name":"DDKONG","type":"software","techniques":["T1083","T1105","T1140","T1218.011"]},{"id":"S0256","name":"Mosquito","type":"software","techniques":["T1016","T1027.011","T1027.013","T1033","T1047","T1057","T1059.001","T1059.003","T1070.004","T1105","T1106","T1112","T1218.011","T1518.001","T1546.015","T1547.001","T1573.001"]},{"id":"S0257","name":"VERMIN","type":"software","techniques":["T1016","T1027.002","T1027.013","T1033","T1056.001","T1057","T1070.004","T1071.001","T1082","T1105","T1113","T1115","T1119","T1123","T1140","T1518.001","T1560"]},{"id":"S0258","name":"RGDoor","type":"software","techniques":["T1033","T1059.003","T1071.001","T1105","T1140","T1505.004","T1560.003"]},{"id":"S0259","name":"InnaputRAT","type":"software","techniques":["T1027","T1036.004","T1036.005","T1059.003","T1070.004","T1082","T1083","T1106","T1543.003","T1547.001","T1680"]},{"id":"S0260","name":"InvisiMole","type":"software","techniques":["T1001.003","T1005","T1007","T1008","T1010","T1012","T1016","T1025","T1027","T1027.005","T1033","T1036.004","T1036.005","T1046","T1053.005","T1055","T1055.002","T1055.004","T1055.015","T1056.001","T1057","T1059.003","T1059.007","T1068","T1070.004","T1070.005","T1070.006","T1071.001","T1071.004","T1074.001","T1080","T1082","T1083","T1087.001","T1090.001","T1090.002","T1095","T1105","T1106","T1112","T1113","T1119","T1123","T1124","T1125","T1132.002","T1135","T1140","T1203","T1204.002","T1210","T1218.002","T1218.011","T1480.001","T1490","T1497.001","T1518","T1518.001","T1543.003","T1547.001","T1547.009","T1548.002","T1559.001","T1560.001","T1560.002","T1560.003","T1564.001","T1564.003","T1569.002","T1573.001","T1574.001","T1680","T1686"]},{"id":"S0261","name":"Catchamas","type":"software","techniques":["T1010","T1016","T1036.004","T1056.001","T1074.001","T1112","T1113","T1115","T1543.003"]},{"id":"S0262","name":"QuasarRAT","type":"software","techniques":["T1005","T1010","T1016","T1021.001","T1033","T1053.005","T1056.001","T1059.003","T1082","T1090","T1095","T1105","T1112","T1125","T1547.001","T1548.002","T1552.001","T1553.002","T1555","T1555.003","T1564.001","T1564.003","T1571","T1573.001","T1614"]},{"id":"S0263","name":"TYPEFRAME","type":"software","techniques":["T1027.011","T1027.013","T1059.003","T1059.005","T1070.004","T1083","T1090","T1105","T1112","T1140","T1204.002","T1543.003","T1571","T1680","T1686.003"]},{"id":"S0264","name":"OopsIE","type":"software","techniques":["T1027","T1027.002","T1030","T1041","T1047","T1053.005","T1059.003","T1059.005","T1070.004","T1071.001","T1074.001","T1082","T1105","T1124","T1132.001","T1140","T1497.001","T1560.001","T1560.003"]},{"id":"S0265","name":"Kazuar","type":"software","techniques":["T1005","T1008","T1010","T1016","T1027","T1029","T1033","T1047","T1055.001","T1057","T1059.003","T1059.004","T1069.001","T1070.004","T1071.001","T1071.002","T1074.001","T1082","T1083","T1087.001","T1090.001","T1102.002","T1105","T1113","T1125","T1132.001","T1485","T1543.003","T1547.001","T1547.009","T1680"]},{"id":"S0266","name":"TrickBot","type":"software","techniques":["T1005","T1007","T1008","T1016","T1018","T1021.005","T1027","T1027.002","T1027.013","T1033","T1036","T1041","T1053.005","T1055","T1055.012","T1056.004","T1057","T1059.001","T1059.003","T1069","T1071.001","T1082","T1083","T1087.001","T1087.003","T1090.002","T1105","T1106","T1110.004","T1112","T1132.001","T1135","T1140","T1185","T1204.002","T1210","T1219","T1482","T1495","T1497.003","T1542.003","T1543.003","T1547.001","T1552.001","T1552.002","T1553.002","T1555.003","T1555.005","T1559.001","T1564.003","T1566.001","T1566.002","T1571","T1573.001","T1685"]},{"id":"S0267","name":"FELIXROOT","type":"software","techniques":["T1012","T1016","T1027.013","T1033","T1047","T1057","T1059.003","T1070.004","T1071.001","T1082","T1105","T1112","T1124","T1218.011","T1518.001","T1547.001","T1547.009","T1560","T1680"]},{"id":"S0268","name":"Bisonal","type":"software","techniques":["T1005","T1012","T1016","T1027.001","T1027.002","T1027.013","T1036","T1036.005","T1041","T1057","T1059.003","T1059.005","T1070.004","T1071.001","T1082","T1083","T1090","T1095","T1105","T1106","T1112","T1124","T1132.001","T1137.006","T1140","T1204.002","T1218.011","T1497","T1497.003","T1543.003","T1547.001","T1566.001","T1568","T1573.001"]},{"id":"S0269","name":"QUADAGENT","type":"software","techniques":["T1008","T1012","T1016","T1027.010","T1027.011","T1033","T1036.005","T1053.005","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1071.004","T1112","T1132.001","T1140"]},{"id":"S0270","name":"RogueRobin","type":"software","techniques":["T1016","T1027.010","T1033","T1047","T1057","T1059.001","T1059.003","T1082","T1102.002","T1105","T1113","T1132.001","T1140","T1218.010","T1497.001","T1518.001","T1547.001","T1547.009"]},{"id":"S0271","name":"KEYMARBLE","type":"software","techniques":["T1016","T1057","T1059.003","T1070.004","T1082","T1083","T1105","T1112","T1113","T1573.001","T1680"]},{"id":"S0272","name":"NDiskMonitor","type":"software","techniques":["T1033","T1082","T1083","T1105","T1573.001"]},{"id":"S0273","name":"Socksbot","type":"software","techniques":["T1055.001","T1057","T1059.001","T1090","T1113"]},{"id":"S0274","name":"Calisto","type":"software","techniques":["T1005","T1016","T1036.005","T1056.002","T1070.004","T1074.001","T1098","T1105","T1136.001","T1217","T1543.001","T1555.001","T1560.001","T1564.001","T1569.001"]},{"id":"S0275","name":"UPPERCUT","type":"software","techniques":["T1005","T1016","T1033","T1059.003","T1071.001","T1082","T1083","T1105","T1113","T1124","T1132.001","T1548.002","T1573.001","T1574.001","T1678"]},{"id":"S0276","name":"Keydnap","type":"software","techniques":["T1036.006","T1056.002","T1059.006","T1071.001","T1090.003","T1543.001","T1548.001","T1555.002","T1564.009"]},{"id":"S0277","name":"FruitFly","type":"software","techniques":["T1027.010","T1057","T1070.004","T1083","T1113","T1543.001","T1564.001"]},{"id":"S0278","name":"iKitten","type":"software","techniques":["T1016","T1037.004","T1056.002","T1057","T1555.001","T1560.001","T1564.001"]},{"id":"S0279","name":"Proton","type":"software","techniques":["T1021.005","T1056.001","T1056.002","T1059.004","T1070.004","T1113","T1140","T1543.001","T1548.003","T1555.001","T1555.003","T1555.005","T1560","T1685","T1685.006"]},{"id":"S0280","name":"MirageFox","type":"software","techniques":["T1033","T1059.003","T1082","T1140","T1574.001"]},{"id":"S0281","name":"Dok","type":"software","techniques":["T1027.002","T1048.003","T1056.002","T1059.002","T1090.003","T1222.002","T1543.001","T1547.015","T1548.003","T1553.004","T1557"]},{"id":"S0282","name":"MacSpy","type":"software","techniques":["T1056.001","T1070.004","T1071.001","T1090.003","T1113","T1115","T1123","T1543.001","T1564.001"]},{"id":"S0283","name":"jRAT","type":"software","techniques":["T1007","T1016","T1021.001","T1027","T1027.002","T1029","T1037.005","T1047","T1049","T1056.001","T1057","T1059.003","T1059.005","T1059.007","T1070.004","T1082","T1083","T1090","T1105","T1113","T1115","T1120","T1123","T1125","T1518.001","T1552.001","T1552.004","T1555.003"]},{"id":"S0284","name":"More_eggs","type":"software","techniques":["T1016","T1016.001","T1027.013","T1033","T1059.003","T1070.004","T1071.001","T1082","T1105","T1132.001","T1140","T1218.010","T1518.001","T1553.002","T1573.001"]},{"id":"S0330","name":"Zeus Panda","type":"software","techniques":["T1012","T1027.010","T1027.013","T1055.002","T1056.001","T1056.004","T1057","T1059","T1059.001","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1112","T1113","T1115","T1124","T1140","T1518.001","T1547.001","T1614.001"]},{"id":"S0331","name":"Agent Tesla","type":"software","techniques":["T1016","T1016.002","T1027","T1033","T1047","T1048.003","T1053.005","T1055","T1055.012","T1056.001","T1057","T1071.001","T1071.003","T1082","T1087.001","T1105","T1112","T1113","T1115","T1124","T1125","T1140","T1185","T1203","T1204.002","T1218.009","T1497","T1547.001","T1552.001","T1552.002","T1555","T1555.003","T1560","T1564.001","T1564.003","T1566.001","T1685"]},{"id":"S0332","name":"Remcos","type":"software","techniques":["T1010","T1012","T1027","T1027.013","T1033","T1055","T1056.001","T1057","T1059.003","T1059.005","T1059.006","T1059.007","T1070","T1070.004","T1082","T1083","T1090","T1105","T1112","T1113","T1115","T1123","T1125","T1132.001","T1204.002","T1491.001","T1497.001","T1529","T1543.003","T1547.001","T1548.002","T1560.001","T1564","T1564.003","T1566.001","T1568","T1573.002","T1614"]},{"id":"S0333","name":"UBoatRAT","type":"software","techniques":["T1057","T1059.003","T1071.001","T1102.002","T1105","T1197","T1497.001","T1573.001"]},{"id":"S0334","name":"DarkComet","type":"software","techniques":["T1021.001","T1027.002","T1033","T1036.005","T1056.001","T1057","T1059","T1059.003","T1071.001","T1082","T1105","T1112","T1115","T1123","T1125","T1547.001","T1685","T1686.003"]},{"id":"S0335","name":"Carbon","type":"software","techniques":["T1012","T1016","T1018","T1027","T1048.003","T1049","T1053.005","T1055.001","T1057","T1069","T1071.001","T1074.001","T1095","T1102","T1124","T1140","T1543.003","T1573.002"]},{"id":"S0336","name":"NanoCore","type":"software","techniques":["T1016","T1027","T1056.001","T1059.003","T1059.005","T1105","T1112","T1123","T1125","T1547.001","T1573.001","T1685","T1686"]},{"id":"S0337","name":"BadPatch","type":"software","techniques":["T1005","T1056.001","T1071.001","T1071.003","T1074.001","T1082","T1083","T1105","T1113","T1497.001","T1518.001","T1547.001"]},{"id":"S0338","name":"Cobian RAT","type":"software","techniques":["T1056.001","T1059.003","T1071.004","T1113","T1123","T1125","T1132.001","T1547.001"]},{"id":"S0339","name":"Micropsia","type":"software","techniques":["T1027.013","T1033","T1047","T1056.001","T1059.003","T1071.001","T1082","T1083","T1105","T1113","T1119","T1123","T1518.001","T1547.009","T1560.001","T1564.001"]},{"id":"S0340","name":"Octopus","type":"software","techniques":["T1005","T1016","T1033","T1036.005","T1041","T1047","T1071.001","T1074.001","T1082","T1083","T1105","T1113","T1132.001","T1204.002","T1547.001","T1560.001","T1566.001","T1567.002","T1680"]},{"id":"S0341","name":"Xbash","type":"software","techniques":["T1016","T1046","T1053.003","T1059.001","T1059.005","T1059.007","T1071.001","T1102.001","T1105","T1110.001","T1203","T1218.005","T1218.010","T1485","T1486","T1547.001"]},{"id":"S0342","name":"GreyEnergy","type":"software","techniques":["T1003.001","T1007","T1027.002","T1027.013","T1055.002","T1056.001","T1059.003","T1070.004","T1071.001","T1090.003","T1105","T1112","T1218.011","T1543.003","T1553.002","T1573.001","T1573.002"]},{"id":"S0343","name":"Exaramel for Windows","type":"software","techniques":["T1027.011","T1036.004","T1059.003","T1059.005","T1074.001","T1112","T1543.003","T1560"]},{"id":"S0344","name":"Azorult","type":"software","techniques":["T1012","T1016","T1033","T1055.012","T1057","T1070.004","T1082","T1083","T1105","T1113","T1124","T1134.002","T1140","T1552.001","T1555.003","T1573.001"]},{"id":"S0345","name":"Seasalt","type":"software","techniques":["T1027.013","T1036.004","T1057","T1059.003","T1070.004","T1071.001","T1083","T1105","T1543.003","T1547.001"]},{"id":"S0346","name":"OceanSalt","type":"software","techniques":["T1016","T1057","T1059.003","T1070.004","T1082","T1083","T1132.002","T1566.001"]},{"id":"S0347","name":"AuditCred","type":"software","techniques":["T1027.013","T1055","T1059.003","T1070.004","T1083","T1090","T1105","T1140","T1543.003"]},{"id":"S0348","name":"Cardinal RAT","type":"software","techniques":["T1008","T1012","T1027.004","T1027.013","T1033","T1055","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1090","T1105","T1112","T1113","T1140","T1204.002","T1547.001","T1560.002","T1573.001"]},{"id":"S0349","name":"LaZagne","type":"software","techniques":["T1003.001","T1003.004","T1003.005","T1003.007","T1003.008","T1552.001","T1555","T1555.001","T1555.003","T1555.004"]},{"id":"S0350","name":"zwShell","type":"software","techniques":["T1016","T1021.001","T1021.002","T1033","T1053.005","T1059.003","T1070.004","T1082","T1083","T1112","T1543.003"]},{"id":"S0351","name":"Cannon","type":"software","techniques":["T1033","T1041","T1057","T1071.003","T1082","T1083","T1105","T1113","T1124","T1547.004","T1680"]},{"id":"S0352","name":"OSX_OCEANLOTUS.D","type":"software","techniques":["T1005","T1016","T1027.002","T1027.013","T1036.004","T1036.008","T1059.001","T1059.004","T1059.005","T1070.004","T1070.006","T1071.001","T1082","T1095","T1105","T1129","T1132.001","T1140","T1222.002","T1497.001","T1543.001","T1543.004","T1553.001","T1560.002","T1560.003","T1564.001","T1571","T1573.001"]},{"id":"S0353","name":"NOKKI","type":"software","techniques":["T1016","T1027","T1033","T1036.005","T1056.004","T1070.004","T1071.001","T1071.002","T1074.001","T1082","T1105","T1124","T1140","T1218.011","T1547.001","T1680"]},{"id":"S0354","name":"Denis","type":"software","techniques":["T1012","T1016","T1027","T1027.010","T1033","T1055.012","T1059.001","T1059.003","T1070.004","T1071.004","T1082","T1083","T1105","T1106","T1132.001","T1140","T1497.001","T1560.002","T1574","T1574.001"]},{"id":"S0355","name":"Final1stspy","type":"software","techniques":["T1027","T1057","T1071.001","T1082","T1140","T1547.001"]},{"id":"S0356","name":"KONNI","type":"software","techniques":["T1005","T1016","T1027.002","T1027.013","T1033","T1036.004","T1036.005","T1041","T1048.003","T1049","T1056.001","T1057","T1059.001","T1059.003","T1059.007","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1112","T1113","T1115","T1132.001","T1134.002","T1134.004","T1140","T1204.002","T1218.011","T1543.003","T1546.015","T1547.001","T1547.009","T1548.002","T1555.003","T1560","T1566.001","T1573.001","T1680"]},{"id":"S0357","name":"Impacket","type":"software","techniques":["T1003.001","T1003.002","T1003.003","T1003.004","T1040","T1047","T1557.001","T1558.003","T1558.005","T1569.002","T1570"]},{"id":"S0358","name":"Ruler","type":"software","techniques":["T1087.003","T1137.003","T1137.004","T1137.005"]},{"id":"S0359","name":"Nltest","type":"software","techniques":["T1016","T1018","T1482"]},{"id":"S0360","name":"BONDUPDATER","type":"software","techniques":["T1053.005","T1059.001","T1059.003","T1071.004","T1105","T1564.003","T1568.002"]},{"id":"S0361","name":"Expand","type":"software","techniques":["T1140","T1564.004","T1570"]},{"id":"S0362","name":"Linux Rabbit","type":"software","techniques":["T1033","T1078","T1110.003","T1132","T1133","T1546.004"]},{"id":"S0363","name":"Empire","type":"software","techniques":["T1003.001","T1016","T1020","T1021.003","T1021.004","T1027.010","T1033","T1040","T1041","T1046","T1047","T1049","T1053.005","T1055","T1056.001","T1056.004","T1057","T1059","T1059.001","T1059.003","T1068","T1070.006","T1071.001","T1082","T1083","T1087.001","T1087.002","T1102.002","T1105","T1106","T1113","T1114.001","T1115","T1119","T1125","T1127.001","T1134","T1134.002","T1134.005","T1135","T1136.001","T1136.002","T1210","T1217","T1482","T1484.001","T1518.001","T1543.003","T1546.008","T1547.001","T1547.005","T1547.009","T1548.002","T1550.002","T1552.001","T1552.004","T1555.001","T1555.003","T1557.001","T1558.001","T1558.002","T1558.003","T1560","T1567.001","T1567.002","T1569.002","T1573.002","T1574.001","T1574.004","T1574.007","T1574.008","T1574.009","T1615"]},{"id":"S0364","name":"RawDisk","type":"software","techniques":["T1485","T1561.001","T1561.002"]},{"id":"S0365","name":"Olympic Destroyer","type":"software","techniques":["T1003.001","T1016","T1018","T1021.002","T1047","T1135","T1485","T1489","T1490","T1529","T1555.003","T1569.002","T1570","T1685.005"]},{"id":"S0366","name":"WannaCry","type":"software","techniques":["T1016","T1018","T1047","T1083","T1090.003","T1120","T1210","T1222.001","T1486","T1489","T1490","T1543.003","T1563.002","T1564.001","T1570","T1573.002"]},{"id":"S0367","name":"Emotet","type":"software","techniques":["T1003.001","T1016.002","T1021.002","T1027.001","T1027.002","T1027.009","T1027.010","T1027.013","T1033","T1036.004","T1040","T1041","T1047","T1053.005","T1055.001","T1055.012","T1057","T1059.001","T1059.003","T1059.005","T1071.001","T1078.003","T1087.003","T1105","T1106","T1110.001","T1114","T1114.001","T1132.001","T1134.001","T1135","T1140","T1204.001","T1204.002","T1210","T1218.010","T1543.003","T1547.001","T1552.001","T1555.003","T1566.001","T1566.002","T1570","T1571","T1573","T1573.001","T1620"]},{"id":"S0368","name":"NotPetya","type":"software","techniques":["T1003.001","T1021.002","T1036","T1047","T1053.005","T1078.003","T1083","T1210","T1218.011","T1486","T1518.001","T1529","T1569.002","T1685.005"]},{"id":"S0369","name":"CoinTicker","type":"software","techniques":["T1027","T1059.003","T1059.004","T1059.006","T1105","T1140","T1543.001","T1553.001","T1564.001"]},{"id":"S0370","name":"SamSam","type":"software","techniques":["T1027.013","T1027.016","T1059.003","T1070.004","T1486"]},{"id":"S0371","name":"POWERTON","type":"software","techniques":["T1003.002","T1059.001","T1071.001","T1546.003","T1547.001","T1573.001"]},{"id":"S0372","name":"LockerGoga","type":"software","techniques":["T1070.004","T1486","T1529","T1531","T1553.002","T1570","T1685"]},{"id":"S0373","name":"Astaroth","type":"software","techniques":["T1016","T1027.002","T1027.010","T1027.013","T1041","T1047","T1055.012","T1056.001","T1057","T1059.003","T1059.005","T1059.007","T1074.001","T1082","T1102.001","T1105","T1115","T1124","T1129","T1132.001","T1140","T1204.002","T1218.001","T1218.010","T1220","T1497.001","T1518.001","T1547.001","T1547.009","T1552","T1555","T1564.003","T1564.004","T1566.001","T1568.002","T1574.001"]},{"id":"S0374","name":"SpeakUp","type":"software","techniques":["T1016","T1027.013","T1033","T1046","T1049","T1053.003","T1059","T1059.006","T1070.004","T1071.001","T1082","T1105","T1110.001","T1132.001","T1203"]},{"id":"S0375","name":"Remexi","type":"software","techniques":["T1010","T1027.013","T1041","T1047","T1053.005","T1056.001","T1059.003","T1059.005","T1071.001","T1083","T1113","T1115","T1140","T1547.001","T1547.004","T1560"]},{"id":"S0376","name":"HOPLIGHT","type":"software","techniques":["T1003.002","T1008","T1012","T1041","T1047","T1055","T1059.003","T1082","T1083","T1090","T1105","T1112","T1124","T1132.001","T1546.003","T1550.002","T1569.002","T1571","T1652","T1680","T1686"]},{"id":"S0377","name":"Ebury","type":"software","techniques":["T1008","T1014","T1020","T1027","T1041","T1059.004","T1059.006","T1071.004","T1129","T1132.001","T1140","T1552.004","T1553.002","T1554","T1556","T1556.003","T1568.002","T1573.001","T1574.006","T1685","T1685.004"]},{"id":"S0378","name":"PoshC2","type":"software","techniques":["T1003.001","T1007","T1016","T1040","T1046","T1047","T1049","T1055","T1056.001","T1068","T1069.001","T1071.001","T1082","T1083","T1087.001","T1087.002","T1090","T1110","T1119","T1134","T1134.002","T1201","T1210","T1482","T1546.003","T1548.002","T1550.002","T1552.001","T1555","T1557.001","T1560.001","T1569.002"]},{"id":"S0379","name":"Revenge RAT","type":"software","techniques":["T1003","T1016","T1021.001","T1033","T1053.005","T1056.001","T1059.001","T1059.003","T1082","T1102.002","T1105","T1113","T1123","T1125","T1132.001","T1202","T1218.005","T1547.004"]},{"id":"S0380","name":"StoneDrill","type":"software","techniques":["T1012","T1027.013","T1047","T1055","T1059.005","T1070.004","T1082","T1105","T1113","T1124","T1485","T1497","T1518.001","T1561.001","T1561.002"]},{"id":"S0381","name":"FlawedAmmyy","type":"software","techniques":["T1001","T1005","T1033","T1041","T1047","T1056","T1056.001","T1059.001","T1059.003","T1069.001","T1070.004","T1071.001","T1082","T1105","T1113","T1115","T1120","T1218.007","T1218.011","T1518.001","T1547.001","T1573.001"]},{"id":"S0382","name":"ServHelper","type":"software","techniques":["T1021.001","T1033","T1036.010","T1053.005","T1059.001","T1059.003","T1070.004","T1071.001","T1082","T1098.007","T1105","T1136.001","T1218.011","T1547.001","T1573.002"]},{"id":"S0383","name":"FlawedGrace","type":"software","techniques":["T1027.013"]},{"id":"S0384","name":"Dridex","type":"software","techniques":["T1027","T1053.005","T1071.001","T1082","T1090","T1090.003","T1106","T1185","T1204.002","T1218.010","T1219","T1518","T1573.001","T1573.002","T1574.001"]},{"id":"S0385","name":"njRAT","type":"software","techniques":["T1005","T1010","T1012","T1018","T1021.001","T1027.004","T1027.013","T1033","T1041","T1056.001","T1057","T1059.001","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1083","T1091","T1105","T1106","T1112","T1113","T1120","T1125","T1132.001","T1547.001","T1555.003","T1568.001","T1571","T1686.003"]},{"id":"S0386","name":"Ursnif","type":"software","techniques":["T1005","T1007","T1012","T1027.010","T1027.013","T1036.005","T1041","T1047","T1055.005","T1055.012","T1056.004","T1057","T1059.001","T1059.005","T1070.004","T1071.001","T1074.001","T1080","T1082","T1090","T1090.003","T1091","T1105","T1106","T1112","T1113","T1132","T1140","T1185","T1497.003","T1543.003","T1547.001","T1559.001","T1564.003","T1568.002"]},{"id":"S0387","name":"KeyBoy","type":"software","techniques":["T1001.003","T1016","T1027.013","T1056.001","T1059.001","T1059.003","T1059.005","T1059.006","T1070.006","T1082","T1083","T1105","T1113","T1543.003","T1547.004","T1555.003","T1559.002","T1564.003"]},{"id":"S0388","name":"YAHOYAH","type":"software","techniques":["T1027.013","T1071.001","T1082","T1105","T1140","T1518.001"]},{"id":"S0389","name":"JCry","type":"software","techniques":["T1059.001","T1059.003","T1059.005","T1204.002","T1486","T1490","T1547.001"]},{"id":"S0390","name":"SQLRat","type":"software","techniques":["T1027.010","T1053.005","T1059.001","T1059.003","T1070.004","T1105","T1140","T1204.002"]},{"id":"S0391","name":"HAWKBALL","type":"software","techniques":["T1027.013","T1033","T1041","T1059.003","T1070.004","T1071.001","T1082","T1106","T1203","T1559.002","T1560.003"]},{"id":"S0393","name":"PowerStallion","type":"software","techniques":["T1027","T1057","T1059.001","T1070.006","T1102.002"]},{"id":"S0394","name":"HiddenWasp","type":"software","techniques":["T1014","T1027.013","T1037.004","T1059.003","T1095","T1105","T1136.001","T1140","T1573.001","T1574.006"]},{"id":"S0395","name":"LightNeuron","type":"software","techniques":["T1001.002","T1005","T1016","T1020","T1027.013","T1029","T1036.005","T1041","T1059.003","T1070.004","T1071.003","T1074.001","T1082","T1105","T1106","T1114.002","T1119","T1140","T1505.002","T1560","T1565.002","T1573.001"]},{"id":"S0396","name":"EvilBunny","type":"software","techniques":["T1047","T1053.005","T1057","T1059.003","T1059.011","T1070.004","T1071.001","T1105","T1106","T1124","T1203","T1497.001","T1497.003","T1518.001","T1547.001"]},{"id":"S0397","name":"LoJax","type":"software","techniques":["T1014","T1112","T1542.001","T1547.001","T1564.004"]},{"id":"S0398","name":"HyperBro","type":"software","techniques":["T1007","T1027.002","T1027.013","T1055","T1070.004","T1071.001","T1105","T1106","T1113","T1140","T1569.002","T1574.001"]},{"id":"S0400","name":"RobbinHood","type":"software","techniques":["T1059.003","T1070.005","T1486","T1489","T1490","T1685"]},{"id":"S0401","name":"Exaramel for