{ "type": "bundle", "id": "bundle--58c38583-fcc5-49ed-8a05-0dfe305e0c41", "spec_version": "2.0", "objects": [ { "id": "attack-pattern--2b9a666e-bd59-4f67-9031-ed41b428e04a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Acquire OSINT data sets and information", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1266).\n\nOpen source intelligence (OSINT) provides free, readily available information about a target while providing the target no indication they are of interest. Such information can assist an adversary in crafting a successful approach for compromise. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1266", "external_id": "T1266" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "This activity is indistinguishable from legitimate business uses and easy to obtain.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Possible to gather digital intelligence about a person is easily aided by social networking sites, free/for fee people search engines, and publicly available information (e.g., county databases on tickets/DUIs).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1043", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--784ff1bc-1483-41fe-a172-4cd9ae25c06b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Acquire OSINT data sets and information", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1247).\n\nOpen source intelligence (OSINT) is intelligence gathered from publicly available sources. This can include both information gathered on-line, such as from search engines, as well as in the physical world. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1247", "external_id": "T1247" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "This activity is indistinguishable from legitimate business uses and easy to obtain. Direct access to the selected target is not required for the adversary to conduct this technique. There is a limited ability to detect this by looking at referrer fields on local web site accesses (e.g., a person who has accessed your web servers from [https://www.shodan.io Shodan]).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Possible to gather technical intelligence about Internet accessible systems/devices by obtaining various commercial data sets and supporting business intelligence tools for ease of analysis. Commercial data set examples include advertising content delivery networks, Internet mapping/traffic collections, system fingerprinting data sets, device fingerprinting data sets, etc.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1024", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--028ad431-84c5-4eb7-a364-2b797c234f88", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Acquire OSINT data sets and information", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1277).\n\nData sets can be anything from Security Exchange Commission (SEC) filings to public phone numbers. Many datasets are now either publicly available for free or can be purchased from a variety of data vendors. Open source intelligence (OSINT) is intelligence gathered from publicly available sources. This can include both information gathered on-line as well as in the physical world. (Citation: SANSThreatProfile) (Citation: Infosec-osint) (Citation: isight-osint)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1277", "external_id": "T1277" }, { "source_name": "SANSThreatProfile", "description": "Stephen Irwin. (2014, September 8). Creating a Threat Profile for Your Organization. Retrieved March 5, 2017." }, { "source_name": "Infosec-osint", "description": "InfoSec Institute. (2013, September 11). OSINT (Open-Source Intelligence). Retrieved May 9, 2017." }, { "source_name": "isight-osint", "description": "Dawn Lomer. (2017). 101+ OSINT Resources for Investigators. Retrieved May 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "This activity is indistinguishable from legitimate business uses and easy to obtain.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Large quantities of data exists on people, organizations and technologies whether divulged wittingly or collected as part of doing business on the Internet (unbeknownst to the user/company). Search engine and database indexing companies continuously mine this information and make it available to anyone who queries for it.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1054", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--795c1a92-3a26-453e-b99a-6a566aa94dc6", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Acquire and/or use 3rd party infrastructure services", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1329).\n\nA wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available. Additionally botnets are available for rent or purchase. Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down. (Citation: TrendmicroHideoutsLease)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1329", "external_id": "T1329" }, { "source_name": "TrendmicroHideoutsLease", "description": "Max Goncharov. (2015, July 15). Criminal Hideouts for Lease: Bulletproof Hosting Services. Retrieved March 6, 2017.", "url": "https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1106", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Wide variety of cloud/VPS/hosting/compute/storage solutions available for adversary to acquire freely or at a low cost.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Hard to differentiate from standard business operations.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--286cc500-4291-45c2-99a1-e760db176402", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Acquire and/or use 3rd party infrastructure services", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1307).\n\nA wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available. Additionally botnets are available for rent or purchase. Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down. (Citation: LUCKYCAT2012)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1307", "external_id": "T1307" }, { "source_name": "LUCKYCAT2012", "description": "Forward-Looking Threat Research Team. (2012). LUCKYCAT REDUX: Inside an APT Campaign with Multiple Targets in India and Japan. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "3rd party services highly leveraged by legitimate services, hard to distinguish from background noise. While an adversary can use their own infrastructure, most know this is a sure- re way to get caught. To add degrees of separation, they can buy or rent from another adversary or accomplice.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Wide range of 3rd party services for hosting, rotating, or moving C2, static data, exploits, exfiltration, etc.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1084", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--1a295f87-af63-4d94-b130-039d6221fb11", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Acquire and/or use 3rd party software services", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1308).\n\nA wide variety of 3rd party software services are available (e.g., [Twitter](https://twitter.com), [Dropbox](https://www.dropbox.com), [GoogleDocs](https://www.google.com/docs/about)). Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down. (Citation: LUCKYCAT2012) (Citation: Nemucod Facebook)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1308", "external_id": "T1308" }, { "source_name": "LUCKYCAT2012", "description": "Forward-Looking Threat Research Team. (2012). LUCKYCAT REDUX: Inside an APT Campaign with Multiple Targets in India and Japan. Retrieved March 1, 2017." }, { "source_name": "Nemucod Facebook", "description": "Bart Blaze. (2016, November 20). Nemucod downloader spreading via Facebook. Retrieved March 28, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender will not have visibility over account creation for 3rd party software services.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "3rd party services like these listed are freely available.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1085", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--488da8ed-2887-4ef6-a39a-5b69bc6682c6", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Acquire and/or use 3rd party software services", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1330).\n\nA wide variety of 3rd party software services are available (e.g., [Twitter](https://twitter.com), [Dropbox](https://www.dropbox.com), [GoogleDocs](https://www.google.com/docs/about)). Use of these solutions allow an adversary to stage, launch, and execute an attack from infrastructure that does not physically tie back to them and can be rapidly provisioned, modified, and shut down. (Citation: LOWBALL2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1330", "external_id": "T1330" }, { "source_name": "LOWBALL2015", "description": "FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender will not have visibility over account creation for 3rd party software services.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "3rd party services like these listed are freely available.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1107", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--e5164428-03ca-4336-a9a7-4d9ea1417e59", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Acquire or compromise 3rd party signing certificates", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1310).\n\nCode signing is the process of digitally signing executables or scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Users may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. (Citation: Adobe Code Signing Cert)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1310", "external_id": "T1310" }, { "description": "Brad Arkin. (2012, September 27). Inappropriate Use of Adobe Code Signing Certificate. Retrieved March 28, 2017.", "source_name": "Adobe Code Signing Cert" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1087", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "It is trivial to purchase code signing certificates within an organization; many exist and are available at reasonable cost. It is complex to factor or steal 3rd party code signing certificates for use in malicious mechanisms", "x_mitre_difficulty_for_adversary": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender will not know what certificates an adversary acquires from a 3rd party. Defender will not know prior to public disclosure if a 3rd party has had their certificate compromised.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--03f4a766-7a21-4b5e-9ccf-e0cf422ab983", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Acquire or compromise 3rd party signing certificates", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1332).\n\nCode signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Users may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. (Citation: DiginotarCompromise)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1332", "external_id": "T1332" }, { "description": "Fisher, D. (2012, October 31). Final Report on DigiNotar Hack Shows Total Compromise of CA Servers. Retrieved March 6, 2017.", "source_name": "DiginotarCompromise", "url": "https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-103112/77170/" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1109", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "It is trivial to purchase code signing certificates within an organization; many exist and are available at reasonable cost. It is complex to factor or steal 3rd party code signing certificates for use in malicious mechanisms", "x_mitre_difficulty_for_adversary": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender will not know what certificates an adversary acquires from a 3rd party. Defender will not know prior to public disclosure if a 3rd party has had their certificate compromised.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--b3f36317-3940-4d71-968f-e11ac1bf6a31", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Aggregate individual's digital footprint", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1275).\n\nIn addition to a target's social media presence may exist a larger digital footprint, such as accounts and credentials on e-commerce sites or usernames and logins for email. An adversary familiar with a target's username can mine to determine the target's larger digital footprint via publicly available sources. (Citation: DigitalFootprint) (Citation: trendmicro-vtech)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1275", "external_id": "T1275" }, { "source_name": "DigitalFootprint", "description": "Christopher Budd. (2016, June 27). The importance of understanding your digital footprint. Retrieved May 4, 2017." }, { "source_name": "trendmicro-vtech", "description": "Christopher Budd. (2015, December 1). Understanding the Risks of the VTech Data Breach. Retrieved May 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Searching publicly available sources that cannot be monitored by a defender.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Information readily available through searches", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1052", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--fe421ab9-c8f3-42f7-9ae1-5d6c324cc925", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze application security posture", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1293).\n\nAn adversary can probe a victim's network to determine configurations. The configurations may provide opportunities to route traffic through the network in an undetected or less detectable way. (Citation: Li2014ExploitKits) (Citation: RecurlyGHOST)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1293", "external_id": "T1293" }, { "source_name": "Li2014ExploitKits", "description": "Brooks Li. (2014, December 17). What\u2019s New in Exploit Kits in 2014. Retrieved March 6, 2017." }, { "source_name": "RecurlyGHOST", "description": "Mark Poole. (2015, January 27). GHOST vulnerability (CVE-2015-0235) in popular Linux library glibc allows remote code execution. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "This can be done offline after the data has been collected.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Analyze technical scanning results to identify weaknesses in the configuration or architecture. Many of the common tools highlight these weakness automatically (e.g., software security scanning tools or published vulnerabilities about commonly used libraries).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1070", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--87775365-2081-4b6e-99bd-48a3b8f36563", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze architecture and configuration posture", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1288).\n\nAn adversary may analyze technical scanning results to identify weaknesses in the configuration or architecture of a victim network. These weaknesses could include architectural flaws, misconfigurations, or improper security controls. (Citation: FireEyeAPT28)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1288", "external_id": "T1288" }, { "source_name": "FireEyeAPT28", "description": "FireEye, Inc. (2014). APT 28: A Window into Russia\u2019s Cyber Espionage Operations?. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "This can be done offline after the data has been collected.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Many of the common tools highlight these weakness automatically.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1065", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--57619ab3-f6a5-43c8-8dd1-b0b8a986a870", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze business processes", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1301).\n\nBusiness processes, such as who typically communicates with who, or what the supply chain is for a particular part, provide opportunities for social engineering or other (Citation: Warwick2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1301", "external_id": "T1301" }, { "source_name": "Warwick2015", "description": "Warwick Ashford. (2015, March). Cyber crime: What every business needs to know. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Social engineering and other attempts to learn about business practices and processes would not immediately be associated with an impending cyber event.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "To get any kind of fidelity into business processes would require insider access. Basic processes could be mapped, but understanding where in the organization these processes take place and who to target during any given phase of the process would generally be difficult.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1078", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--773950e1-090c-488b-a480-9ff236312e31", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze data collected", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1287).\n\nAn adversary will assess collected information such as software/hardware versions, vulnerabilities, patch level, etc. They will analyze technical scanning results to identify weaknesses in the confirmation or architecture. (Citation: SurveyDetectionStrategies) (Citation: CyberReconPaper) (Citation: RSA-APTRecon) (Citation: FireEyeAPT28)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1287", "external_id": "T1287" }, { "source_name": "SurveyDetectionStrategies", "description": "Jamal Raiyn. (2014). A survey of Cyber Attack Detection Strategies. Retrieved March 5, 2017." }, { "source_name": "CyberReconPaper", "description": "H. P. Sanghvi and M. S. Dahiya. (2013, February). Cyber Reconnaissance: An Alarm before Cyber Attack. Retrieved March 5, 2017." }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." }, { "source_name": "FireEyeAPT28", "description": "FireEye, Inc. (2014). APT 28: A Window into Russia\u2019s Cyber Espionage Operations?. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "This can be done offline after the data has been collected.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Many of the common tools highlight these weaknesses automatically. Adversary can \"dry run\" against the target using known exploits or burner devices to determine key identifiers of software, hardware, and services.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1064", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--a1e8d61b-22e1-4983-8485-96420152ecd8", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze hardware/software security defensive capabilities", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1294).\n\nAn adversary can probe a victim's network to determine configurations. The configurations may provide opportunities to route traffic through the network in an undetected or less detectable way. (Citation: OSFingerprinting2014)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1294", "external_id": "T1294" }, { "source_name": "OSFingerprinting2014", "description": "InfoSec Institute. (2014, June 19). What You Must Know About OS Fingerprinting. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "This can be done offline after the data has been collected.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Analyze network traffic to determine security filtering policies, packets dropped, etc.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1071", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--7baccb84-356c-4e89-8c5d-58e701f033fc", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze organizational skillsets and deficiencies", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1300).\n\nAnalyze strengths and weaknesses of the target for potential areas of where to focus compromise efforts. (Citation: FakeLinkedIn)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1300", "external_id": "T1300" }, { "source_name": "FakeLinkedIn", "description": "LIFARS. (2015, October 8). Hackers Fake LinkedIn Profiles to Scout Targets. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "This can be done offline after the data has been collected.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Analyze strengths and weaknesses of the target for potential areas of where to focus compromise efforts.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1077", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--092f05e3-f7c0-4cd2-91be-3a8d6ed3cadc", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze organizational skillsets and deficiencies", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1289).\n\nAnalyze strengths and weaknesses of the target for potential areas of where to focus compromise efforts. (Citation: FakeLinkedIn)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1289", "external_id": "T1289" }, { "source_name": "FakeLinkedIn", "description": "LIFARS. (2015, October 8). Hackers Fake LinkedIn Profiles to Scout Targets. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "This can be done offline after the data has been collected.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Job postings and hiring requisitions have to be made public for contractors and many times have the name of the organization being supported. In addition, they outline the skills needed to do a particular job, which can provide insight into the technical structure and organization of a target.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1066", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--96eb59d1-6c46-44bb-bfcd-56be02a00d41", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze organizational skillsets and deficiencies", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1297).\n\nUnderstanding organizational skillsets and deficiencies could provide insight in to weakness in defenses, or opportunities for exploitation. (Citation: FakeLinkedIn)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1297", "external_id": "T1297" }, { "source_name": "FakeLinkedIn", "description": "LIFARS. (2015, October 8). Hackers Fake LinkedIn Profiles to Scout Targets. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "No access to who is consuming the job postings to know what is being observed.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Job postings have to be made public for contractors and many times have the name of the organization being supported.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1074", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--34450117-d1d5-417c-bb74-4359fc6551ca", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze presence of outsourced capabilities", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1303).\n\nOutsourcing, the arrangement of one company providing goods or services to another company for something that could be done in-house, provides another avenue for an adversary to target. Businesses often have networks, portals, or other technical connections between themselves and their outsourced/partner organizations that could be exploited. Additionally, outsourced/partner organization information could provide opportunities for phishing. (Citation: Scasny2015) (Citation: OPM Breach)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1303", "external_id": "T1303" }, { "source_name": "Scasny2015", "description": "Gregory Scasny. (2015, September 14). Understanding Open Source Intelligence (OSINT) and its relationship to Identity Theft. Retrieved March 1, 2017." }, { "source_name": "OPM Breach", "description": "Hon. Jason Chaffetz, Hon. Mark Meadows, Hon. Will Hurd. (2016, September 7). The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation. Retrieved March 28, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Much of this analysis can be done using the target's open source website, which is purposely designed to be informational and may not have extensive visitor tracking capabilities.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Analyzing business relationships from information gathering may provide insight into outsourced capabilities. In certain industries, outsourced capabilities or close business partnerships may be advertised on corporate websites.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1080", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--ee40d054-6e83-4302-88dc-a3af98821d8d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Analyze social and business relationships, interests, and affiliations", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1295).