Linux","type":"software","techniques":["T1008","T1027.013","T1033","T1053.003","T1059.004","T1070.004","T1071.001","T1105","T1140","T1543","T1543.002","T1548.001"]},{"id":"S0402","name":"OSX/Shlayer","type":"software","techniques":["T1036.005","T1059.004","T1082","T1083","T1105","T1140","T1176.001","T1204.002","T1222.002","T1548.004","T1553.001","T1564","T1564.001","T1564.009","T1564.011"]},{"id":"S0404","name":"esentutl","type":"software","techniques":["T1003.003","T1005","T1006","T1105","T1564.004","T1570"]},{"id":"S0409","name":"Machete","type":"software","techniques":["T1005","T1008","T1010","T1016","T1016.002","T1020","T1025","T1027.002","T1027.010","T1029","T1036.004","T1036.005","T1041","T1052.001","T1053.005","T1056.001","T1057","T1059.006","T1070.004","T1071.001","T1071.002","T1074.001","T1082","T1083","T1105","T1113","T1115","T1120","T1123","T1125","T1132.001","T1140","T1217","T1547.001","T1552.004","T1555.003","T1560","T1560.003","T1564.001","T1573.001","T1573.002"]},{"id":"S0410","name":"Fysbis","type":"software","techniques":["T1027.013","T1036.004","T1036.005","T1056.001","T1057","T1059.004","T1070.004","T1082","T1083","T1132.001","T1543.002","T1547.013"]},{"id":"S0412","name":"ZxShell","type":"software","techniques":["T1005","T1007","T1012","T1021.001","T1021.005","T1033","T1046","T1055.001","T1056.001","T1056.004","T1057","T1059.003","T1070.004","T1071.001","T1071.002","T1082","T1083","T1090","T1105","T1106","T1112","T1113","T1125","T1134.002","T1136.001","T1190","T1218.011","T1499","T1543.003","T1569.002","T1571","T1685","T1685.005","T1686"]},{"id":"S0413","name":"MailSniper","type":"software","techniques":["T1087.003","T1110.003","T1114.002"]},{"id":"S0414","name":"BabyShark","type":"software","techniques":["T1012","T1016","T1033","T1053.005","T1056.001","T1057","T1059.003","T1059.005","T1070.004","T1082","T1083","T1105","T1132.001","T1140","T1218.005","T1547.001"]},{"id":"S0415","name":"BOOSTWRITE","type":"software","techniques":["T1027.013","T1129","T1140","T1553.002","T1574.001"]},{"id":"S0416","name":"RDFSNIFFER","type":"software","techniques":["T1056.004","T1070.004","T1106"]},{"id":"S0417","name":"GRIFFON","type":"software","techniques":["T1053.005","T1059.001","T1059.007","T1069.002","T1082","T1113","T1124","T1547.001"]},{"id":"S0428","name":"PoetRAT","type":"software","techniques":["T1003.001","T1018","T1027","T1027.010","T1033","T1041","T1048","T1048.003","T1056.001","T1057","T1059.003","T1059.005","T1059.006","T1059.011","T1070.004","T1071.001","T1071.002","T1082","T1083","T1105","T1112","T1113","T1119","T1125","T1140","T1204.002","T1497.001","T1547.001","T1555.003","T1559.002","T1560.001","T1564.001","T1566.001","T1571","T1573.002"]},{"id":"S0430","name":"Winnti for Linux","type":"software","techniques":["T1014","T1027.013","T1071.001","T1095","T1105","T1140","T1205","T1573.001"]},{"id":"S0431","name":"HotCroissant","type":"software","techniques":["T1007","T1010","T1016","T1027.002","T1027.013","T1033","T1041","T1053.005","T1057","T1059.003","T1070.004","T1082","T1083","T1105","T1106","T1113","T1489","T1518","T1564.003","T1573.001"]},{"id":"S0433","name":"Rifdoor","type":"software","techniques":["T1016","T1027.001","T1027.013","T1033","T1082","T1204.002","T1547.001","T1566.001","T1573.001"]},{"id":"S0434","name":"Imminent Monitor","type":"software","techniques":["T1021.001","T1027","T1041","T1056.001","T1057","T1059","T1070.004","T1083","T1106","T1123","T1125","T1140","T1496.001","T1555.003","T1564.001","T1685"]},{"id":"S0435","name":"PLEAD","type":"software","techniques":["T1001.001","T1010","T1057","T1059.003","T1070.004","T1071.001","T1083","T1090","T1105","T1106","T1204.001","T1204.002","T1555","T1555.003","T1573.001"]},{"id":"S0436","name":"TSCookie","type":"software","techniques":["T1016","T1055","T1057","T1059.003","T1071.001","T1083","T1090","T1095","T1105","T1140","T1204.001","T1555.003","T1573.001"]},{"id":"S0437","name":"Kivars","type":"software","techniques":["T1021","T1056.001","T1070.004","T1083","T1105","T1113","T1564.003"]},{"id":"S0438","name":"Attor","type":"software","techniques":["T1010","T1012","T1020","T1027.013","T1036.004","T1037.001","T1041","T1053.005","T1055","T1055.004","T1056.001","T1070.004","T1070.006","T1071.002","T1074.001","T1083","T1090.003","T1105","T1106","T1112","T1113","T1115","T1119","T1120","T1123","T1129","T1218.011","T1497.001","T1543.003","T1560.003","T1564.001","T1569.002","T1573.001","T1573.002","T1680"]},{"id":"S0439","name":"Okrum","type":"software","techniques":["T1001","T1001.003","T1003.001","T1003.005","T1016","T1027.003","T1033","T1036.004","T1041","T1049","T1053.005","T1056.001","T1059.003","T1070.004","T1071.001","T1082","T1083","T1090.002","T1105","T1124","T1132.001","T1134.001","T1140","T1497.001","T1497.002","T1497.003","T1543.003","T1547.001","T1547.009","T1560.001","T1560.003","T1564.001","T1569.002","T1573.001"]},{"id":"S0441","name":"PowerShower","type":"software","techniques":["T1016","T1033","T1041","T1057","T1059.001","T1059.005","T1070.004","T1071.001","T1082","T1112","T1132.001","T1547.001","T1560.001","T1564.003"]},{"id":"S0442","name":"VBShower","type":"software","techniques":["T1059.005","T1070.004","T1071.001","T1105","T1547.001"]},{"id":"S0443","name":"MESSAGETAP","type":"software","techniques":["T1040","T1049","T1070.004","T1074.001","T1083","T1119","T1140","T1560.003"]},{"id":"S0444","name":"ShimRat","type":"software","techniques":["T1005","T1008","T1027.002","T1027.015","T1029","T1036.004","T1059.003","T1070.004","T1071.001","T1083","T1090.002","T1105","T1106","T1112","T1135","T1140","T1543.003","T1546.011","T1547.001","T1548.002","T1574"]},{"id":"S0445","name":"ShimRatReporter","type":"software","techniques":["T1016","T1020","T1027","T1036.005","T1041","T1049","T1057","T1069","T1071.001","T1082","T1087","T1105","T1106","T1119","T1518","T1560"]},{"id":"S0446","name":"Ryuk","type":"software","techniques":["T1016","T1021.002","T1027","T1036","T1036.005","T1053.005","T1055","T1057","T1059.003","T1078.002","T1083","T1106","T1134","T1205","T1222.001","T1486","T1489","T1490","T1547.001","T1614.001","T1680","T1685"]},{"id":"S0447","name":"Lokibot","type":"software","techniques":["T1016","T1027","T1027.002","T1033","T1041","T1053","T1053.005","T1055.012","T1056.001","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1112","T1140","T1204.002","T1497.003","T1548.002","T1555","T1555.003","T1564.001","T1566.001","T1620"]},{"id":"S0448","name":"Rising Sun","type":"software","techniques":["T1005","T1012","T1016","T1016.001","T1027.013","T1033","T1041","T1057","T1059.003","T1070","T1070.004","T1071.001","T1082","T1083","T1106","T1140","T1560.003","T1564.001","T1573.002","T1680"]},{"id":"S0449","name":"Maze","type":"software","techniques":["T1027","T1027.016","T1036.004","T1047","T1049","T1053.005","T1055.001","T1057","T1059.003","T1070","T1071.001","T1082","T1106","T1218.007","T1486","T1489","T1490","T1529","T1547.001","T1564.006","T1568","T1614.001","T1685"]},{"id":"S0450","name":"SHARPSTATS","type":"software","techniques":["T1016","T1027.010","T1033","T1059.001","T1082","T1105","T1124"]},{"id":"S0451","name":"LoudMiner","type":"software","techniques":["T1016","T1027.010","T1027.013","T1057","T1059.003","T1059.004","T1070.004","T1082","T1105","T1189","T1218.007","T1496.001","T1543.003","T1543.004","T1564.001","T1564.006","T1569.001","T1569.002"]},{"id":"S0452","name":"USBferry","type":"software","techniques":["T1005","T1016","T1018","T1049","T1057","T1059.003","T1083","T1087.001","T1091","T1120","T1218.011"]},{"id":"S0453","name":"Pony","type":"software","techniques":["T1027.015","T1027.016","T1036","T1059.003","T1070.004","T1071.001","T1082","T1087.001","T1105","T1106","T1110.001","T1204.001","T1204.002","T1497.003","T1566.001","T1566.002"]},{"id":"S0454","name":"Cadelspy","type":"software","techniques":["T1010","T1056.001","T1082","T1113","T1115","T1120","T1123","T1560"]},{"id":"S0455","name":"Metamorfo","type":"software","techniques":["T1010","T1027.002","T1027.013","T1033","T1036.005","T1041","T1055.001","T1056.001","T1056.002","T1057","T1059.003","T1059.005","T1059.007","T1070","T1070.004","T1071.001","T1082","T1083","T1095","T1102.001","T1102.003","T1105","T1106","T1112","T1113","T1115","T1119","T1124","T1129","T1140","T1204.002","T1218.005","T1218.007","T1497","T1518","T1518.001","T1547.001","T1553.002","T1564.003","T1565.002","T1566.001","T1571","T1573.001","T1573.002","T1574.001","T1685"]},{"id":"S0456","name":"Aria-body","type":"software","techniques":["T1010","T1016","T1025","T1027.013","T1033","T1049","T1055.001","T1057","T1070.004","T1071.001","T1082","T1083","T1090","T1095","T1105","T1106","T1113","T1134.001","T1134.002","T1140","T1547.001","T1560","T1568.002","T1680"]},{"id":"S0457","name":"Netwalker","type":"software","techniques":["T1027.009","T1027.010","T1047","T1055.001","T1059.001","T1059.003","T1082","T1105","T1106","T1112","T1140","T1486","T1489","T1490","T1518.001","T1569.002","T1570","T1685"]},{"id":"S0458","name":"Ramsay","type":"software","techniques":["T1005","T1014","T1016","T1025","T1027","T1027.003","T1036","T1036.005","T1039","T1046","T1049","T1053.005","T1055.001","T1057","T1059.005","T1071.001","T1074.001","T1080","T1083","T1091","T1106","T1113","T1119","T1120","T1132.001","T1135","T1140","T1203","T1204.002","T1546.010","T1547.001","T1548.002","T1559.001","T1559.002","T1560.001","T1560.003","T1566.001","T1574.001","T1680"]},{"id":"S0459","name":"MechaFlounder","type":"software","techniques":["T1033","T1036.005","T1041","T1059.003","T1059.006","T1071.001","T1105","T1132.001"]},{"id":"S0460","name":"Get2","type":"software","techniques":["T1033","T1055.001","T1057","T1059","T1071.001","T1082"]},{"id":"S0461","name":"SDBbot","type":"software","techniques":["T1005","T1016","T1021.001","T1027","T1027.002","T1033","T1041","T1055.001","T1057","T1059.003","T1070","T1070.004","T1082","T1083","T1090","T1095","T1105","T1125","T1140","T1218.011","T1546.011","T1546.012","T1547.001","T1614"]},{"id":"S0462","name":"CARROTBAT","type":"software","techniques":["T1027.010","T1027.013","T1059.003","T1070.004","T1082","T1105"]},{"id":"S0464","name":"SYSCON","type":"software","techniques":["T1057","T1059.003","T1071.002","T1082","T1204.002"]},{"id":"S0465","name":"CARROTBALL","type":"software","techniques":["T1027","T1071.002","T1105","T1204.002"]},{"id":"S0466","name":"WindTail","type":"software","techniques":["T1027.013","T1027.015","T1036","T1036.001","T1048.003","T1059.004","T1070.004","T1071.001","T1083","T1106","T1119","T1124","T1140","T1560.001","T1564.003"]},{"id":"S0467","name":"TajMahal","type":"software","techniques":["T1005","T1016","T1020","T1025","T1027","T1041","T1055.001","T1056.001","T1057","T1082","T1083","T1112","T1113","T1115","T1119","T1120","T1123","T1124","T1125","T1129","T1518","T1518.001","T1539","T1560.002"]},{"id":"S0468","name":"Skidmap","type":"software","techniques":["T1014","T1027.013","T1036.005","T1053.003","T1057","T1059.004","T1082","T1083","T1098.004","T1105","T1140","T1496.001","T1518.001","T1547.006","T1556.003","T1685"]},{"id":"S0469","name":"ABK","type":"software","techniques":["T1027.003","T1055","T1059.003","T1071.001","T1105","T1140","T1518.001"]},{"id":"S0470","name":"BBK","type":"software","techniques":["T1027.003","T1055","T1059.003","T1071.001","T1105","T1106","T1140"]},{"id":"S0471","name":"build_downer","type":"software","techniques":["T1027.003","T1036.004","T1105","T1106","T1124","T1518.001","T1547.001","T1680"]},{"id":"S0472","name":"down_new","type":"software","techniques":["T1016","T1057","T1071.001","T1083","T1105","T1132.001","T1518","T1518.001","T1573.001","T1680"]},{"id":"S0473","name":"Avenger","type":"software","techniques":["T1016","T1027.003","T1027.013","T1055","T1057","T1071.001","T1082","T1083","T1105","T1140","T1518.001","T1680"]},{"id":"S0475","name":"BackConfig","type":"software","techniques":["T1027.010","T1036.005","T1053.005","T1059.003","T1059.005","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1137.001","T1140","T1204.001","T1553.002","T1564.001"]},{"id":"S0476","name":"Valak","type":"software","techniques":["T1008","T1012","T1016","T1027","T1027.002","T1027.011","T1033","T1041","T1047","T1053.005","T1057","T1059.001","T1059.007","T1071.001","T1082","T1087.001","T1087.002","T1104","T1105","T1112","T1113","T1114.002","T1119","T1132.001","T1140","T1204.002","T1218.010","T1518.001","T1552.002","T1555.004","T1559.002","T1564.004","T1566.001","T1566.002"]},{"id":"S0477","name":"Goopy","type":"software","techniques":["T1005","T1027.001","T1027.016","T1033","T1036.005","T1041","T1053.005","T1057","T1059.003","T1059.005","T1070.008","T1071.001","T1071.003","T1071.004","T1106","T1140","T1574.001","T1685"]},{"id":"S0481","name":"Ragnar Locker","type":"software","techniques":["T1059.003","T1120","T1218.007","T1218.010","T1218.011","T1486","T1489","T1490","T1543.003","T1564.006","T1569.002","T1614","T1685"]},{"id":"S0482","name":"Bundlore","type":"software","techniques":["T1027","T1036.005","T1048","T1056.002","T1057","T1059.002","T1059.004","T1059.006","T1059.007","T1071.001","T1082","T1098.004","T1105","T1140","T1176.001","T1189","T1204.002","T1222.002","T1518","T1543.001","T1543.004","T1564","T1685"]},{"id":"S0483","name":"IcedID","type":"software","techniques":["T1016","T1027.002","T1027.003","T1027.009","T1027.013","T1036.005","T1047","T1048.002","T1053.005","T1055.004","T1055.012","T1059.005","T1069","T1071.001","T1082","T1087.002","T1105","T1106","T1135","T1185","T1189","T1204.002","T1218.007","T1218.011","T1482","T1497","T1518.001","T1547.001","T1566.001","T1573.002","T1614.001"]},{"id":"S0484","name":"Carberp","type":"software","techniques":["T1012","T1014","T1021.005","T1027.013","T1036.005","T1041","T1055.001","T1055.004","T1056.004","T1057","T1068","T1071.001","T1082","T1105","T1106","T1113","T1185","T1497","T1518.001","T1542.003","T1547.001","T1555","T1555.003","T1564.001","T1685"]},{"id":"S0486","name":"Bonadan","type":"software","techniques":["T1016","T1033","T1057","T1059","T1082","T1105","T1496.001","T1554","T1573.001"]},{"id":"S0487","name":"Kessel","type":"software","techniques":["T1016","T1027.013","T1030","T1041","T1048.003","T1059","T1082","T1090","T1105","T1132.001","T1140","T1554","T1556","T1560"]},{"id":"S0488","name":"CrackMapExec","type":"software","techniques":["T1003.002","T1003.003","T1003.004","T1016","T1018","T1047","T1049","T1053.002","T1059.001","T1069.002","T1083","T1087.002","T1110","T1110.001","T1110.003","T1112","T1135","T1201","T1550.002","T1680"]},{"id":"S0491","name":"StrongPity","type":"software","techniques":["T1016","T1020","T1027.013","T1036.004","T1036.005","T1041","T1057","T1059.001","T1070.004","T1071.001","T1083","T1090.003","T1105","T1119","T1204.002","T1518.001","T1543.003","T1547.001","T1553.002","T1560.003","T1564.003","T1569.002","T1571","T1573.002","T1680","T1685"]},{"id":"S0492","name":"CookieMiner","type":"software","techniques":["T1005","T1027.010","T1048.003","T1059.004","T1059.006","T1083","T1105","T1140","T1496.001","T1518.001","T1539","T1543.001","T1555.003","T1686"]},{"id":"S0493","name":"GoldenSpy","type":"software","techniques":["T1027.013","T1036.005","T1041","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1136.001","T1195.002","T1497.003","T1543.003","T1571"]},{"id":"S0495","name":"RDAT","type":"software","techniques":["T1001","T1001.002","T1008","T1027.003","T1030","T1036.004","T1036.005","T1041","T1059.003","T1070.004","T1071.001","T1071.003","T1071.004","T1105","T1113","T1132.001","T1132.002","T1140","T1543.003","T1573.001"]},{"id":"S0496","name":"REvil","type":"software","techniques":["T1007","T1012","T1027.011","T1027.013","T1036.005","T1041","T1047","T1055","T1059.001","T1059.003","T1059.005","T1069.002","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1112","T1134.001","T1134.002","T1140","T1189","T1204.002","T1480.002","T1485","T1486","T1489","T1490","T1566.001","T1573.002","T1614.001","T1680","T1685","T1688"]},{"id":"S0497","name":"Dacls","type":"software","techniques":["T1027.013","T1036","T1057","T1071.001","T1083","T1105","T1543.001","T1543.004","T1564.001"]},{"id":"S0498","name":"Cryptoistic","type":"software","techniques":["T1005","T1033","T1070.004","T1083","T1095","T1105","T1573"]},{"id":"S0499","name":"Hancitor","type":"software","techniques":["T1027","T1027.015","T1059.001","T1070.004","T1105","T1106","T1140","T1204.001","T1204.002","T1218.012","T1497","T1547.001","T1566.001","T1566.002"]},{"id":"S0500","name":"MCMD","type":"software","techniques":["T1005","T1027","T1036.005","T1053.005","T1059.003","T1070.009","T1071.001","T1105","T1547.001","T1564.003"]},{"id":"S0501","name":"PipeMon","type":"software","techniques":["T1008","T1016","T1027.011","T1027.013","T1036.005","T1055.001","T1057","T1082","T1095","T1105","T1106","T1112","T1124","T1129","T1134.002","T1134.004","T1140","T1518.001","T1543.003","T1547.012","T1548.002","T1553.002","T1573.001"]},{"id":"S0502","name":"Drovorub","type":"software","techniques":["T1005","T1014","T1027","T1041","T1059.004","T1070.004","T1071.001","T1090.001","T1095","T1105","T1140","T1547.006"]},{"id":"S0503","name":"FrameworkPOS","type":"software","techniques":["T1005","T1048","T1057","T1074.001","T1560.003"]},{"id":"S0504","name":"Anchor","type":"software","techniques":["T1008","T1016","T1021.002","T1027","T1027.002","T1053.003","T1053.005","T1059.003","T1059.004","T1070.004","T1071.001","T1071.004","T1082","T1095","T1105","T1480","T1543.003","T1553.002","T1564.004","T1569.002"]},{"id":"S0508","name":"ngrok","type":"software","techniques":["T1090","T1102","T1567","T1568.002","T1572"]},{"id":"S0511","name":"RegDuke","type":"software","techniques":["T1027","T1027.003","T1027.011","T1059.001","T1102.002","T1105","T1112","T1140","T1546.003"]},{"id":"S0512","name":"FatDuke","type":"software","techniques":["T1005","T1008","T1012","T1016","T1027","T1027.002","T1027.016","T1036.012","T1057","T1059.001","T1070.004","T1071.001","T1082","T1083","T1090.001","T1106","T1140","T1218.011","T1497.003","T1547.001","T1573.001"]},{"id":"S0513","name":"LiteDuke","type":"software","techniques":["T1012","T1016","T1027.002","T1027.003","T1033","T1070.004","T1071.001","T1082","T1105","T1140","T1497.003","T1518.001","T1547.001"]},{"id":"S0514","name":"WellMess","type":"software","techniques":["T1001.001","T1005","T1016","T1033","T1059.001","T1059.003","T1069.002","T1071.001","T1071.004","T1082","T1105","T1132.001","T1140","T1573.001","T1573.002"]},{"id":"S0515","name":"WellMail","type":"software","techniques":["T1005","T1016","T1033","T1095","T1105","T1140","T1560","T1571","T1573.002"]},{"id":"S0516","name":"SoreFang","type":"software","techniques":["T1016","T1027","T1053.005","T1057","T1069.002","T1071.001","T1082","T1083","T1087.001","T1087.002","T1105","T1140","T1190","T1680"]},{"id":"S0517","name":"Pillowmint","type":"software","techniques":["T1005","T1012","T1027","T1027.011","T1027.015","T1055.004","T1057","T1059.001","T1070.004","T1070.009","T1106","T1112","T1140","T1546.011","T1560"]},{"id":"S0518","name":"PolyglotDuke","type":"software","techniques":["T1027","T1027.003","T1027.011","T1071.001","T1102.001","T1105","T1106","T1112","T1140","T1218.011"]},{"id":"S0519","name":"SYNful Knock","type":"software","techniques":["T1205","T1556.004","T1601.001"]},{"id":"S0520","name":"BLINDINGCAN","type":"software","techniques":["T1005","T1016","T1027.002","T1027.013","T1036.005","T1041","T1059.003","T1070.004","T1070.006","T1071.001","T1082","T1083","T1105","T1129","T1132.001","T1140","T1204.002","T1218.011","T1553.002","T1566.001","T1573.001","T1680"]},{"id":"S0521","name":"BloodHound","type":"software","techniques":["T1018","T1033","T1059.001","T1069.001","T1069.002","T1087.001","T1087.002","T1106","T1482","T1560","T1615"]},{"id":"S0526","name":"KGH_SPY","type":"software","techniques":["T1005","T1027.013","T1036.005","T1037.001","T1041","T1056.001","T1059.001","T1059.003","T1071.001","T1074.001","T1083","T1105","T1114.001","T1140","T1204.002","T1518","T1555","T1555.003","T1555.004","T1680"]},{"id":"S0527","name":"CSPY Downloader","type":"software","techniques":["T1027.002","T1036.004","T1053.005","T1070","T1070.004","T1071.001","T1105","T1112","T1204.002","T1497.001","T1548.002","T1553.002"]},{"id":"S0528","name":"Javali","type":"software","techniques":["T1027.001","T1057","T1059.005","T1102.001","T1105","T1204.001","T1204.002","T1218.007","T1555.003","T1566.001","T1566.002","T1574.001"]},{"id":"S0530","name":"Melcoz","type":"software","techniques":["T1027.002","T1059.005","T1059.010","T1105","T1115","T1185","T1204.001","T1218.007","T1555.003","T1565.002","T1566.002","T1574.001"]},{"id":"S0531","name":"Grandoreiro","type":"software","techniques":["T1010","T1016","T1027.001","T1027.011","T1027.013","T1033","T1036.005","T1041","T1056.001","T1057","T1059.005","T1070.004","T1071.001","T1082","T1087.003","T1102.001","T1102.002","T1105","T1106","T1112","T1115","T1124","T1140","T1176.001","T1185","T1189","T1204.001","T1204.002","T1218.007","T1222.001","T1497.001","T1518.001","T1539","T1547.001","T1547.009","T1548.002","T1555.003","T1566.002","T1568.002","T1573.002","T1685","T1686","T1686.002"]},{"id":"S0532","name":"Lucifer","type":"software","techniques":["T1012","T1016","T1021.002","T1027.002","T1033","T1046","T1047","T1049","T1053.005","T1057","T1059.003","T1071","T1082","T1105","T1110.001","T1140","T1210","T1496.001","T1497.001","T1498","T1547.001","T1570","T1573.001","T1685.005"]},{"id":"S0533","name":"SLOTHFULMEDIA","type":"software","techniques":["T1001","T1005","T1007","T1033","T1036.004","T1036.005","T1041","T1049","T1055","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1083","T1105","T1112","T1113","T1489","T1543.003","T1564.001","T1569.002","T1680"]},{"id":"S0534","name":"Bazar","type":"software","techniques":["T1005","T1008","T1012","T1016","T1018","T1027.002","T1027.007","T1027.013","T1033","T1036.004","T1036.005","T1036.007","T1047","T1053.005","T1055","T1055.012","T1055.013","T1057","T1059.001","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1083","T1087.001","T1087.002","T1102","T1104","T1105","T1106","T1124","T1135","T1140","T1197","T1204.001","T1482","T1497","T1497.003","T1518","T1518.001","T1547.001","T1547.004","T1547.009","T1553.002","T1566.002","T1568.002","T1573.001","T1573.002","T1614.001","T1685"]},{"id":"S0537","name":"HyperStack","type":"software","techniques":["T1078.001","T1087.001","T1106","T1112","T1559","T1573.001"]},{"id":"S0538","name":"Crutch","type":"software","techniques":["T1005","T1008","T1020","T1025","T1036.004","T1041","T1053.005","T1071.001","T1074.001","T1102.002","T1119","T1120","T1560.001","T1567.002","T1574.001"]},{"id":"S0543","name":"Spark","type":"software","techniques":["T1027.002","T1033","T1041","T1059.003","T1071.001","T1082","T1132.001","T1140","T1497.002","T1614.001"]},{"id":"S0546","name":"SharpStage","type":"software","techniques":["T1047","T1053.005","T1059.001","T1059.003","T1082","T1102","T1105","T1113","T1140","T1547.001","T1614.001"]},{"id":"S0547","name":"DropBook","type":"software","techniques":["T1059.003","T1059.006","T1082","T1083","T1102","T1105","T1140","T1567","T1614.001"]},{"id":"S0552","name":"AdFind","type":"software","techniques":["T1016","T1018","T1069.002","T1087.002","T1482"]},{"id":"S0553","name":"MoleNet","type":"software","techniques":["T1047","T1059.001","T1059.003","T1082","T1105","T1518.001","T1547.001"]},{"id":"S0554","name":"Egregor","type":"software","techniques":["T1027.002","T1033","T1036.004","T1039","T1049","T1055","T1059.001","T1059.003","T1069.002","T1071.001","T1082","T1105","T1106","T1124","T1140","T1197","T1218.010","T1218.011","T1219","T1484.001","T1486","T1497","T1497.003","T1574.001","T1685"]},{"id":"S0556","name":"Pay2Key","type":"software","techniques":["T1016","T1070.004","T1082","T1090.001","T1095","T1486","T1489","T1573.002"]},{"id":"S0559","name":"SUNBURST","type":"software","techniques":["T1001.001","T1001.002","T1001.003","T1005","T1007","T1012","T1016","T1027","T1027.005","T1027.015","T1033","T1036.005","T1047","T1057","T1059.005","T1070","T1070.004","T1070.007","T1070.009","T1071.001","T1071.004","T1082","T1083","T1105","T1112","T1124","T1132.001","T1218.011","T1497.001","T1497.003","T1518.001","T1546.012","T1553.002","T1568","T1573.001","T1685"]},{"id":"S0560","name":"TEARDROP","type":"software","techniques":["T1012","T1027","T1036.005","T1112","T1140","T1543.003"]},{"id":"S0561","name":"GuLoader","type":"software","techniques":["T1055","T1070.004","T1071.001","T1102","T1105","T1106","T1204.001","T1204.002","T1497.001","T1497.003","T1547.001","T1566.002"]},{"id":"S0562","name":"SUNSPOT","type":"software","techniques":["T1027","T1036.005","T1057","T1070.004","T1083","T1106","T1134","T1140","T1195.002","T1480","T1480.002","T1565.001"]},{"id":"S0564","name":"BlackMould","type":"software","techniques":["T1005","T1059.003","T1071.001","T1083","T1105","T1680"]},{"id":"S0565","name":"Raindrop","type":"software","techniques":["T1027.002","T1027.003","T1027.013","T1036","T1036.005","T1140","T1497.003"]},{"id":"S0567","name":"Dtrack","type":"software","techniques":["T1005","T1012","T1016","T1027.009","T1036.005","T1049","T1055.012","T1056.001","T1057","T1059.003","T1070.004","T1074.001","T1078","T1082","T1083","T1105","T1129","T1140","T1217","T1543.003","T1547","T1560","T1574"]},{"id":"S0568","name":"EVILNUM","type":"software","techniques":["T1033","T1041","T1047","T1070","T1070.006","T1082","T1102.003","T1105","T1112","T1218.010","T1218.011","T1518.001","T1539","T1547.001"]},{"id":"S0569","name":"Explosive","type":"software","techniques":["T1016","T1025","T1033","T1056.001","T1071.001","T1082","T1105","T1106","T1112","T1115","T1564.001","T1573.001"]},{"id":"S0570","name":"BitPaymer","type":"software","techniques":["T1007","T1012","T1018","T1027.013","T1070.006","T1087.001","T1106","T1112","T1134.001","T1135","T1222.001","T1480","T1486","T1490","T1543.003","T1547.001","T1548.002","T1564.004"]},{"id":"S0572","name":"Caterpillar