\n\nSocial media provides insight into the target's affiliations with groups and organizations. Certification information can explain their technical associations and professional associations. Personal information can provide data for exploitation or even blackmail. (Citation: Scasny2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1295", "external_id": "T1295" }, { "source_name": "Scasny2015", "description": "Gregory Scasny. (2015, September 14). Understanding Open Source Intelligence (OSINT) and its relationship to Identity Theft. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Public sources are external to the defender's organization. Some social media sites have an option to show you when users are looking at your profile, but an adversary can evade this tracking depending on how they conduct the searches.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Social and business relationship information for an individual can be found by examining their social media contacts (e.g., [https://www.facebook.com Facebook] and [https://www.linkedin.com LinkedIn]). Social media also provides insight into the target's affiliations with groups and organizations. Finally, certification information can explain their technical associations and professional associations.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1072", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--d3dca536-8bf0-4e43-97c1-44a2353c3d69", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Anonymity services", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1306).\n\nAnonymity services reduce the amount of information available that can be used to track an adversary's activities. Multiple options are available to hide activity, limit tracking, and increase anonymity. (Citation: TOR Design) (Citation: Stratfor2012)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1306", "external_id": "T1306" }, { "source_name": "TOR Design", "description": "Roger Dingledine, Nick Mathewson, Paul Syverson. (2004, August). Tor: The Second-Generation Onion Router. Retrieved March 28, 2017." }, { "source_name": "Stratfor2012", "description": "Sean Gallagher. (2012, March 6). Inside the hacking of Stratfor: the FBI\u2019s case against Antisec member Anarchaos. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Depends on service. Some are easy to detect, but are hard to trace (e.g., [https://torproject.org TOR]).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Easy access to anonymizers, quasi-anonymous services like remailers, [https://torproject.org TOR], relays, burner phones, etc.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1083", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--ae85ba2f-27ea-42d9-b42a-0fe89ee19ed5", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Assess KITs/KIQs benefits", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1229).\n\nKey Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) may be further subdivided to focus on political, economic, diplomatic, military, financial, or intellectual property categories. An adversary may specify KITs or KIQs in this manner in order to understand how the information they are pursuing can have multiple uses and to consider all aspects of the types of information they need to target for a particular purpose. (Citation: CompetitiveIntelligence) (Citation: CompetitiveIntelligence)KIT.", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1229", "external_id": "T1229" }, { "source_name": "CompetitiveIntelligence", "description": "Matt H. Evans. (n.d.). Course 12: Competitive Intelligence (Part 2 of 2). Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1006", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--8e927b19-04a6-4aaa-a42f-4f0a53411d27", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Assess current holdings, needs, and wants", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1236).\n\nAnalysts assess current information available against requirements that outline needs and wants as part of the research baselining process to begin satisfying a requirement. (Citation: CyberAdvertisingChar) (Citation: CIATradecraft) (Citation: ForensicAdversaryModeling) (Citation: CyberAdversaryBehavior)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1236", "external_id": "T1236" }, { "source_name": "CyberAdvertisingChar", "description": "Tom Parker, Matt Devost, Marcus Sachs, and Toby Miller. (2003). Cyber Adversary Characterization. Retrieved March 5, 2017." }, { "source_name": "CIATradecraft", "description": "Central Intelligence Agency. (2009). A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis. Retrieved March 5, 2017." }, { "source_name": "ForensicAdversaryModeling", "description": "John Lowry, Rico Valdez, Brad Wood. (n.d.). Adversary Modeling to Develop Forensic Observables. Retrieved March 5, 2017." }, { "source_name": "CyberAdversaryBehavior", "description": "Elizabeth Van Ruitenbeek, Ken Keefe, William H. Sanders, and Carol Muehrcke. (2010). Characterizing the Behavior of Cyber Adversaries: The Means, Motive, and Opportunity of Cyberattacks. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1013", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--d3999268-740f-467e-a075-c82e2d04be62", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Assess leadership areas of interest", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1224).\n\nLeadership assesses the areas of most interest to them and generates Key Intelligence Topics (KIT) or Key Intelligence Questions (KIQ). For example, an adversary knows from open and closed source reporting that cyber is of interest, resulting in it being a KIT. (Citation: ODNIIntegration)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1224", "external_id": "T1224" }, { "source_name": "ODNIIntegration", "description": "Office of the Director of National Intelligence. (n.d.). Intelligence Integration - Who Are We. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1001", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--e2aa077d-60c9-4de5-b015-a9c382877cd9", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Assess opportunities created by business deals", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1299).\n\nDuring mergers, divestitures, or other period of change in joint infrastructure or business processes there may be an opportunity for exploitation. During this type of churn, unusual requests, or other non standard practices may not be as noticeable. (Citation: RossiMergers) (Citation: MeidlHealthMergers)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1299", "external_id": "T1299" }, { "source_name": "RossiMergers", "description": "Ben Rossi. (2014, August 29). Mergers and acquisitions: a new target for cyber attack. Retrieved March 6, 2017." }, { "source_name": "MeidlHealthMergers", "description": "Holly Meidl. (2015, December 16). How Health Care Companies Can Reduce the Risk of Cyber-Attack During Mergers and Acquisitions. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Most of this activity would target partners and business processes. Partners would not report. Difficult to tie this activity to a cyber attack.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Mapping joint infrastructure and business processes is difficult without insider knowledge or SIGINT capability. While a merger creates and opportunity to exploit potentially cumbersome or sloppy business processes, advance notice of a merger is difficult; merger information is typically close-hold until the deal is done.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1076", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--31a57c70-6709-4d06-a473-c3df1f74c1d4", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Assess security posture of physical locations", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1302).\n\nPhysical access may be required for certain types of adversarial actions. (Citation: CyberPhysicalAssessment) (Citation: CriticalInfrastructureAssessment)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1302", "external_id": "T1302" }, { "source_name": "CyberPhysicalAssessment", "description": "Doug MacDonald, Samuel L Clements, Scott W Patrick, Casey Perkins, George Muller, Mary J Lancaster, Will Hutton. (2013, February). Cyber/physical security vulnerability assessment integration. Retrieved March 6, 2017." }, { "source_name": "CriticalInfrastructureAssessment", "description": "J. Depoy, J. Phelan, P. Sholander, B. Smith, G.B. Varnado and G. Wyss. (2015). RISK ASSESSMENT for PHYSICAL AND CYBER ATTACKS on CRITICAL INFRASTRUCTURES. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Physical security is often unaware of implications of physical access to network. However, some organizations have thorough physical security measures that would log and report attempted incursions, perimeter breaches, unusual RF at a site, etc.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Social engineering and OSINT are still generally successful. Physical locations of offices/sites are easily determined. Monitoring for other sites of interest, such as backup storage vendors, is also easy to accomplish.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1079", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--d69c3e06-8311-4093-8e3e-0a8e06b15d92", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Assess targeting options", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1296).\n\nAn adversary may assess a target's operational security (OPSEC) practices in order to identify targeting options. A target may share different information in different settings or be more of less cautious in different environments. (Citation: Scasny2015) (Citation: EverstineAirStrikes)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1296", "external_id": "T1296" }, { "source_name": "Scasny2015", "description": "Gregory Scasny. (2015, September 14). Understanding Open Source Intelligence (OSINT) and its relationship to Identity Theft. Retrieved March 1, 2017." }, { "source_name": "EverstineAirStrikes", "description": "Brian Everstine. (2015, June 04). Carlisle: Air Force intel uses ISIS 'moron's' social media posts to target airstrikes. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender does not have access to information stored outside of defenders scope or visibility (e.g., log data for Facebook is not easily accessible). Defender has very infrequent visibility into an adversary's more detailed TTPs for developing people targets.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Information is out in the open for items that are available - part of this is ease of use for consumers to support the expected networking use case. OSINT can provide many avenues to gather intel which contain weaknesses. Developing and refining the methodology to exploit weak human targets has been done for years (e.g., spies).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1073", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--1def484d-2343-470d-8925-88f45b5f9615", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Assess vulnerability of 3rd party vendors", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1298).\n\nOnce a 3rd party vendor has been identified as being of interest it can be probed for vulnerabilities just like the main target would be. (Citation: Zetter2015Threats) (Citation: WSJTargetBreach)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1298", "external_id": "T1298" }, { "source_name": "Zetter2015Threats", "description": "Kim Zetter. (2015, January 4). The Biggest Security Threats We\u2019ll Face in 2015. Retrieved March 5, 2017." }, { "source_name": "WSJTargetBreach", "description": "Paul Ziobro. (2014, February 6). Target Breach Began With Contractor's Electronic Billing Link. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "3rd parties would most likely not report network scans to their partners. Target network would not know that their 3rd party partners were being used as a vector.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "The difficult part is enumerating all 3rd parties. Finding major partners would not be difficult. Significantly easier with insider knowledge. Vulnerability scanning the 3rd party networks is trivial.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1075", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--4fad17d3-8f42-449d-ac4b-dbb4c486127d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Assign KITs, KIQs, and/or intelligence requirements", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1238).\n\nOnce generated, Key Intelligence Topics (KITs), Key Intelligence Questions (KIQs), and/or intelligence requirements are assigned to applicable agencies and/or personnel. For example, an adversary may decide nuclear energy requirements should be assigned to a specific organization based on their mission. (Citation: AnalystsAndPolicymaking) (Citation: JP2-01)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1238", "external_id": "T1238" }, { "source_name": "AnalystsAndPolicymaking", "description": "Jack Davis. (2002, September). Improving CIA Analytic Performance: Analysts and the Policymaking Process. Retrieved March 5, 2017." }, { "source_name": "JP2-01", "description": "Joint Chiefs of Staff. (2012, January 05). Joint and National Intelligence Support to Military Operations. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1015", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-direction" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--a86a21a4-6304-4df3-aa6d-08114c47d48f", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Assign KITs/KIQs into categories", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1228).\n\nLeadership organizes Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) into three types of categories and creates more if necessary. An example of a description of key players KIT would be when an adversary assesses the cyber defensive capabilities of a nation-state threat actor. (Citation: Herring1999)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1228", "external_id": "T1228" }, { "source_name": "Herring1999", "description": "Jan P. Herring. (1999). Key Intelligence Topics: A Process to Identify and Define Intelligence Needs. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1005", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--4dfb98ea-03cc-4a9c-a3a7-b22e14f126c4", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Authentication attempt", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nAttempt to use default vendor credentials, brute force credentials, or previously obtained legitimate credentials to authenticate remotely. This access could be to a web portal, through a VPN, or in a phone app. (Citation: Remote Access Healthcare) (Citation: RDP Point of Sale)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1381", "url": "https://attack.mitre.org/techniques/T1381" }, { "description": "Gary Glover. (2015, June 25). Remote access threats are imminent. Retrieved March 31, 2017.", "source_name": "Remote Access Healthcare" }, { "description": "Brian Prince. (2014, July 31). Hackers Turn Remote Desktop Tools Into Gateways for Point-of-Sale Malware Attacks. Retrieved March 31, 2017.", "source_name": "RDP Point of Sale" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:13:56.705Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1158", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Attempt to use default vendor credentials, brute force credentials, or previously obtained legitimate credentials. This is increasingly difficult to obtain access when two-factor authentication mechanisms are employed.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "This is possible with diligent monitoring of login anomalies, expected user behavior/location. If the adversary uses legitimate credentials, it may go undetected.", "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_deprecated": true }, { "id": "attack-pattern--0440f60f-9056-4791-a740-8eae96eb61fa", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Authorized user performs requested cyber action", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nClicking on links in email, opening attachments, or visiting websites that result in drive by downloads can all result in compromise due to users performing actions of a cyber nature. (Citation: AnonHBGary)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1386", "url": "https://attack.mitre.org/techniques/T1386" }, { "source_name": "AnonHBGary", "description": "Bright, P. (2011, February 15). Anonymous speaks: the inside story of the HBGary hack. Retrieved March 9, 2017.", "url": "https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "compromise" } ], "modified": "2020-10-14T01:53:27.989Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1163", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Users unwittingly click on spearphishing links frequently, despite training designed to educate about the perils of spearphishing.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Some environments have anti-spearphishing mechanisms to detect or block the link before it reaches the user.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "Yes" }, { "id": "attack-pattern--0e6abb17-0f81-4988-9fd2-4ba0b673d729", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Automated system performs requested action", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nUsers may be performing legitimate activity but using media that is compromised (e.g., using a USB drive that comes with malware installed during manufacture or supply). Upon insertion in the system the media auto-runs and the malware executes without further action by the user. (Citation: WSUSpect2015)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1384", "url": "https://attack.mitre.org/techniques/T1384" }, { "description": "Paul Stone & Alex Chapman. (2015, August 5). WSUSpect: Compromising the Windows Enterprise via Windows Update. Retrieved March 1, 2017.", "source_name": "WSUSpect2015" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "compromise" } ], "modified": "2020-03-30T14:15:05.089Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1161", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Autoruns with USB keys and CDs traditionally were always on (e.g., [http://windows.microsoft.com Windows] 7 is now an exception with a new policy of limiting the always on nature of Autoruns), ensuring and automated system completes a requested action. Specialized use cases exist where automated systems are specifically designed against automatically performing certain actions (e.g., USB/CD insertion and automatically running is disabled in certain environments).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Environments without extensive endpoint sensing capabilities do not typically collect this level of detailed information.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--15ef4da5-3b93-4bb1-a39a-5396661956d3", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Build and configure delivery systems", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1347).\n\nDelivery systems are the infrastructure used by the adversary to host malware or other tools used during exploitation. Building and configuring delivery systems may include multiple activities such as registering domain names, renting hosting space, or configuring previously exploited environments. (Citation: APT1)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1347", "external_id": "T1347" }, { "source_name": "APT1", "description": "Mandiant. (n.d.). APT1: Exposing One of China\u2019s Cyber Espionage Units. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "It is detectable once deployed to the public Internet, used for adversarial purposes, discovered, and reported to defenders.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "It is easy to create and burn infrastructure. Otherwise, blacklisting would be more successful for defenders.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1124", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--4886e3c2-468b-4e26-b7e5-2031d995d13a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Build or acquire exploits", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1349).\n\nAn exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. The adversary may use or modify existing exploits when those exploits are still relevant to the environment they are trying to compromise. (Citation: NYTStuxnet) (Citation: NationsBuying)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1349", "external_id": "T1349" }, { "source_name": "NYTStuxnet", "description": "William J. Broad, John Markoff, and David E. Sanger. (2011, January 15). Israeli Test on Worm Called Crucial in Iran Nuclear Delay. Retrieved March 1, 2017.", "url": "https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html" }, { "source_name": "NationsBuying", "description": "Nicole Perlroth and David E. Sanger. (2013, July 12). Nations Buying as Hackers Sell Flaws in Computer Code. Retrieved March 9, 2017.", "url": "https://www.nytimes.com/2013/07/14/world/europe/nations-buying-as-hackers-sell-computer-flaws.html" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1126", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Several exploit repositories and tool suites exist for re-use and tailoring.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Adversary will likely use code repositories, but development will be performed on their local systems.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--9108e212-1c94-4f8d-be76-1aad9b4c86a4", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Build social network persona", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1341).\n\nFor attacks incorporating social engineering the utilization of an on-line persona is important. These personas may be fictitious or impersonate real people. The persona may exist on a single site or across multiple sites ([Facebook](https://www.facebook.com), [LinkedIn](https://www.linkedin.com), [Twitter](https://twitter.com), [Google+](https://plus.google.com), etc.). (Citation: NEWSCASTER2014) (Citation: BlackHatRobinSage) (Citation: RobinSageInterview)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1341", "external_id": "T1341" }, { "source_name": "NEWSCASTER2014", "description": "Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.", "url": "https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation" }, { "source_name": "BlackHatRobinSage", "description": "Ryan, T. (2010). \u201cGetting In Bed with Robin Sage.\u201d. Retrieved March 6, 2017.", "url": "http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf" }, { "source_name": "RobinSageInterview", "description": "Joan Goodchild. (2010, July 8). The Robin Sage experiment: Fake profile fools security pros. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "persona-development" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1118", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Performing activities like typical users, but with specific intent in mind.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Unless there is some threat intelligence reporting, these users are hard to differentiate.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "created": "2017-12-14T16:46:06.044Z", "modified": "2020-10-26T13:42:49.342Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "type": "attack-pattern", "x_mitre_old_attack_id": "PRE-T1105", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Proliferation of DNS TLDs and registrars. Adversary may choose domains that are similar to legitimate domains (aka \"domain typosquatting\" or homoglyphs).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "This is by design captured in public registration logs. Various tools and services exist to track/query/monitor domain name registration information.", "x_mitre_detectable_by_common_defenses": "Yes", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1328", "external_id": "T1328" }, { "source_name": "PWCSofacy2014", "description": "Tom Lancaster and Michael Yip. (2014, December 05). APT28: Sofacy? So-funny.. Retrieved March 6, 2017." } ], "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1328).\n\nDomain Names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. (Citation: PWCSofacy2014)", "name": "Buy domain name", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "id": "attack-pattern--45242287-2964-4a3e-9373-159fad4d8195", "x_mitre_deprecated": true }, { "id": "attack-pattern--8e211ec9-5dfc-4915-aff4-84d5908f0336", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "C2 protocol development", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1352).\n\nCommand and Control (C2 or C&C) is a method by which the adversary communicates with malware. An adversary may use a variety of protocols and methods to execute C2 such as a centralized server, peer to peer, IRC, compromised web sites, or even social media. (Citation: HAMMERTOSS2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1352", "external_id": "T1352" }, { "source_name": "HAMMERTOSS2015", "description": "FireEye. (2015, July). HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary will likely use code repositories, but development will be performed on their local systems.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "C2 over commonly used and permitted protocols provides the necessary cover and access.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1129", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--7a265bf0-6acc-4f43-8b22-2e58b443e62e", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Choose pre-compromised mobile app developer account credentials or signing keys", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1391).\n\nThe adversary can use account credentials or signing keys of an existing mobile app developer to publish malicious updates of existing mobile apps to an application store, or to abuse the developer's identity and reputation to publish new malicious apps. Many mobile devices are configured to automatically install new versions of already-installed apps. (Citation: Fraudenlent Apps Stolen Dev Credentials)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1391", "external_id": "T1391" }, { "source_name": "Fraudenlent Apps Stolen Dev Credentials", "description": "Galen Gruman. (2014, December 5). Keep out hijackers: Secure your app store dev account. Retrieved April 12, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Possible to detect compromised credentials if alerting from a service provider is enabled and acted upon by the individual.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "The difficulty of obtaining useful developer credentials may vary. Well-organized, professional app developers whose credentials or signing keys would be the most useful to an adversary because of the large install bases of their apps, would likely strongly protect their credentials and signing keys. Less-organized app developers may not protect their credentials and signing keys as strongly, but the credentials and signing keys would also be less useful to an adversary. These less-organized app developers may reuse passwords across sites, fail to turn on multi-factor authentication features when available, or store signing keys in unprotected locations.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1168", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "persona-development" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--9a8c47f6-ae69-4044-917d-4b1602af64d9", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Choose pre-compromised persona and affiliated accounts", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1343).\n\nFor attacks incorporating social engineering the utilization of an on-line persona is important. Utilizing an existing persona with compromised accounts may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. (Citation: AnonHBGary) (Citation: Hacked Social Media Accounts)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1343", "external_id": "T1343" }, { "source_name": "AnonHBGary", "description": "Bright, P. (2011, February 15). Anonymous speaks: the inside story of the HBGary hack. Retrieved March 9, 2017.", "url": "https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/" }, { "source_name": "Hacked Social Media Accounts", "description": "Marcus Habert. (2015, November 8). What Happens to Hacked Social Media Accounts. Retrieved March 28, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "persona-development" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1120", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "It is relatively easy and low cost to purchase compromised credentials. Mining social media sites offers open source information about a particular target. Most users tend to reuse passwords across sites and are not paranoid enough to check and see if spoofed sites from their persona exist across current social media.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Possible to detect compromised credentials if alerting from a service provider is enabled and acted upon by the individual.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--0c592c79-29a7-4a94-81a4-c87eae3aead6", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Common, high volume protocols and software", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1321).\n\nCertain types of traffic (e.g., Twitter14, HTTP) are more commonly used than others. Utilizing more common protocols and software may make an adversary's traffic more difficult to distinguish from legitimate traffic. (Citation: symantecNITRO)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1321", "external_id": "T1321" }, { "source_name": "symantecNITRO", "description": "Eric Chien and Gavin O\u2019Gorman. (n.d.). The Nitro Attacks: Stealing Secrets from the Chemical Industry. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "High level of entropy in communications. High volume of communications makes it extremely hard for a defender to distinguish between legitimate and adversary communications.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to decipher or to make the communication less conspicuous.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1098", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--4900fabf-1142-4c1f-92f5-0b590e049077", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Compromise 3rd party infrastructure to support delivery", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1312).\n\nInstead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it for some or all of the attack cycle. (Citation: WateringHole2014) (Citation: FireEye Operation SnowMan)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1312", "external_id": "T1312" }, { "source_name": "WateringHole2014", "description": "Pierluigi Paganini. (2014, February 15). FireEye discovered a new watering hole attack based on 0-day exploit. Retrieved March 1, 2017." }, { "source_name": "FireEye Operation SnowMan", "description": "Darien Kindlund, Xiaobo Chen, Mike Scott, Ned Moran, Dan Caselden. (2014, February 13). Operation SnowMan: DeputyDog Actor Compromises US Veterans of Foreign Wars Website. Retrieved March 28, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender will not have visibility on 3rd party sites unless target is successfully enticed to visit one.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Commonly used technique currently (e.g., [https://www.wordpress.com WordPress] sites) as precursor activity to launching attack against intended target (e.g., acquiring botnet or layers of proxies for reducing attribution possibilities).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1089", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "created": "2017-12-14T16:46:06.044Z", "modified": "2020-10-26T13:42:49.342Z", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "type": "attack-pattern", "x_mitre_old_attack_id": "PRE-T1111", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Commonly used technique currently (e.g., [https://www.wordpress.com WordPress] sites) as precursor activity to launching attack against intended target (e.g., acquiring botnet or layers of proxies for reducing attribution possibilities).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Defender will not have visibility on 3rd party sites unless target is successfully enticed to visit one.", "x_mitre_detectable_by_common_defenses": "No", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1334", "external_id": "T1334" }, { "source_name": "WateringHole2014", "description": "Pierluigi Paganini. (2014, February 15). FireEye discovered a new watering hole attack based on 0-day exploit. Retrieved March 1, 2017." }, { "source_name": "FireEye Operation SnowMan", "description": "Darien Kindlund, Xiaobo Chen, Mike Scott, Ned Moran, Dan Caselden. (2014, February 13). Operation SnowMan: DeputyDog Actor Compromises US Veterans of Foreign Wars Website. Retrieved March 28, 2017." } ], "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1334).\n\nInstead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it for some or all of the attack cycle. (Citation: WateringHole2014) (Citation: FireEye Operation SnowMan)", "name": "Compromise 3rd party infrastructure to support delivery", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "id": "attack-pattern--e51398e6-53dc-4e9f-a323-e54683d8672b", "x_mitre_deprecated": true }, { "id": "attack-pattern--5a68c603-d7f9-4535-927e-ab56819eaa85", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Compromise 3rd party or closed-source vulnerability/exploit information", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1354).\n\nThere is usually a delay between when a vulnerability or exploit is discovered and when it is made public. An adversary may target the systems of those known to research vulnerabilities in order to gain that knowledge for use during a different attack. (Citation: TempertonDarkHotel)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1354", "external_id": "T1354" }, { "source_name": "TempertonDarkHotel", "description": "Temperton, J. (2015, August 10). Hacking Team zero-day used in new Darkhotel attacks. Retrieved March 9, 2017.", "url": "https://www.wired.co.uk/article/darkhotel-hacking-team-cyber-espionage" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1131", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Finding, attacking, and compromising a 3rd party or closed vulnerability entity is challenging, because those containing the vulnerabilities should be very aware of attacks on their environments have a heightened awareness.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_detectable_by_common_defenses_explanation": "The compromise of unknown vulnerabilities would provide little attack and warning against a defender, rendering it highly challenging to detect.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--4aeafdb3-eb0b-4e8e-b93f-95cd499088b4", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Compromise of externally facing system", "description": "**This technique has been deprecated. Please use [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**\n\nExternally facing systems allow connections from outside the network as a normal course of operations. Externally facing systems may include, but are not limited to, websites, web portals, email, DNS, FTP, VPN concentrators, and boarder routers and firewalls. These systems could be in a demilitarized zone (DMZ) or may be within other parts of the internal environment. (Citation: CylanceOpCleaver) (Citation: DailyTechAntiSec)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1388", "url": "https://attack.mitre.org/techniques/T1388" }, { "description": "CYLANCE. (n.d.). Operation Cleaver. Retrieved March 6, 2017.", "source_name": "CylanceOpCleaver" }, { "description": "Jason Mick. (2011, July 12). AntiSec Exposes U.S. Soldiers' S/Ns, Passwords, Vows Attack on Monsanto. Retrieved March 9, 2017.", "source_name": "DailyTechAntiSec" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "compromise" } ], "modified": "2020-03-30T14:16:12.162Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1165", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "DMZ environments are specifically designed to be isolated because one assumes they will ultimately be compromised by the adversary.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Most DMZs are monitored but are also designed so that if they are compromised, the damage/risk is limited.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "Yes" }, { "id": "attack-pattern--7f2d3da6-7e34-44a3-9e7f-905455339726", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Conduct active scanning", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1254).\n\nActive scanning is the act of sending transmissions to end nodes, and analyzing the responses, in order to identify information about the communications system. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1254", "external_id": "T1254" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "This technique is an expected and voluminous activity when on the Internet. Active scanning techniques/tools typically generate benign traffic that does not require further investigation by a defender since there is no actionable defense to execute. The high volume of this activity makes it burdensome for any defender to chase and therefore often ignored.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Various available tools and data sources for scouting and detecting address, routing, version numbers, patch levels, protocols/services running, etc.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1031", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--51bca707-a806-49bf-91e0-03885b0ac85c", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Conduct cost/benefit analysis", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1226).\n\nLeadership conducts a cost/benefit analysis that generates a compelling need for information gathering which triggers a Key Intelligence Toptic (KIT) or Key Intelligence Question (KIQ). For example, an adversary compares the cost of cyber intrusions with the expected benefits from increased intelligence collection on cyber adversaries. (Citation: LowenthalCh4) (Citation: KIT-Herring)", "external_references": [ { "external_id": "T1226", "url": "https://attack.mitre.org/techniques/T1226", "source_name": "mitre-pre-attack" }, { "description": "Mark M. Lowenthal. (n.d.). Ch 4: The Intelligence Process--A Macro Look; Who Does What for Whome?, Intelligence: From Secrets to Policy. Retrieved March 2, 2017.", "source_name": "LowenthalCh4" }, { "description": "Jan P. Herring. (1999). Key Intelligence Topics: A Process to Identify and Define Intelligence Needs. Retrieved May 19, 2017.", "source_name": "KIT-Herring" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "phase_name": "priority-definition-planning", "kill_chain_name": "mitre-pre-attack" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1003", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--a7c620e5-cbc9-41b2-9695-418ef560f16c", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Conduct passive scanning", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1253).\n\nPassive scanning is the act of looking at existing network traffic in order to identify information about the communications system. (Citation: SurveyDetectionStrategies) (Citation: CyberReconPaper)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1253", "external_id": "T1253" }, { "source_name": "SurveyDetectionStrategies", "description": "Jamal Raiyn. (2014). A survey of Cyber Attack Detection Strategies. Retrieved March 5, 2017." }, { "source_name": "CyberReconPaper", "description": "H. P. Sanghvi and M. S. Dahiya. (2013, February). Cyber Reconnaissance: An Alarm before Cyber Attack. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Generates no network traffic that would enable detection.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Easy to do but it requires a vantage point conducive to accessing this data.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1030", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--a757670d-d600-48d9-8ae9-601d42c184a5", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Conduct social engineering", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1279).\n\nSocial Engineering is the practice of manipulating people in order to get them to divulge information or take an action. (Citation: SEAttackVectors) (Citation: BeachSE2003)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1279", "external_id": "T1279" }, { "source_name": "SEAttackVectors", "description": "Mathew J. Schwartz. (2011, September 14). Social Engineering Leads APT Attack Vectors. Retrieved March 5, 2017." }, { "source_name": "BeachSE2003", "description": "Gary Beach. (2003, October 1). Kevin Mitnick on Social Engineering Hackers. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "No technical means to detect an adversary collecting information about a target. Any detection would be based upon strong OPSEC policy implementation.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Very effective technique for the adversary that does not require any formal training and relies upon finding just one person who exhibits poor judgement.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1056", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--af358cad-eb71-4e91-a752-236edc237dae", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Conduct social engineering", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1268).\n\nSocial Engineering is the practice of manipulating people in order to get them to divulge information or take an action. (Citation: SEAttackVectors) (Citation: BeachSE2003)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1268", "external_id": "T1268" }, { "source_name": "SEAttackVectors", "description": "Mathew J. Schwartz. (2011, September 14). Social Engineering Leads APT Attack Vectors. Retrieved March 5, 2017." }, { "source_name": "BeachSE2003", "description": "Gary Beach. (2003, October 1). Kevin Mitnick on Social Engineering Hackers. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "No technical means to detect an adversary collecting information about a target. Any detection would be based upon strong OPSEC policy implementation.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Very effective technique for the adversary that does not require any formal training and relies upon finding just one person who exhibits poor judgement.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1045", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--74a3288e-eee9-4f8e-973a-fbc128e033f1", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Conduct social engineering", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1249).\n\nSocial Engineering is the practice of manipulating people in order to get them to divulge information or take an action. (Citation: SEAttackVectors) (Citation: BeachSE2003)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1249", "external_id": "T1249" }, { "source_name": "SEAttackVectors", "description": "Mathew J. Schwartz. (2011, September 14). Social Engineering Leads APT Attack Vectors. Retrieved March 5, 2017." }, { "source_name": "BeachSE2003", "description": "Gary Beach. (2003, October 1). Kevin Mitnick on Social Engineering Hackers. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "No technical means to detect an adversary collecting technical information about a target. Any detection would be based upon strong OPSEC policy implementation.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Very effective technique for the adversary that does not require any formal training and relies upon finding just one person who exhibits poor judgement.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1026", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--b79a1960-d0be-4b51-bb62-b27e91e1dea0", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Conduct social engineering or HUMINT operation", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nSocial Engineering is the practice of manipulating people in order to get them to divulge information or take an action. Human Intelligence (HUMINT) is intelligence collected and provided by human sources. (Citation: 17millionScam) (Citation: UbiquityEmailScam)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1376", "url": "https://attack.mitre.org/techniques/T1376" }, { "description": "Chris Johnston. (2015, February 5). Company loses $17m in email scam. Retrieved March 9, 2017.", "source_name": "17millionScam" }, { "description": "Robert Hackett. (2015, August 10). Fraudsters duped this company into handing over $40 million. Retrieved March 9, 2017.", "source_name": "UbiquityEmailScam" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:16:46.619Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1153", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Assuming an average adversary whose focus is social engineering, it is not difficult for an adversary. Assuming a HUMINT operation and specialized circumstances, the adversary difficulty becomes 1. Social engineering can be easily done remotely via email or phone. In contrast, HUMINT operations typically would require physical contact at some point in the process, increasing the difficulty.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Assuming an average company does not train its employees to be aware of social engineering techniques, it is not possible to detect the adversary's use unless a highly motivated or paranoid employee informs security. This assessment flips to a 1 in cases of environments where security trains employees to be vigilant or in specialized industries where competitive intelligence and business intelligence train employees to be highly aware. Most likely more complex for an adversary to detect as methods move to physical or non traditionally monitored mechanisms (such as phone calls outside of call centers). Furthermore, the content of such an interaction may be lost due to lack of collection.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--f4c5d1d9-8f0e-46f1-a9fa-f9a440926046", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Confirmation of launched compromise achieved", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nUpon successful compromise the adversary may implement methods for confirming success including communication to a command and control server, exfiltration of data, or a verifiable intended effect such as a publicly accessible resource being inaccessible or a web page being defaced. (Citation: FireEye Malware Stages) (Citation: APTNetworkTrafficAnalysis)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1383", "url": "https://attack.mitre.org/techniques/T1383" }, { "description": "carlota. (2014, November 12). Stages of a Malware Infection. Retrieved April 1, 2017.", "source_name": "FireEye Malware Stages" }, { "description": "Nart Villeneuve and James Bennett. (2012). Detecting APT Activity with Network Traffic Analysis. Retrieved March 9, 2017.", "source_name": "APTNetworkTrafficAnalysis" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "compromise" } ], "modified": "2020-03-30T14:17:12.000Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1160", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Certainty of the confirmation of compromise is not guaranteed unless the adversary sees communication to a command and control server, exfiltration of data, or an intended effect occur.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Current commercial tools and sensitive analytics can be used to detect communications to command and control servers or data exfiltration.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "Yes" }, { "id": "attack-pattern--a425598d-7c19-40f7-9aa3-ac20f0d5c2b2", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Create backup infrastructure", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1339).\n\nBackup infrastructure allows an adversary to recover from environmental and system failures. It also facilitates recovery or movement to other infrastructure if the primary infrastructure is discovered or otherwise is no longer viable. (Citation: LUCKYCAT2012)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1339", "external_id": "T1339" }, { "source_name": "LUCKYCAT2012", "description": "Forward-Looking Threat Research Team. (2012). LUCKYCAT REDUX: Inside an APT Campaign with Multiple Targets in India and Japan. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Infrastructure is (typically) outside of control/visibility of defender and as such as tools are staged for specific campaigns, it will not be obvious to those being attacked.