WebShell","type":"software","techniques":["T1005","T1007","T1014","T1016","T1033","T1041","T1046","T1057","T1059.003","T1069.001","T1082","T1083","T1105","T1110","T1112"]},{"id":"S0574","name":"BendyBear","type":"software","techniques":["T1001.001","T1012","T1027.013","T1027.014","T1105","T1106","T1124","T1140","T1497.003","T1571","T1573.001"]},{"id":"S0575","name":"Conti","type":"software","techniques":["T1016","T1018","T1021.002","T1027","T1049","T1055.001","T1057","T1059.003","T1080","T1083","T1106","T1135","T1140","T1486","T1489","T1490"]},{"id":"S0576","name":"MegaCortex","type":"software","techniques":["T1055.001","T1059.003","T1083","T1106","T1112","T1134","T1140","T1218.011","T1486","T1489","T1490","T1497.001","T1531","T1561.001","T1588.003","T1685"]},{"id":"S0578","name":"SUPERNOVA","type":"software","techniques":["T1027.013","T1036.005","T1071.001","T1203","T1505.003"]},{"id":"S0579","name":"Waterbear","type":"software","techniques":["T1012","T1027.005","T1027.013","T1049","T1055","T1055.003","T1057","T1105","T1106","T1112","T1140","T1518.001","T1574.001","T1685"]},{"id":"S0581","name":"IronNetInjector","type":"software","techniques":["T1027.013","T1036.004","T1053.005","T1055","T1055.001","T1057","T1059.006","T1140"]},{"id":"S0582","name":"LookBack","type":"software","techniques":["T1007","T1036.005","T1057","T1059.003","T1059.005","T1070.004","T1071.001","T1083","T1095","T1113","T1140","T1489","T1529","T1547.001","T1573.001","T1574.001"]},{"id":"S0583","name":"Pysa","type":"software","techniques":["T1003.001","T1016","T1021.001","T1036.005","T1046","T1059.001","T1059.006","T1070.004","T1110","T1112","T1486","T1489","T1490","T1552.001","T1569.002","T1685"]},{"id":"S0584","name":"AppleJeus","type":"software","techniques":["T1027","T1041","T1053.005","T1059.004","T1070.004","T1071.001","T1082","T1140","T1204.001","T1204.002","T1218.007","T1497.003","T1543.003","T1543.004","T1546.016","T1548.002","T1553.002","T1564.001","T1566.002","T1569.001"]},{"id":"S0585","name":"Kerrdown","type":"software","techniques":["T1027.013","T1027.015","T1059.005","T1082","T1105","T1140","T1204.001","T1204.002","T1566.001","T1566.002","T1574.001"]},{"id":"S0586","name":"TAINTEDSCRIBE","type":"software","techniques":["T1001.003","T1008","T1018","T1027.001","T1036.005","T1057","T1059.003","T1070.004","T1070.006","T1083","T1105","T1124","T1547.001","T1560","T1573.001","T1680"]},{"id":"S0587","name":"Penquin","type":"software","techniques":["T1016","T1027.005","T1027.013","T1036.005","T1040","T1041","T1053.003","T1059.004","T1070.004","T1082","T1083","T1095","T1105","T1205","T1205.002","T1222.002","T1573.002","T1680"]},{"id":"S0588","name":"GoldMax","type":"software","techniques":["T1001.001","T1016","T1027.002","T1027.013","T1036.004","T1036.005","T1041","T1053.003","T1053.005","T1059.003","T1071.001","T1105","T1124","T1140","T1497.001","T1497.003","T1564.011","T1573.002"]},{"id":"S0589","name":"Sibot","type":"software","techniques":["T1012","T1016","T1027.010","T1027.011","T1036.005","T1047","T1049","T1053.005","T1059.005","T1070","T1070.004","T1071.001","T1102","T1105","T1112","T1140","T1218.005","T1218.011"]},{"id":"S0590","name":"NBTscan","type":"software","techniques":["T1016","T1018","T1033","T1040","T1046"]},{"id":"S0591","name":"ConnectWise","type":"software","techniques":["T1059.001","T1113","T1125"]},{"id":"S0592","name":"RemoteUtilities","type":"software","techniques":["T1083","T1105","T1113","T1218.007"]},{"id":"S0593","name":"ECCENTRICBANDWAGON","type":"software","techniques":["T1027","T1056.001","T1059.003","T1070.004","T1074.001","T1113"]},{"id":"S0594","name":"Out1","type":"software","techniques":["T1005","T1027","T1059.003","T1071.001","T1114.001"]},{"id":"S0595","name":"ThiefQuest","type":"software","techniques":["T1036.005","T1041","T1056.001","T1057","T1059.002","T1071.001","T1105","T1106","T1486","T1497.003","T1518.001","T1543.001","T1543.004","T1554","T1564.001","T1620","T1622","T1685"]},{"id":"S0596","name":"ShadowPad","type":"software","techniques":["T1016","T1027","T1027.011","T1029","T1033","T1055","T1055.001","T1057","T1070","T1071.001","T1071.002","T1071.004","T1082","T1095","T1105","T1112","T1124","T1132.002","T1140","T1568.002","T1680"]},{"id":"S0597","name":"GoldFinder","type":"software","techniques":["T1016.001","T1071.001","T1119"]},{"id":"S0598","name":"P.A.S. Webshell","type":"software","techniques":["T1005","T1027","T1046","T1059","T1070.004","T1071.001","T1083","T1087.001","T1105","T1110.001","T1140","T1213.006","T1222.002","T1505.003","T1518"]},{"id":"S0599","name":"Kinsing","type":"software","techniques":["T1018","T1021.004","T1053.003","T1057","T1059.004","T1071.001","T1078","T1083","T1105","T1110","T1133","T1222.002","T1496.001","T1552.003","T1552.004","T1609","T1610"]},{"id":"S0600","name":"Doki","type":"software","techniques":["T1020","T1036.005","T1041","T1057","T1059.004","T1071.001","T1083","T1102","T1105","T1133","T1568.002","T1573.002","T1610","T1611"]},{"id":"S0601","name":"Hildegard","type":"software","techniques":["T1014","T1027.002","T1027.013","T1036.004","T1046","T1059.004","T1068","T1070.003","T1070.004","T1071","T1082","T1102","T1105","T1133","T1136.001","T1140","T1219","T1496.001","T1543.002","T1552.001","T1552.004","T1552.005","T1574.006","T1609","T1611","T1613","T1685"]},{"id":"S0603","name":"Stuxnet","type":"software","techniques":["T1008","T1012","T1014","T1016","T1021","T1021.002","T1027.013","T1041","T1047","T1053.005","T1055.001","T1068","T1070","T1070.004","T1070.006","T1071.001","T1078.001","T1078.002","T1080","T1082","T1083","T1087.001","T1087.002","T1090.001","T1091","T1106","T1112","T1120","T1124","T1129","T1132.001","T1134.001","T1135","T1140","T1210","T1480","T1505.001","T1518.001","T1543.003","T1553.002","T1560.003","T1570","T1573.001","T1685"]},{"id":"S0604","name":"Industroyer","type":"software","techniques":["T1012","T1016","T1018","T1027","T1041","T1046","T1071.001","T1078","T1082","T1083","T1090.003","T1105","T1140","T1485","T1489","T1499.004","T1543.003","T1554","T1572"]},{"id":"S0605","name":"EKANS","type":"software","techniques":["T1016","T1027","T1036.005","T1047","T1057","T1486","T1489","T1490","T1685"]},{"id":"S0606","name":"Bad Rabbit","type":"software","techniques":["T1003.001","T1036.005","T1053.005","T1057","T1106","T1110.003","T1135","T1189","T1204.002","T1210","T1218.011","T1486","T1495","T1548.002","T1569.002"]},{"id":"S0607","name":"KillDisk","type":"software","techniques":["T1027","T1036.004","T1057","T1070.004","T1083","T1106","T1129","T1134","T1485","T1486","T1489","T1529","T1561.002","T1680","T1685.005"]},{"id":"S0608","name":"Conficker","type":"software","techniques":["T1021.002","T1027","T1046","T1091","T1105","T1112","T1124","T1210","T1490","T1543.003","T1547.001","T1568.002","T1685"]},{"id":"S0610","name":"SideTwist","type":"software","techniques":["T1001","T1005","T1008","T1016","T1033","T1041","T1059.003","T1071.001","T1082","T1083","T1105","T1106","T1132.001","T1140","T1573.001"]},{"id":"S0611","name":"Clop","type":"software","techniques":["T1027.002","T1057","T1059.003","T1083","T1106","T1112","T1135","T1140","T1218.007","T1486","T1489","T1490","T1497.003","T1518.001","T1553.002","T1614.001","T1685"]},{"id":"S0612","name":"WastedLocker","type":"software","techniques":["T1012","T1027.013","T1027.016","T1059.003","T1083","T1106","T1112","T1120","T1135","T1140","T1222.001","T1486","T1490","T1497.001","T1543.003","T1548.002","T1564.001","T1564.004","T1569.002","T1574.001"]},{"id":"S0613","name":"PS1","type":"software","techniques":["T1027.013","T1055.001","T1059.001","T1105","T1140"]},{"id":"S0614","name":"CostaBricks","type":"software","techniques":["T1027.001","T1027.002","T1055","T1105","T1106","T1140"]},{"id":"S0615","name":"SombRAT","type":"software","techniques":["T1005","T1007","T1027","T1033","T1036","T1041","T1055.001","T1057","T1070.004","T1071.004","T1074.001","T1082","T1083","T1090","T1095","T1105","T1106","T1124","T1140","T1560.003","T1564.010","T1568.002","T1573.001","T1573.002"]},{"id":"S0616","name":"DEATHRANSOM","type":"software","techniques":["T1047","T1071.001","T1083","T1105","T1135","T1486","T1490","T1614.001","T1680"]},{"id":"S0617","name":"HELLOKITTY","type":"software","techniques":["T1047","T1057","T1135","T1486","T1490","T1680"]},{"id":"S0618","name":"FIVEHANDS","type":"software","techniques":["T1027.013","T1047","T1059","T1083","T1135","T1140","T1486","T1490"]},{"id":"S0622","name":"AppleSeed","type":"software","techniques":["T1005","T1008","T1016","T1025","T1027","T1027.002","T1030","T1036","T1036.005","T1041","T1056.001","T1057","T1059.001","T1059.007","T1070.004","T1071.001","T1074.001","T1082","T1083","T1106","T1113","T1119","T1124","T1134","T1140","T1204.002","T1218.010","T1547.001","T1560","T1560.001","T1566.001","T1567"]},{"id":"S0623","name":"Siloscape","type":"software","techniques":["T1027","T1059.003","T1068","T1069","T1071","T1083","T1090.003","T1106","T1134.001","T1140","T1190","T1518","T1609","T1611"]},{"id":"S0624","name":"Ecipekac","type":"software","techniques":["T1027","T1105","T1140","T1553.002","T1574.001"]},{"id":"S0625","name":"Cuba","type":"software","techniques":["T1007","T1016","T1027","T1027.002","T1036.005","T1049","T1056.001","T1057","T1059.001","T1059.003","T1070.004","T1083","T1105","T1106","T1134","T1135","T1486","T1489","T1543.003","T1564.003","T1614.001","T1620","T1680"]},{"id":"S0626","name":"P8RAT","type":"software","techniques":["T1001.001","T1057","T1105","T1497.001","T1497.003"]},{"id":"S0627","name":"SodaMaster","type":"software","techniques":["T1012","T1027","T1033","T1057","T1082","T1105","T1106","T1497.001","T1497.003","T1573.001","T1573.002"]},{"id":"S0628","name":"FYAnti","type":"software","techniques":["T1027.002","T1083","T1105","T1140"]},{"id":"S0629","name":"RainyDay","type":"software","techniques":["T1005","T1007","T1008","T1027.013","T1036.004","T1036.005","T1053.005","T1057","T1059.003","T1070.004","T1071.001","T1074.001","T1083","T1090","T1095","T1105","T1106","T1113","T1140","T1543.003","T1555.003","T1555.004","T1567.002","T1573.001","T1574.001"]},{"id":"S0630","name":"Nebulae","type":"software","techniques":["T1005","T1036.004","T1036.005","T1057","T1059.003","T1070.004","T1083","T1095","T1105","T1106","T1543.003","T1547.001","T1573.001","T1574.001","T1680"]},{"id":"S0631","name":"Chaes","type":"software","techniques":["T1027.011","T1033","T1036.005","T1048","T1056","T1059.003","T1059.005","T1059.006","T1059.007","T1071.001","T1082","T1105","T1106","T1112","T1113","T1132.001","T1140","T1185","T1204.002","T1218.004","T1218.007","T1221","T1539","T1547.001","T1555.003","T1566.001","T1573","T1574.001"]},{"id":"S0632","name":"GrimAgent","type":"software","techniques":["T1001.001","T1005","T1016","T1027","T1027.001","T1033","T1041","T1053.005","T1059.003","T1070.004","T1070.009","T1071.001","T1082","T1083","T1105","T1106","T1132.001","T1140","T1480.002","T1497.003","T1547.001","T1573.001","T1573.002","T1614","T1614.001"]},{"id":"S0633","name":"Sliver","type":"software","techniques":["T1001.002","T1003.001","T1016","T1027","T1027.004","T1027.013","T1041","T1049","T1055","T1059.001","T1071","T1071.001","T1071.004","T1083","T1090.001","T1105","T1113","T1132.001","T1134","T1548.002","T1558.001","T1573.001","T1573.002"]},{"id":"S0634","name":"EnvyScout","type":"software","techniques":["T1005","T1027.006","T1027.013","T1036","T1059.003","T1059.007","T1082","T1140","T1187","T1204.002","T1218.011","T1480","T1564.001","T1566.001"]},{"id":"S0635","name":"BoomBox","type":"software","techniques":["T1027","T1033","T1036","T1071.001","T1082","T1083","T1087.002","T1087.003","T1102","T1105","T1140","T1204.002","T1218.011","T1480","T1547.001","T1567.002"]},{"id":"S0636","name":"VaporRage","type":"software","techniques":["T1071.001","T1105","T1140","T1480"]},{"id":"S0637","name":"NativeZone","type":"software","techniques":["T1036","T1140","T1204.002","T1218.011","T1480","T1497.001"]},{"id":"S0638","name":"Babuk","type":"software","techniques":["T1007","T1027.002","T1049","T1057","T1059.003","T1083","T1106","T1135","T1140","T1486","T1489","T1490","T1680","T1685"]},{"id":"S0639","name":"Seth-Locker","type":"software","techniques":["T1059.003","T1105","T1486"]},{"id":"S0640","name":"Avaddon","type":"software","techniques":["T1016","T1027","T1047","T1057","T1059.007","T1083","T1106","T1112","T1135","T1140","T1486","T1489","T1490","T1547.001","T1548.002","T1614.001","T1685"]},{"id":"S0641","name":"Kobalos","type":"software","techniques":["T1016","T1027","T1048","T1056","T1059.004","T1070.003","T1070.006","T1074","T1082","T1090.003","T1140","T1205","T1554","T1573.001","T1573.002"]},{"id":"S0642","name":"BADFLICK","type":"software","techniques":["T1005","T1016","T1082","T1083","T1105","T1140","T1204.002","T1497.003","T1560.002","T1566.001"]},{"id":"S0643","name":"Peppy","type":"software","techniques":["T1020","T1056.001","T1059.003","T1071.001","T1083","T1105","T1113"]},{"id":"S0644","name":"ObliqueRAT","type":"software","techniques":["T1025","T1027.003","T1030","T1033","T1057","T1074.001","T1082","T1083","T1113","T1120","T1125","T1204.001","T1497.001","T1547.001"]},{"id":"S0645","name":"Wevtutil","type":"software","techniques":["T1005","T1685.001","T1685.005"]},{"id":"S0646","name":"SpicyOmelette","type":"software","techniques":["T1005","T1016","T1018","T1059.007","T1082","T1105","T1204.001","T1518","T1518.001","T1553.002","T1566.002"]},{"id":"S0647","name":"Turian","type":"software","techniques":["T1001.001","T1016","T1027","T1033","T1036.004","T1059.003","T1059.004","T1059.006","T1071.001","T1074.001","T1082","T1083","T1105","T1113","T1120","T1140","T1547.001","T1560.001"]},{"id":"S0648","name":"JSS Loader","type":"software","techniques":["T1053.005","T1059.001","T1059.005","T1059.007","T1105","T1204.002","T1566.001"]},{"id":"S0649","name":"SMOKEDHAM","type":"software","techniques":["T1027.009","T1033","T1041","T1056.001","T1059.001","T1071.001","T1082","T1087.001","T1090.004","T1098.007","T1102","T1105","T1112","T1113","T1132.001","T1136.001","T1204.001","T1547.001","T1564.002","T1573.001","T1598.003"]},{"id":"S0650","name":"QakBot","type":"software","techniques":["T1005","T1010","T1016","T1016.001","T1018","T1027","T1027.001","T1027.002","T1027.005","T1027.006","T1027.010","T1027.011","T1033","T1036.008","T1041","T1047","T1049","T1053.005","T1055","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1059.007","T1069.001","T1070.004","T1071.001","T1074.001","T1082","T1083","T1090.002","T1091","T1095","T1105","T1106","T1110","T1112","T1114.001","T1120","T1124","T1132.001","T1135","T1140","T1185","T1204.001","T1204.002","T1210","T1218.007","T1218.010","T1218.011","T1482","T1497.001","T1497.003","T1518","T1518.001","T1539","T1543.003","T1547.001","T1553.002","T1553.005","T1555.003","T1564.001","T1566.001","T1566.002","T1568.002","T1572","T1573.001","T1574.001","T1685"]},{"id":"S0651","name":"BoxCaon","type":"software","techniques":["T1005","T1016","T1027","T1041","T1059.003","T1074.001","T1083","T1102.002","T1105","T1106","T1547","T1567.002"]},{"id":"S0652","name":"MarkiRAT","type":"software","techniques":["T1005","T1033","T1036.005","T1041","T1056.001","T1057","T1059.003","T1071.001","T1074.001","T1082","T1083","T1105","T1106","T1113","T1115","T1197","T1518","T1518.001","T1547.001","T1547.009","T1555.005","T1614.001"]},{"id":"S0653","name":"xCaon","type":"software","techniques":["T1005","T1016","T1059.003","T1071.001","T1105","T1106","T1132.001","T1140","T1518.001","T1547","T1573.001"]},{"id":"S0654","name":"ProLock","type":"software","techniques":["T1027.003","T1047","T1068","T1070.004","T1197","T1486","T1490"]},{"id":"S0657","name":"BLUELIGHT","type":"software","techniques":["T1016","T1027.013","T1033","T1041","T1057","T1070.004","T1071.001","T1082","T1083","T1102.002","T1105","T1113","T1124","T1497.001","T1518.001","T1539","T1555.003","T1560","T1560.003"]},{"id":"S0658","name":"XCSSET","type":"software","techniques":["T1005","T1027.013","T1036","T1041","T1056.002","T1059.004","T1068","T1082","T1083","T1087","T1098.004","T1105","T1113","T1195.001","T1222.002","T1486","T1497.003","T1518","T1518.001","T1539","T1543.004","T1546","T1546.004","T1548.006","T1553.001","T1554","T1560","T1564.001","T1569.001","T1573.001","T1574.006","T1614.001","T1647"]},{"id":"S0659","name":"Diavol","type":"software","techniques":["T1016","T1018","T1021.002","T1027","T1027.003","T1033","T1057","T1071.001","T1082","T1083","T1105","T1106","T1135","T1485","T1486","T1489","T1490","T1491.001","T1685"]},{"id":"S0660","name":"Clambling","type":"software","techniques":["T1005","T1012","T1016","T1027","T1033","T1055","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1071","T1071.001","T1082","T1083","T1095","T1102.002","T1112","T1113","T1115","T1124","T1125","T1135","T1140","T1204.002","T1497.003","T1543.003","T1547.001","T1548.002","T1564.001","T1566.001","T1567.002","T1569.002","T1574.001"]},{"id":"S0661","name":"FoggyWeb","type":"software","techniques":["T1005","T1027.004","T1027.013","T1036","T1036.005","T1040","T1041","T1057","T1071.001","T1083","T1105","T1106","T1129","T1140","T1550","T1552.004","T1560.002","T1560.003","T1573.001","T1574.001","T1620"]},{"id":"S0662","name":"RCSession","type":"software","techniques":["T1005","T1027.011","T1027.015","T1033","T1036","T1055.012","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1095","T1105","T1106","T1112","T1113","T1218.007","T1547.001","T1548.002","T1573","T1574.001"]},{"id":"S0663","name":"SysUpdate","type":"software","techniques":["T1005","T1007","T1016","T1016.001","T1027.002","T1027.011","T1027.013","T1033","T1036.004","T1041","T1047","T1057","T1070.004","T1071.004","T1082","T1083","T1105","T1106","T1112","T1113","T1132.001","T1140","T1543.002","T1543.003","T1547.001","T1553.002","T1564.001","T1569.002","T1573.001","T1574.001","T1680"]},{"id":"S0664","name":"Pandora","type":"software","techniques":["T1027.015","T1055","T1057","T1068","T1071.001","T1105","T1112","T1205","T1543.003","T1553.006","T1569.002","T1573.001","T1574.001"]},{"id":"S0665","name":"ThreatNeedle","type":"software","techniques":["T1005","T1027.011","T1027.013","T1027.015","T1036.005","T1082","T1083","T1105","T1112","T1140","T1204.002","T1543.003","T1547.001","T1566.001"]},{"id":"S0666","name":"Gelsemium","type":"software","techniques":["T1005","T1008","T1012","T1027.011","T1027.015","T1027.016","T1033","T1036.001","T1036.005","T1055.001","T1057","T1059.003","T1070.004","T1070.006","T1071.001","T1071.004","T1082","T1083","T1095","T1105","T1106","T1112","T1134","T1140","T1497","T1518.001","T1543.003","T1547.001","T1547.012","T1548.002","T1559.001","T1568","T1620"]},{"id":"S0667","name":"Chrommme","type":"software","techniques":["T1005","T1016","T1027.013","T1029","T1033","T1041","T1074.001","T1082","T1105","T1106","T1113","T1140","T1560","T1680"]},{"id":"S0668","name":"TinyTurla","type":"software","techniques":["T1005","T1008","T1012","T1027.011","T1029","T1036.004","T1036.005","T1059.003","T1071.001","T1105","T1106","T1112","T1569.002","T1573.002"]},{"id":"S0669","name":"KOCTOPUS","type":"software","techniques":["T1027.010","T1036.005","T1059.001","T1059.003","T1059.005","T1070.009","T1082","T1090","T1105","T1106","T1112","T1140","T1204.001","T1204.002","T1547.001","T1548.002","T1564.003","T1566.001","T1566.002","T1685"]},{"id":"S0670","name":"WarzoneRAT","type":"software","techniques":["T1005","T1014","T1021.001","T1021.005","T1041","T1055","T1056.001","T1057","T1059.001","T1059.003","T1082","T1083","T1090","T1095","T1105","T1106","T1112","T1125","T1140","T1204.002","T1221","T1546.015","T1547.001","T1548.002","T1555.003","T1564","T1564.003","T1566.001","T1573.001","T1685"]},{"id":"S0671","name":"Tomiris","type":"software","techniques":["T1005","T1027.002","T1041","T1053.005","T1071.001","T1105","T1497.003","T1568"]},{"id":"S0672","name":"Zox","type":"software","techniques":["T1001.002","T1005","T1021.002","T1027.013","T1057","T1068","T1083","T1105","T1680"]},{"id":"S0673","name":"DarkWatchman","type":"software","techniques":["T1005","T1010","T1012","T1027.004","T1027.010","T1027.011","T1027.015","T1033","T1036","T1047","T1053.005","T1056.001","T1059.001","T1059.003","T1059.007","T1070","T1070.004","T1071.001","T1074.001","T1082","T1083","T1112","T1120","T1124","T1129","T1132.001","T1140","T1217","T1490","T1518.001","T1566.001","T1568.002","T1573.002","T1614"]},{"id":"S0674","name":"CharmPower","type":"software","techniques":["T1005","T1008","T1012","T1016","T1016.002","T1041","T1047","T1048.003","T1057","T1059.001","T1059.003","T1070.004","T1071.001","T1082","T1083","T1102","T1102.001","T1105","T1112","T1113","T1132.001","T1140","T1518","T1573.001"]},{"id":"S0677","name":"AADInternals","type":"software","techniques":["T1003.004","T1048","T1059.001","T1069.003","T1087.004","T1098.005","T1112","T1136.003","T1484.002","T1526","T1528","T1530","T1552.001","T1552.004","T1556.006","T1556.007","T1558.002","T1566.002","T1589.002","T1590.001","T1598.003","T1606.002","T1649","T1651"]},{"id":"S0678","name":"Torisma","type":"software","techniques":["T1016","T1027.002","T1027.013","T1041","T1049","T1071.001","T1106","T1124","T1132.001","T1140","T1480","T1573.001","T1680"]},{"id":"S0679","name":"Ferocious","type":"software","techniques":["T1059.001","T1059.005","T1070.004","T1082","T1112","T1120","T1497.001","T1518.001","T1546.015"]},{"id":"S0680","name":"LitePower","type":"software","techniques":["T1012","T1033","T1041","T1053.005","T1059.001","T1071.001","T1082","T1105","T1106","T1113","T1518.001","T1680"]},{"id":"S0681","name":"Lizar","type":"software","techniques":["T1003.001","T1016","T1027","T1033","T1049","T1055","T1055.001","T1055.002","T1057","T1059.001","T1059.003","T1059.006","T1082","T1087.003","T1095","T1105","T1106","T1113","T1132.002","T1140","T1217","T1518.001","T1555.003","T1555.004","T1560","T1573","T1588.002","T1620"]},{"id":"S0682","name":"TrailBlazer","type":"software","techniques":["T1001","T1001.001","T1036","T1071.001","T1546.003"]},{"id":"S0683","name":"Peirates","type":"software","techniques":["T1046","T1078.004","T1528","T1530","T1550.001","T1552.005","T1552.007","T1609","T1610","T1611","T1613","T1619"]},{"id":"S0684","name":"ROADTools","type":"software","techniques":["T1018","T1069.003","T1078.004","T1087.004","T1119","T1526"]},{"id":"S0685","name":"PowerPunch","type":"software","techniques":["T1027.010","T1059.001","T1105","T1480.001"]},{"id":"S0686","name":"QuietSieve","type":"software","techniques":["T1005","T1016.001","T1071.001","T1083","T1105","T1113","T1120","T1135","T1564.003"]},{"id":"S0687","name":"Cyclops