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "The adversary has control of the infrastructure and will likely be able to add/remove tools to infrastructure, whether acquired via hacking or standard computer acquisition (e.g., [https://aws.amazon.com AWS], commercial storage solutions).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1116", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--fddd81e9-dd3d-477e-9773-4fb8ae227234", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Create custom payloads", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1345).\n\nA payload is the part of the malware which performs a malicious action. The adversary may create custom payloads when none exist with the needed capability or when targeting a specific environment. (Citation: APT1)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1345", "external_id": "T1345" }, { "source_name": "APT1", "description": "Mandiant. (n.d.). APT1: Exposing One of China\u2019s Cyber Espionage Units. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "It is likely that an adversary will create and develop payloads on inaccessible or unknown networks for OPSEC reasons.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Specialized tools exist for research, development, and testing of virus/malware payloads.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1122", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--b355817c-cf63-43b4-94a4-05e9645fa910", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Create implementation plan", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1232).\n\nImplementation plans specify how the goals of the strategic plan will be executed. (Citation: ChinaCollectionPlan) (Citation: OrderOfBattle)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1232", "external_id": "T1232" }, { "source_name": "ChinaCollectionPlan", "description": "Thomas B Inglis. (1946, December 31). COLLECTION PLAN TO IMPLEMENT NATIONAL INTELLIGENCE REQUIREMENTS FOR CHINA. Retrieved March 2, 2017." }, { "source_name": "OrderOfBattle", "description": "Wikipedia contributors. (2016, November 20). Order of battle. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1009", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--eacadff4-164b-451c-bacc-7b29ebfd0c3f", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Create infected removable media", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1355).\n\nUse of removable media as part of the Launch phase requires an adversary to determine type, format, and content of the media and associated malware. (Citation: BadUSB)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1355", "external_id": "T1355" }, { "source_name": "BadUSB", "description": "Security Research labs. (n.d.). BadUSB Exposure. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary will likely use code repositories, but development will be performed on their local systems.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Several exploit repositories and tool suites exist for re-use and tailoring.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1132", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--ec739e26-d097-4804-b04a-54dd81ff11e0", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Create strategic plan", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1231).\n\nStrategic plans outline the mission, vision, and goals for an adversary at a high level in relation to the key partners, topics, and functions the adversary carries out. (Citation: KPMGChina5Year) (Citation: China5YearPlans) (Citation: ChinaUN)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1231", "external_id": "T1231" }, { "source_name": "KPMGChina5Year", "description": "KPMG. (2016, October 19). China\u2019s 13th Five-Year Plan signals a potential new era of Sino-foreign cooperation, finds KPMG report. Retrieved March 2, 2017." }, { "source_name": "China5YearPlans", "description": "Wikipedia contributors. (2017, February 8). Five-year plans of China. Retrieved March 2, 2017." }, { "source_name": "ChinaUN", "description": "People's Republic of China. (2015, November). China's 13th Five-Year Plan. Retrieved May 19, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1008", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--38a6d2f5-d948-4235-bb91-bb01604448b4", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Credential pharming", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nCredential pharming a form of attack designed to steal users' credential by redirecting users to fraudulent websites. Pharming can be conducted either by changing the hosts file on a victim's computer or by exploitation of a vulnerability in DNS server software. (Citation: DriveByPharming) (Citation: GoogleDrive Phishing)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1374", "url": "https://attack.mitre.org/techniques/T1374" }, { "description": "Ellen Messmer. (2008, January 22). First case of \"drive-by pharming\" identified in the wild. Retrieved March 2, 2017.", "source_name": "DriveByPharming" }, { "description": "Nick Johnston. (2014, March 13). Google Docs Users Targeted by Sophisticated Phishing Scam. Retrieved March 29, 2017.", "source_name": "GoogleDrive Phishing" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:18:16.035Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1151", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Although it can be difficult to spoof/redirect content to a hostile service via DNS poisoning or MiTM attacks, current malware such as Zeus is able to successfully pharm credentials and end users are not well-versed in checking for certificate mismatches.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Fidelity of networking monitoring must be able to detect when traffic is diverted to non-normal sources at a site level. It is possible to identify some methods of pharming, but detection capabilities are limited and not commonly implemented.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--76c9e8cb-52e1-4ddc-80d4-5f7231842e06", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "DNS poisoning", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nDNS (cache) poisoning is the corruption of an Internet server's domain name system table by replacing an Internet address with that of another, rogue address. When a Web user seeks the page with that address, the request is redirected by the rogue entry in the table to a different address. (Citation: Google DNS Poisoning) (Citation: DNS Poisoning China) (Citation: Mexico Modem DNS Poison)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1382", "url": "https://attack.mitre.org/techniques/T1382" }, { "description": "Cindy Liu. (2016, March 30). Google DNS Poisoning Follows Brief Unblocking. Retrieved March 31, 2017.", "source_name": "Google DNS Poisoning" }, { "description": "John Leyden. (2014, January 21). DNS poisoning slams web traffic from millions in China into the wrong hole. Retrieved March 31, 2017.", "source_name": "DNS Poisoning China" }, { "description": "Paul Oliveria. (2008, January 11). Targeted Attack in Mexico: DNS Poisoning via Modems. Retrieved April 1, 2017.", "source_name": "Mexico Modem DNS Poison" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:19:39.311Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1159", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Adversary poisons DNS entry to redirect traffic designated for one site to route to an adversary controlled resource.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Tracking multiple DNS infrastructures will likely require multiple tools/services, more advanced analytics, and mature detection/response capabilities in order to be effective. Few defenders demonstrate the mature processes to immediately detect and mitigate against the use of this technique.", "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_deprecated": true }, { "id": "attack-pattern--7823039f-e2d5-4997-853c-ec983631206b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "DNSCalc", "description": "**This technique has been deprecated. Please use [DNS Calculation](https://attack.mitre.org/techniques/T1568/003).**\n\nDNS Calc is a technique in which the octets of an IP address are used to calculate the port for command and control servers from an initial DNS request. (Citation: CrowdstrikeNumberedPanda) (Citation: FireEyeDarwinsAPTGroup) (Citation: Rapid7G20Espionage)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1324", "url": "https://attack.mitre.org/techniques/T1324" }, { "description": "Adam Meyers. (2013, March 29). Whois Numbered Panda. Retrieved March 6, 2017.", "source_name": "CrowdstrikeNumberedPanda" }, { "description": "Ned Moran, Mike Oppenheim. (2014, September 3). Darwin\u2019s Favorite APT Group. Retrieved March 6, 2017.", "source_name": "FireEyeDarwinsAPTGroup" }, { "source_name": "Rapid7G20Espionage", "description": "Rapid7. (2013, August 26). Upcoming G20 Summit Fuels Espionage Operations. Retrieved March 6, 2017.", "url": "https://blog.rapid7.com/2013/08/26/upcoming-g20-summit-fuels-espionage-operations/" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-03-30T14:05:23.291Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true, "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1101", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "This technique assists the adversary in bypassing egress filtering designed to prevent unauthorized communication. It has been used by APT12, but not otherwise widely reported. Some botnets are hardcoded to be able to use this technique.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "There are not currently available tools that provide the ability to conduct this calculation to detect this type of activity.", "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--1ff8b824-5287-4583-ab6a-013bf36d4864", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Data Hiding", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1320).\n\nCertain types of traffic (e.g., DNS tunneling, header inject) allow for user-defined fields. These fields can then be used to hide data. In addition to hiding data in network protocols, steganography techniques can be used to hide data in images or other file formats. Detection can be difficult unless a particular signature is already known. (Citation: BotnetsDNSC2) (Citation: HAMMERTOSS2015) (Citation: DNS-Tunnel)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1320", "external_id": "T1320" }, { "source_name": "BotnetsDNSC2", "description": "Christian J. Dietrich, Christian Rossow, Felix C. Freiling, Herbert Bos, Maarten van Steen, Norbert Pohlmann. (2011). On Botnets that use DNS for Command and Control. Retrieved March 6, 2017." }, { "source_name": "HAMMERTOSS2015", "description": "FireEye. (2015, July). HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group. Retrieved March 6, 2017." }, { "source_name": "DNS-Tunnel", "description": "Alexey Shulmi and Sergey Yunakovsky. (2017, April 28). Use of DNS Tunneling for C&C Communications. Retrieved May 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Unless defender is dissecting protocols or performing network signature analysis on any protocol deviations/patterns, this technique is largely undetected.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "This technique requires a more advanced protocol understanding and testing to insert covert communication into legitimate protocol fields.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1097", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--d72c0bc0-3007-418c-842c-328027ebdbc1", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Deploy exploit using advertising", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nExploits spread through advertising (malvertising) involve injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages. (Citation: TPMalvertising)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1380", "url": "https://attack.mitre.org/techniques/T1380" }, { "description": "Michael Mimoso. (2015, March 30). AD NETWORKS RIPE FOR ABUSE VIA MALVERTISING. Retrieved March 9, 2017.", "source_name": "TPMalvertising" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:18:44.045Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1157", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "An adversary can deploy exploits via malvertising using multiple mechanisms. Such mechanisms include an image ad that is infected, redirection, or using social engineering to get the end user to install the malicious software themselves.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Although some commercial technologies are being advertised which claim to detect malvertising, it largely spreads unknowingly because it doesn't always require an action by a user.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--15d5eaa4-597a-47fd-a692-f2bed434d904", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Derive intelligence requirements", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1230).\n\nLeadership or key decision makers may derive specific intelligence requirements from Key Intelligence Topics (KITs) or Key Intelligence Questions (KIQs). Specific intelligence requirements assist analysts in gathering information to establish a baseline of information about a topic or question and collection managers to clarify the types of information that should be collected to satisfy the requirement. (Citation: LowenthalCh4) (Citation: Heffter)", "external_references": [ { "external_id": "T1230", "url": "https://attack.mitre.org/techniques/T1230", "source_name": "mitre-pre-attack" }, { "description": "Mark M. Lowenthal. (n.d.). Ch 4: The Intelligence Process--A Macro Look; Who Does What for Whome?, Intelligence: From Secrets to Policy. Retrieved March 2, 2017.", "source_name": "LowenthalCh4" }, { "description": "Clyde R. Heffter. (2011, August 4). A Fresh Look at Collection Requirements. Retrieved March 2, 2017.", "source_name": "Heffter" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "phase_name": "priority-definition-planning", "kill_chain_name": "mitre-pre-attack" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1007", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--dfa4eaf4-50d9-49de-89e9-d33f579f3e05", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine 3rd party infrastructure services", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1284).\n\nA wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available as 3rd party infrastructure services. These services could provide an adversary with another avenue of approach or compromise. (Citation: LUCKYCAT2012) (Citation: Schneier-cloud) (Citation: Computerworld-suppliers)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1284", "external_id": "T1284" }, { "source_name": "LUCKYCAT2012", "description": "Forward-Looking Threat Research Team. (2012). LUCKYCAT REDUX: Inside an APT Campaign with Multiple Targets in India and Japan. Retrieved March 1, 2017." }, { "source_name": "Schneier-cloud", "description": "Bruce Schneier. (2017, April 5). APT10 and Cloud Hopper. Retrieved May 9, 2017." }, { "source_name": "Computerworld-suppliers", "description": "Michael Kan. (2017, April 4). Chinese hackers go after third-party IT suppliers to steal data. Retrieved May 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary searches publicly available sources and may find this information on the 3rd party web site listing new customers/clients.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Press releases may reveal this information particularly when it is an expected cost savings or improvement for scalability/reliability.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1061", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--856a9371-4f0f-4ea9-946e-f3144204240f", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine 3rd party infrastructure services", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1260).\n\nInfrastructure services includes the hardware, software, and network resources required to operate a communications environment. This infrastructure can be managed by a 3rd party rather than being managed by the owning organization. (Citation: FFIECAwareness) (Citation: Zetter2015Threats)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1260", "external_id": "T1260" }, { "source_name": "FFIECAwareness", "description": "Federal Financial Institutions Examination Council. (2016, October 17). Cybersecurity Awareness. Retrieved March 5, 2017." }, { "source_name": "Zetter2015Threats", "description": "Kim Zetter. (2015, January 4). The Biggest Security Threats We\u2019ll Face in 2015. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "The data is passive in nature or not controlled by the defender, so it is hard to identify when an adversary is getting or analyzing the data.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Based on what the 3rd party infrastructure is, there are many tell tail signs which indicate it is hosted by a 3rd party, such as ASN data, MX or CNAME pointers or IP addresses", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1037", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--d45fe3c2-0688-43b9-ac07-7eb86f575e93", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine approach/attack vector", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1245).\n\nThe approach or attack vector outlines the specifics behind how the adversary would like to attack the target. As additional information is known through the other phases of PRE-ATT&CK, an adversary may update the approach or attack vector. (Citation: CyberAdversaryBehavior) (Citation: WITCHCOVEN2015) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1245", "external_id": "T1245" }, { "source_name": "CyberAdversaryBehavior", "description": "Elizabeth Van Ruitenbeek, Ken Keefe, William H. Sanders, and Carol Muehrcke. (2010). Characterizing the Behavior of Cyber Adversaries: The Means, Motive, and Opportunity of Cyberattacks. Retrieved March 5, 2017." }, { "source_name": "WITCHCOVEN2015", "description": "Jonathan Wrolstad and Barry Vengerik. (2015, November). Pinpointing Targets: Exploiting Web Analytics to Ensnare Victims. Retrieved March 5, 2017." }, { "source_name": "JP3-60", "description": "Joint Chiefs of Staff. (2013, January 31). Joint Targeting. Retrieved May 19, 2017." }, { "source_name": "JP3-12R", "description": "Joint Chiefs of Staff. (2013, February 5). Cyberspace Operations. Retrieved May 19, 2017." }, { "source_name": "DoD Cyber 2015", "description": "Department of Defense. (2015, April). The Department of Defense Cyber Strategy. Retrieved May 19, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. May change for special use cases or adversary and defender overlays.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "This is the normal adversary targeting cycle where they utilize our poor OPSEC practices to their advantage.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1022", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "target-selection" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--a7dff5d5-99f9-4a7e-ac54-a64113c28121", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine centralization of IT management", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1285).\n\nDetermining if a \"corporate\" help desk exists, the degree of access and control it has, and whether there are \"edge\" units that may have different support processes and standards. (Citation: SANSCentratlizeManagement)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1285", "external_id": "T1285" }, { "source_name": "SANSCentratlizeManagement", "description": "Scott Rasmussen. (2002, January 28). Centralized Network Security Management: Combining Defense In Depth with Manageable Security. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "No technical means to detect an adversary collecting information about a target. Any detection would be based upon strong OPSEC policy implementation.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Requires an adversary to undergo a research process to learn the internal workings of an organization. An adversary can do this by social engineering individuals in the company by claiming to need to find information for the help desk, or through social engineering of former employees or business partners.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1062", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--23ecb7e0-0340-43d9-80a5-8971fe866ddf", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine domain and IP address space", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1250).\n\nDomain Names are the human readable names used to represent one or more IP addresses. IP addresses are the unique identifier of computing devices on a network. Both pieces of information are valuable to an adversary who is looking to understand the structure of a network. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1250", "external_id": "T1250" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Public or easily obtainable information by design.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "AS and IANA data are easily available, existing research tools.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1027", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--a2fc93cd-e371-4755-9305-2615b6753d91", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine external network trust dependencies", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1259).\n\nNetwork trusts enable communications between different networks with specific accesses and permissions. Network trusts could include the implementation of domain trusts or the use of virtual private networks (VPNs). (Citation: CuckoosEgg) (Citation: CuckoosEggWikipedia) (Citation: KGBComputerMe)", "external_references": [ { "external_id": "T1259", "url": "https://attack.mitre.org/techniques/T1259", "source_name": "mitre-pre-attack" }, { "description": "Cliff Stoll. (1089). The Cuckoo's Egg. Retrieved August 8, 2017.", "source_name": "CuckoosEgg" }, { "description": "Wikipedia contributors. (2017, January 18). The Cuckoo's Egg. Retrieved March 5, 2017.", "source_name": "CuckoosEggWikipedia" }, { "description": "WBGH Nova. (1990, October 3). The KGB, the Computer and Me. Retrieved March 5, 2017.", "source_name": "KGBComputerMe" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "phase_name": "technical-information-gathering", "kill_chain_name": "mitre-pre-attack" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1036", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Determining trust relationships once internal to a network is trivial. Simple tools like trace route can show evidence of firewalls or VPNs and then hosts on the either side of the firewall indicating a different trusted network. Active Directory command line tools can also identify separate trusted networks.\n\nIf completely external to a network, sniffing traffic (if possible) could also reveal the communications protocols that could be guessed to be a trusted network connection (e.g., IPsec, maybe SSL, etc.) though this is error-prone. \n\nWith no other access, this is hard for an adversary to do completely from a remote vantage point.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_detectable_by_common_defenses_explanation": "This is not easily performed remotely and therefore not a detectable event. If the adversary can sniff traffic to deduce trust relations, this is a passive activity and not detectable.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--6baf6388-d49f-4804-86a4-5837240555cd", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine firmware version", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1258).\n\nFirmware is permanent software programmed into the read-only memory of a device. As with other types of software, firmware may be updated over time and have multiple versions. (Citation: Abdelnur Advanced Fingerprinting)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1258", "external_id": "T1258" }, { "source_name": "Abdelnur Advanced Fingerprinting", "description": "Humberto J. Abdelnur, Radu State, Olivier Festor. (2008). Advanced Network Fingerprinting. Retrieved April 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "No easy way for defenders to detect when an adversary collects this information.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Depending upon the target device, there are variable ways for an adversary to determine the firmware version. In some cases, this information can be derived from easily obtained information. For example, in [http://www.cisco.com Cisco] devices, the firmware version is easily determined once the device model and OS version is known since it is included in the release notes.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1035", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--dc7dfc9f-be1b-4e6e-a2e6-9a9bb2400ec9", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine highest level tactical element", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1243).\n\nFrom a tactical viewpoint, an adversary could potentially have a primary and secondary level target. The primary target represents the highest level tactical element the adversary wishes to attack. For example, the corporate network within a corporation or the division within an agency. (Citation: CyberAdversaryBehavior) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1243", "external_id": "T1243" }, { "source_name": "CyberAdversaryBehavior", "description": "Elizabeth Van Ruitenbeek, Ken Keefe, William H. Sanders, and Carol Muehrcke. (2010). Characterizing the Behavior of Cyber Adversaries: The Means, Motive, and Opportunity of Cyberattacks. Retrieved March 5, 2017." }, { "source_name": "JP3-60", "description": "Joint Chiefs of Staff. (2013, January 31). Joint Targeting. Retrieved May 19, 2017." }, { "source_name": "JP3-12R", "description": "Joint Chiefs of Staff. (2013, February 5). Cyberspace Operations. Retrieved May 19, 2017." }, { "source_name": "DoD Cyber 2015", "description": "Department of Defense. (2015, April). The Department of Defense Cyber Strategy. Retrieved May 19, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. May change for special use cases or adversary and defender overlays.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "This is the normal adversary targeting cycle where they utilize our poor OPSEC practices to their advantage.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1020", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "target-selection" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--c860af4a-376e-46d7-afbf-262c41012227", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine operational element", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1242).\n\nIf going from strategic down to tactical or vice versa, an adversary would next consider the operational element. For example, the specific company within an industry or agency within a government. (Citation: CyberAdversaryBehavior) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1242", "external_id": "T1242" }, { "source_name": "CyberAdversaryBehavior", "description": "Elizabeth Van Ruitenbeek, Ken Keefe, William H. Sanders, and Carol Muehrcke. (2010). Characterizing the Behavior of Cyber Adversaries: The Means, Motive, and Opportunity of Cyberattacks. Retrieved March 5, 2017." }, { "source_name": "JP3-60", "description": "Joint Chiefs of Staff. (2013, January 31). Joint Targeting. Retrieved May 19, 2017." }, { "source_name": "JP3-12R", "description": "Joint Chiefs of Staff. (2013, February 5). Cyberspace Operations. Retrieved May 19, 2017." }, { "source_name": "DoD Cyber 2015", "description": "Department of Defense. (2015, April). The Department of Defense Cyber Strategy. Retrieved May 19, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. May change for special use cases or adversary and defender overlays.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "This is the normal adversary targeting cycle where they utilize our poor OPSEC practices to their advantage.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1019", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "target-selection" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--2011ffeb-8003-41ef-b962-9d1cbfa35e6d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine physical locations", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1282).\n\nPhysical locality information may be used by an adversary to shape social engineering attempts (language, culture, events, weather, etc.) or to plan for physical actions such as dumpster diving or attempting to access a facility. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1282", "external_id": "T1282" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary searches publicly available sources that list physical locations that cannot be monitored by a defender or are not necessarily monitored (e.g., all IP addresses touching their public web space listing physical locations).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Most corporations now list their locations on public facing websites. Some challenge still exists to find covert or sensitive locations.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1059", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--b9148981-152a-4a19-95c1-962803f5c9af", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine secondary level tactical element", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1244).\n\nThe secondary level tactical element the adversary seeks to attack is the specific network or area of a network that is vulnerable to attack. Within the corporate network example, the secondary level tactical element might be a SQL server or a domain controller with a known vulnerability. (Citation: CyberAdversaryBehavior) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1244", "external_id": "T1244" }, { "source_name": "CyberAdversaryBehavior", "description": "Elizabeth Van Ruitenbeek, Ken Keefe, William H. Sanders, and Carol Muehrcke. (2010). Characterizing the Behavior of Cyber Adversaries: The Means, Motive, and Opportunity of Cyberattacks. Retrieved March 5, 2017." }, { "source_name": "JP3-60", "description": "Joint Chiefs of Staff. (2013, January 31). Joint Targeting. Retrieved May 19, 2017." }, { "source_name": "JP3-12R", "description": "Joint Chiefs of Staff. (2013, February 5). Cyberspace Operations. Retrieved May 19, 2017." }, { "source_name": "DoD Cyber 2015", "description": "Department of Defense. (2015, April). The Department of Defense Cyber Strategy. Retrieved May 19, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. May change for special use cases or adversary and defender overlays.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "This is the normal adversary targeting cycle where they utilize our poor OPSEC practices to their advantage.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1021", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "target-selection" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--91a3735f-817a-4450-8ed4-f05a0f5c3877", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Determine strategic target", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1241).\n\nAn adversary undergoes an iterative target selection process that may begin either broadly and narrow down into specifics (strategic to tactical) or narrowly and expand outward (tactical to strategic). As part of this process, an adversary may determine a high level target they wish to attack. One example of this may be a particular country, government, or commercial sector. (Citation: CyberAdversaryBehavior) (Citation: JP3-60) (Citation: JP3-12R) (Citation: DoD Cyber 2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1241", "external_id": "T1241" }, { "source_name": "CyberAdversaryBehavior", "description": "Elizabeth Van Ruitenbeek, Ken Keefe, William H. Sanders, and Carol Muehrcke. (2010). Characterizing the Behavior of Cyber Adversaries: The Means, Motive, and Opportunity of Cyberattacks. Retrieved March 5, 2017." }, { "source_name": "JP3-60", "description": "Joint Chiefs of Staff. (2013, January 31). Joint Targeting. Retrieved May 19, 2017." }, { "source_name": "JP3-12R", "description": "Joint Chiefs of Staff. (2013, February 5). Cyberspace Operations. Retrieved May 19, 2017." }, { "source_name": "DoD Cyber 2015", "description": "Department of Defense. (2015, April). The Department of Defense Cyber Strategy. Retrieved May 19, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. May change for special use cases or adversary and defender overlays.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "This is the normal adversary targeting cycle where they utilize our poor OPSEC practices to their advantage.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1018", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "target-selection" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--6063b486-a247-499b-976a-9de16f4e83bc", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Develop KITs/KIQs", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1227).\n\nLeadership derives Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) from the areas of most interest to them. KITs are an expression of management's intelligence needs with respect to early warning, strategic and operational decisions, knowing the competition, and understanding the competitive situation. KIQs are the critical questions aligned by KIT which provide the basis for collection plans, create a context for analytic work, and/or identify necessary external operations. (Citation: Herring1999)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1227", "external_id": "T1227" }, { "source_name": "Herring1999", "description": "Jan P. Herring. (1999). Key Intelligence Topics: A Process to Identify and Define Intelligence Needs. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1004", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--271e6d40-e191-421a-8f87-a8102452c201", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Develop social network persona digital footprint", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1342).\n\nBoth newly built personas and pre-compromised personas may require development of additional documentation to make them seem real. This could include filling out profile information, developing social networks, or incorporating photos. (Citation: NEWSCASTER2014) (Citation: BlackHatRobinSage) (Citation: RobinSageInterview)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1342", "external_id": "T1342" }, { "source_name": "NEWSCASTER2014", "description": "Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.", "url": "https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation" }, { "source_name": "BlackHatRobinSage", "description": "Ryan, T. (2010). \u201cGetting In Bed with Robin Sage.\u201d. Retrieved March 6, 2017.", "url": "http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf" }, { "source_name": "RobinSageInterview", "description": "Joan Goodchild. (2010, July 8). The Robin Sage experiment: Fake profile fools security pros. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "persona-development" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1119", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "The only difference between an adversary conducting this technique and a typical user, is the adversary's intent - to target an individual for compromise.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Unless there is some threat intelligence reporting, these users are hard to differentiate.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--82bbd209-f516-45e0-9542-4ffbbc2a8717", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Discover new exploits and monitor exploit-provider forums", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1350).\n\nAn exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. The adversary may need to discover new exploits when existing exploits are no longer relevant to the environment they are trying to compromise. An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits. (Citation: EquationQA)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1350", "external_id": "T1350" }, { "source_name": "EquationQA", "description": "Kaspersky Lab. (2015, February). EQUATION GROUP: QUESTIONS AND ANSWERS. Retrieved March 9, 2017.", "url": "https://www.threatminer.org/_reports/2015/Equation_group_questions_and_answers.pdf" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Public source external to the defender's organization.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Many public sources exist for this information.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1127", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--ef0f816a-d561-4953-84c6-2a2936c96957", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Discover target logon/email address format", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1255).\n\nEmail addresses, logon credentials, and other forms of online identification typically share a common format. This makes guessing other credentials within the same domain easier. For example if a known email address is first.last@company.com it is likely that others in the company will have an email in the same format. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1255", "external_id": "T1255" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Easily determined and not intended to be protected information. Publicly collected and shared repositories of email addresses exist.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Scraping of known email addresses from the target will likely reveal the target standard for address/username format. This information is easily discoverable.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1032", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--2f442206-2983-4fc2-93fd-0a828e026412", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Disseminate removable media", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1379).\n\nRemovable media containing malware can be injected in to a supply chain at large or small scale. It can also be physically placed for someone to find or can be sent to someone in a more targeted manner. The intent is to have the user utilize the removable media on a system where the adversary is trying to gain access. (Citation: USBMalwareAttacks) (Citation: FPDefendNewDomain) (Citation: ParkingLotUSB)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1379", "external_id": "T1379" }, { "source_name": "USBMalwareAttacks", "description": "Sean Carroll. (2010, November 4). USB Malware Attacks On the Rise. Retrieved March 9, 2017." }, { "source_name": "FPDefendNewDomain", "description": "William J. Lynn III. (2010, September). Defending a New Domain. Retrieved March 9, 2017." }, { "source_name": "ParkingLotUSB", "description": "Emil Protalinski. (2012, July 11). Criminals push malware by 'losing' USB sticks in parking lots. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "From a technical perspective, detection of an adversary disseminating removable media is not possible as there is no technical element involved until the compromise phase. Most facilities generally do not perform extensive physical security patrols, which would be necessary in order to promptly identify an adversary deploying removable media to be used in an attack.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Commonly executed technique by penetration testers to gain access to networks via end users who are innately trusting of newly found or available technology.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1156", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "stage-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--d2c4206a-a431-4494-834d-52944a79e9f4", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Distribute malicious software development tools", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1394).\n\nAn adversary could distribute malicious software development tools (e.g., compiler) that hide malicious behavior in software built using the tools. (Citation: PA XcodeGhost) (Citation: Reflections on Trusting Trust)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1394", "external_id": "T1394" }, { "source_name": "PA XcodeGhost", "description": "Claud Xiao. (2015, September 17). Novel Malware XcodeGhost Modifies Xcode, Infects Apple iOS Apps and Hits App Store. Retrieved April 12, 2017." }, { "source_name": "Reflections on Trusting Trust", "description": "Ken Thompson. (1984, August). Reflections on Trusting Trust. Retrieved April 12, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Developers could check a hash or signature of their development tools to ensure that they match expected values (e.g., Apple provides instructions of how to do so for its Xcode developer tool), but developers may not always do so.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "The adversary would need to either replace the tools provided at the official download location or influence developers to download the tools from an adversary-controlled third-party download location. Desktop operating systems (e.g., Windows, macOS) are increasingly encouraging use of vendor-provided official app stores to distribute software, which utilize code signing and increase the difficulty of replacing development tools with malicious versions.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1171", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "stage-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--274164c6-4297-42d4-84b5-2369e51013fe", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Domain Generation Algorithms (DGA)", "description": "**This technique has been deprecated. Please use [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1568/002).**\n\nThe use of algorithms in malware to periodically generate a large number of domain names which function as rendezvous points for malware command and control servers. (Citation: DamballaDGA) (Citation: DambballaDGACyberCriminals)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1323", "url": "https://attack.mitre.org/techniques/T1323" }, { "description": "Damballa Day Before Zero Blog. (2012, March 5). Domain Generation Algorithms (DGA) in Stealthy Malware. Retrieved March 6, 2017.", "source_name": "DamballaDGA" }, { "description": "Damballa. (n.d.). DGAs in the Hands of Cyber-Criminals Examining The State Of The Art In Malware Evasion Techniques. Retrieved March 6, 2017.", "source_name": "DambballaDGACyberCriminals" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-03-30T14:06:00.117Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_deprecated": true, "x_mitre_old_attack_id": "PRE-T1100", "x_mitre_version": "2.0", "x_mitre_difficulty_for_adversary_explanation": "This technique does not require a significant amount of sophistication while still being highly effective. It was popularized by the Conficker worms but is prevalent in crimeware such as Murofet and BankPatch.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "It is possible to detect the use of DGAs; however, defenders have largely not been successful at mitigating the domains because they are generally registered less than an hour before they are used and disposed of within 24 hours.", "x_mitre_detectable_by_common_defenses": "Partial" }, { "id": "attack-pattern--aadaee0d-794c-4642-8293-7ec22a99fb1a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Domain registration hijacking", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1326).\n\nDomain Registration Hijacking is the act of changing the registration of a domain name without the permission of the original registrant. (Citation: ICANNDomainNameHijacking)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1326", "external_id": "T1326" }, { "source_name": "ICANNDomainNameHijacking", "description": "ICANN Security and Stability Advisory Committee. (2005, July 12). Domain Name Hijacking: Incidents, Threats, Risks and Remediation. Retrieved March 6, 2017.", "url": "https://www.icann.org/groups/ssac/documents/sac-007-en" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1103", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Requires adversary to gain access to an email account for person listed as the domain registrar/POC. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or take advantage of renewal process gaps.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Generally not easily detectable unless domain registrar provides alerting on any updates.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--6c79d654-6506-4f33-b48f-c80babdcc52d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Dumpster dive", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1286).\n\nDumpster diving is looking through waste for information on technology, people, and/or organizational items of interest. (Citation: FriedDumpsters)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1286", "external_id": "T1286" }, { "source_name": "FriedDumpsters", "description": "Robert B. Fried. (n.d.). Dumpsters: Beware of Treasures. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Strong physical security and monitoring will detect this behavior if performed on premises.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Not difficult if waste is placed in an unsecured or minimally secured area before collection.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1063", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--20a66013-8dab-4ca3-a67d-766c842c561c", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Dynamic DNS", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1311).\n\nDynamic DNS is a method of automatically updating a name in the DNS system. Providers offer this rapid reconfiguration of IPs to hostnames as a service. (Citation: DellMirage2012)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1311", "external_id": "T1311" }, { "source_name": "DellMirage2012", "description": "DELL SECUREWORKS COUNTER THREAT UNIT THREAT INTELLIGENCE. (2012, September 18). The Mirage Campaign. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender will not know at first use what is valid or hostile traffic without more context. It is possible, however, for defenders to see if the PTR record for an address is hosted by a known DDNS provider. There is potential to assign some level of risk based on this.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Flexible and re-configurable command and control servers, along with deniable ownership and reduced cost of ownership.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1088", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--54eb2bab-125f-4d1c-b999-0c692860bafe", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Dynamic DNS", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1333).\n\nDynamic DNS is a automated method to rapidly update the domain name system mapping of hostnames to IPs. (Citation: FireEyeSupplyChain)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1333", "external_id": "T1333" }, { "source_name": "FireEyeSupplyChain", "description": "FireEye. (2014). SUPPLY CHAIN ANALYSIS: From Quartermaster to SunshopFireEye. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender will not know at first use what is valid or hostile traffic without more context.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "It is relatively easy to subscribe to dynamic DNS providers or find ways to get different IP addresses from a cloud provider.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1110", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--78ae433b-289d-4c8d-b8c1-f8de0b7f9090", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Enumerate client configurations", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1262).\n\nClient configurations information such as the operating system and web browser, along with additional information such as version or language, are often transmitted as part of web browsing communications. This can be accomplished in several ways including use of a compromised web site to collect details on visiting computers. (Citation: UnseenWorldOfCookies) (Citation: Panopticlick)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1262", "external_id": "T1262" }, { "source_name": "UnseenWorldOfCookies", "description": "Joanna Geary, Chris Cross. (2012, April 13). Tracking the trackers: help us reveal the unseen world of cookies. Retrieved March 5, 2017." }, { "source_name": "Panopticlick", "description": "Electronic Frontier Foundation. (n.d.). Panopticlick: Is your browser safe against tracking?. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Typical information collected as part of accessing web sites (e.g., operating system, browser version, basic configurations).