Blink","type":"software","techniques":["T1005","T1016","T1036.005","T1037.004","T1041","T1057","T1070.006","T1071.001","T1082","T1083","T1090.003","T1105","T1106","T1132.002","T1140","T1542.002","T1559","T1571","T1572","T1573.002","T1686.002"]},{"id":"S0688","name":"Meteor","type":"software","techniques":["T1036.004","T1047","T1053.005","T1057","T1059.001","T1059.003","T1070.004","T1082","T1105","T1106","T1484.001","T1485","T1489","T1490","T1491.001","T1518.001","T1531","T1564.003","T1685","T1685.005"]},{"id":"S0689","name":"WhisperGate","type":"software","techniques":["T1027.013","T1036","T1055.012","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1083","T1102","T1105","T1106","T1134.002","T1135","T1140","T1218.004","T1485","T1497.001","T1497.003","T1518.001","T1529","T1542.003","T1561.001","T1561.002","T1569.002","T1620","T1680","T1685"]},{"id":"S0690","name":"Green Lambert","type":"software","techniques":["T1005","T1016","T1027","T1036.004","T1036.005","T1037.004","T1059.004","T1070.004","T1071.004","T1082","T1090","T1124","T1140","T1543.001","T1543.004","T1546.004","T1547.015","T1555.001"]},{"id":"S0691","name":"Neoichor","type":"software","techniques":["T1005","T1016","T1016.001","T1033","T1070","T1071.001","T1082","T1105","T1112","T1559.001","T1614.001"]},{"id":"S0692","name":"SILENTTRINITY","type":"software","techniques":["T1003.001","T1007","T1010","T1012","T1018","T1021.003","T1021.006","T1033","T1041","T1046","T1047","T1055","T1056.001","T1056.002","T1057","T1059.001","T1059.003","T1059.006","T1069.001","T1069.002","T1070","T1070.004","T1082","T1083","T1087.002","T1105","T1106","T1112","T1113","T1115","T1124","T1134.001","T1134.003","T1135","T1518.001","T1543.003","T1546.001","T1546.003","T1546.015","T1547.001","T1548.002","T1552.006","T1555.003","T1555.004","T1556","T1558.003","T1559.001","T1564.003","T1620","T1680","T1685","T1689","T1690"]},{"id":"S0693","name":"CaddyWiper","type":"software","techniques":["T1057","T1082","T1083","T1106","T1222.001","T1485","T1561.002"]},{"id":"S0694","name":"DRATzarus","type":"software","techniques":["T1005","T1018","T1027","T1027.002","T1033","T1036.005","T1057","T1071.001","T1105","T1106","T1124","T1497.003","T1622"]},{"id":"S0695","name":"Donut","type":"software","techniques":["T1027.002","T1027.013","T1027.015","T1055","T1057","T1059","T1059.001","T1059.005","T1059.006","T1059.007","T1070","T1071.001","T1105","T1106","T1620","T1685"]},{"id":"S0696","name":"Flagpro","type":"software","techniques":["T1005","T1010","T1016","T1018","T1027","T1029","T1033","T1036","T1041","T1049","T1057","T1059.003","T1059.005","T1069.001","T1070","T1071.001","T1105","T1106","T1132.001","T1135","T1204.002","T1547.001","T1566.001","T1614.001"]},{"id":"S0697","name":"HermeticWiper","type":"software","techniques":["T1027.015","T1036.005","T1053.005","T1059.003","T1070","T1070.004","T1082","T1083","T1106","T1112","T1134","T1140","T1484.001","T1485","T1489","T1490","T1497.003","T1529","T1543.003","T1553.002","T1561.001","T1561.002","T1569.002","T1680","T1685","T1685.005"]},{"id":"S0698","name":"HermeticWizard","type":"software","techniques":["T1018","T1021.002","T1027.013","T1036.005","T1046","T1047","T1059.003","T1106","T1110.001","T1218.010","T1218.011","T1553.002","T1559.001","T1569.002","T1570","T1685.005"]},{"id":"S0699","name":"Mythic","type":"software","techniques":["T1008","T1030","T1071.001","T1071.002","T1071.004","T1090.001","T1090.002","T1090.004","T1095","T1119","T1132","T1572","T1573.002"]},{"id":"S1010","name":"VPNFilter","type":"software","techniques":["T1561.001"]},{"id":"S1011","name":"Tarrask","type":"software","techniques":["T1036.004","T1036.005","T1053.005","T1059.003","T1112","T1134.001","T1564"]},{"id":"S1012","name":"PowerLess","type":"software","techniques":["T1005","T1056.001","T1059.001","T1074.001","T1105","T1140","T1217","T1560","T1573"]},{"id":"S1013","name":"ZxxZ","type":"software","techniques":["T1005","T1012","T1027.013","T1033","T1036.004","T1053.005","T1057","T1082","T1105","T1106","T1140","T1204.002","T1518.001","T1566.001"]},{"id":"S1014","name":"DanBot","type":"software","techniques":["T1005","T1021.005","T1027.013","T1036.005","T1053.005","T1059.003","T1059.005","T1070.004","T1071.001","T1071.004","T1105","T1140","T1204.002","T1566.001"]},{"id":"S1015","name":"Milan","type":"software","techniques":["T1005","T1012","T1016","T1027.013","T1033","T1036","T1036.007","T1053.005","T1059.003","T1070.004","T1071.001","T1071.004","T1074.001","T1082","T1087.001","T1105","T1106","T1559.001","T1568.002","T1572"]},{"id":"S1016","name":"MacMa","type":"software","techniques":["T1005","T1016","T1021","T1033","T1041","T1056.001","T1057","T1059.004","T1070.004","T1070.006","T1074.001","T1082","T1083","T1095","T1105","T1106","T1113","T1123","T1140","T1543.001","T1553.001","T1553.002","T1555.001","T1571","T1573","T1680","T1685.006"]},{"id":"S1017","name":"OutSteel","type":"software","techniques":["T1005","T1020","T1036.005","T1041","T1057","T1059.003","T1059.010","T1070.004","T1071.001","T1083","T1105","T1119","T1204.001","T1204.002","T1566.001","T1566.002","T1570"]},{"id":"S1018","name":"Saint Bot","type":"software","techniques":["T1005","T1012","T1016","T1027","T1027.002","T1033","T1036","T1036.005","T1053.005","T1055.001","T1055.004","T1055.012","T1057","T1059.001","T1059.003","T1059.005","T1070.004","T1071.001","T1082","T1083","T1105","T1106","T1132.001","T1140","T1204.001","T1204.002","T1218.004","T1218.010","T1497.001","T1497.003","T1547.001","T1548.002","T1566.001","T1566.002","T1574","T1614","T1622"]},{"id":"S1019","name":"Shark","type":"software","techniques":["T1005","T1008","T1012","T1027.013","T1029","T1036.005","T1041","T1059.003","T1070.004","T1071.001","T1071.004","T1074","T1082","T1105","T1140","T1497.001","T1568.002"]},{"id":"S1020","name":"Kevin","type":"software","techniques":["T1001.001","T1005","T1008","T1016","T1027.013","T1030","T1036.003","T1041","T1059.003","T1070.004","T1071.001","T1071.004","T1074","T1082","T1105","T1106","T1132.001","T1497","T1546.003","T1564.003","T1572"]},{"id":"S1021","name":"DnsSystem","type":"software","techniques":["T1005","T1033","T1041","T1059.003","T1071.004","T1105","T1132.001","T1204.002","T1547.001"]},{"id":"S1022","name":"IceApple","type":"software","techniques":["T1003.002","T1003.004","T1005","T1016","T1027.010","T1036.005","T1041","T1056.003","T1070.004","T1071.001","T1082","T1083","T1087.002","T1140","T1505.004","T1552.002","T1560.001","T1573.001","T1620"]},{"id":"S1023","name":"CreepyDrive","type":"software","techniques":["T1005","T1059.001","T1071.001","T1083","T1102.002","T1105","T1550.001","T1567.002"]},{"id":"S1024","name":"CreepySnail","type":"software","techniques":["T1016","T1033","T1041","T1059.001","T1071.001","T1078.002","T1132.001"]},{"id":"S1025","name":"Amadey","type":"software","techniques":["T1005","T1016","T1027","T1033","T1041","T1071.001","T1082","T1083","T1105","T1106","T1112","T1140","T1518.001","T1547.001","T1553.005","T1568.001","T1614"]},{"id":"S1026","name":"Mongall","type":"software","techniques":["T1005","T1027.002","T1041","T1055.001","T1071.001","T1082","T1105","T1120","T1132.001","T1140","T1204.002","T1218.011","T1547.001","T1573.001","T1680"]},{"id":"S1027","name":"Heyoka Backdoor","type":"software","techniques":["T1007","T1027.013","T1036.004","T1055.001","T1057","T1070.004","T1071.004","T1083","T1120","T1140","T1204.002","T1218.011","T1547.001","T1572","T1680"]},{"id":"S1028","name":"Action RAT","type":"software","techniques":["T1005","T1016","T1027","T1033","T1047","T1059.003","T1071.001","T1082","T1083","T1105","T1140","T1518.001"]},{"id":"S1029","name":"AuTo Stealer","type":"software","techniques":["T1005","T1033","T1041","T1059.003","T1071.001","T1074.001","T1082","T1095","T1518.001","T1547.001"]},{"id":"S1030","name":"Squirrelwaffle","type":"software","techniques":["T1016","T1027.002","T1027.013","T1033","T1041","T1059.001","T1059.003","T1059.005","T1071.001","T1082","T1105","T1132.001","T1140","T1204.001","T1204.002","T1218.010","T1218.011","T1497","T1560.003","T1566.001","T1566.002"]},{"id":"S1031","name":"PingPull","type":"software","techniques":["T1005","T1016","T1036.004","T1041","T1059.003","T1070.006","T1071.001","T1082","T1083","T1095","T1132.001","T1140","T1543.003","T1571","T1573.001"]},{"id":"S1032","name":"PyDCrypt","type":"software","techniques":["T1027.013","T1033","T1036.005","T1047","T1049","T1059.001","T1059.003","T1059.006","T1070.004","T1140","T1686"]},{"id":"S1033","name":"DCSrv","type":"software","techniques":["T1027.013","T1036.004","T1106","T1112","T1124","T1486","T1529","T1543.003"]},{"id":"S1034","name":"StrifeWater","type":"software","techniques":["T1005","T1033","T1036.005","T1041","T1053.005","T1059.003","T1070.004","T1082","T1083","T1105","T1106","T1113","T1124","T1497.003","T1573.001"]},{"id":"S1035","name":"Small Sieve","type":"software","techniques":["T1016","T1027","T1033","T1036.005","T1059.003","T1059.006","T1071.001","T1102.002","T1105","T1132.002","T1480","T1547.001","T1573.002"]},{"id":"S1037","name":"STARWHALE","type":"software","techniques":["T1005","T1016","T1027.013","T1033","T1041","T1059.003","T1059.005","T1071.001","T1074.001","T1082","T1132.001","T1204.002","T1543.003","T1547.001"]},{"id":"S1039","name":"Bumblebee","type":"software","techniques":["T1005","T1008","T1012","T1027","T1033","T1036.005","T1041","T1047","T1053.005","T1055","T1055.001","T1055.004","T1057","T1059.001","T1059.003","T1059.005","T1070.004","T1082","T1102","T1105","T1106","T1129","T1132.001","T1140","T1204.001","T1204.002","T1218.008","T1218.011","T1497","T1497.001","T1497.003","T1518.001","T1548.002","T1559.001","T1560","T1566.001","T1566.002","T1573.001","T1622"]},{"id":"S1040","name":"Rclone","type":"software","techniques":["T1030","T1048.002","T1048.003","T1083","T1560.001","T1567.002"]},{"id":"S1041","name":"Chinoxy","type":"software","techniques":["T1027.013","T1036.005","T1140","T1547.001","T1574.001"]},{"id":"S1042","name":"SUGARDUMP","type":"software","techniques":["T1036.004","T1036.005","T1041","T1053.005","T1071.001","T1071.003","T1074.001","T1083","T1204.002","T1217","T1518","T1555.003","T1560.003"]},{"id":"S1043","name":"ccf32","type":"software","techniques":["T1005","T1048.003","T1053.005","T1059.003","T1070.004","T1074.001","T1074.002","T1083","T1119","T1124","T1560.001","T1564.001"]},{"id":"S1044","name":"FunnyDream","type":"software","techniques":["T1001","T1005","T1010","T1012","T1016","T1018","T1025","T1027.013","T1033","T1036.004","T1041","T1047","T1055.001","T1056.001","T1057","T1059.003","T1070","T1070.004","T1074.001","T1083","T1090","T1095","T1105","T1106","T1113","T1119","T1120","T1124","T1218.011","T1518.001","T1543.003","T1547.001","T1559.001","T1560.002","T1560.003","T1572","T1680"]},{"id":"S1046","name":"PowGoop","type":"software","techniques":["T1036","T1036.005","T1059.001","T1071.001","T1132.002","T1140","T1573","T1574.001"]},{"id":"S1047","name":"Mori","type":"software","techniques":["T1001.001","T1012","T1070.004","T1071.001","T1071.004","T1112","T1132.001","T1140","T1218.010"]},{"id":"S1048","name":"macOS.OSAMiner","type":"software","techniques":["T1027.008","T1027.009","T1057","T1059.002","T1082","T1105","T1497.001","T1543.001","T1569.001","T1680","T1685"]},{"id":"S1049","name":"SUGARUSH","type":"software","techniques":["T1016.001","T1059.003","T1095","T1543.003","T1571","T1680"]},{"id":"S1050","name":"PcShare","type":"software","techniques":["T1005","T1012","T1016","T1027.013","T1027.015","T1036.001","T1036.005","T1041","T1055","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1106","T1112","T1113","T1125","T1140","T1218.011","T1546.015"]},{"id":"S1051","name":"KEYPLUG","type":"software","techniques":["T1027.013","T1071.001","T1090","T1095","T1102.001","T1124","T1140","T1573.002"]},{"id":"S1052","name":"DEADEYE","type":"software","techniques":["T1016","T1027.009","T1027.013","T1036.004","T1059.003","T1082","T1106","T1140","T1218.007","T1218.011","T1480","T1564.004"]},{"id":"S1053","name":"AvosLocker","type":"software","techniques":["T1027","T1027.007","T1036.008","T1057","T1083","T1106","T1124","T1135","T1140","T1486","T1489","T1529","T1547.001","T1564.003","T1688"]},{"id":"S1058","name":"Prestige","type":"software","techniques":["T1053.005","T1059.001","T1083","T1106","T1112","T1484.001","T1486","T1489","T1490"]},{"id":"S1059","name":"metaMain","type":"software","techniques":["T1005","T1027.013","T1033","T1041","T1055","T1056","T1056.001","T1057","T1070.004","T1070.006","T1071.001","T1074.001","T1082","T1083","T1090.001","T1095","T1105","T1106","T1112","T1113","T1140","T1205.001","T1497.003","T1546.003","T1560.003","T1573.001","T1574.001","T1620"]},{"id":"S1060","name":"Mafalda","type":"software","techniques":["T1003.001","T1005","T1012","T1016","T1027.013","T1033","T1041","T1049","T1056","T1057","T1059.001","T1059.003","T1071.001","T1074.001","T1082","T1083","T1090.001","T1095","T1105","T1106","T1112","T1113","T1132.001","T1133","T1134","T1134.003","T1140","T1205.001","T1217","T1518.001","T1552.004","T1569.002","T1573.001","T1622","T1680","T1685.005"]},{"id":"S1063","name":"Brute Ratel C4","type":"software","techniques":["T1005","T1021","T1021.002","T1021.006","T1027","T1027.007","T1036.005","T1036.008","T1046","T1047","T1055.002","T1057","T1059.003","T1069.002","T1071.001","T1071.004","T1087.002","T1095","T1102","T1105","T1106","T1113","T1140","T1204.002","T1482","T1497.003","T1518.001","T1558.003","T1569.002","T1572","T1574.001","T1620","T1685"]},{"id":"S1064","name":"SVCReady","type":"software","techniques":["T1005","T1012","T1027","T1033","T1036.004","T1041","T1047","T1053.005","T1057","T1059.005","T1071.001","T1082","T1105","T1106","T1113","T1120","T1124","T1204.002","T1218.011","T1497.001","T1497.003","T1518","T1546.015","T1566.001"]},{"id":"S1065","name":"Woody RAT","type":"software","techniques":["T1005","T1012","T1016","T1016.001","T1027.013","T1033","T1041","T1055","T1055.012","T1057","T1059.001","T1059.003","T1070.004","T1071.001","T1082","T1083","T1087","T1105","T1106","T1113","T1140","T1203","T1204.002","T1518","T1518.001","T1566.001","T1573.001","T1573.002","T1680","T1685"]},{"id":"S1066","name":"DarkTortilla","type":"software","techniques":["T1007","T1016.001","T1027","T1036","T1047","T1055.001","T1056.001","T1057","T1059.003","T1071.001","T1082","T1102","T1105","T1106","T1112","T1115","T1140","T1204.002","T1497.001","T1497.003","T1518.001","T1547.001","T1547.004","T1559.001","T1564","T1566.001","T1574.012","T1622"]},{"id":"S1068","name":"BlackCat","type":"software","techniques":["T1018","T1033","T1047","T1059.003","T1069.002","T1082","T1083","T1087.002","T1112","T1134","T1135","T1222.001","T1486","T1489","T1490","T1491.001","T1548.002","T1561.001","T1570","T1680","T1685.005"]},{"id":"S1070","name":"Black Basta","type":"software","techniques":["T1007","T1018","T1027.001","T1036.004","T1036.005","T1047","T1059.001","T1059.003","T1082","T1083","T1106","T1112","T1204.002","T1222.002","T1480.002","T1486","T1490","T1491.001","T1497","T1497.001","T1529","T1543.003","T1553.002","T1622","T1680","T1688"]},{"id":"S1071","name":"Rubeus","type":"software","techniques":["T1482","T1558.001","T1558.002","T1558.003","T1558.004"]},{"id":"S1072","name":"Industroyer2","type":"software","techniques":["T1057"]},{"id":"S1073","name":"Royal","type":"software","techniques":["T1016","T1021.002","T1046","T1057","T1059.012","T1082","T1083","T1095","T1106","T1135","T1486","T1489","T1490","T1566","T1680"]},{"id":"S1074","name":"ANDROMEDA","type":"software","techniques":["T1036.005","T1036.008","T1055","T1071.001","T1091","T1105","T1547.001"]},{"id":"S1075","name":"KOPILUWAK","type":"software","techniques":["T1005","T1016","T1033","T1041","T1049","T1057","T1059.007","T1071.001","T1074.001","T1135","T1204.002","T1566.001","T1680"]},{"id":"S1076","name":"QUIETCANARY","type":"software","techniques":["T1012","T1016","T1071.001","T1074","T1106","T1132.001","T1140","T1564.003","T1573.001"]},{"id":"S1078","name":"RotaJakiro","type":"software","techniques":["T1036.005","T1037","T1041","T1057","T1082","T1095","T1106","T1119","T1129","T1132.001","T1140","T1543.002","T1546.004","T1547.013","T1559","T1571","T1573.001"]},{"id":"S1081","name":"BADHATCH","type":"software","techniques":["T1018","T1027.009","T1027.010","T1027.015","T1033","T1041","T1046","T1047","T1049","T1053.005","T1055","T1055.001","T1055.004","T1057","T1059.001","T1059.003","T1069.002","T1070.004","T1071.001","T1071.002","T1082","T1090","T1102","T1105","T1106","T1113","T1124","T1134.001","T1135","T1482","T1546.003","T1548.002","T1550.002","T1573.002","T1620"]},{"id":"S1084","name":"QUIETEXIT","type":"software","techniques":["T1008","T1036.005","T1071","T1090.002","T1095"]},{"id":"S1085","name":"Sardonic","type":"software","techniques":["T1005","T1007","T1016","T1027","T1027.010","T1047","T1049","T1055.004","T1057","T1059.001","T1059.003","T1070","T1082","T1095","T1105","T1106","T1132.001","T1135","T1140","T1546.003","T1571","T1573.001","T1573.002","T1620","T1680"]},{"id":"S1086","name":"Snip3","type":"software","techniques":["T1027","T1027.001","T1047","T1055.012","T1059.001","T1059.005","T1082","T1102","T1104","T1105","T1140","T1189","T1204.001","T1204.002","T1497.001","T1497.003","T1547.001","T1564.003","T1566.001","T1566.002"]},{"id":"S1087","name":"AsyncRAT","type":"software","techniques":["T1016","T1033","T1053.005","T1056.001","T1057","T1059.003","T1090.003","T1105","T1106","T1113","T1124","T1125","T1204.002","T1497.001","T1564.003","T1566.001","T1568","T1568.002","T1622","T1680"]},{"id":"S1088","name":"Disco","type":"software","techniques":["T1053.005","T1071.002","T1105","T1204.002","T1659"]},{"id":"S1089","name":"SharpDisco","type":"software","techniques":["T1005","T1041","T1053.005","T1059.003","T1071.002","T1083","T1105","T1106","T1120","T1564.003","T1680"]},{"id":"S1090","name":"NightClub","type":"software","techniques":["T1005","T1010","T1027","T1036.004","T1036.005","T1041","T1056.001","T1057","T1070.006","T1071.003","T1071.004","T1074.001","T1083","T1105","T1106","T1112","T1113","T1120","T1123","T1132.002","T1543.003"]},{"id":"S1091","name":"Pacu","type":"software","techniques":["T1049","T1059.009","T1069.003","T1078.004","T1087.004","T1098.001","T1119","T1518.001","T1526","T1530","T1546","T1552","T1555.006","T1578.001","T1580","T1619","T1648","T1651","T1654","T1685.002","T1686.001"]},{"id":"S1096","name":"Cheerscrypt","type":"software","techniques":["T1059.012","T1083","T1486","T1489","T1673"]},{"id":"S1097","name":"HUI Loader","type":"software","techniques":["T1140","T1574.001","T1685"]},{"id":"S1099","name":"Samurai","type":"software","techniques":["T1005","T1012","T1027","T1027.004","T1027.007","T1027.015","T1036.005","T1059.003","T1071.001","T1083","T1090","T1095","T1105","T1106","T1112","T1132.001","T1518","T1543.003","T1573.001"]},{"id":"S1100","name":"Ninja","type":"software","techniques":["T1001","T1001.003","T1016","T1027.013","T1027.015","T1029","T1036.005","T1055","T1057","T1070.006","T1071.001","T1082","T1083","T1090.001","T1090.003","T1095","T1106","T1132.002","T1140","T1204.002","T1218.011","T1480.001","T1543.003","T1559","T1566.003","T1573.001","T1574.001","T1680"]},{"id":"S1101","name":"LoFiSe","type":"software","techniques":["T1005","T1074.001","T1083","T1119","T1560","T1574.001"]},{"id":"S1102","name":"Pcexter","type":"software","techniques":["T1005","T1083","T1567.002","T1574.001"]},{"id":"S1104","name":"SLOWPULSE","type":"software","techniques":["T1027","T1074.001","T1111","T1554","T1556.004","T1556.006"]},{"id":"S1105","name":"COATHANGER","type":"software","techniques":["T1014","T1027","T1027.002","T1055","T1057","T1059.004","T1070.004","T1071.001","T1083","T1095","T1140","T1190","T1222.002","T1543.004","T1564.001","T1573.002","T1574","T1574.006"]},{"id":"S1106","name":"NGLite","type":"software","techniques":["T1016","T1033","T1071.001","T1090.003","T1573.001"]},{"id":"S1107","name":"NKAbuse","type":"software","techniques":["T1016.001","T1053.003","T1057","T1059.004","T1082","T1090.003","T1113","T1498"]},{"id":"S1108","name":"PULSECHECK","type":"software","techniques":["T1059.004","T1071.001","T1132.001","T1505.003"]},{"id":"S1109","name":"PACEMAKER","type":"software","techniques":["T1003.007","T1055.008","T1059.004","T1074.001","T1083","T1119"]},{"id":"S1110","name":"SLIGHTPULSE","type":"software","techniques":["T1005","T1059","T1071.001","T1074.001","T1105","T1132.001","T1140","T1505.003","T1573.001"]},{"id":"S1111","name":"DarkGate","type":"software","techniques":["T1001","T1005","T1010","T1027","T1027.013","T1036","T1036.003","T1036.007","T1041","T1047","T1055.012","T1056.001","T1057","T1059.001","T1059.003","T1059.005","T1059.010","T1070.004","T1071.004","T1082","T1083","T1098.007","T1105","T1106","T1115","T1119","T1124","T1134.004","T1136.001","T1140","T1204.002","T1480","T1486","T1490","T1496.001","T1497.001","T1518.001","T1529","T1539","T1547.001","T1548.002","T1552","T1555","T1561.001","T1564.001","T1566.001","T1566.002","T1569.002","T1574","T1574.001","T1574.007","T1583.001","T1614","T1622","T1657","T1665","T1680","T1685"]},{"id":"S1112","name":"STEADYPULSE","type":"software","techniques":["T1071.001","T1105","T1132.001","T1140","T1505.003"]},{"id":"S1113","name":"RAPIDPULSE","type":"software","techniques":["T1005","T1027.013","T1140","T1505.003"]},{"id":"S1114","name":"ZIPLINE","type":"software","techniques":["T1057","T1059.004","T1083","T1090","T1095","T1105","T1205","T1573.001","T1685"]},{"id":"S1115","name":"WIREFIRE","type":"software","techniques":["T1071.001","T1105","T1132.001","T1140","T1505.003","T1554","T1573.001"]},{"id":"S1116","name":"WARPWIRE","type":"software","techniques":["T1048.003","T1056.003","T1059.007","T1132.001","T1554"]},{"id":"S1117","name":"GLASSTOKEN","type":"software","techniques":["T1059.001","T1132.001","T1140","T1505.003"]},{"id":"S1118","name":"BUSHWALK","type":"software","techniques":["T1027","T1105","T1140","T1205","T1505.003","T1554"]},{"id":"S1119","name":"LIGHTWIRE","type":"software","techniques":["T1071.001","T1140","T1505.003","T1554","T1573.001"]},{"id":"S1120","name":"FRAMESTING","type":"software","techniques":["T1001","T1001.003","T1059.006","T1071.001","T1140","T1505.003","T1554"]},{"id":"S1121","name":"LITTLELAMB.WOOLTEA","type":"software","techniques":["T1082","T1083","T1090","T1095","T1543","T1554","T1573.002"]},{"id":"S1122","name":"Mispadu","type":"software","techniques":["T1027.013","T1041","T1055","T1056.001","T1056.002","T1057","T1059.005","T1082","T1083","T1106","T1113","T1115","T1140","T1176.001","T1204.002","T1217","T1218.007","T1218.011","T1497.001","T1518.001","T1547.001","T1555","T1555.003","T1566.002","T1573.002","T1614.001"]},{"id":"S1123","name":"PITSTOP","type":"software","techniques":["T1059.004","T1140","T1205.002","T1559","T1573.002"]},{"id":"S1124","name":"SocGholish","type":"software","techniques":["T1016","T1027.013","T1027.015","T1033","T1036.005","T1047","T1048.003","T1057","T1059.007","T1074.001","T1082","T1102","T1105","T1189","T1204.001","T1482","T1518","T1566.002","T1614"]},{"id":"S1125","name":"AcidRain","type":"software","techniques":["T1083","T1485","T1529","T1561.001"]},{"id":"S1129","name":"Akira","type":"software","techniques":["T1047","T1057","T1059.001","T1059.003","T1082","T1083","T1106","T1135","T1486","T1490"]},{"id":"S1130","name":"Raspberry Robin","type":"software","techniques":["T1027","T1027.002","T1033","T1036.004","T1036.008","T1047","T1055.012","T1057","T1059","T1059.003","T1070.004","T1070.009","T1071","T1071.001","T1082","T1083","T1091","T1102","T1105","T1140","T1204","T1218.007","T1218.008","T1218.010","T1218.011","T1480","T1497","T1497.001","T1518.001","T1547.001","T1548","T1548.002","T1559","T1559.001","T1571","T1574","T1574.001","T1583.001","T1583.008","T1622","T1685"]},{"id":"S1131","name":"NPPSPY","type":"software","techniques":["T1005","T1056","T1112","T1119","T1552","T1557","T1684.001"]},{"id":"S1132","name":"IPsec Helper","type":"software","techniques":["T1005","T1027.013","T1041","T1057","T1059.001","T1059.003","T1059.005","T1070","T1070.004","T1070.009","T1071.001","T1112","T1497.003","T1569.002","T1570"]},{"id":"S1133","name":"Apostle","type":"software","techniques":["T1053.005","T1057","T1070.004","T1140","T1480","T1485","T1486","T1529","T1561.001","T1685.005"]},{"id":"S1134","name":"DEADWOOD","type":"software","techniques":["T1027.009","T1027.013","T1036.004","T1124","T1140","T1485","T1531","T1561.001","T1561.002","T1569.002"]},{"id":"S1135","name":"MultiLayer Wiper","type":"software","techniques":["T1027.009","T1053.005","T1059.003","T1070","T1070.004","T1070.006","T1083","T1485","T1490","T1529","T1561.002","T1565.001","T1685","T1685.005"]},{"id":"S1136","name":"BFG Agonizer","type":"software","techniques":["T1490","T1529","T1554","T1561.002"]},{"id":"S1137","name":"Moneybird","type":"software","techniques":["T1027.009","T1486"]},{"id":"S1138","name":"Gootloader","type":"software","techniques":["T1016","T1027","T1055.002","T1055.012","T1059.001","T1059.007","T1069.002","T1082","T1105","T1132.001","T1140","T1204.001","T1497.003","T1547.001","T1584.001","T1584.006","T1614","T1614.001"]},{"id":"S1139","name":"INC Ransomware","type":"software","techniques":["T1047","T1057","T1083","T1106","T1120","T1135","T1140","T1486","T1489","T1490","T1491.001","T1566","T1570","T1652","T1680"]},{"id":"S1140","name":"Spica","type":"software","techniques":["T1036.004","T1053.005","T1059.001","T1083","T1095","T1105","T1140","T1539","T1560"]},{"id":"S1141","name":"LunarWeb","type":"software","techniques":["T1001.002","T1016","T1027.013","T1030","T1033","T1047","T1049","T1057","T1059.001","T1059.003","T1069.001","T1070.004","T1071.001","T1082","T1083","T1090","T1104","T1132.001","T1135","T1140","T1497.003","T1518","T1518.001","T1559","T1560.001","T1560.002","T1572","T1573.001","T1573.002","T1615"]},{"id":"S1142","name":"LunarMail","type":"software","techniques":["T1001.002","T1027.013","T1041","T1059.005","T1070.004","T1070.008","T1071.003","T1074.001","T1082","T1083","T1095","T1113","T1114.001","T1137.006","T1140","T1204.002","T1543"]},{"id":"S1143","name":"LunarLoader","type":"software","techniques":["T1016","T1137.006","T1140","T1480","T1620"]},{"id":"S1144","name":"FRP","type":"software","techniques":["T1046","T1049","T1059.007","T1071.001","T1090","T1090.003","T1095","T1572","T1573.001","T1573.002"]},{"id":"S1145","name":"Pikabot","type":"software","techniques":["T1016","T1027.003","T1027.009","T1027.011","T1041","T1055.002","T1055.003","T1059.003","T1082","T1087.001","T1106","T1132.001","T1140","T1480.001","T1482","T1497.001","T1547.001","T1571","T1573.001","T1620","T1622"]},{"id":"S1146","name":"MgBot","type":"software","techniques":["T1003","T1005","T1018","T1025","T1033","T1046","T1056.001","T1057","T1087.001","T1087.002","T1115","T1123","T1213.006","T1482","T1539","T1555","T1555.003"]},{"id":"S1147","name":"Nightdoor","type":"software","techniques":["T1016","T1033","T1053.005","T1057","T1059.003","T1070.004","T1071","T1082","T1102","T1124","T1140","T1497.001","T1574","T1680"]},{"id":"S1148","name":"Raccoon Stealer","type":"software","techniques":["T1005","T1012","T1020","T1027.007","T1027.013","T1033","T1041","T1070.004","T1071.001","T1082","T1083","T1087.001","T1105","T1113","T1119","T1124","T1140","T1195","T1213","T1518","T1539","T1555.003","T1560","T1614"]},{"id":"S1149","name":"CHIMNEYSWEEP","type":"software","techniques":["T1005","T1027","T1027.001","T1027.007","T1027.009","T1033","T1041","T1053.005","T1056.001","T1057","T1059.001","T1059.005","T1070.006","T1071.001","T1074.001","T1083","T1102","T1105","T1106","T1112","T1113","T1115","T1120","T1132.002","T1140","T1218.003","T1480","T1518.001","T1529","T1548.002","T1553.002"]},{"id":"S1150","name":"ROADSWEEP","type":"software","techniques":["T1027.013","T1059.003","T1070.004","T1083","T1120","T1140","T1480","T1486","T1489","T1490","T1491.001","T1547.001","T1553.002","T1559","T1680"]},{"id":"S1151","name":"ZeroCleare","type":"software","techniques":["T1059","T1059.001","T1068","T1070.004","T1106","T1553.002","T1561.002","T1680"]},{"id":"S1152","name":"IMAPLoader","type":"software","techniques":["T1047","T1053.005","T1071.003","T1082","T1105","T1106","T1543","T1564.003","T1574.014"]},{"id":"S1153","name":"Cuckoo Stealer","type":"software","techniques":["T1027.008","T1027.013","T1033","T1036.005","T1041","T1056.002","T1057","T1059.002","T1059.004","T1071.001","T1074.001","T1082","T1083","T1095","T1113","T1140","T1217","T1518","T1543.001","T1553.001","T1555.001","T1564.001","T1569.001","T1614","T1614.001","T1647"]},{"id":"S1154","name":"VersaMem","type":"software","techniques":["T1027.013","T1040","T1056.004","T1059","T1070.004","T1074.001","T1129","T1203"]},{"id":"S1155","name":"Covenant","type":"software","techniques":["T1047","T1059.001","T1059.003","T1071.001","T1082","T1218.004","T1218.005","T1218.010","T1571","T1573.002"]},{"id":"S1156","name":"Manjusaka","type":"software","techniques":["T1016","T1041","T1059.003","T1071.001","T1082","T1083","T1113","T1132.001","T1555","T1555.003"]},{"id":"S1158","name":"DUSTPAN","type":"software","techniques":["T1027.009","T1027.013","T1036.005","T1055.002","T1140","T1543.003"]},{"id":"S1159","name":"DUSTTRAP","type":"software","techniques":["T1005","T1010","T1012","T1016","T1018","T1027.009","T1027.013","T1041","T1055","T1056.001","T1057","T1059.003","T1070","T1070.005","T1082","T1083","T1087.001","T1087.002","T1105","T1113","T1124","T1135","T1140","T1482","T1497.001","T1518.001","T1615","T1654","T1685.005"]},{"id":"S1160","name":"Latrodectus","type":"software","techniques":["T1005","T1016","T1021.005","T1027.001","T1027.002","T1027.007","T1027.013","T1033","T1036.005","T1041","T1047","T1053.005","T1057","T1059.003","T1059.007","T1069.002","T1070.004","T1071.001","T1082","T1083","T1087.002","T1102","T1104","T1105","T1106","T1132.001","T1135","T1140","T1204.001","T1204.002","T1218.007","T1218.011","T1482","T1497.001","T1518.001","T1529","T1547.001","T1559.001","T1564.004","T1566.001","T1566.002","T1573.001","T1622"]},{"id":"S1161","name":"BPFDoor","type":"software","techniques":["T1027","T1036.009","T1036.011","T1059.004","T1070","T1070.004","T1070.006","T1205.002","T1480","T1480.002","T1564.011","T1686","T1690"]},{"id":"S1162","name":"Playcrypt","type":"software","techniques":["T1083","T1486","T1490"]},{"id":"S1163","name":"SnappyTCP","type":"software","techniques":["T1059.004","T1071.001","T1095","T1505.003","T1573.002"]},{"id":"S1164","name":"UPSTYLE","type":"software","techniques":["T1001.001","T1027.013","T1036","T1057","T1059.006","T1070.004","T1070.006","T1102.003","T1140","T1546","T1665","T1685.006"]},{"id":"S1166","name":"Solar","type":"software","techniques":["T1020","T1041","T1053.005","T1070.004","T1082","T1105","T1132.001","T1573.001"]},{"id":"S1167","name":"AcidPour","type":"software","techniques":["T1070.004","T1082","T1083","T1120","T1485","T1529","T1561.001"]},{"id":"S1168","name":"SampleCheck5000","type":"software","techniques":["T1059.003","T1071.001","T1074.001","T1082","T1102.002","T1105","T1140","T1560.001","T1567","T1680"]},{"id":"S1169","name":"Mango","type":"software","techniques":["T1027.013","T1033","T1041","T1053.005","T1071.001","T1082","T1083","T1106","T1132.001","T1204.002","T1573.001","T1573.002","T1685"]},{"id":"S1170","name":"ODAgent","type":"software","techniques":["T1041","T1059.003","T1070.004","T1083","T1102.002","T1105","T1106","T1140","T1567.002"]},{"id":"S1171","name":"OilCheck","type":"software","techniques":["T1102.002","T1105","T1567"]},{"id":"S1172","name":"OilBooster","type":"software","techniques":["T1008","T1033","T1041","T1059.003","T1071.001","T1074.001","T1082","T1102.002","T1105","T1106","T1140","T1559","T1564.003","T1567.002","T1573.002"]},{"id":"S1173","name":"PowerExchange","type":"software","techniques":["T1041","T1059.001","T1071.003","T1105","T1140"]},{"id":"S1176","name":"attrib","type":"software","techniques":["T1564.001"]},{"id":"S1178","name":"ShrinkLocker","type":"software","techniques":["T1016","T1041","T1047","T1057","T1059.001","T1059.005","T1070.004","T1071.001","T1082","T1102","T1112","T1124","T1480","T1485","T1486","T1491.001","T1529","T1561.002","T1685","T1685.005","T1686"]},{"id":"S1179","name":"Exbyte","type":"software","techniques":["T1069.001","T1070.004","T1083","T1106","T1140","T1480","T1497.001","T1518.001","T1567"]},{"id":"S1180","name":"BlackByte Ransomware","type":"software","techniques":["T1012","T1021.002","T1027.013","T1046","T1053.005","T1059.007","T1082","T1106","T1112","T1135","T1140","T1222.001","T1480","T1486","T1490","T1497.001","T1518.001","T1570","T1614.001","T1685","T1689"]},{"id":"S1181","name":"BlackByte 2.0 Ransomware","type":"software","techniques":["T1055","T1068","T1070.004","T1070.006","T1112","T1135","T1486","T1489","T1490","T1569.002","T1686.003"]},{"id":"S1182","name":"MagicRAT","type":"software","techniques":["T1016","T1027.013","T1036.005","T1036.008","T1041","T1053.005","T1059.003","T1070.004","T1071.001","T1082","T1105","T1140","T1547.001"]},{"id":"S1183","name":"StrelaStealer","type":"software","techniques":["T1001","T1020","T1027","T1027.002","T1027.013","T1027.015","T1027.016","T1036","T1036.003","T1036.005","T1036.008","T1041","T1059.001","T1059.003","T1059.007","T1071.001","T1082","T1105","T1119","T1132.001","T1140","T1204.002","T1218.011","T1480","T1480.002","T1497","T1518","T1552.001","T1552.002","T1553.002","T1566.001","T1574.001","T1614.001","T1622"]},{"id":"S1184","name":"BOLDMOVE","type":"software","techniques":["T1016","T1059.004","T1070.004","T1071.001","T1082","T1083","T1090.003","T1190","T1480","T1543","T1554","T1564.011","T1573.002","T1685"]},{"id":"S1185","name":"LightSpy","type":"software","techniques":["T1027.001","T1027.013","T1041","T1046","T1057","T1071.001","T1082","T1083","T1105","T1113","T1123","T1129","T1217","T1480","T1518","T1555.001"]},{"id":"S1186","name":"Line Dancer","type":"software","techniques":["T1014","T1040","T1041","T1059.008","T1071.001","T1082","T1140","T1653","T1690"]},{"id":"S1187","name":"reGeorg","type":"software","techniques":["T1021.001","T1021.002","T1021.004","T1059.006","T1071.001","T1090","T1095","T1105","T1505.003","T1572"]},{"id":"S1188","name":"Line Runner","type":"software","techniques":["T1027.015","T1041","T1059.011","T1070.004","T1071.001","T1505.003","T1557","T1653"]},{"id":"S1189","name":"Neo-reGeorg","type":"software","techniques":["T1059.006","T1071.001","T1090","T1095","T1105","T1132.002","T1505.003","T1572"]},{"id":"S1190","name":"Kapeka","type":"software","techniques":["T1012","T1027.013","T1036.008","T1053.005","T1059.003","T1070.009","T1071.001","T1082","T1090","T1106","T1112","T1132.001","T1140","T1218.011"]},{"id":"S1191","name":"Megazord","type":"software","techniques":["T1057","T1059.003","T1083","T1486","T1489","T1654"]},{"id":"S1192","name":"NICECURL","type":"software","techniques":["T1059","T1070.004","T1071.001","T1105","T1573.002"]},{"id":"S1193","name":"TAMECAT","type":"software","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1071.001","T1105","T1132.001","T1518.001","T1573.001"]},{"id":"S1194","name":"Akira _v2","type":"software","techniques":["T1083","T1480","T1486","T1489","T1543","T1654"]},{"id":"S1196","name":"Troll Stealer","type":"software","techniques":["T1005","T1016","T1027.002","T1036.005","T1041","T1059.001","T1059.003","T1070.004","T1071.001","T1074.001","T1082","T1083","T1113","T1132.001","T1213","T1217","T1218.011","T1480.002","T1552.004","T1553.002","T1560","T1573.001"]},{"id":"S1197","name":"GoBear","type":"software","techniques":["T1036.005","T1090","T1553.002"]},{"id":"S1198","name":"Gomir","type":"software","techniques":["T1016","T1018","T1053.003","T1059.004","T1069.001","T1070.004","T1071.001","T1082","T1083","T1090.001","T1132.001","T1543.002","T1573","T1573.002"]},{"id":"S1199","name":"LockBit 2.0","type":"software","techniques":["T1021.002","T1047","T1053.005","T1057","T1059.001","T1059.003","T1070.004","T1082","T1083","T1112","T1120","T1135","T1136","T1140","T1480","T1484.001","T1486","T1489","T1490","T1547.001","T1548.002","T1564.003","T1614.001","T1680","T1685","T1685.005"]},{"id":"S1200","name":"StealBit","type":"software","techniques":["T1005","T1027.013","T1030","T1070.004","T1071.001","T1082","T1083","T1095","T1106","T1140","T1480","T1559","T1614.001","T1622","T1685"]},{"id":"S1201","name":"TRANSLATEXT","type":"software","techniques":["T1012","T1036.005","T1041","T1059.001","T1071.001","T1102.001","T1102.002","T1112","T1113","T1114","T1176.001","T1185","T1205","T1539","T1555.003"]},{"id":"S1202","name":"LockBit 3.0","type":"software","techniques":["T1021.002","T1027.002","T1027.013","T1057","T1059.001","T1070.004","T1071.001","T1078.003","T1082","T1083","T1106","T1112","T1120","T1132.001","T1135","T1140","T1218.003","T1480","T1480.002","T1484.001","T1486","T1489","T1490","T1543.003","T1547.004","T1548.002","T1569.002","T1573.001","T1614.001","T1622","T1680","T1685","T1685.005","T1688"]},{"id":"S1203","name":"J-magic","type":"software","techniques":["T1016","T1036.005","T1040","T1059.004","T1070.003","T1095","T1205","T1573.002"]},{"id":"S1204","name":"cd00r","type":"software","techniques":["T1016","T1040","T1095","T1205.001"]},{"id":"S1205","name":"cipher.exe","type":"software","techniques":["T1561.001"]},{"id":"S1206","name":"JumbledPath","type":"software","techniques":["T1040","T1104","T1560","T1665","T1685","T1685.006"]},{"id":"S1207","name":"XLoader","type":"software","techniques":["T1027.002","T1027.013","T1033","T1053.005","T1055.004","T1055.012","T1056.001","T1059.010","T1070.004","T1071.001","T1082","T1106","T1113","T1115","T1140","T1185","T1203","T1497","T1497.001","T1529","T1539","T1547.001","T1555","T1555.003","T1566.001","T1583.001","T1622","T1685"]},{"id":"S1209","name":"Quick Assist","type":"software","techniques":["T1071.001","T1113","T1125"]},{"id":"S1210","name":"Sagerunex","type":"software","techniques":["T1016","T1027.002","T1027.013","T1041","T1055.001","T1057","T1071.001","T1074.001","T1082","T1090","T1102.002","T1102.003","T1106","T1134","T1140","T1480","T1560.001","T1573.002"]},{"id":"S1211","name":"Hannotog","type":"software","techniques":["T1020","T1059.003","T1105","T1489","T1543.003","T1571","T1686"]},{"id":"S1212","name":"RansomHub","type":"software","techniques":["T1018","T1021.002","T1027.013","T1057","T1059.001","T1059.003","T1070.004","T1082","T1083","T1090","T1135","T1140","T1480","T1486","T1489","T1490","T1491.001","T1497.003","T1547.001","T1685.005","T1688"]},{"id":"S1213","name":"Lumma Stealer","type":"software","techniques":["T1027","T1027.013","T1036.008","T1041","T1055.012","T1059.001","T1059.006","T1059.010","T1071.001","T1074.001","T1082","T1113","T1119","T1140","T1176.001","T1195","T1204","T1204.002","T1217","T1218.005","T1218.015","T1497.001","T1518.001","T1539","T1547.001","T1553.002","T1555.003","T1564.003","T1566.001","T1566.002","T1573.002","T1574.001","T1620","T1622","T1685"]},{"id":"S1217","name":"VIRTUALPITA","type":"software","techniques":["T1036.004","T1036.005","T1037","T1059.004","T1059.006","T1105","T1489","T1570","T1571","T1673","T1675","T1690"]},{"id":"S1218","name":"VIRTUALPIE","type":"software","techniques":["T1059.006","T1059.012","T1505.006","T1570","T1571","T1573.001"]},{"id":"S1219","name":"REPTILE","type":"software","techniques":["T1014","T1059.004","T1095","T1140","T1205","T1205.001","T1543.004","T1546.017","T1547.006","T1564.001","T1573.002"]},{"id":"S1220","name":"MEDUSA","type":"software","techniques":["T1014","T1027.013","T1563.001","T1574.006"]},{"id":"S1221","name":"MOPSLED","type":"software","techniques":["T1027.013","T1071.001","T1095","T1102","T1102.001","T1140"]},{"id":"S1222","name":"RIFLESPINE","type":"software","techniques":["T1059.004","T1071.001","T1074.001","T1082","T1102.002","T1105","T1140","T1543.002","T1567.002","T1573.001"]},{"id":"S1223","name":"THINCRUST","type":"software","techniques":["T1059.006","T1071.001","T1140","T1573.001","T1686"]},{"id":"S1224","name":"CASTLETAP","type":"software","techniques":["T1005","T1040","T1059.004","T1105","T1140","T1205.002","T1573.001","T1573.002"]},{"id":"S1226","name":"BOOKWORM","type":"software","techniques":["T1001.003","T1027","T1027.013","T1033","T1036.004","T1056.001","T1070.006","T1071.001","T1106","T1112","T1115","T1140","T1543.003","T1553.002","T1564.003","T1573.001","T1574.001"]},{"id":"S1227","name":"StarProxy","type":"software","techniques":["T1001.003","T1059","T1090.001","T1095","T1106","T1124","T1140","T1573.001","T1574.001"]},{"id":"S1228","name":"PUBLOAD","type":"software","techniques":["T1001.003","T1007","T1012","T1016","T1016.001","T1016.002","T1027","T1027.015","T1033","T1036.005","T1047","T1048.003","T1049","T1053.005","T1057","T1059.003","T1071.001","T1071.002","T1082","T1105","T1106","T1124","T1140","T1205","T1480.001","T1518","T1518.001","T1547.001","T1553.002","T1560.001","T1573.001","T1574.001","T1614.001","T1622","T1680"]},{"id":"S1229","name":"Havoc","type":"software","techniques":["T1005","T1016","T1016.001","T1018","T1027.010","T1033","T1055.001","T1055.002","T1057","T1059.001","T1059.003","T1071.001","T1071.002","T1082","T1083","T1087","T1090","T1105","T1106","T1113","T1134.001","T1204.002","T1204.004","T1497.003","T1559","T1566.002","T1570","T1573.001","T1574.001"]},{"id":"S1230","name":"HIUPAN","type":"software","techniques":["T1057","T1091","T1112","T1120","T1204.002","T1547.001","T1564.001","T1574.001","T1678"]},{"id":"S1232","name":"SplatDropper","type":"software","techniques":["T1027.007","T1027.013","T1070.009","T1106","T1140","T1543.003","T1553.002","T1574.001"]},{"id":"S1233","name":"PAKLOG","type":"software","techniques":["T1010","T1027.013","T1056.001","T1057","T1074.001","T1106","T1115","T1124","T1553.002","T1574.001"]},{"id":"S1234","name":"SplatCloak","type":"software","techniques":["T1036.001","T1082","T1083","T1106","T1518.001","T1685"]},{"id":"S1235","name":"CorKLOG","type":"software","techniques":["T1027.013","T1053.005","T1056.001","T1074.001","T1140","T1543.003","T1553.002","T1574.001"]},{"id":"S1236","name":"CLAIMLOADER","type":"software","techniques":["T1027.007","T1036.005","T1053.005","T1106","T1140","T1204.002","T1480.002","T1547.001","T1559.001","T1564.001","T1574.001"]},{"id":"S1237","name":"CANONSTAGER","type":"software","techniques":["T1027.007","T1036.005","T1055.005","T1106","T1564.003","T1574.001"]},{"id":"S1238","name":"STATICPLUGIN","type":"software","techniques":["T1036.005","T1036.008","T1204.002","T1553.002","T1559.001"]},{"id":"S1239","name":"TONESHELL","type":"software","techniques":["T1001.003","T1010","T1027.001","T1027.007","T1027.012","T1033","T1036.004","T1036.005","T1047","T1053.005","T1055.001","T1056.001","T1057","T1059.003","T1070.004","T1071.001","T1082","T1087","T1095","T1105","T1106","T1113","T1132.002","T1134.002","T1140","T1205","T1218.010","T1218.013","T1480","T1480.001","T1480.002","T1497.002","T1518.001","T1543.003","T1547.001","T1553.002","T1559","T1560.001","T1573.001","T1574.001","T1622","T1678","T1680"]},{"id":"S1240","name":"RedLine Stealer","type":"software","techniques":["T1005","T1012","T1016","T1027.002","T1027.010","T1027.013","T1033","T1036","T1041","T1053.005","T1059.003","T1059.011","T1071.001","T1082","T1087.001","T1102","T1105","T1113","T1132.001","T1140","T1204.002","T1217","T1218.007","T1480","T1497","T1518","T1518.001","T1539","T1553.002","T1555","T1555.003","T1614","T1614.001","T1657","T1685"]},{"id":"S1242","name":"Qilin","type":"software","techniques":["T1003.001","T1007","T1012","T1016","T1018","T1021.002","T1021.004","T1027.013","T1036.004","T1036.005","T1047","T1053.005","T1055.001","T1057","T1059.001","T1059.003","T1069.002","T1070.004","T1071.002","T1082","T1083","T1087.001","T1087.002","T1106","T1112","T1134","T1135","T1190","T1204.001","T1204.002","T1219.002","T1222","T1480","T1480.002","T1484.001","T1486","T1489","T1490","T1491.001","T1529","T1547.001","T1547.004","T1548.002","T1566.001","T1566.002","T1570","T1673","T1678","T1680","T1685","T1685.005","T1688"]},{"id":"S1244","name":"Medusa Ransomware","type":"software","techniques":["T1007","T1027.013","T1057","T1059.001","T1059.003","T1070.004","T1082","T1083","T1106","T1124","T1135","T1140","T1486","T1489","T1490","T1518.001","T1543.003","T1559","T1564.003","T1679","T1680","T1685"]},{"id":"S1245","name":"InvisibleFerret","type":"software","techniques":["T1005","T1016","T1027.013","T1033","T1041","T1048.003","T1056","T1056.001","T1057","T1059.001","T1059.006","T1071.001","T1074.001","T1082","T1083","T1087.001","T1095","T1105","T1115","T1140","T1219","T1489","T1518","T1543.001","T1547.001","T1547.013","T1555.003","T1555.005","T1560.001","T1564.003","T1567","T1571","T1614","T1657","T1679"]},{"id":"S1246","name":"BeaverTail","type":"software","techniques":["T1001.001","T1005","T1027.013","T1036","T1041","T1059.007","T1070.004","T1071.001","T1074.001","T1082","T1083","T1105","T1124","T1195.001","T1204.002","T1217","T1555","T1555.001","T1555.003","T1560.001","T1571","T1654","T1657"]},{"id":"S1247","name":"Embargo","type":"software","techniques":["T1007","T1027.013","T1053.005","T1057","T1059.003","T1068","T1070.004","T1083","T1106","T1112","T1135","T1140","T1480.002","T1486","T1489","T1490","T1543.003","T1547.001","T1569.002","T1657","T1679","T1688"]},{"id":"S1248","name":"XORIndex Loader","type":"software","techniques":["T1016","T1027.010","T1027.013","T1033","T1036.005","T1041","T1059.007","T1071.001","T1082","T1105","T1140","T1614"]},{"id":"S1249","name":"HexEval