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Basic web scripting capability to collect information of interest on users of interest. Requires a compromised web site and the users of interest to navigate there.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1039", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--ef6197fd-a58a-4006-bfd6-1d7765d8409d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Enumerate externally facing software applications technologies, languages, and dependencies", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1261).\n\nSoftware applications will be built using different technologies, languages, and dependencies. This information may reveal vulnerabilities or opportunities to an adversary. (Citation: CommonApplicationAttacks) (Citation: WebApplicationSecurity) (Citation: SANSTop25)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1261", "external_id": "T1261" }, { "source_name": "CommonApplicationAttacks", "description": "Paul Ionescu. (2015, April 8). The 10 Most Common Application Attacks in Action. Retrieved March 5, 2017." }, { "source_name": "WebApplicationSecurity", "description": "Gregory Leonard. (2016, February). Getting Started with Web Application Security. Retrieved March 5, 2017." }, { "source_name": "SANSTop25", "description": "SANS Institute. (2011, June 27). CWE/SANS TOP 25 Most Dangerous Software Errors. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Impossible to differentiate between an adversary and a normal user when accessing a site to determine the languages/technologies used. If active scanning tools are employed, then the defender has the ability to detect. However, this is typically not acted upon due to the large volume of this type of traffic and it will likely not prompt the defender to take any actionable defense. Defender review of access logs may provide some insight based on trends or patterns.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Basic interaction with the site provides insight into the programming languages/technologies used for a given web site. Additionally many of the active scanning tools will also provide some insight into this information.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1038", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--8a64f743-acaa-49d5-9d3d-ae5616a3876f", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Exploit public-facing application", "description": "**This technique has been deprecated. Please use [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190).**\n\nThe use of software, data, or commands to take advantage of a weakness in a computer system or program in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. (Citation: GoogleCrawlerSQLInj)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1377", "url": "https://attack.mitre.org/techniques/T1377" }, { "description": "PETER BRIGHT. (2013, November 6). Google crawler tricked into performing SQL injection attacks using decade-old technique. Retrieved March 9, 2017.", "source_name": "GoogleCrawlerSQLInj" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:20:54.394Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1154", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Launching a SQL injection attack is not overly complex and a commonly used technique. This technique, however, requires finding a vulnerable application.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "If the application and network are designed well, the defender should be able to utilize logging and application logic to catch and deflect SQL injection attacks.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "Yes" }, { "id": "attack-pattern--248cbfdd-fec4-451b-b2a9-e46d4b268e30", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Fast Flux DNS", "description": "**This technique has been deprecated. Please use [Fast Flux DNS](https://attack.mitre.org/techniques/T1568/001).**\n\nA technique in which a fully qualified domain name has multiple IP addresses assigned to it which are swapped with extreme frequency, using a combination of round robin IP address and short Time-To-Live (TTL) for a DNS resource record. (Citation: HoneynetFastFlux) (Citation: MisnomerFastFlux) (Citation: MehtaFastFluxPt1) (Citation: MehtaFastFluxPt2)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1325", "url": "https://attack.mitre.org/techniques/T1325" }, { "description": "Jamie Riden. (2008, August 16). HOW FAST-FLUX SERVICE NETWORKS WORK. Retrieved March 6, 2017.", "source_name": "HoneynetFastFlux" }, { "description": "Misnomer. (2012, May 4). RESEARCH TO DETECTION \u2013 IDENTIFY FAST FLUX IN YOUR ENVIRONMENT. Retrieved March 6, 2017.", "source_name": "MisnomerFastFlux" }, { "url": "https://resources.infosecinstitute.com/fast-flux-networks-working-detection-part-1/#gref", "description": "Mehta, L. (2014, December 17). Fast Flux Networks Working and Detection, Part 1. Retrieved March 6, 2017.", "source_name": "MehtaFastFluxPt1" }, { "source_name": "MehtaFastFluxPt2", "description": "Mehta, L. (2014, December 23). Fast Flux Networks Working and Detection, Part 2. Retrieved March 6, 2017.", "url": "https://resources.infosecinstitute.com/fast-flux-networks-working-detection-part-2/#gref" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-03-30T14:06:03.611Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true, "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1102", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Fast flux is generally simple for an adversary to set up and offers several advantages. Such advantages include limited audit trails for defenders to find, ease of operation for an adversary to maintain, and support for main nodes.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "In general, detecting usage of fast flux DNS is difficult due to web traffic load balancing that services client requests quickly. In single flux cases only IP addresses change for static domain names. In double flux cases, nothing is static. Defenders such as IPS, domain registrars, and service providers are likely in the best position for detection.", "x_mitre_detectable_by_common_defenses": "Partial" }, { "id": "attack-pattern--103d72e6-7e0d-4b3a-9373-c38567305c33", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Friend/Follow/Connect to targets of interest", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1344).\n\nOnce a persona has been developed an adversary will use it to create connections to targets of interest. These connections may be direct or may include trying to connect through others. (Citation: NEWSCASTER2014) (Citation: BlackHatRobinSage)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1344", "external_id": "T1344" }, { "source_name": "NEWSCASTER2014", "description": "Lennon, M. (2014, May 29). Iranian Hackers Targeted US Officials in Elaborate Social Media Attack Operation. Retrieved March 1, 2017.", "url": "https://www.securityweek.com/iranian-hackers-targeted-us-officials-elaborate-social-media-attack-operation" }, { "source_name": "BlackHatRobinSage", "description": "Ryan, T. (2010). \u201cGetting In Bed with Robin Sage.\u201d. Retrieved March 6, 2017.", "url": "http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "persona-development" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1121", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "The nature of social media is such that the adversary naturally connects to a target of interest without suspicion, given the purpose of the platform is to promote connections between individuals. Performing activities like typical users, but with specific intent in mind.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Unless there is some threat intelligence reporting, these users are hard to differentiate.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--eacd1efe-ee30-4b03-b58f-5b3b1adfe45d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Friend/Follow/Connect to targets of interest", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1364).\n\nA form of social engineering designed build trust and to lay the foundation for future interactions or attacks. (Citation: BlackHatRobinSage)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1364", "external_id": "T1364" }, { "source_name": "BlackHatRobinSage", "description": "Ryan, T. (2010). \u201cGetting In Bed with Robin Sage.\u201d. Retrieved March 6, 2017.", "url": "http://media.blackhat.com/bh-us-10/whitepapers/Ryan/BlackHat-USA-2010-Ryan-Getting-In-Bed-With-Robin-Sage-v1.0.pdf" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "stage-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1141", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Connecting with \"friends\" is a fundamental requirement for social media - without it, social media is worthless. An adversary can easily create a profile and request targets to validate the requests.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Users have the ability to detect and report non-authenticated individuals requesting to follow, friend or connect to a target. However the rigidity in validating the users is not typically followed by standard users.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--e754fa49-2db1-416b-92db-7f886decd099", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Generate analyst intelligence requirements", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1234).\n\nAnalysts may receive Key Intelligence Topics (KITs) and Key Intelligence Questions (KIQs) from leadership or key decision makers and generate intelligence requirements to articulate intricacies of information required on a topic or question. (Citation: Herring1999)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1234", "external_id": "T1234" }, { "source_name": "Herring1999", "description": "Jan P. Herring. (1999). Key Intelligence Topics: A Process to Identify and Define Intelligence Needs. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1011", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--388f3a5c-2cdd-466c-9159-b507fa429fcd", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Hardware or software supply chain implant", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1365).\n\nDuring production and distribution, the placement of software, firmware, or a CPU chip in a computer, handheld, or other electronic device that enables an adversary to gain illegal entrance. (Citation: McDRecall) (Citation: SeagateMaxtor)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1365", "external_id": "T1365" }, { "source_name": "McDRecall", "description": "Tash Shifrin. (2006, October 16). Malware forces McDonald\u2019s recall of giveaway MP3s. Retrieved March 9, 2017." }, { "source_name": "SeagateMaxtor", "description": "Brandon Hill. (2007, November 14). Seagate Serves External HDDs with a Side of Virus. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "The number of elements and components in a supply chain of HW or SW is vast and detecting an implant is complex for SW, but more complex for HW.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Access to the supply chain by an adversary can be a challenging endeavor, depending on what element is attempting to be subverted.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1142", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "stage-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--6f088e84-37b2-44de-8df3-393908f2d77b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Host-based hiding techniques", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1314).\n\nHost based hiding techniques are designed to allow an adversary to remain undetected on a machine upon which they have taken action. They may do this through the use of static linking of binaries, polymorphic code, exploiting weakness in file formats, parsers, or self-deleting code. (Citation: VirutAP)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1314", "external_id": "T1314" }, { "source_name": "VirutAP", "description": "Microsoft Malware Protection Center. (2008, July 30). Virus: Win32/Virut.AP. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Techniques are difficult to detect and might occur in uncommon use-cases (e.g., patching, anti-malware, anti-exploitation software).", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Some of the host-based hiding techniques require advanced knowledge combined with an understanding and awareness of the target's environment (e.g., exploiting weaknesses in file formats, parsers and detection capabilities).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1091", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--fb39384c-00e4-414a-88af-e80c4904e0b8", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Human performs requested action of physical nature", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nThrough social engineering or other methods, an adversary can get users to perform physical actions that provide access to an adversary. This could include providing a password over the phone or inserting a 'found' CD or USB into a system. (Citation: AnonHBGary) (Citation: CSOInsideOutside)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1385", "url": "https://attack.mitre.org/techniques/T1385" }, { "source_name": "AnonHBGary", "description": "Bright, P. (2011, February 15). Anonymous speaks: the inside story of the HBGary hack. Retrieved March 9, 2017.", "url": "https://arstechnica.com/tech-policy/2011/02/anonymous-speaks-the-inside-story-of-the-hbgary-hack/" }, { "description": "Taylor Armerding. (2012, October 25). Line blurs between insider, outsider attacks. Retrieved March 9, 2017.", "source_name": "CSOInsideOutside" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "compromise" } ], "modified": "2020-10-14T01:53:28.015Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1162", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Ill-informed users insert devices into their network that they randomly find, despite training educating them why this is not a wise idea.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Non-hypersensing environments do not typically collect this level of detailed information.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--0fad2267-9f46-4ebb-91b5-d543243732cb", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify analyst level gaps", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1233).\n\nAnalysts identify gap areas that generate a compelling need to generate a Key Intelligence Topic (KIT) or Key Intelligence Question (KIQ). (Citation: BrighthubGapAnalysis) (Citation: ICD115) (Citation: JP2-01)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1233", "external_id": "T1233" }, { "source_name": "BrighthubGapAnalysis", "description": "Ronda Bowen. (2014, March 26). Performing a Gap Analysis: Where Do You Begin?. Retrieved March 14, 2017." }, { "source_name": "ICD115", "description": "Office of the Director of National Intelligence. (2012, December 21). ICD 115: Intelligence Community Capability Requirements Process. Retrieved March 2, 2017." }, { "source_name": "JP2-01", "description": "Joint Chiefs of Staff. (2012, January 05). Joint and National Intelligence Support to Military Operations. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1010", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--1f82ef59-b7da-4cd3-a41c-2e80f80f084f", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify business processes/tempo", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1280).\n\nUnderstanding an organizations business processes and tempo may allow an adversary to more effectively craft social engineering attempts or to better hide technical actions, such as those that generate network traffic. (Citation: Scasny2015) (Citation: Infosec-osint)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1280", "external_id": "T1280" }, { "source_name": "Scasny2015", "description": "Gregory Scasny. (2015, September 14). Understanding Open Source Intelligence (OSINT) and its relationship to Identity Theft. Retrieved March 1, 2017." }, { "source_name": "Infosec-osint", "description": "InfoSec Institute. (2013, September 11). OSINT (Open-Source Intelligence). Retrieved May 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Current or previous employees may divulge information on the Internet. If insiders are used, the defender may have policies or tools in place to detect loss of this data or knowledge.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "In some cases, this requires some insider knowledge or specialized access to learn when critical operations occur in a corporation. For publicly traded US corporations, there is a lot of open source information about their financial reporting obligations (per SEC). Companies announce their annual shareholder meeting and their quarter phone calls with investors. Information such as this can help the adversary to glean certain aspects of the business processes and/or rhythm.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1057", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--5b6ce031-bb86-407a-9984-2b9700ac4549", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify business relationships", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1272).\n\nBusiness relationship information includes the associates of a target and may be discovered via social media sites such as [LinkedIn](https://www.linkedin.com) or public press releases announcing new partnerships between organizations or people (such as key hire announcements in industry articles). This information may be used by an adversary to shape social engineering attempts (exploiting who a target expects to hear from) or to plan for technical actions such as exploiting network trust relationship. (Citation: RSA-APTRecon) (Citation: Scasny2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1272", "external_id": "T1272" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." }, { "source_name": "Scasny2015", "description": "Gregory Scasny. (2015, September 14). Understanding Open Source Intelligence (OSINT) and its relationship to Identity Theft. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Searching publicly available sources that cannot be monitored by a defender. Much of this information is widely known and difficult to obscure.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Made easier by today's current social media.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1049", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--73e7d7d5-1782-4cd0-a4d7-00c7ec051c2a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify business relationships", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1283).\n\nBusiness relationship information may be used by an adversary to shape social engineering attempts (exploiting who a target expects to hear from) or to plan for technical actions such as exploiting network trust relationship. (Citation: 11StepsAttackers)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1283", "external_id": "T1283" }, { "source_name": "11StepsAttackers", "description": "Thor Olavsrud. (2014, September 2). 11 Steps Attackers Took to Crack Target. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Exception to the rule is if the adversary tips off the target that others have been asking about the relationship with them.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Requires an intensive process. In some industries, business relationships may be public in order to generate business, but this is not the case for all industries and all relationships.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1060", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--d778cb83-2292-4995-b006-d38f52bc1e64", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify gap areas", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1225).\n\nLeadership identifies gap areas that generate a compelling need to generate a Key Intelligence Topic (KIT) or Key Intelligence Question (KIQ). (Citation: ODNIIntegration) (Citation: ICD115)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1225", "external_id": "T1225" }, { "source_name": "ODNIIntegration", "description": "Office of the Director of National Intelligence. (n.d.). Intelligence Integration - Who Are We. Retrieved March 2, 2017." }, { "source_name": "ICD115", "description": "Office of the Director of National Intelligence. (2012, December 21). ICD 115: Intelligence Community Capability Requirements Process. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1002", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--89a79d91-53e0-4ef5-ba28-558cb8b01f76", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify groups/roles", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1270).\n\nPersonnel internally to a company may belong to a group or maintain a role with electronic specialized access, authorities, or privilege that make them an attractive target for an adversary. One example of this is a system administrator. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1270", "external_id": "T1270" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Searching publicly available sources that cannot be monitored by a defender.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Requires an adversary to undergo an intensive research process. It is resource intensive or requires special data access. May be easier for certain specialty use cases.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1047", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--c721b235-679a-4d76-9ae9-e08921fccf84", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify job postings and needs/gaps", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1248).\n\nJob postings, on either company sites, or in other forums, provide information on organizational structure and often provide contact information for someone within the organization. This may give an adversary information on technologies within the organization which could be valuable in attack or provide insight in to possible security weaknesses or limitations in detection or protection mechanisms. (Citation: JobPostingThreat)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1248", "external_id": "T1248" }, { "source_name": "JobPostingThreat", "description": "Jay D. Krasnow. (2000, October). The Competitive Intelligence and National Security Threat from Website Job Listings. Retrieved March 16, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Impossible to differentiate between an adversary and a normal user when accessing open/public information.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Publicly posted information by design. Providing too much detail in the job posting could aid the adversary in learning more about the target's environment and possible technical weaknesses/deficiencies.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1025", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--7718e92f-b011-4f88-b822-ae245a1de407", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify job postings and needs/gaps", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1278).\n\nJob postings, on either company sites, or in other forums, provide information on organizational structure, needs, and gaps in an organization. This may give an adversary an indication of weakness in an organization (such as under-resourced IT shop). Job postings can also provide information on an organizations structure which could be valuable in social engineering attempts. (Citation: JobPostingThreat) (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1278", "external_id": "T1278" }, { "source_name": "JobPostingThreat", "description": "Jay D. Krasnow. (2000, October). The Competitive Intelligence and National Security Threat from Website Job Listings. Retrieved March 16, 2017." }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Public source external to the defender's organization.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Very public by design.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1055", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--0722cd65-0c83-4c89-9502-539198467ab1", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify job postings and needs/gaps", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1267).