Loader","type":"software","techniques":["T1016","T1027.013","T1033","T1036.005","T1041","T1056.001","T1059.007","T1071.001","T1082","T1105","T1140","T1614"]},{"id":"S9001","name":"SystemBC","type":"software","techniques":["T1001","T1053.005","T1057","T1059.001","T1059.003","T1059.005","T1071.004","T1082","T1087.001","T1090.003","T1095","T1105","T1106","T1124","T1140","T1480","T1564.003","T1571","T1573.001","T1620","T1678"]},{"id":"S9002","name":"Diskpart","type":"software","techniques":["T1059.003","T1082","T1083","T1222.001","T1561.002"]},{"id":"S9003","name":"evilginx2","type":"software","techniques":["T1001","T1016","T1059.007","T1071.001","T1090.002","T1111","T1132","T1185","T1480","T1497.003","T1539","T1553.004","T1557","T1598.003"]},{"id":"S9004","name":"Crocodilus","type":"software","techniques":["T1657"]},{"id":"S9007","name":"HTTPTroy","type":"software","techniques":["T1027","T1027.007","T1041","T1059.003","T1070.004","T1071.001","T1105","T1106","T1113","T1132.002","T1140","T1548.002","T1573.001"]},{"id":"S9008","name":"Shai-Hulud","type":"software","techniques":["T1027","T1036.005","T1036.009","T1041","T1059.001","T1059.004","T1059.007","T1071.001","T1078.004","T1082","T1098","T1105","T1119","T1195.001","T1213.003","T1485","T1528","T1543.002","T1546.016","T1548.003","T1550.001","T1552.001","T1552.005","T1553","T1555.006","T1564.011","T1567.001","T1567.004","T1593.003","T1608.001","T1677","T1678","T1685"]},{"id":"S9009","name":"TruffleHog","type":"software","techniques":["T1005","T1059.009","T1078.004","T1083","T1213.001","T1213.002","T1213.003","T1213.005","T1526","T1528","T1530","T1552.001","T1552.005","T1555.006","T1580","T1619"]},{"id":"S9010","name":"GlassWorm","type":"software","techniques":["T1005","T1008","T1027.013","T1027.018","T1036","T1059.002","T1059.007","T1071.001","T1074.001","T1082","T1090.001","T1102.001","T1105","T1124","T1140","T1195.001","T1213.003","T1213.006","T1217","T1480","T1518","T1539","T1543.001","T1547.001","T1554","T1555.001","T1555.003","T1560.001","T1564.003","T1565.002","T1571","T1602.002","T1614","T1614.001","T1657","T1678"]},{"id":"S9011","name":"BRUSHFIRE","type":"software","techniques":["T1048.002","T1140","T1205","T1620"]},{"id":"S9012","name":"TRAILBLAZE","type":"software","techniques":["T1055.012","T1057","T1070.004","T1106"]},{"id":"S9013","name":"DRYHOOK","type":"software","techniques":["T1027.013","T1056.001","T1059.006","T1059.008","T1074.001","T1222.002","T1489","T1556","T1556.004","T1601","T1685"]},{"id":"S9014","name":"PHASEJAM","type":"software","techniques":["T1027.010","T1027.013","T1036.003","T1041","T1059.008","T1105","T1140","T1489","T1505.003","T1546.004","T1554","T1565","T1678","T1685","T1685.003"]},{"id":"S9015","name":"BRICKSTORM","type":"software","techniques":["T1005","T1027","T1027.013","T1036.005","T1041","T1057","T1059.004","T1070.004","T1070.010","T1071.001","T1071.004","T1083","T1090.001","T1102","T1105","T1132.001","T1140","T1489","T1543","T1568","T1572","T1573.002","T1574.007","T1678","T1690"]},{"id":"S9016","name":"Caminho","type":"software","techniques":["T1027.001","T1027.013","T1055.012","T1105","T1106","T1140"]},{"id":"S9017","name":"DCRAT","type":"software","techniques":["T1027.013","T1056.001","T1573.002","T1685"]},{"id":"S9018","name":"HeartCrypt","type":"software","techniques":["T1027.001","T1027.002","T1027.013","T1036.008","T1055.004","T1055.012","T1059.003","T1106","T1140","T1497.001","T1547.001"]},{"id":"S9019","name":"PureCrypter","type":"software","techniques":["T1027.013","T1027.016","T1033","T1036.005","T1036.008","T1053.005","T1055","T1057","T1059.001","T1070.004","T1082","T1102","T1105","T1140","T1480","T1480.002","T1518.001","T1547.001","T1564.003","T1573.001","T1573.002","T1614","T1622","T1673","T1678","T1685"]},{"id":"S9020","name":"LODEINFO","type":"software","techniques":["T1001.001","T1005","T1016","T1018","T1027","T1027.007","T1027.013","T1027.015","T1027.016","T1033","T1041","T1047","T1055","T1056.001","T1057","T1070.004","T1074.001","T1082","T1083","T1105","T1106","T1113","T1124","T1204.002","T1480","T1486","T1539","T1547.001","T1566.001","T1573.001","T1574.001","T1614.001"]},{"id":"S9021","name":"DOWNIISSA","type":"software","techniques":["T1027.013","T1055","T1070.004","T1105","T1106","T1140","T1218.007"]},{"id":"S9022","name":"MirrorStealer","type":"software","techniques":["T1074.001","T1552.006","T1555","T1555.003"]},{"id":"S9023","name":"HiddenFace","type":"software","techniques":["T1005","T1008","T1027.007","T1027.013","T1033","T1053.005","T1055","T1057","T1070.006","T1082","T1090.001","T1095","T1105","T1112","T1140","T1480","T1480.002","T1497.003","T1518.001","T1568.002","T1571","T1572","T1573.001","T1573.002","T1686.003"]},{"id":"S9024","name":"SPAWNCHIMERA","type":"software","techniques":["T1005","T1027.013","T1037","T1040","T1055.002","T1057","T1059.006","T1070.004","T1070.006","T1082","T1140","T1480.002","T1505.003","T1518.001","T1553.002","T1559","T1571","T1572","T1574","T1574.006","T1678","T1685","T1690"]},{"id":"S9025","name":"NOOPLDR","type":"software","techniques":["T1027","T1027.013","T1027.016","T1055","T1070.004","T1082","T1106","T1112","T1127.001","T1140","T1564","T1574.001"]},{"id":"S9026","name":"ROAMINGHOUSE","type":"software","techniques":["T1027.013","T1047","T1137.001","T1140","T1204.001","T1204.002","T1480","T1497.002","T1518.001","T1566.002","T1574.001"]},{"id":"S9027","name":"ANELLDR","type":"software","techniques":["T1027","T1027.013","T1027.016","T1083","T1106","T1140","T1574.001","T1622"]},{"id":"S9028","name":"PHPsert","type":"software","techniques":["T1027.013","T1071.001","T1105","T1132.001","T1140","T1505.003"]},{"id":"S9029","name":"IronWind","type":"software","techniques":["T1027.010","T1033","T1059.003","T1070","T1071.001","T1082","T1140","T1518","T1574.001"]},{"id":"S9030","name":"SameCoin","type":"software","techniques":["T1036.005","T1053.005","T1083","T1485","T1491.001","T1534","T1570","T1614","T1679"]},{"id":"S9031","name":"AshTag","type":"software","techniques":["T1027.013","T1036.005","T1041","T1047","T1053.005","T1057","T1059.007","T1071.001","T1082","T1083","T1102","T1105","T1113","T1140","T1204.002","T1574.001","T1614","T1678","T1680"]},{"id":"S9032","name":"MuddyViper","type":"software","techniques":["T1041","T1053.005","T1056.002","T1057","T1059","T1059.001","T1059.003","T1071.001","T1105","T1106","T1112","T1140","T1518.001","T1547.001","T1560","T1573.001","T1620","T1678"]},{"id":"S9033","name":"Fooder","type":"software","techniques":["T1027","T1036.005","T1106","T1134.001","T1140","T1620","T1678"]},{"id":"S9034","name":"Tsundere Botnet","type":"software","techniques":["T1027.010","T1027.013","T1036.005","T1059.001","T1059.007","T1071.001","T1082","T1102.001","T1105","T1140","T1195.001","T1218.007","T1480","T1547.001","T1564.003","T1567.002","T1614"]},{"id":"S9035","name":"LAMEHUG","type":"software","techniques":["T1005","T1007","T1016","T1033","T1036.005","T1041","T1047","T1057","T1059.003","T1059.006","T1069.002","T1071.001","T1074.001","T1082","T1083","T1087.002","T1102.002","T1119","T1132","T1140","T1204.002","T1482","T1560.001","T1566.001","T1573.002"]},{"id":"S9036","name":"LP-Notes","type":"software","techniques":["T1027.007","T1027.013","T1056.002","T1057","T1059.001","T1074.001","T1078","T1106","T1134.001","T1140","T1560"]},{"id":"S9037","name":"RustyWater","type":"software","techniques":["T1027","T1027.013","T1033","T1036.005","T1055.002","T1071.001","T1082","T1087.002","T1106","T1132.001","T1140","T1204.002","T1518.001","T1547.001","T1559.001","T1566.001","T1573.001","T1622","T1678","T1684.001"]},{"id":"S9038","name":"DynoWiper","type":"software","techniques":["T1036","T1083","T1106","T1120","T1485","T1529","T1678","T1679","T1680"]},{"id":"S9039","name":"LazyWiper","type":"software","techniques":["T1059.001","T1082","T1083","T1480","T1485","T1588.007","T1679","T1685"]},{"id":"S9041","name":"TeamPCP Cloud Stealer","type":"software","techniques":["T1003.007","T1008","T1016","T1020","T1027.013","T1033","T1036.005","T1041","T1049","T1057","T1059.004","T1059.006","T1059.007","T1070.004","T1071.001","T1074.001","T1082","T1083","T1105","T1119","T1140","T1213.003","T1213.006","T1480","T1518","T1526","T1528","T1543.002","T1546.016","T1546.018","T1548.003","T1552.001","T1552.003","T1552.004","T1552.007","T1555","T1555.006","T1560.001","T1564.001","T1567.001","T1573.001","T1573.002","T1580","T1609","T1613","T1657","T1678"]},{"id":"S9042","name":"CanisterWorm","type":"software","techniques":["T1016","T1018","T1027.009","T1033","T1036.004","T1036.005","T1053.006","T1059.004","T1059.006","T1059.007","T1070.004","T1083","T1102.001","T1105","T1124","T1140","T1195.001","T1480","T1485","T1497.003","T1528","T1529","T1543","T1548.003","T1550.001","T1552.004","T1555.006","T1569.003","T1609","T1613","T1614.001","T1677"]},{"id":"S9043","name":"Mini Shai-Hulud","type":"software","techniques":["T1003.007","T1008","T1016","T1021.007","T1027.013","T1033","T1036.005","T1041","T1053.006","T1059.006","T1059.007","T1059.013","T1070.004","T1071.001","T1078.004","T1082","T1083","T1087.004","T1090.003","T1102.001","T1105","T1119","T1124","T1132.001","T1140","T1195.001","T1205","T1213.003","T1480","T1485","T1497","T1497.001","T1528","T1543.001","T1543.002","T1546","T1546.018","T1550.001","T1552.001","T1552.004","T1552.005","T1552.007","T1554","T1555.005","T1555.006","T1559","T1560","T1560.001","T1564.011","T1567.001","T1609","T1614","T1614.001","T1649","T1677"]},{"id":"S9044","name":"Kali365","type":"software","techniques":["T1059.007","T1071.001","T1087.003","T1090","T1102","T1185","T1204.001","T1204.004","T1528","T1539","T1550.001","T1552.001","T1557","T1564.008","T1566.001","T1566.002","T1683.001"]}]} diff --git a/src/components/TileCard/TileCard.tsx b/src/components/TileCard/TileCard.tsx index da4971b..5dc9ed8 100644 --- a/src/components/TileCard/TileCard.tsx +++ b/src/components/TileCard/TileCard.tsx @@ -6,6 +6,7 @@ import { resultStatusFieldFor } from '../../features/linked-results/result-messa import { highlightText } from '../HighlightText/highlight-text'; import { BookmarkIcon } from '../BookmarkIcon'; import { cisBenchmarkCategories } from '../../profiles/cis-cat/cis-benchmark-hierarchy'; +import { cisCategoryRecordTitle } from '../../profiles/cis-cat/cis-benchmark-section-titles'; import { policyFindingCategories } from '../../profiles/group-policy/categories'; import { measureNavigationStep } from '../../app/navigation-diagnostics'; @@ -14,6 +15,8 @@ export interface TileBadge { value: string; text: string; severity?: string; + /** Hover text, for example the report title of a CIS section. */ + title?: string; } export function tileBadges(record: FindingRecord, fallbackToolId?: string): TileBadge[] { @@ -33,7 +36,11 @@ export function tileBadges(record: FindingRecord, fallbackToolId?: string): Tile const text = /^(Weight|Score)$/.test(label) ? `${label}: ${field.value}` : field.value; return [{ label, value: field.value, text, ...(label === 'Severity' ? { severity: normalizeSeverity(field.value) } : {}) }]; }); - const cisBadges = cisBenchmarkCategories(record, fallbackToolId).map(value => ({ label: 'CIS Category', value, text: value })); + // Tiles stay compact: the CIS number is the badge, the section title from the run's report is its hover text. + const cisBadges = cisBenchmarkCategories(record, fallbackToolId).map(value => { + const title = cisCategoryRecordTitle(record, value); + return { label: 'CIS Category', value, text: value, ...(title ? { title } : {}) }; + }); const gpoBadges = policyFindingCategories(record, fallbackToolId).map(value => ({ label: 'GPO Category', value, text: value })); const scopeBadges = toolIdForRecord(record, fallbackToolId) === 'group-policy' ? record.fields.filter(field => field.label.trim().toLowerCase() === 'scope' && field.value.trim()) @@ -110,7 +117,7 @@ function TileCardComponent({ record, title, bookmarked, resultColor, toolId, sea plus Glyph statt gefuellter Flaeche. Sonst sehen Passed, Failed und Investigate in der Kachelansicht identisch aus. */ ? {highlightText(badge.text, search)} - : {highlightText(badge.text, search)})} + : {highlightText(badge.text, search)})}
diff --git a/src/domain/canonical-model.ts b/src/domain/canonical-model.ts index ba99554..5499c96 100644 --- a/src/domain/canonical-model.ts +++ b/src/domain/canonical-model.ts @@ -335,6 +335,8 @@ export interface ImportDiagnostic { } export interface CanonicalAssessmentModel { + /** Latest stored reference derivation per scan; canonical source facts remain unchanged. */ + referenceRuns?: import('./reference-recognition').ReferenceRecognitionRun[]; schemaVersion: 1; project: AssessmentProject; assessment: Assessment; @@ -352,4 +354,3 @@ export interface CanonicalAssessmentModel { diagnostics: ImportDiagnostic[]; } - diff --git a/src/domain/dataset.ts b/src/domain/dataset.ts index 26059e9..b98f11b 100644 --- a/src/domain/dataset.ts +++ b/src/domain/dataset.ts @@ -83,6 +83,8 @@ export interface DatasetSheet { export interface ImportedDataset { /** Run-bound scoring evidence, prepared once while projecting the canonical workspace. */ securityScoring?: SecurityScoreContext; + /** Benchmark section titles per scan run and section number, read from retained report tables. */ + benchmarkSectionTitles?: Map>; fileName: string; fileSize: number; lastModified: number; diff --git a/src/domain/finding.ts b/src/domain/finding.ts index 1333660..823b48b 100644 --- a/src/domain/finding.ts +++ b/src/domain/finding.ts @@ -58,6 +58,7 @@ export interface RecordField { } export interface FindingRecord { + referenceRecognition?: import('./reference-recognition').FindingReferenceRecognition; id: string; /** Stable database identity of the projected canonical finding occurrence. */ findingOccurrenceId?: string; @@ -66,6 +67,8 @@ export interface FindingRecord { /** Exact source scope for native report metrics; never inferred from display names. */ scanRunId?: string; importFileId?: string; + /** Benchmark section titles of this record's own scan run, by section number (presentation only). */ + benchmarkSectionTitles?: ReadonlyMap; /** Presentation-only provenance of Fail comparisons, using the Processing tile's exact backup identity. */ policyFailingBackupSources?: Array<{ id: string; label: string }>; policySourceEvidence?: PolicySourceEvidence[]; diff --git a/src/domain/reference-recognition.ts b/src/domain/reference-recognition.ts new file mode 100644 index 0000000..fe23065 --- /dev/null +++ b/src/domain/reference-recognition.ts @@ -0,0 +1,163 @@ +import type { JsonValue, OriginalField, SourcePosition } from './canonical-model'; + +/** Independent derivation: these references never become FindingDefinition identity keys. */ +export const REFERENCE_RECOGNIZER_VERSION = '1.0.0'; +export type ReferenceFramework = 'mitre-attack' | 'mitre-d3fend'; +export interface ReferenceCatalogEntry { + id: string; + title: string; + kind: 'technique' | 'tactic'; + state: 'active' | 'deprecated' | 'revoked'; + url: string; + tactics: string[]; +} +export interface ReferenceCatalog { + schemaVersion: 1; + framework: ReferenceFramework; + version: string; + sourceUrl: string; + sourceSha256: string; + license: string; + entries: ReferenceCatalogEntry[]; +} +export interface ReferenceCatalogSnapshot extends ReferenceCatalog { + /** SHA-256 of canonicalJson(catalog), including every recognition input and the notice. */ + sha256: string; +} +export interface RecognizedReference { + framework: ReferenceFramework; + id: string; + title?: string; + kind?: 'technique' | 'tactic'; + url?: string; + tactics: string[]; + status: 'active' | 'deprecated' | 'revoked' | 'not-in-catalog'; + evidence: 'declared' | 'mentioned'; + matchedBy: 'id' | 'exact-title'; + catalogVersion: string; + catalogSha256: string; + source: { + fieldKey: string; + fieldLabel: string; + fieldPath?: string; + /** JSON pointer within value; rawValue is authoritative when present. */ + valuePath: string; + representation: 'rawValue' | 'value'; + start: number; + end: number; + offsetUnit: 'utf16'; + text: string; + }; +} +export interface ReferenceOccurrenceResult { + occurrenceId: string; + importFileId: string; + sourceFileSha256?: string; + sourcePosition: SourcePosition; + references: RecognizedReference[]; +} +export interface ReferenceRecognitionRun { + schemaVersion: 1; + id: string; + projectId: string; + assessmentId: string; + scanRunId: string; + recognizerVersion: string; + inputSha256: string; + catalogHashes: string[]; + createdAt: string; + results: ReferenceOccurrenceResult[]; +} +export interface FindingReferenceRecognition { + runId: string; + recognizerVersion: string; + createdAt: string; + references: RecognizedReference[]; +} + +/** Header semantics are framework-specific, never scanner-specific. */ +export function declaredReferenceFramework(label: string): ReferenceFramework | undefined { + const value = label.trim().toLowerCase().replace(/[_-]+/g, ' '); + if (/\b(?:d3fend|mitre\s*(?:d3fend|defen[cs]e))\b/.test(value)) return 'mitre-d3fend'; + if (/\b(?:att&?ck|mitre\s*(?:att&?ck|attack))\b/.test(value)) return 'mitre-attack'; + return undefined; +} + +function* strings(value: JsonValue, path = ''): Generator<{ text: string; path: string }> { + if (typeof value === 'string') yield { text: value, path }; + else if (Array.isArray(value)) { + for (let i = 0; i < value.length; i++) yield* strings(value[i], `${path}/${i}`); + } else if (value && typeof value === 'object') { + for (const [key, item] of Object.entries(value)) yield* strings(item, `${path}/${key.replace(/~/g, '~0').replace(/\//g, '~1')}`); + } +} +const normalizeTitle = (value: string) => value.trim().replace(/\s+/g, ' ').toLowerCase(); + +/** Build indexes once per run, then process every source field offline. */ +export function createReferenceRecognizer(catalogs: readonly ReferenceCatalogSnapshot[]) { + const indexes = catalogs.map(catalog => { + const titles = new Map(); + for (const entry of catalog.entries) { + const key = normalizeTitle(entry.title); + titles.set(key, [...(titles.get(key) ?? []), entry]); + } + return { catalog, ids: new Map(catalog.entries.map(entry => [entry.id.toUpperCase(), entry])), titles }; + }); + return (fields: readonly OriginalField[]): RecognizedReference[] => { + const results: RecognizedReference[] = []; + for (const field of fields) { + const declared = declaredReferenceFramework(field.label); + const representation = typeof field.rawValue === 'string' ? 'rawValue' : 'value'; + for (const { text, path } of strings(representation === 'rawValue' ? field.rawValue! : field.value)) { + for (const { catalog, ids, titles } of indexes) { + const evidence = declared === catalog.framework ? 'declared' : 'mentioned'; + const occupied: Array<[number, number]> = []; + const add = (id: string, start: number, end: number, matchedBy: 'id' | 'exact-title', entry?: ReferenceCatalogEntry) => { + occupied.push([start, end]); + results.push({ framework: catalog.framework, id: entry?.id ?? id, + ...(entry ? { title: entry.title, kind: entry.kind, url: entry.url } : {}), + tactics: entry?.tactics ?? [], status: entry?.state ?? 'not-in-catalog', evidence, matchedBy, + catalogVersion: catalog.version, catalogSha256: catalog.sha256, + source: { fieldKey: field.key, fieldLabel: field.label, ...(field.path ? { fieldPath: field.path } : {}), + valuePath: path, representation, start, end, offsetUnit: 'utf16', text: text.slice(start, end) } }); + }; + // Unicode-aware boundaries prevent partial IDs, embedded host names and longer dotted numbers. + const pattern = catalog.framework === 'mitre-attack' + ? /(? ({ text: piece[0], start: fragment.index! + piece.index! }))]; + const separator = fragment[0].lastIndexOf(' - '); + if (separator >= 0) candidates.push({ text: fragment[0].slice(separator + 3), start: fragment.index! + separator + 3 }); + for (const candidate of candidates) { + const trimmed = candidate.text.trim(); + const start = candidate.start + candidate.text.indexOf(trimmed); + const end = start + trimmed.length; + if (!trimmed || occupied.some(([a, b]) => start < b && end > a)) continue; + const entries = titles.get(normalizeTitle(trimmed)); + if (entries?.length === 1) add(entries[0].id, start, end, 'exact-title', entries[0]); + } + } + } + } + } + return results; + }; +} + +export function latestReferenceRuns(runs: readonly ReferenceRecognitionRun[]): ReferenceRecognitionRun[] { + const latest = new Map(); + for (const run of runs) { + const previous = latest.get(run.scanRunId); + if (!previous || `${run.createdAt}\0${run.id}` > `${previous.createdAt}\0${previous.id}`) latest.set(run.scanRunId, run); + } + return [...latest.values()]; +} diff --git a/src/domain/tool-profile-definition.ts b/src/domain/tool-profile-definition.ts index 9962c8c..d007938 100644 --- a/src/domain/tool-profile-definition.ts +++ b/src/domain/tool-profile-definition.ts @@ -144,6 +144,8 @@ export interface ToolProfileDefinition { schemaVersion: 1; id: string; name: string; + /** Further scan-run names the import assigns to this profile, for example scope-specific names. */ + runNames?: string[]; version: string; processing: ToolProcessingContract; securityScoring: ToolSecurityScoringDefinition; @@ -237,6 +239,17 @@ export interface ToolProfileDefinition { nextStepHeaders?: RegExp[]; /** Retained https documentation link offered as the next step when no remediation text exists. */ nextStepLinkHeaders?: RegExp[]; + /** + * Native remediation subsection inside another retained field, used when no dedicated + * remediation field exists. The section runs from the native heading to the end of the field; + * the text before the heading stays in place as background. + */ + nextStepSection?: { headers: RegExp[]; heading: RegExp }; + /** + * Native reference heading the scanner appends to its impact text. The impact row ends before it; + * the retained remainder is shown with the references. + */ + impactReferenceMarker?: RegExp; /** Explanatory text shown below the next step. */ backgroundHeaders?: RegExp[]; /** Documentation and references shown after the background. */ diff --git a/src/features/dataset-viewer/DatasetViewer.tsx b/src/features/dataset-viewer/DatasetViewer.tsx index 834b3c8..a28d4a3 100644 --- a/src/features/dataset-viewer/DatasetViewer.tsx +++ b/src/features/dataset-viewer/DatasetViewer.tsx @@ -11,6 +11,8 @@ import type { DatasetSheet } from '../../domain/dataset'; import type { FindingRecord } from '../../domain/finding'; import { resultReferenceValues } from '../../profiles/purple-knight/result-linker'; import { maesterFindingTitle } from '../../profiles/maester/presentation'; +import { cisBenchmarkRuleId } from '../../profiles/cis-cat/cis-benchmark-hierarchy'; +import { cisSectionHeading } from '../../profiles/cis-cat/cis-benchmark-section-titles'; import { pingCastleSectionIds } from '../../profiles/pingcastle/pingcastle-section-links'; import { recordResultSheets } from '../linked-results/record-results'; import { resultMessageFor, resultOutcomeFor, resultSectionsFor, type ResultSection } from '../linked-results/result-message'; @@ -231,9 +233,10 @@ export function DatasetViewer() { const recordTitle = (record: FindingRecord) => { const candidate = (titleColumn && record.fields.find(field => field.label === titleColumn)?.value) || record.title; - return toolIdForRecord(record, activeSheet.toolId ?? dataset.profileId) === 'maester' - ? maesterFindingTitle(record, candidate) - : candidate; + const recordToolId = toolIdForRecord(record, activeSheet.toolId ?? dataset.profileId); + if (recordToolId === 'maester') return maesterFindingTitle(record, candidate); + // CIS headings name their benchmark section instead of the rule number, which stays in Source Rule ID. + return recordToolId === 'cis-cat' ? cisSectionHeading(record, cisBenchmarkRuleId(record, recordToolId), candidate) : candidate; }; const selected = records.find(record => record.id === selectedRecordId) ?? records[0]; const toolId = activeSheet.toolId ?? dataset.profileId; diff --git a/src/features/finding-reader/FindingFirstRead.tsx b/src/features/finding-reader/FindingFirstRead.tsx index 50b5176..0059306 100644 --- a/src/features/finding-reader/FindingFirstRead.tsx +++ b/src/features/finding-reader/FindingFirstRead.tsx @@ -1,7 +1,7 @@ import { RichTextValue } from '../../components/RichTextValue/RichTextValue'; import { highlightText } from '../../components/HighlightText/highlight-text'; import { TriangleIcon } from '../../components/TriangleIcon'; -import type { FindingFirstRead as Summary } from './first-read'; +import { powerShellDisplayLines, type FindingFirstRead as Summary } from './first-read'; /** Scanner first read: what the scanner found here, why it matters, and what to do next. */ export function FindingFirstRead({ summary, outcome, search, onResults }: { @@ -20,7 +20,7 @@ export function FindingFirstRead({ summary, outcome, search, onResults }: { {(summary.nextStep || summary.link) &&

Next step

{summary.nextStep?.lead && } - {summary.nextStep?.command && 
{highlightText(summary.nextStep.command, search)}
} + {summary.nextStep?.command && 
{highlightText(powerShellDisplayLines(summary.nextStep.command).join('\n'), search)}
} {summary.nextStep?.rest &&
Full remediation diff --git a/src/features/finding-reader/FindingReader.tsx b/src/features/finding-reader/FindingReader.tsx index c01acae..cc02479 100644 --- a/src/features/finding-reader/FindingReader.tsx +++ b/src/features/finding-reader/FindingReader.tsx @@ -9,7 +9,7 @@ import { PolicySourceEvidence } from './PolicySourceEvidence'; import { PolicyBaselineComparison } from './PolicyBaselineComparison'; import { PolicyProblemSummary } from './PolicyProblemSummary'; import { FindingFirstRead } from './FindingFirstRead'; -import { findingFirstRead, firstReadConsumedFields, firstReadFieldRank } from './first-read'; +import { findingFirstRead, firstReadConsumedFields, firstReadFieldRank, firstReadImpactSplit, firstReadSectionSplit } from './first-read'; import { policyProblemSummary } from '../../profiles/group-policy/problem-summary'; import { normalizeSeverity, mitreBadgeLabel } from '../../profiles/purple-knight/presentation'; import { RichTextValue } from '../../components/RichTextValue/RichTextValue'; @@ -23,6 +23,7 @@ import { BookmarkIcon } from '../../components/BookmarkIcon'; import { TriangleIcon } from '../../components/TriangleIcon'; import { resultSectionFields, resultStatusFieldFor } from '../linked-results/result-message'; import { cisBenchmarkCategories } from '../../profiles/cis-cat/cis-benchmark-hierarchy'; +import { cisCategoryRecordTitle } from '../../profiles/cis-cat/cis-benchmark-section-titles'; import { policyComparisonDisplayLines, policyValueName } from '../../profiles/group-policy/presentation'; import { policyDiagnosticBadges, policyFindingCategories } from '../../profiles/group-policy/categories'; import { findingWebSearch } from '../../profiles/public-search/search'; @@ -268,6 +269,17 @@ export function selectFindingFields(record: FindingRecord, title: string, hasStr // Scanner first read (user decision 2026-09-25): problem, impact and next step are shown above, // so their fields are not repeated; background precedes references. if (toolId !== 'group-policy') firstReadConsumedFields(record, toolId).forEach(field => hiddenFieldIndexes.add(field.index)); + // A native remediation subsection moved to the next step is not repeated; the text before it stays as background. + // References a scanner appended to its impact text move to the references position. + const sectionSplit = toolId !== 'group-policy' ? firstReadSectionSplit(record, toolId) : undefined; + const impactSplit = toolId !== 'group-policy' ? firstReadImpactSplit(record, toolId) : undefined; + const sectionBackground: RecordField[] = []; + let firstReadIndex = Math.max(-1, ...record.fields.map(field => field.index), ...maesterPresentationFields.map(field => field.index)) + 1; + if (sectionSplit) { + hiddenFieldIndexes.add(sectionSplit.field.index); + if (sectionSplit.background) sectionBackground.push({ ...sectionSplit.field, value: sectionSplit.background, index: firstReadIndex++ }); + } + if (impactSplit?.references) sectionBackground.push({ ...impactSplit.field, label: 'References', value: impactSplit.references, index: firstReadIndex++ }); const summaryPriority = (label: string) => { const normalized = normalizeLabel(label); const firstReadRank = toolId !== 'group-policy' ? firstReadFieldRank(label, toolId) : undefined; @@ -290,7 +302,7 @@ export function selectFindingFields(record: FindingRecord, title: string, hasStr return 10; }; const summaryValues = new Set(); - const presentationFields = [...record.fields, ...maesterPresentationFields]; + const presentationFields = [...record.fields, ...maesterPresentationFields, ...sectionBackground]; const maesterPresentationIndexes = new Set(maesterPresentationFields.map(field => field.index)); const summaryFields = presentationFields .filter(field => { @@ -413,7 +425,8 @@ export function FindingReader({ record, title, review: storedReview, previousPol {/* Ergebnisstatus als Outcome, nicht als Meta-Plakette: sonst ist `Investigate` optisch nicht von `Passed` zu unterscheiden. */} {statusField?.value && {highlightText(statusField.value, search)}} - {derivedCategories.map(category => {highlightText(category, search)})} + {/* The heading already names the CIS section; each number badge names its section on hover. */} + {derivedCategories.map(category => {highlightText(category, search)})} {badges.map(field => { const isSeverity = field.label.toLowerCase() === 'severity'; const scale = /^(?:category score|domain risk level)$/i.test(field.label.trim()) ? ' / 100' : ''; @@ -490,6 +503,7 @@ export function FindingReader({ record, title, review: storedReview, previousPol
)}
{/* Work tracking is opt-in below the finding so the first screen states the problem. */} +
Work tracking {[`Status: ${review.status}`, `Priority: ${review.priority}`, review.owner && `Owner: ${review.owner}`, review.due && `Due: ${review.due}`].filter(Boolean).join(' · ')} @@ -535,3 +549,4 @@ export function FindingReader({ record, title, review: storedReview, previousPol ); } +import { FindingReferences } from './FindingReferences'; diff --git a/src/features/finding-reader/FindingReferences.tsx b/src/features/finding-reader/FindingReferences.tsx new file mode 100644 index 0000000..20bcdc1 --- /dev/null +++ b/src/features/finding-reader/FindingReferences.tsx @@ -0,0 +1,30 @@ +import type { FindingRecord } from '../../domain/finding'; +import { TriangleIcon } from '../../components/TriangleIcon'; +import { PathText } from '../../components/PathText/PathText'; + +const labels = { active: 'Catalog match', deprecated: 'Deprecated', revoked: 'Revoked', 'not-in-catalog': 'Not found in this catalog' }; +export function FindingReferences({ record }: { record: FindingRecord }) { + const recognition = record.referenceRecognition; + if (!recognition) return record.findingOccurrenceId ?

Catalog references

+

Not indexed yet. Use “Recognize references” in this client’s Data Hub.

: null; + if (!recognition.references.length) return null; + return
+

Catalog references

+

Declared: stated by the source. Mentioned: found elsewhere in the finding text.