\n\nJob postings, on either company sites, or in other forums, provide information on organizational structure and often provide contact information for someone within the organization. This may give an adversary information on people within the organization which could be valuable in social engineering attempts. (Citation: JobPostingThreat)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1267", "external_id": "T1267" }, { "source_name": "JobPostingThreat", "description": "Jay D. Krasnow. (2000, October). The Competitive Intelligence and National Security Threat from Website Job Listings. Retrieved March 16, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Public source external to the defender's organization.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Very public by design.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1044", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--0c0f075b-5d69-43f2-90df-d9ad18f44624", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify people of interest", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1269).\n\nThe attempt to identify people of interest or with an inherent weakness for direct or indirect targeting to determine an approach to compromise a person or organization. Such targets may include individuals with poor OPSEC practices or those who have a trusted relationship with the intended target. (Citation: RSA-APTRecon) (Citation: Scasny2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1269", "external_id": "T1269" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." }, { "source_name": "Scasny2015", "description": "Gregory Scasny. (2015, September 14). Understanding Open Source Intelligence (OSINT) and its relationship to Identity Theft. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Common defenses protecting against poor OPSEC practices are traditionally more policy-based in nature rather than technical. Policy-based mitigations are generally more difficult to enforce and track violations, making it more difficult that this technique can be detected by common defenses.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Specialty cases enable an adversary to use key words in order to search social media and identify personnel with poor OPSEC practices who may have access to specialized information which would make them a target of interest. In addition, the open nature of social media leads to a tendency among individuals to overshare, encouraging poor OPSEC and increasing the ease by which an adversary can identify interesting targets.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1046", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--762771c2-3675-4535-88e9-b1f891758974", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify personnel with an authority/privilege", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1271).\n\nPersonnel internally to a company may have non-electronic specialized access, authorities, or privilege that make them an attractive target for an adversary. One example of this is an individual with financial authority to authorize large transactions. An adversary who compromises this individual might be able to subvert large dollar transfers. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1271", "external_id": "T1271" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "The layers of data required and potential gaps of information to map a specific person to an authority or privilege on a network requires access to resources that may not tip off a defender.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Requires an adversary to undergo an intensive research process. It is resource intensive or requires special data access. May be easier for certain specialty use cases.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1048", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--c9fb4451-729d-4771-b205-52c1829f949c", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify resources required to build capabilities", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1348).\n\nAs with legitimate development efforts, different skill sets may be required for different phases of an attack. The skills needed may be located in house, can be developed, or may need to be contracted out. (Citation: APT1)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1348", "external_id": "T1348" }, { "source_name": "APT1", "description": "Mandiant. (n.d.). APT1: Exposing One of China\u2019s Cyber Espionage Units. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Recruitment is, by its nature, either clandestine or off the record.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Like target organizations, adversary organizations are competing to identify and hire top technical talent. Training less technical staff is also a viable option.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1125", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--04e93ca1-8415-4a46-8549-73b7c84f8dc3", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify security defensive capabilities", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1263).\n\nSecurity defensive capabilities are designed to stop or limit unauthorized network traffic or other types of accesses. (Citation: OSFingerprinting2014) (Citation: NMAP WAF NSE)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1263", "external_id": "T1263" }, { "source_name": "OSFingerprinting2014", "description": "InfoSec Institute. (2014, June 19). What You Must Know About OS Fingerprinting. Retrieved March 1, 2017." }, { "source_name": "NMAP WAF NSE", "description": "Paulino Calderon. (n.d.). http-waf-detect. Retrieved April 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Technically, the defender has the ability to detect. However, this is typically not performed as this type of traffic would likely not prompt the defender to take any actionable defense. In addition, this would require the defender to closely review their access logs for any suspicious activity (if the activity is even logged).", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "The adversary will have some insight into defenses based on dropped traffic or filtered responses. It is more difficult to pinpoint which defenses are implemented (e.g., [https://www.fireeye.com FireEye] WMPS, [https://www.hpe.com Hewlett Packard Enterprise] Tipping Point IPS).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1040", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--7dae871c-effc-444b-9962-4b7efefe7d40", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify sensitive personnel information", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1274).\n\nAn adversary may identify sensitive personnel information not typically posted on a social media site, such as address, marital status, financial history, and law enforcement infractions. This could be conducted by searching public records that are frequently available for free or at a low cost online. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1274", "external_id": "T1274" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Searching publicly available sources that cannot be monitored by a defender.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "This type of information is useful to understand the individual and their ability to be blackmailed. Searching public records is easy and most information can be purchased for a low cost if the adversary really wants it.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1051", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--7860e21e-7514-4a3f-8a9d-56405ccfdb0c", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify supply chains", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1276).\n\nSupply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit organizational relationships. (Citation: SmithSupplyChain) (Citation: CERT-UKSupplyChain)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1276", "external_id": "T1276" }, { "source_name": "SmithSupplyChain", "description": "Drew Smith. (2015). Is your supply chain safe from cyberattacks?. Retrieved March 5, 2017." }, { "source_name": "CERT-UKSupplyChain", "description": "CERT-UK. (2016, October 01). Cyber-security risks in the supply chain. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Searching publicly available sources that cannot be monitored by a defender.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Requires an intensive process. May be easier in certain industries where there are a limited number of suppliers (e.g., SCADA).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1053", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--78e41091-d10d-4001-b202-89612892b6ff", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify supply chains", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1246).\n\nSupply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit the technology or interconnections that are part of the supply chain. (Citation: SmithSupplyChain) (Citation: CERT-UKSupplyChain) (Citation: RSA-supply-chain)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1246", "external_id": "T1246" }, { "source_name": "SmithSupplyChain", "description": "Drew Smith. (2015). Is your supply chain safe from cyberattacks?. Retrieved March 5, 2017." }, { "source_name": "CERT-UKSupplyChain", "description": "CERT-UK. (2016, October 01). Cyber-security risks in the supply chain. Retrieved March 5, 2017." }, { "source_name": "RSA-supply-chain", "description": "RSA Research. (2017, February). KINGSLAYER \u2013 A SUPPLY CHAIN ATTACK. Retrieved May 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Difficult, if not impossible to detect, because the adversary may collect this information from external sources that cannot be monitored by a defender.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Supply chain diversity of sourcing increases adversary difficulty with accurate mapping. Industry practice has moved towards agile sourcing.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1023", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--59369f72-3005-4e54-9095-3d00efcece73", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify supply chains", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1265).\n\nSupply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit the people, their positions, and relationships, that are part of the supply chain. (Citation: SmithSupplyChain) (Citation: CERT-UKSupplyChain)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1265", "external_id": "T1265" }, { "source_name": "SmithSupplyChain", "description": "Drew Smith. (2015). Is your supply chain safe from cyberattacks?. Retrieved March 5, 2017." }, { "source_name": "CERT-UKSupplyChain", "description": "CERT-UK. (2016, October 01). Cyber-security risks in the supply chain. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Searching publicly available sources that cannot be monitored by a defender.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Requires an intensive process to obtain the full picture. It is possible to obtain basic information/some aspects via OSINT. May be easier in certain industries where there are a limited number of suppliers (e.g., SCADA).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1042", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--194bff4f-c218-40df-bea3-1ace715de8dd", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify technology usage patterns", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1264).\n\nTechnology usage patterns include identifying if users work offsite, connect remotely, or other possibly less restricted/secured access techniques. (Citation: SANSRemoteAccess)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1264", "external_id": "T1264" }, { "source_name": "SANSRemoteAccess", "description": "Jason Ragland. (2010, January 18). Remotely Accessing Sensitive Resources. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Physical observations, OSINT for remote access instructions, and other techniques are not detectable.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Determine if users work offsite, connect remotely, or other possibly less restricted/secured access techniques.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1041", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--ad124f84-52d2-40e3-95dd-cfdd44eae6ef", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify vulnerabilities in third-party software libraries", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1389).\n\nMany applications use third-party software libraries, often without full knowledge of the behavior of the libraries by the application developer. For example, mobile applications often incorporate advertising libraries to generate revenue for the application developer. Vulnerabilities in these third-party libraries could potentially be exploited in any application that uses the library, and even if the vulnerabilities are fixed, many applications may still use older, vulnerable versions of the library. (Citation: Flexera News Vulnerabilities) (Citation: Android Security Review 2015) (Citation: Android Multidex RCE)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1389", "external_id": "T1389" }, { "source_name": "Flexera News Vulnerabilities", "description": "John Lipsey. (2015, March 25). 15,435 Vulnerabilities in Close to 4,000 Applications in 2014. Retrieved April 12, 2017." }, { "source_name": "Android Security Review 2015", "description": "Google. (2016, April). Android Security 2015 Year In Review. Retrieved April 12, 2017." }, { "source_name": "Android Multidex RCE", "description": "Ryan Welton. (2015, June 15). A Pattern for Remote Code Execution using Arbitrary File Writes and MultiDex Applications. Retrieved April 12, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_detectable_by_common_defenses_explanation": "Open source software has great appeal mostly due to the time savings and that it is free. However, using this code without assessing it's security is akin to blindly executing third party software. Companies often do not dedicate the time to appropriately detect and scan for vulnerabilities. The mainstream mobile application stores scan applications for some known vulnerabilities. For example, Google's Android Application Security Improvement Program identifies and alerts developers to vulnerabilities present in their applications from use of the Vungle, Apache Cordova, WebView SSL, GnuTLS, and Vitamio third-party libraries. However, these scans are not likely to cover all vulnerable libraries, developers may not always act on the results, and the results may not be made available to impacted end users of the applications.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Developers commonly use open source libraries such that where an adversary can easily discover known vulnerabilities and create exploits. It is also generally easy to decompile arbitrary mobile applications to determine what libraries they use, and similarly use this information to correlate against known CVEs and exploit packages.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1166", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--288b3cc3-f4da-4250-ab8c-d8b5dbed94ca", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Identify web defensive services", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1256).\n\nAn adversary can attempt to identify web defensive services as [CloudFlare](https://www.cloudflare.com), [IPBan](https://github.com/jjxtra/Windows-IP-Ban-Service), and [Snort](https://www.snort.org). This may be done by passively detecting services, like [CloudFlare](https://www.cloudflare.com) routing, or actively, such as by purposefully tripping security defenses. (Citation: NMAP WAF NSE)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1256", "external_id": "T1256" }, { "source_name": "NMAP WAF NSE", "description": "Paulino Calderon. (n.d.). http-waf-detect. Retrieved April 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Active service detection may trigger an alert. Passive service enumeration is not detected.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Adversary can passively detect services (e.g., [https://www.cloudflare.com/ CloudFlare] routing) or actively detect services (e.g., by purposefully tripping security defenses)", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1033", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--73e394e5-3d8a-40d1-ab8c-a1b4ea9db424", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Install and configure hardware, network, and systems", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1336).\n\nAn adversary needs the necessary skills to set up procured equipment and software to create their desired infrastructure. (Citation: KasperskyRedOctober)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1336", "external_id": "T1336" }, { "source_name": "KasperskyRedOctober", "description": "Kaspersky Labs. (2013, January 14). Kaspersky Lab Identifies Operation \u201cRed October,\u201d an Advanced Cyber-Espionage Campaign Targeting Diplomatic and Government Institutions Worldwide. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender will not have visibility on 3rd party sites unless target is successfully enticed to visit one.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Skills are common to majority of computer scientists and \"hackers\". Can be easily obtained through contracting if not organic to adversary's organization.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1113", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--2c8a9df4-52a9-4770-94b3-5e95ab7d59f9", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Leverage compromised 3rd party resources", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nThe utilization of resources not owned by the adversary to launch exploits or operations. This includes utilizing equipment that was previously compromised or leveraging access gained by other methods (such as compromising an employee at a business partner location). (Citation: CitizenLabGreatCannon)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1375", "url": "https://attack.mitre.org/techniques/T1375" }, { "description": "Bill Marczak, Jakub Dalek, John Scott-Railton, Ron Deibert, Sarah McKune. (2015, April 10). China\u2019s Great Cannon. Retrieved March 9, 2017.", "source_name": "CitizenLabGreatCannon" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:21:59.520Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1152", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Conducting technique requires either nation-state level capabilities or large amounts of financing to coordinate multiple 3rd party resources to gain desired insight.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_detectable_by_common_defenses_explanation": "While possible to detect, it requires a broader vantage point than is typical that provides increased insight and conducts extensive data analysis and correlation between events.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--cdfdb0cd-a839-403c-9dd6-8a85d8c5c73d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Map network topology", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1252).\n\nA network topology is the arrangement of the various elements of a network (e.g., servers, workstations, printers, routers, firewalls, etc.). Mapping a network allows an adversary to understand how the elements are connected or related. (Citation: man traceroute) (Citation: Shodan Tutorial)", "external_references": [ { "external_id": "T1252", "url": "https://attack.mitre.org/techniques/T1252", "source_name": "mitre-pre-attack" }, { "description": "Linux Man Page. (n.d.). traceroute(8) - Linux man page. Retrieved April 2, 2017.", "source_name": "man traceroute" }, { "description": "A Shodan Tutorial and Primer Daniel Miessler. (n.d.). A Shodan Tutorial and Primer. Retrieved April 2, 2017.", "source_name": "Shodan Tutorial" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "phase_name": "technical-information-gathering", "kill_chain_name": "mitre-pre-attack" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1029", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Various available tools and data sources for scouting and detecting network topologies.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Network mapping techniques/tools typically generate benign traffic that does not require further investigation by a defender since there is no actionable defense to execute. Defender review of access logs may provide some insight based on trends or patterns.", "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_deprecated": true }, { "id": "attack-pattern--695b1cce-57d7-49ae-a2af-820d50153f12", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Mine social media", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1273).\n\nAn adversary may research available open source information about a target commonly found on social media sites such as [Facebook](https://www.facebook.com), [Instagram](https://www.instagram.com), or [Pinterest](https://www.pinterest.com). Social media is public by design and provides insight into the interests and potentially inherent weaknesses of a target for exploitation by the adversary. (Citation: RSA-APTRecon)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1273", "external_id": "T1273" }, { "source_name": "RSA-APTRecon", "description": "Rotem Kerner. (2015, October). RECONNAISSANCE: A Walkthrough of the \u201cAPT\u201d Intelligence Gathering Process. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Searching publicly available sources that cannot be monitored by a defender.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Very public by design. Application of privacy settings is not a panacea.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1050", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "people-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--a54a7708-8f64-45f3-ad51-1abf976986a0", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Mine technical blogs/forums", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1257).\n\nTechnical blogs and forums provide a way for technical staff to ask for assistance or troubleshoot problems. In doing so they may reveal information such as operating system (OS), network devices, or applications in use. (Citation: FunAndSun2012)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1257", "external_id": "T1257" }, { "source_name": "FunAndSun2012", "description": "Jeff Bardin. (2012, October 10). OSINT and Cyber Intelligence - Fun and Sun in Miami. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Cannot detect access to public sites.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Success is dependent upon the existence of detailed technical specifications for target network posted in blogs/forums. Poor OPSEC practices result in an adversary gleaning a lot of sensitive information about configurations and/or issues encountered.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1034", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--31fa5b03-1ede-4fab-8a68-ed831fcf4899", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Misattributable credentials", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1322).\n\nThe use of credentials by an adversary with the intent to hide their true identity and/or portray them self as another person or entity. An adversary may use misattributable credentials in an attack to convince a victim that credentials are legitimate and trustworthy when this is not actually the case. (Citation: FakeSSLCerts)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1322", "external_id": "T1322" }, { "source_name": "FakeSSLCerts", "description": "Paul Mutton. (2014, February 12). Fake SSL certificates deployed across the internet. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_detectable_by_common_defenses_explanation": "If a previous incident identified the credentials used by an adversary, defenders can potentially use these credentials to track the adversary through reuse of the same credentials.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "An adversary can easily create and use misattributable credentials to obtain servers, build environment, [https://aws.amazon.com AWS] accounts, etc. Many service providers require some form of identifiable information such as a phone number or email address, but there are several avenues to acquire these consistent with the misattributable identity.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1099", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--90884cdb-31dd-431c-87db-9cc7e03191e5", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Network-based hiding techniques", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1315).