+ {recognition.references.map((reference, index) =>
+ {reference.framework === 'mitre-attack' ? 'ATT&CK' : 'D3FEND'} {reference.id}{reference.title ? ` · ${reference.title}` : ''} · {reference.evidence === 'declared' ? 'Declared' : 'Mentioned'} · {labels[reference.status]} + + + + {reference.source.fieldPath && } + + + + + + {reference.url && /^https:\/\/(?:attack\.mitre\.org|d3fend\.mitre\.org)\//.test(reference.url) + && } +
Original text{reference.source.text}
Source field{reference.source.fieldLabel} · {reference.source.fieldKey}
Source path
Text position{reference.source.representation}{reference.source.valuePath} · {reference.source.start}–{reference.source.end} (UTF-16; end excluded)
Catalog version{reference.catalogVersion}
Catalog SHA-256{reference.catalogSha256}
Recognition{recognition.recognizerVersion} · {recognition.createdAt} · {reference.matchedBy}
Run{recognition.runId}
Catalog entry{reference.url}
+
)} +
; +} diff --git a/src/features/finding-reader/first-read.ts b/src/features/finding-reader/first-read.ts index d48de31..a64ace4 100644 --- a/src/features/finding-reader/first-read.ts +++ b/src/features/finding-reader/first-read.ts @@ -43,6 +43,40 @@ export function firstReadConsumedFields(record: FindingRecord, toolId?: string): .map(patterns => fieldFor(record, patterns)).filter((field): field is RecordField => Boolean(field)); } +/** + * A declared native remediation subsection inside another field, used only when no dedicated + * remediation field exists. `background` is the retained text before the native heading. + */ +export function firstReadSectionSplit(record: FindingRecord, toolId?: string): + { field: RecordField; background: string; section: string } | undefined { + const definition = firstReadDefinition(toolId); + if (!definition?.nextStepSection || fieldFor(record, definition.nextStepHeaders)) return undefined; + const field = fieldFor(record, definition.nextStepSection.headers); + const heading = field ? definition.nextStepSection.heading.exec(field.value) : null; + if (!field || !heading) return undefined; + const section = field.value.slice(heading.index + heading[0].length).trim(); + return section ? { field, background: field.value.slice(0, heading.index).trim(), section } : undefined; +} + +/** Impact text before a declared native reference heading, and the retained references after it. */ +export function firstReadImpactSplit(record: FindingRecord, toolId?: string): + { field: RecordField; impact: string; references: string } | undefined { + const definition = firstReadDefinition(toolId); + const field = fieldFor(record, definition?.impactHeaders); + const marker = field && definition?.impactReferenceMarker ? definition.impactReferenceMarker.exec(field.value) : null; + if (!field || !marker) return undefined; + const references = field.value.slice(marker.index + marker[0].length).trim(); + return { field, impact: field.value.slice(0, marker.index).trim(), references }; +} + +/** + * Display paragraphs of prose whose paragraph breaks were lost in the export (`privileges.An attacker`). + * Only a sentence end directly followed by a capitalized word gets a break; no character is removed. + */ +export function restoredParagraphs(text: string): string { + return /\n/.test(text) ? text : text.replace(/([a-z][.!?])(?=[A-Z][a-z])/g, '$1\n\n'); +} + /** Ordering of the remaining explanatory fields: background first, references last. */ export function firstReadFieldRank(label: string, toolId?: string): number | undefined { const definition = firstReadDefinition(toolId); @@ -58,14 +92,72 @@ export function firstReadFieldRank(label: string, toolId?: string): number | und const plural = (count: number, word: string) => `${count} ${word}${count === 1 ? '' : 's'}`; const rowText = (row: FindingRecord) => row.fields.map(field => field.value.trim()).filter(Boolean).join(' · '); -/** Present an explicitly introduced PowerShell command separately without changing the retained source field. */ +/** + * Present an explicitly introduced PowerShell command separately without changing the retained source field. + * The introduction names a command or script within the same sentence and ends with a colon; the command + * starts with a cmdlet (`Verb-Noun`) or a variable assignment (`$name =`). + */ function separatePowerShellCommand(paragraph: string): { lead: string; command?: string } { - const introduction = /\b(?:PowerShell\s+)?command:\s*(?=(?:Get|Set|New|Remove|Enable|Disable|Test|Import|Export)-[A-Za-z][\w-]*\b)/i.exec(paragraph); + const introduction = /\b(?:[Pp]ower[Ss]hell\s+)?(?:[Cc]ommand|[Ss]cript)\b[^:.]{0,160}:\s*(?=(?:[A-Z][a-z]+-[A-Z][\w-]*\b|\$[A-Za-z_]\w*\s*=))/.exec(paragraph); if (!introduction || introduction.index === undefined) return { lead: paragraph }; const command = paragraph.slice(introduction.index + introduction[0].length).trim(); return command ? { lead: paragraph.slice(0, introduction.index + introduction[0].trimEnd().length), command } : { lead: paragraph }; } +const CMDLET_START = /^[A-Z][a-z]+-[A-Z][\w-]*\b/; + +/** + * Display layout of a PowerShell command whose line breaks were lost in the export. Only whitespace + * at the top nesting level outside quotes changes: a new statement that starts with a cmdlet after a + * closing bracket begins a new line, and a pipeline continues on an indented line after `|`. + * Every other character stays as retained, so the displayed text remains valid, copyable PowerShell. + */ +export function powerShellDisplayLines(command: string): string[] { + // A command that kept its own line breaks is shown exactly as retained. + if (/\n/.test(command)) return command.split(/\r?\n/); + const lines: string[] = []; + let current = ''; + let depth = 0; + let quote = ''; + let continuation = false; + const flush = () => { + if (current.trim()) lines.push(`${continuation ? ' ' : ''}${current.trim()}`); + current = ''; + }; + for (let index = 0; index < command.length; index += 1) { + const character = command[index]; + if (quote) { + current += character; + if (character === quote && command[index - 1] !== '`') quote = ''; + continue; + } + if (character === '"' || character === "'") { quote = character; current += character; continue; } + if ('({['.includes(character)) depth += 1; + if (')}]'.includes(character)) depth = Math.max(0, depth - 1); + if (depth === 0 && character === '|' && command[index + 1] !== '|' && command[index - 1] !== '|') { + current += character; + flush(); + continuation = true; + while (/\s/.test(command[index + 1] ?? '')) index += 1; + continue; + } + if (depth === 0 && /\s/.test(character)) { + const previous = current.trimEnd().slice(-1); + const rest = command.slice(index).trimStart(); + // Only after a closed expression: a cmdlet name after a plain word can be an argument (`Get-Help Get-ADUser`). + if (previous && /[)\]}]/.test(previous) && CMDLET_START.test(rest)) { + flush(); + continuation = false; + index += command.slice(index).length - rest.length - 1; + continue; + } + } + current += character; + } + flush(); + return lines; +} + export function findingFirstRead( record: FindingRecord, toolId: string | undefined, linkedSheets: DatasetSheet[], outcome?: CanonicalOutcome ): FindingFirstRead | undefined { @@ -100,9 +192,12 @@ export function findingFirstRead( } const impact = fieldFor(record, definition.impactHeaders); - if (impact) rows.push({ label: 'Impact', value: impact.value.trim() }); + const impactText = impact ? firstReadImpactSplit(record, toolId)?.impact ?? impact.value.trim() : ''; + if (impactText) rows.push({ label: 'Impact', value: restoredParagraphs(impactText) }); - const remediation = fieldFor(record, definition.nextStepHeaders); + const field = fieldFor(record, definition.nextStepHeaders); + const section = field ? undefined : firstReadSectionSplit(record, toolId); + const remediation = field ? { label: field.label, value: field.value } : section ? { label: section.field.label, value: section.section } : undefined; const [lead, ...rest] = remediation ? remediation.value.trim().split(/\n\s*\n/) : []; const nextStep = remediation ? { label: remediation.label, ...separatePowerShellCommand(lead.trim()), rest: rest.join('\n\n').trim() } : undefined; const linkField = fieldFor(record, definition.nextStepLinkHeaders); diff --git a/src/features/mitre-graph/MitreGraphView.tsx b/src/features/mitre-graph/MitreGraphView.tsx index 8868ed0..1a543c4 100644 --- a/src/features/mitre-graph/MitreGraphView.tsx +++ b/src/features/mitre-graph/MitreGraphView.tsx @@ -10,10 +10,8 @@ import { inlineResultTableSheets } from '../linked-results/inline-result-tables' import { resultMessageFor, resultOutcomeFor, resultSectionsFor } from '../linked-results/result-message'; import { useFilteredRecords } from '../search-filter/use-filtered-records'; import { toolIdForRecord } from '../../importers/status-normalization'; -import mitreData from '../../assets/data/mitre-enterprise-v18.1.json'; -import { buildFindingPathItems, loadStoredMitreMatrix, type FindingPathItem, type MitreGraphData } from './mitre-graph'; +import { activeMitreMatrix, buildFindingPathItems, MITRE_MATRIX_CHANGED_EVENT, type FindingPathItem, type MitreGraphData } from './mitre-graph'; -const defaultGraphData = mitreData as MitreGraphData; const severityLabels = { critical: 'Critical', high: 'High', medium: 'Medium', low: 'Low', info: 'Info', unknown: 'Unknown' } as const; // Fensterunterscheidungsfarben fuer gleichzeitig geoeffnete Result-Fenster. // Enthielten zwei violette Toene (#7c3aed, #6d28d9); ersetzt, weil violett als @@ -77,7 +75,12 @@ export function MitreGraphView({ onOpenFinding }: MitreGraphViewProps) { updateReview } = app; - const [graphData, setGraphData] = useState(() => loadStoredMitreMatrix() ?? defaultGraphData); + const [graphData, setGraphData] = useState(activeMitreMatrix); + useEffect(() => { + const refreshMatrix = () => setGraphData(activeMitreMatrix()); + globalThis.addEventListener(MITRE_MATRIX_CHANGED_EVENT, refreshMatrix); + return () => globalThis.removeEventListener(MITRE_MATRIX_CHANGED_EVENT, refreshMatrix); + }, []); const [category, setCategory] = useState('all'); const [severity, setSeverity] = useState('all'); const [originFilter, setOriginFilter] = useState('all'); diff --git a/src/features/mitre-graph/ObsidianGraphView.tsx b/src/features/mitre-graph/ObsidianGraphView.tsx index ac608fe..c4e6b65 100644 --- a/src/features/mitre-graph/ObsidianGraphView.tsx +++ b/src/features/mitre-graph/ObsidianGraphView.tsx @@ -12,14 +12,12 @@ import { ViewBookmarks } from '../view-bookmarks/ViewBookmarks'; import type { PathSnapshotState, ViewBookmark } from '../view-bookmarks/view-bookmarks'; import { toolIdForRecord } from '../../importers/status-normalization'; import { toolProfileDefinitions } from '../../profiles/profile-definition-catalog'; -import mitreData from '../../assets/data/mitre-enterprise-v18.1.json'; -import { buildFindingPathItems, loadStoredMitreMatrix, type FindingPathItem, type MitreGraphData } from './mitre-graph'; +import { activeMitreMatrix, buildFindingPathItems, MITRE_MATRIX_CHANGED_EVENT, type FindingPathItem, type MitreGraphData } from './mitre-graph'; import { buildObsidianGraph, type ObsidianGraphNode } from './obsidian-graph'; import { hiddenPathfinderFacetLabels } from './pathfinder-filter-trail'; import { FILTERED_GRAPH_SELECTION_ID, graphSelectionUnionNodeIds, selectedPathNodeIds } from './category-branch'; import { graphFacetSelectionForNode, relationNodeIdForFacetFilters, type GraphFacetSelection } from './graph-filter-bridge'; -const defaultGraphData = mitreData as MitreGraphData; const severityLabels = { critical: 'Critical', high: 'High', medium: 'Medium', low: 'Low', info: 'Info', unknown: 'Unknown' } as const; const graphNodeKindLabels = { finding: 'Finding', category: 'Category', defense: 'D3FEND', target: 'Target', technique: 'Technique', tactic: 'Tactic' } as const; // Fensterunterscheidungsfarben fuer gleichzeitig geoeffnete Result-Fenster. @@ -67,7 +65,12 @@ export const ObsidianGraphView = memo(ObsidianGraphContent); function ObsidianGraphContent({ active, onOpenFinding, pathSnapshotRequest, onPathSnapshotApplied }: ObsidianGraphViewProps) { const app = useApp(); const { dataset, activeSheet, activeSheetId, activeProfile, titleColumn, reviews, actionOnly, facetFilters, pathFindingIds, search: workSearch, statusFilter, setFacetFilter, setSelectedRecord, setView, toggleWorkspace, updateReview } = app; - const [graphData] = useState(() => loadStoredMitreMatrix() ?? defaultGraphData); + const [graphData, setGraphData] = useState(activeMitreMatrix); + useEffect(() => { + const refreshMatrix = () => setGraphData(activeMitreMatrix()); + globalThis.addEventListener(MITRE_MATRIX_CHANGED_EVENT, refreshMatrix); + return () => globalThis.removeEventListener(MITRE_MATRIX_CHANGED_EVENT, refreshMatrix); + }, []); const [selectedNodeId, setSelectedNodeId] = useState(''); const [pinnedNodeIds, setPinnedNodeIds] = useState([]); const [hoveredNodeId, setHoveredNodeId] = useState(''); diff --git a/src/features/mitre-graph/mitre-graph.ts b/src/features/mitre-graph/mitre-graph.ts index fc3db99..57751e9 100644 --- a/src/features/mitre-graph/mitre-graph.ts +++ b/src/features/mitre-graph/mitre-graph.ts @@ -1,6 +1,9 @@ +import { findingReferences } from '../../references/finding-reference-projection'; import type { FindingRecord, Severity } from '../../domain/finding'; -import { mitreBadgeLabel, normalizeSeverity } from '../../profiles/purple-knight/presentation'; +import { normalizeSeverity } from '../../profiles/purple-knight/presentation'; import { cisBenchmarkCategories } from '../../profiles/cis-cat/cis-benchmark-hierarchy'; +import mitreData from '../../assets/data/mitre-enterprise-v19.2.json'; +import { convertEnterpriseStix } from './mitre-stix'; export interface MitreTechnique { id: string; @@ -51,14 +54,31 @@ export interface FindingPathItem { } const STORAGE_KEY = 'assessor_custom_mitre_matrix'; +export const defaultMitreGraphData = mitreData as MitreGraphData; +export const MITRE_MATRIX_CHANGED_EVENT = 'assessor:mitre-matrix-changed'; +let serverMitreGraphData: MitreGraphData | null = null; + +export function setServerMitreMatrix(data: MitreGraphData): void { + const validated = validateMitreMatrixData(data); + const [major, minor] = validated.version.split('.').map(Number); + const [currentMajor, currentMinor] = (serverMitreGraphData?.version ?? defaultMitreGraphData.version).split('.').map(Number); + if (major < currentMajor || (major === currentMajor && minor < currentMinor)) return; + serverMitreGraphData = validated; + globalThis.dispatchEvent?.(new Event(MITRE_MATRIX_CHANGED_EVENT)); +} export function validateMitreMatrixData(raw: unknown): MitreGraphData { if (!raw || typeof raw !== 'object') throw new Error('Invalid MITRE matrix format: expected a JSON object.'); + if ('type' in raw && raw.type === 'bundle') return convertEnterpriseStix(raw); const data = raw as Partial; + if (typeof data.version !== 'string' || !/^\d+\.\d+$/.test(data.version)) throw new Error('Invalid MITRE matrix: a version is required.'); if (!Array.isArray(data.tacticOrder) || !data.tacticOrder.length) throw new Error('Invalid MITRE matrix: "tacticOrder" array is missing or empty.'); - if (!Array.isArray(data.techniques)) throw new Error('Invalid MITRE matrix: "techniques" array is missing.'); + if (!Array.isArray(data.techniques) || !data.techniques.length) throw new Error('Invalid MITRE matrix: "techniques" array is missing or empty.'); + if (data.techniques.some(t => !t || typeof t.id !== 'string' || !/^T\d{4}(?:\.\d{3})?$/.test(t.id) || typeof t.name !== 'string' || !t.name.trim())) { + throw new Error('Invalid MITRE matrix: a technique ID or name is invalid.'); + } return { - version: String(data.version ?? 'Updated'), + version: data.version, tacticOrder: data.tacticOrder.map(String), techniques: data.techniques.map(t => ({ id: String(t.id), @@ -91,12 +111,9 @@ export function clearStoredMitreMatrix(): void { globalThis.localStorage?.removeItem(STORAGE_KEY); } -const simplify = (value: string) => value - .trim() - .toLocaleLowerCase('en-US') - .replace(/&/g, 'and') - .replace(/[^a-z0-9]+/g, ' ') - .trim(); +export function activeMitreMatrix(): MitreGraphData { + return loadStoredMitreMatrix() ?? serverMitreGraphData ?? defaultMitreGraphData; +} const numberField = (record: FindingRecord, pattern: RegExp) => { const value = record.fields.find(field => pattern.test(field.label.trim()))?.value ?? ''; @@ -116,21 +133,14 @@ const severityRisk: Record = { export function extractFindingMitreFocus(records: FindingRecord[], tacticOrder: string[]): FindingMitreFocus { const techniqueIds = new Set(); const tactics = new Set(); - const tacticLookup = new Map(tacticOrder.map(tactic => [simplify(tactic), tactic])); + const graph = { ...defaultMitreGraphData, tacticOrder }; let findingCount = 0; - for (const record of records) { - const fields = record.fields.filter(field => mitreBadgeLabel(field.label) && field.value); - if (!fields.length) continue; - findingCount += 1; - for (const field of fields) { - for (const match of field.value.toUpperCase().matchAll(/\bT\d{4}(?:\.\d{3})?\b/g)) techniqueIds.add(match[0]); - const fragments = field.value.split(/[,;|/]+/); - for (const fragment of fragments) { - const normalized = simplify(fragment.replace(/\bT\d{4}(?:\.\d{3})?\b/gi, '')); - const tactic = tacticLookup.get(normalized); - if (tactic) tactics.add(tactic); - } + const references = findingReferences(record, graph).filter(ref => ref.framework === 'mitre-attack' && ref.status === 'active'); + if (references.length) findingCount++; + for (const ref of references) { + if (ref.kind === 'technique') techniqueIds.add(ref.id); + if (ref.kind === 'tactic') tactics.add(ref.title!); } } @@ -138,30 +148,14 @@ export function extractFindingMitreFocus(records: FindingRecord[], tacticOrder: } export function buildFindingPathItems(records: FindingRecord[], data: MitreGraphData, titleColumn = '', fallbackToolId?: string): FindingPathItem[] { - const tacticLookup = new Map(data.tacticOrder.map(tactic => [simplify(tactic), tactic])); - const techniqueLookup = new Map(data.techniques.map(technique => [technique.id, technique])); - const headerKinds = new Map(); - const headerKind = (label: string) => { - let kind = headerKinds.get(label); - if (kind === undefined) { kind = mitreBadgeLabel(label); headerKinds.set(label, kind); } - return kind; - }; - return records.map(record => { - const mitreFields = record.fields.filter(field => field.value && headerKind(field.label)); - const attackFields = mitreFields.filter(field => headerKind(field.label) === 'MITRE ATT&CK'); - const defenseFields = mitreFields.filter(field => headerKind(field.label) !== 'MITRE ATT&CK'); - const hasNativeMitreField = attackFields.length > 0; - const techniqueIds = [...new Set(attackFields.flatMap(field => [...field.value.toUpperCase().matchAll(/\bT\d{4}(?:\.\d{3})?\b/g)].map(match => match[0])))]; - const tactics = new Set(); - for (const id of techniqueIds) for (const tactic of techniqueLookup.get(id)?.tactics ?? []) tactics.add(tactic); - for (const field of attackFields) { - for (const fragment of field.value.split(/[,;|/]+/)) { - const tactic = tacticLookup.get(simplify(fragment.replace(/\bT\d{4}(?:\.\d{3})?\b/gi, ''))); - if (tactic) tactics.add(tactic); - } - } - const orderedTactics = data.tacticOrder.filter(tactic => tactics.has(tactic)); + const references = findingReferences(record, data).filter(ref => ref.status === 'active'); + const attackReferences = references.filter(ref => ref.framework === 'mitre-attack'); + const hasNativeMitreField = attackReferences.some(ref => ref.evidence === 'declared'); + const techniqueIds = [...new Set(attackReferences.filter(ref => ref.kind === 'technique').map(ref => ref.id))]; + const tactics = new Set(attackReferences.flatMap(ref => ref.tactics)); + const orderedTactics = [...data.tacticOrder.filter(tactic => tactics.has(tactic)), + ...[...tactics].filter(tactic => !data.tacticOrder.includes(tactic))]; const severityValue = record.fields.find(field => /^(severity|criticality|priority)$/i.test(field.label.trim()))?.value; const severity = normalizeSeverity(severityValue); const weight = numberField(record, /^weight$/i); @@ -176,10 +170,7 @@ export function buildFindingPathItems(records: FindingRecord[], data: MitreGraph ...cisBenchmarkCategories(record, fallbackToolId) ])]; const category = categories[0] ?? ''; - const defenses = [...new Set(defenseFields - .flatMap(field => field.value.split(/[;|]+/)) - .map(value => value.trim()) - .filter(Boolean))]; + const defenses = [...new Set(references.filter(ref => ref.framework === 'mitre-d3fend').map(ref => `${ref.id} · ${ref.title}`))]; const targets = [...new Set(record.fields .filter(field => /^(?:target|ziel|betroffenes objekt|asset|host|hostname|domain|resource|system)$/i.test(field.label.trim()) && field.value) .flatMap(field => field.value.split(/[;|]+/)) diff --git a/src/features/mitre-graph/mitre-stix.ts b/src/features/mitre-graph/mitre-stix.ts new file mode 100644 index 0000000..904740f --- /dev/null +++ b/src/features/mitre-graph/mitre-stix.ts @@ -0,0 +1,87 @@ +import type { MitreGraphData, MitreEntity, MitreTechnique } from './mitre-graph'; + +interface StixObject { + id?: string; + type?: string; + name?: string; + revoked?: boolean; + x_mitre_deprecated?: boolean; + x_mitre_version?: string; + x_mitre_shortname?: string; + x_mitre_platforms?: string[]; + tactic_refs?: string[]; + kill_chain_phases?: { kill_chain_name?: string; phase_name?: string }[]; + external_references?: { source_name?: string; external_id?: string; url?: string }[]; + relationship_type?: string; + source_ref?: string; + target_ref?: string; +} + +const active = (item: StixObject) => !item.revoked && !item.x_mitre_deprecated; +const attackReference = (item: StixObject) => item.external_references?.find(reference => reference.source_name === 'mitre-attack'); +const byId = (left: { id: string }, right: { id: string }) => left.id.localeCompare(right.id); + +/** Convert MITRE's Enterprise ATT&CK STIX 2.1 bundle to the compact Pathfinder catalog. */ +export function convertEnterpriseStix(raw: unknown): MitreGraphData { + if (!raw || typeof raw !== 'object' || !('type' in raw) || raw.type !== 'bundle' + || !('objects' in raw) || !Array.isArray(raw.objects)) { + throw new Error('Expected an Enterprise ATT&CK STIX bundle.'); + } + const objects = raw.objects as StixObject[]; + const collection = objects.find(item => item.type === 'x-mitre-collection' && item.name === 'Enterprise ATT&CK'); + const matrix = objects.find(item => item.type === 'x-mitre-matrix' && item.name === 'Enterprise ATT&CK' && active(item)); + if (!collection?.x_mitre_version || !matrix?.tactic_refs?.length) { + throw new Error('Enterprise ATT&CK collection version or tactic matrix is missing.'); + } + + const tactics = new Map(objects.filter(item => item.type === 'x-mitre-tactic' && active(item)).map(item => [item.id, item])); + const ordered = matrix.tactic_refs.map(id => tactics.get(id)); + if (ordered.some(item => !item?.name || !item.x_mitre_shortname)) { + throw new Error('Enterprise ATT&CK matrix references an unavailable tactic.'); + } + const tacticOrder = ordered.map(item => item!.name!); + const tacticNames = new Map(ordered.map(item => [item!.x_mitre_shortname!, item!.name!])); + const techniqueStixIds = new Map(); + const techniques: MitreTechnique[] = objects.filter(item => item.type === 'attack-pattern' && active(item)).flatMap(item => { + const reference = attackReference(item); + if (!item.id || !item.name || !reference?.external_id || !/^T\d{4}(?:\.\d{3})?$/.test(reference.external_id)) return []; + const mappedTactics = [...new Set((item.kill_chain_phases ?? []) + .filter(phase => phase.kill_chain_name === 'mitre-attack') + .map(phase => tacticNames.get(phase.phase_name ?? '')) + .filter((name): name is string => Boolean(name)))]; + if (!mappedTactics.length) return []; + techniqueStixIds.set(item.id, reference.external_id); + return [{ + id: reference.external_id, + name: item.name, + tactics: tacticOrder.filter(name => mappedTactics.includes(name)), + platforms: Array.isArray(item.x_mitre_platforms) ? item.x_mitre_platforms : [], + parent: reference.external_id.includes('.') ? reference.external_id.split('.')[0] : null, + url: reference.url ?? `https://attack.mitre.org/techniques/${reference.external_id.replace('.', '/')}`, + sourceCount: item.external_references?.length ?? 0 + }]; + }).sort(byId); + if (!techniques.length) throw new Error('Enterprise ATT&CK bundle contains no active techniques.'); + + const entityTypes: Record = { + 'intrusion-set': 'group', campaign: 'campaign', malware: 'software', tool: 'software' + }; + const entitiesByStixId = new Map(); + for (const item of objects) { + const type = entityTypes[item.type ?? '']; + const reference = attackReference(item); + if (type && active(item) && item.id && item.name && reference?.external_id) { + entitiesByStixId.set(item.id, { id: reference.external_id, name: item.name, type, techniques: [] }); + } + } + for (const item of objects) { + if (item.type !== 'relationship' || item.relationship_type !== 'uses' || !active(item)) continue; + const entity = entitiesByStixId.get(item.source_ref ?? ''); + const techniqueId = techniqueStixIds.get(item.target_ref ?? ''); + if (entity && techniqueId && !entity.techniques.includes(techniqueId)) entity.techniques.push(techniqueId); + } + const entities = [...entitiesByStixId.values()].sort(byId).map(entity => ({ + ...entity, techniques: entity.techniques.sort() + })); + return { version: collection.x_mitre_version, tacticOrder, techniques, entities }; +} diff --git a/src/features/project-import/DataHub.tsx b/src/features/project-import/DataHub.tsx index 9e85d2f..1254912 100644 --- a/src/features/project-import/DataHub.tsx +++ b/src/features/project-import/DataHub.tsx @@ -15,7 +15,9 @@ import { PanelLoadingState } from '../../components/PanelLoadingState/PanelLoadi import { BackendConnectionDialog } from '../../components/BackendConnectionDialog/BackendConnectionDialog'; import { MicrosoftBaselineLibrary } from './MicrosoftBaselineLibrary'; import { MitreMatrixLibrary } from './MitreMatrixLibrary'; -import { clearStoredMitreMatrix, loadStoredMitreMatrix, saveStoredMitreMatrix, validateMitreMatrixData } from '../mitre-graph/mitre-graph'; +import { ReferenceRecognitionPanel } from './ReferenceRecognitionPanel'; +import { activeMitreMatrix, clearStoredMitreMatrix, loadStoredMitreMatrix, MITRE_MATRIX_CHANGED_EVENT, saveStoredMitreMatrix, setServerMitreMatrix, validateMitreMatrixData } from '../mitre-graph/mitre-graph'; +import { downloadBrowserBlob } from '../../platform/browser/browser-download-adapter'; import { TriangleIcon } from '../../components/TriangleIcon'; import { DatahubHistoryOverview, type DatahubTimeslotSelection } from './DatahubHistoryOverview'; import { comparableTimeslotSources, type DatahubTimeslotResultMetrics } from './datahub-scan-analysis'; @@ -24,11 +26,12 @@ import { summarizeScanProcessingReadiness } from './datahub-processing-readiness import { compareReimportSourceHashes } from '../../domain/reimport-source'; import { loadTimeslotOpenReadiness, type TimeslotOpenReadiness } from './datahub-open-readiness'; import { DatahubMetricsCache } from './datahub-metrics-cache'; +import { useReferenceRecognitionStatus } from './use-reference-recognition-status'; +import { datahubScanLabel } from './datahub-scan-labels'; const assessorApi = new AssessorApiClient(); const metricsCache = new DatahubMetricsCache(scope => assessorApi.getTimeslotResultMetrics( scope.projectId, scope.scanRunIds, scope.assessmentIds)); -const SHOW_MITRE_MATRIX_LIBRARY = false; type BackendStatus = 'connected' | 'checking' | 'unavailable'; interface DataHubProps { @@ -84,7 +87,8 @@ function groupScanReports(files: ImportFileRecord[], scanRuns: ScanRun[] = []): scanRunId, scanRunIds: [scanRunId], assessmentIds: run ? [run.assessmentId] : [], - tool: run?.tool ?? runFiles[0].detectedTool, + tool: { ...(run?.tool ?? runFiles[0].detectedTool), + name: datahubScanLabel(run?.tool ?? runFiles[0].detectedTool, scanRunId, runFiles) }, files: runFiles, gpoBackups: [], sourceCount: 1, @@ -100,6 +104,9 @@ function groupScanReports(files: ImportFileRecord[], scanRuns: ScanRun[] = []): } export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChanged, onDetailViewChanged, backendStatus }: DataHubProps) { const [projects, setProjects] = useState([]); + const [referenceRefreshKey, setReferenceRefreshKey] = useState(0); + const { states: projectReferenceReadiness, reportStatus: reportReferenceStatus } = useReferenceRecognitionStatus( + projects, backendStatus === 'connected', referenceRefreshKey); const [projectData, setProjectData] = useState>({}); const [projectHistory, setProjectHistory] = useState>({}); const [projectGpoData, setProjectGpoData] = useState>({}); @@ -116,6 +123,8 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang const [error, setError] = useState(null); const [saveFeedback, setSaveFeedback] = useState(null); const [mitreStatus, setMitreStatus] = useState(() => loadStoredMitreMatrix()); + const [mitreActiveVersion, setMitreActiveVersion] = useState(() => activeMitreMatrix().version); + const [mitreBusy, setMitreBusy] = useState<'refresh' | 'download' | 'upload' | null>(null); const [mitreError, setMitreError] = useState(null); const [mitreFeedback, setMitreFeedback] = useState(null); const [scanSelection, setScanSelection] = useState(null); @@ -129,6 +138,7 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang const [timeslotDialogOpen, setTimeslotDialogOpen] = useState(false); const [timeslotDate, setTimeslotDate] = useState(''); const [scanReadiness, setScanReadiness] = useState>({}); + const [scanLabels, setScanLabels] = useState>({}); const [projectOpenReadiness, setProjectOpenReadiness] = useState>>({}); const [detailSection, setDetailSection] = useState('client-information'); const projectModelsCache = useRef(new Map()); @@ -142,11 +152,58 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang useEffect(() => () => onDetailViewChanged?.(false), [onDetailViewChanged]); + useEffect(() => { + let mounted = true; + void assessorApi.getMitreCatalog().then(state => { + if (!mounted) return; + setServerMitreMatrix(state.catalog); + setMitreActiveVersion(activeMitreMatrix().version); + }).catch(() => undefined); + return () => { mounted = false; }; + }, []); + + const handleMitreRefresh = async () => { + setMitreBusy('refresh'); + setMitreError(null); + setMitreFeedback(null); + try { + const result = await assessorApi.refreshMitreCatalog(); + clearStoredMitreMatrix(); + setMitreStatus(null); + setServerMitreMatrix(result.catalog); + setMitreActiveVersion(result.catalog.version); + setReferenceRefreshKey(current => current + 1); + setMitreFeedback(result.updated + ? `Enterprise ATT&CK v${result.catalog.version} is active in ASSESSOR.` + : `Enterprise ATT&CK v${result.catalog.version} is already current.`); + } catch (error) { + setMitreError(error instanceof Error ? error.message : 'MITRE could not be updated.'); + } finally { + setMitreBusy(null); + } + }; + + const handleMitreDownload = async () => { + setMitreBusy('download'); + setMitreError(null); + setMitreFeedback(null); + try { + const source = await assessorApi.downloadLatestMitreSource(); + downloadBrowserBlob(source.blob, source.fileName); + setMitreFeedback(`Official MITRE file ${source.fileName} downloaded.`); + } catch (error) { + setMitreError(error instanceof Error ? error.message : 'MITRE could not be downloaded.'); + } finally { + setMitreBusy(null); + } + }; + const handleMitreUpload = async (event: React.ChangeEvent) => { const file = event.target.files?.[0]; if (!file) return; setMitreError(null); setMitreFeedback(null); + setMitreBusy('upload'); setOperationProgress('Importing MITRE Matrix'); try { const text = await file.text(); @@ -154,12 +211,14 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang const validated = validateMitreMatrixData(parsed); saveStoredMitreMatrix(validated); setMitreStatus(validated); + setMitreActiveVersion(validated.version); setMitreFeedback(`MITRE Matrix version ${validated.version} (${validated.techniques.length} techniques, ${validated.tacticOrder.length} tactics) updated successfully.`); - globalThis.dispatchEvent(new CustomEvent('assessor:mitre-matrix-changed')); + globalThis.dispatchEvent(new Event(MITRE_MATRIX_CHANGED_EVENT)); } catch (err) { setMitreError(err instanceof Error ? err.message : 'Error loading the MITRE Matrix JSON.'); } finally { setOperationProgress(undefined); + setMitreBusy(null); event.target.value = ''; } }; @@ -167,9 +226,10 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang const handleMitreReset = () => { clearStoredMitreMatrix(); setMitreStatus(null); - setMitreFeedback('Default matrix v18.1 restored.'); + setMitreActiveVersion(activeMitreMatrix().version); + setMitreFeedback(`Active catalog v${activeMitreMatrix().version} restored.`); setMitreError(null); - globalThis.dispatchEvent(new CustomEvent('assessor:mitre-matrix-changed')); + globalThis.dispatchEvent(new Event(MITRE_MATRIX_CHANGED_EVENT)); }; const loadProjects = useCallback(async () => { @@ -208,6 +268,7 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang setProjectData(Object.fromEntries(data.map(item => [item.projectId, item.files]))); setProjectHistory(Object.fromEntries(data.map(item => [item.projectId, item.history]))); setProjectGpoData(Object.fromEntries(data.map(item => [item.projectId, item.gpoRecords]))); + setReferenceRefreshKey(current => current + 1); setMetricsRevision(health.repositoryRevision); // Open-readiness checks are independent of the six result metrics. Start // them after the overview is available so they cannot hold back the rings. @@ -373,12 +434,16 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang const projectId = form?.project?.id; if (!projectId || editedReports.length === 0) { setScanReadiness({}); + setScanLabels({}); return; } let cancelled = false; + setScanLabels({}); setScanReadiness(Object.fromEntries(editedReports.map(report => [report.scanRunId, 'checking']))); void loadProjectModels(projectId).then(models => { if (cancelled) return; + setScanLabels(Object.fromEntries(editedReports.map(report => [report.scanRunId, + datahubScanLabel(report.tool, report.scanRunId, report.files, models)]))); setScanReadiness(Object.fromEntries(editedReports.map(report => [ report.scanRunId, datahubScanReadiness(models, report.scanRunId, report.tool.id) @@ -788,7 +853,10 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang {reports.length === 0 && group.gpoBackups.length === 0 ?

No sources

This timeslot does not contain a scan report or GPO backup yet.

:
- {reports.map(report => { + {reports.map(sourceReport => { + const report = scanLabels[sourceReport.scanRunId] + ? { ...sourceReport, tool: { ...sourceReport.tool, name: scanLabels[sourceReport.scanRunId] } } + : sourceReport; const readiness = scanReadiness[report.scanRunId] ?? 'checking'; const processing = processingByRun.get(report.scanRunId)!; const viewable = isDatahubScanViewable(readiness); @@ -862,7 +930,12 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang {form.project && }

{form.mode === 'create' ? 'Create Client' : form.project?.name}

{form.project &&

{formatTenantDate(form.project.createdAt)}

}
- {form.mode === 'edit' && filesSection} + {form.mode === 'edit' &&
+ {form.project && onProjectDataChanged?.(form.project!.id)}/>} + {filesSection} +
}
{detailSection === 'client-information' ?
@@ -893,6 +966,7 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang projectHistory={projectHistory} projectGpoData={projectGpoData} projectOpenReadiness={projectOpenReadiness} + projectReferenceReadiness={projectReferenceReadiness} selection={scanSelection} timeslotMetrics={timeslotMetrics} loading={loading} @@ -903,15 +977,19 @@ export function DataHub({ activeProjectId, onProjectSelected, onProjectDataChang onOpen={(project, scanRunIds, assessmentIds) => onProjectSelected(project, scanRunIds, assessmentIds)} onSelectProject={selectProject} /> -
+
- {SHOW_MITRE_MATRIX_LIBRARY && void handleMitreRefresh()} + onDownload={() => void handleMitreDownload()} onUpload={event => void handleMitreUpload(event)} onReset={handleMitreReset} - />} + />
} {scanDeleteTarget && !busy && setScanDeleteTarget(null)}>
{scanDeleteTarget.tool.name}

{new Date(scanDeleteTarget.fileDate).toLocaleString('en-US')} · {scanDeleteTarget.fileCount} file{scanDeleteTarget.fileCount === 1 ? '' : 's'}

The scan report, its findings, evidence, and scan-related mappings will be permanently deleted. Other scan reports for this client remain intact.

} diff --git a/src/features/project-import/DatahubHistoryOverview.tsx b/src/features/project-import/DatahubHistoryOverview.tsx index 2d1080f..23c2955 100644 --- a/src/features/project-import/DatahubHistoryOverview.tsx +++ b/src/features/project-import/DatahubHistoryOverview.tsx @@ -1,7 +1,7 @@ import type { GpoBackupStatusRecord, ProjectAssessmentHistoryResponse } from '../../api/assessor-api-contract'; import type { AssessmentProject, ImportFileRecord } from '../../domain/canonical-model'; import { groupProjectImportFiles } from './datahub-import-groups'; -import { summarizeClientProcessingReadiness } from './datahub-processing-readiness'; +import { summarizeClientProcessingReadiness, withReferenceReadiness, type DatahubReferenceReadiness } from './datahub-processing-readiness'; import type { DatahubTimeslotResultMetrics } from './datahub-scan-analysis'; import { DonutMetricCard } from '../../components/DonutMetricCard/DonutMetricCard'; import type { TimeslotOpenReadiness } from './datahub-open-readiness'; @@ -18,6 +18,7 @@ interface DatahubHistoryOverviewProps { projectHistory: Record; projectGpoData: Record; projectOpenReadiness?: Record>; + projectReferenceReadiness?: Record; selection: DatahubTimeslotSelection | null; timeslotMetrics: DatahubTimeslotResultMetrics | null; loading: boolean; @@ -44,6 +45,7 @@ export function DatahubHistoryOverview({ projectHistory, projectGpoData, projectOpenReadiness = {}, + projectReferenceReadiness = {}, selection, timeslotMetrics, loading, @@ -85,11 +87,11 @@ export function DatahubHistoryOverview({ const latest = groups[0]; const latestOpenable = groups.find(group => projectOpenReadiness[project.id]?.[group.id]?.canOpen); const activeProcessingRunIds = groups.flatMap(group => group.scanRunIds); - const processingSummary = summarizeClientProcessingReadiness( + const processingSummary = withReferenceReadiness(summarizeClientProcessingReadiness( projectData[project.id] ?? [], activeProcessingRunIds, projectGpoData[project.id] ?? [] - ); + ), projectReferenceReadiness[project.id]); const selected = selection?.projectId === project.id; return
{processingSummary.state !== 'no-data' && ): void; onReset(): void; } @@ -14,21 +18,32 @@ interface MitreMatrixLibraryProps { * Wiederherstellung der Standardmatrix erscheint nur, wenn eine eigene Matrix * geladen ist - ohne sie gaebe es keinen Weg zurueck. */ -export function MitreMatrixLibrary({ status, feedback, error, onUpload, onReset }: MitreMatrixLibraryProps) { +export function MitreMatrixLibrary({ status, activeVersion, busy, feedback, error, onRefresh, onDownload, onUpload, onReset }: MitreMatrixLibraryProps) { return