\n\nTechnical network hiding techniques are methods of modifying traffic to evade network signature detection or to utilize misattribution techniques. Examples include channel/IP/VLAN hopping, mimicking legitimate operations, or seeding with misinformation. (Citation: HAMMERTOSS2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1315", "external_id": "T1315" }, { "source_name": "HAMMERTOSS2015", "description": "FireEye. (2015, July). HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Unless defender is dissecting protocols or performing network signature analysis on any protocol deviations/patterns, this technique is largely undetected.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Some of the hiding techniques require special accesses (network, proximity, physical, etc.) and/or may rely on knowledge of how the defender operates and/or awareness on what visibility the defender has and how it is obtained", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1092", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--b79e8a3f-a109-47c2-a0e3-564955590a3d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Non-traditional or less attributable payment options", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1316).\n\nUsing alternative payment options allows an adversary to hide their activities. Options include crypto currencies, barter systems, pre-paid cards or shell accounts. (Citation: Goodin300InBitcoins)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1316", "external_id": "T1316" }, { "source_name": "Goodin300InBitcoins", "description": "Dan Goodin. (2013, October 17). You\u2019re infected\u2014if you want to see your data again, pay us $300 in Bitcoins. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender likely will not have access to payment information. Monitoring crypto-currency or barter boards is resource intensive and not fully automatable.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Easy to use pre-paid cards or shell accounts to pay for services online. Crypto currencies and barter systems can avoid use of trace-able bank or credit apparatus.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1093", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--5436571f-2332-4b51-b7ed-0bc822fe02c2", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "OS-vendor provided communication channels", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1390).\n\nGoogle and Apple provide Google Cloud Messaging and Apple Push Notification Service, respectively, services designed to enable efficient communication between third-party mobile app backend servers and the mobile apps running on individual devices. These services maintain an encrypted connection between every mobile device and Google or Apple that cannot easily be inspected and must be allowed to traverse networks as part of normal device operation. These services could be used by adversaries for communication to compromised mobile devices. (Citation: Securelist Mobile Malware 2013) (Citation: DroydSeuss)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1390", "external_id": "T1390" }, { "source_name": "Securelist Mobile Malware 2013", "description": "Roman Unuchek, Victor Chebyshev. (2014, February 24). Mobile Malware Evolution: 2013. Retrieved April 12, 2017." }, { "source_name": "DroydSeuss", "description": "Alberto Coletta, Victor van der Veen, and Federico Maggi. (2016). DroydSeuss: A Mobile Banking Trojan Tracker - Short Paper. Retrieved April 12, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "These services are heavily utilized by mainstream mobile app developers. High volume of communications makes it extremely hard for a defender to distinguish between legitimate and adversary communications.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "These are free services provided by Google and Apple to app developers, and information on how to use them is readily available.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1167", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--e6ca2820-a564-4b74-b42a-b6bdf052e5b6", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obfuscate infrastructure", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1309).\n\nObfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc. (Citation: LUCKYCAT2012)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1309", "external_id": "T1309" }, { "source_name": "LUCKYCAT2012", "description": "Forward-Looking Threat Research Team. (2012). LUCKYCAT REDUX: Inside an APT Campaign with Multiple Targets in India and Japan. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Difficult, but defender is well aware of technique and attempts to find discrepancies.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Adversary has a variety of solutions, ranging in difficulty, that can be employed (e.g., BGP hijacking, tunneling, reflection, multi-hop, etc.)\nAdversary can also use misattributable credentials to obtain servers, build environment, [https://aws.amazon.com Amazon Web Services] (AWS) accounts, etc.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1086", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--72c8d526-1247-42d4-919c-6d7a31ca8f39", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obfuscate infrastructure", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1331).\n\nObfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc. (Citation: FireEyeAPT17)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1331", "external_id": "T1331" }, { "source_name": "FireEyeAPT17", "description": "FireEye. (2015, May). APT17: Hiding in Plain Sight - FireEye and Microsoft Expose Obfuscation Tactic. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defender will generally not have visibility into their infrastructure.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Building and testing infrastructure and obfuscating it to protect it against intrusions are a standard part of the adversary process in preparing to conduct an operation against a target.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1108", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--9d234df0-2344-4db4-bc0f-8de9c6c071a7", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obfuscate operational infrastructure", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1318).\n\nObfuscation is hiding the day-to-day building and testing of new tools, chat servers, etc. (Citation: DellComfooMasters)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1318", "external_id": "T1318" }, { "source_name": "DellComfooMasters", "description": "Joe Stewart and Don Jackson, Dell SecureWorks Counter Threat Unit(TM) Threat Intelligence. (2013, July 31). Secrets of the Comfoo Masters. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "While possible to detect given a significant sample size, depending on how the unique identifier is used detection may be difficult as similar patterns may be employed elsewhere (e.g., content hosting providers, account reset URLs).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "An adversary can easily generate pseudo-random identifiers to associate with a specific target, include the indicator as part of a URL and then identify which target was successful.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1095", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--357e137c-7589-4af1-895c-3fbad35ea4d2", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obfuscate or encrypt code", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1319).\n\nObfuscation is the act of creating code that is more difficult to understand. Encoding transforms the code using a publicly available format. Encryption transforms the code such that it requires a key to reverse the encryption. (Citation: CylanceOpCleaver)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1319", "external_id": "T1319" }, { "source_name": "CylanceOpCleaver", "description": "CYLANCE. (n.d.). Operation Cleaver. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Detecting encryption is easy, decrypting/deobfuscating is hard.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Various solutions exist for the adversary to use. This technique is commonly used to prevent attribution and evade detection.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1096", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--c2ffd229-11bb-4fd8-9208-edbe97b14c93", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obfuscation or cryptography", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1313).\n\nObfuscation is the act of creating communications that are more difficult to understand. Encryption transforms the communications such that it requires a key to reverse the encryption. (Citation: FireEyeAPT28)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1313", "external_id": "T1313" }, { "source_name": "FireEyeAPT28", "description": "FireEye, Inc. (2014). APT 28: A Window into Russia\u2019s Cyber Espionage Operations?. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Techniques and signatures are hard to detect. Advanced communications and exfiltration channels are nearly indistinguishable from background noise.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Known approaches include the use of cryptography for communications, rotating drops sites (such as random list of chat fora), and one-time [https://aws.amazon.com/s3/ Simple Storage Service (S3)] buckets, etc. All require sophisticated knowledge, infrastructure, and funding.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1090", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--d58f3996-e293-4f69-a2c8-0e1851cb8297", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obtain Apple iOS enterprise distribution key pair and certificate", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1392).\n\nThe adversary can obtain an Apple iOS enterprise distribution key pair and certificate and use it to distribute malicious apps directly to Apple iOS devices without the need to publish the apps to the Apple App Store (where the apps could potentially be detected). (Citation: Apple Developer Enterprise Porgram Apps) (Citation: Fruit vs Zombies) (Citation: WIRELURKER) (Citation: Sideloading Change)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1392", "external_id": "T1392" }, { "source_name": "Apple Developer Enterprise Porgram Apps", "description": "Apple Inc.. (2016). Distributing Apple Developer Enterprise Program Apps. Retrieved April 12, 2017." }, { "source_name": "Fruit vs Zombies", "description": "Claud Xiao. (2016). Fruit vs Zombies: Defeat Non-jailbroken iOS Malware. Retrieved April 12, 2017." }, { "source_name": "WIRELURKER", "description": "Claud Xiao. (2014). WIRELURKER: A New Era in iOS and OS X Malware. Retrieved April 12, 2017." }, { "source_name": "Sideloading Change", "description": "David Richardson. (2015, September 10). Change to sideloading apps in iOS 9 is a security win. Retrieved April 12, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_detectable_by_common_defenses_explanation": "Starting in iOS 9, Apple has changed the user interface when installing apps to better indicate to users the potential implications of installing apps signed by an enterprise distribution key rather than from Apple's App Store and to make it more difficult for users to inadvertently install these apps. Additionally, enterprise management controls are available that can be imposed to prevent installing these apps. Also, enterprise mobility management / mobile device management (EMM/MDM) systems can be used to scan for the presence of undesired apps on enterprise mobile devices.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Apple requires a DUNS number, corporate documentation, and $299 to obtain an enterprise distribution certificate. Additionally, Apple revokes certificates if they discover malicious use. However, the enrollment information could be falsified to Apple by an adversary, or an adversary could steal an existing enterprise distribution certificate (and the corresponding private key) from a business that already possesses one.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1169", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "persona-development" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--3d1488a6-59e6-455a-8b80-78b53edc33fe", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obtain booter/stressor subscription", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1396).\n\nConfigure and setup booter/stressor services, often intended for server stress testing, to enable denial of service attacks. (Citation: Krebs-Anna) (Citation: Krebs-Booter) (Citation: Krebs-Bazaar)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1396", "external_id": "T1396" }, { "source_name": "Krebs-Anna", "description": "Brian Krebs. (2017, January 18). Who is Anna-Senpai, the Mirai Worm Author?. Retrieved May 15, 2017.", "url": "https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" }, { "source_name": "Krebs-Booter", "description": "Brian Krebs. (2016, October 27). Are the Days of \u201cBooter\u201d Services Numbered?. Retrieved May 15, 2017.", "url": "https://krebsonsecurity.com/2016/10/are-the-days-of-booter-services-numbered/" }, { "source_name": "Krebs-Bazaar", "description": "Brian Krebs. (2016, October 31). Hackforums Shutters Booter Service Bazaar. Retrieved May 15, 2017.", "url": "https://krebsonsecurity.com/2016/10/hackforums-shutters-booter-service-bazaar/" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1173", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Easily accessible and used to launch DDoS attacks by even novice Internet users, and can be purchased from providers for a nominal fee, some of which even accept credit cards and PayPal payments to do.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Purchase of booster services is not observable; potentially can trace booster service used to origin of sale, yet not before attack is executed. Furthermore, subscription does not automatically mean foul intention.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--46017368-6e09-412b-a29c-385be201cc03", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obtain domain/IP registration information", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1251).\n\nFor a computing resource to be accessible to the public, domain names and IP addresses must be registered with an authorized organization. (Citation: Google Domains WHOIS) (Citation: FunAndSun2012) (Citation: Scasny2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1251", "external_id": "T1251" }, { "source_name": "Google Domains WHOIS", "description": "Google Domains. (n.d.). About WHOIS. Retrieved April 2, 2017." }, { "source_name": "FunAndSun2012", "description": "Jeff Bardin. (2012, October 10). OSINT and Cyber Intelligence - Fun and Sun in Miami. Retrieved March 1, 2017." }, { "source_name": "Scasny2015", "description": "Gregory Scasny. (2015, September 14). Understanding Open Source Intelligence (OSINT) and its relationship to Identity Theft. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Open access to DNS registration/routing information is inherent in Internet architecture.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Proliferation of DNS information makes registration information functionally freely available.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1028", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--68b45999-bb0c-4829-bbd0-75d6dac57c94", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obtain templates/branding materials", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1281).\n\nTemplates and branding materials may be used by an adversary to add authenticity to social engineering message. (Citation: Scasny2015)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1281", "external_id": "T1281" }, { "source_name": "Scasny2015", "description": "Gregory Scasny. (2015, September 14). Understanding Open Source Intelligence (OSINT) and its relationship to Identity Theft. Retrieved March 1, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary may download templates or branding from publicly available presentations that the defender can't monitor.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Some branding information is publicly available when a corporation publishes their briefings to the internet which provides insight into branding information and template materials. An exhaustive list of templating and branding is likely not available on the internet.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1058", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "organizational-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--27f3ddf8-1b77-4cc2-a4c0-e6da3d31a768", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Obtain/re-use payloads", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1346).\n\nA payload is the part of the malware which performs a malicious action. The adversary may re-use payloads when the needed capability is already available. (Citation: SonyDestover)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1346", "external_id": "T1346" }, { "source_name": "SonyDestover", "description": "Kurt Baumgartner. (2014, December 4). Sony/Destover: mystery North Korean actor\u2019s destructive and past network activity. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary will likely use code repositories, but detecting an adversary acquiring a payload would require the defender to be monitoring the code repository where the payload is stored. If the adversary re-uses payloads, this allows the defender to create signatures to detect using these known indicators of compromise (e.g., hashes).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Several exploit repositories and tool suites exist for re-use and tailoring.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1123", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--13ff5307-b650-405a-9664-d8076930b2bf", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Port redirector", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1363).\n\nRedirecting a communication request from one address and port number combination to another. May be set up to obfuscate the final location of communications that will occur in later stages of an attack. (Citation: SecureWorks HTRAN Analysis)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1363", "external_id": "T1363" }, { "source_name": "SecureWorks HTRAN Analysis", "description": "JOE STEWART. (2011, August 3). HTran and the Advanced Persistent Threat. Retrieved March 28, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Infrastructure is (typically) outside of control/visibility of defender and as such as tools are staged for specific campaigns, it will not be observable to those being attacked.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Adversary has control of the infrastructure and will likely be able to add/remove tools to infrastructure, whether acquired via hacking or standard computer acquisition (e.g., [https://aws.amazon.com AWS], VPS providers).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1140", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "stage-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--df42286d-dfbd-4455-bc9d-aef52ac29aa7", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Post compromise tool development", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1353).\n\nAfter compromise, an adversary may utilize additional tools to facilitate their end goals. This may include tools to further explore the system, move laterally within a network, exfiltrate data, or destroy data. (Citation: SofacyHits)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1353", "external_id": "T1353" }, { "source_name": "SofacyHits", "description": "Kaspersky Lab's Global Research & Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary will likely use code repositories, but development will be performed on their local systems.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Post compromise tool development is a standard part of the adversary's protocol in developing the necessary tools required to completely conduct an attack.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1130", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--3160347f-11ac-44a3-9640-a648b3c17a8f", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Private whois services", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1305).\n\nEvery domain registrar maintains a publicly viewable database that displays contact information for every registered domain. Private 'whois' services display alternative information, such as their own company data, rather than the owner of the domain. (Citation: APT1)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1305", "external_id": "T1305" }, { "source_name": "APT1", "description": "Mandiant. (n.d.). APT1: Exposing One of China\u2019s Cyber Espionage Units. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Algorithmically possible to detect COTS service usage or use of non-specific mailing addresses (PO Boxes, drop sites, etc.)", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Commercially available or easy to set up and/or register using a disposable email account.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1082", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--2141aea0-cf38-49aa-9e51-ac34092bc30a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Procure required equipment and software", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1335).\n\nAn adversary will require some physical hardware and software. They may only need a lightweight set-up if most of their activities will take place using on-line infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems. (Citation: NYTStuxnet)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1335", "external_id": "T1335" }, { "source_name": "NYTStuxnet", "description": "William J. Broad, John Markoff, and David E. Sanger. (2011, January 15). Israeli Test on Worm Called Crucial in Iran Nuclear Delay. Retrieved March 1, 2017.", "url": "https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1112", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Ease and availability of current hardware and software, mobile phones (cash and go phones), and additional online technology simplifies adversary process to achieve this technique (and possibly without traceability). The adversary has control of the infrastructure and will likely be able to add/remove tools to infrastructure, whether acquired via hacking or standard computer acquisition (e.g., [https://aws.amazon.com AWS], VPS).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Outside of highly specific or rare HW, nearly impossible to detect and track.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--b14f6692-b613-44bb-9f30-8381a5ff10d5", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Proxy/protocol relays", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1304).\n\nProxies act as an intermediary for clients seeking resources from other systems. Using a proxy may make it more difficult to track back the origin of a network communication. (Citation: APT1)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1304", "external_id": "T1304" }, { "source_name": "APT1", "description": "Mandiant. (n.d.). APT1: Exposing One of China\u2019s Cyber Espionage Units. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Defenders with standard capabilities will traditionally be able to see the first hop but not all the subsequent earlier hops an adversary takes to be able to conduct reconnaissance.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Proxies are readily available for the adversary with both free and cost-based options available.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1081", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--702dc95d-3266-42dc-9eef-4a19e2445148", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Push-notification client-side exploit", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nA technique to push an [iOS](https://www.apple.com/ios) or [Android](https://www.android.com) MMS-type message to the target which does not require interaction on the part of the target to be successful. (Citation: BlackHat Stagefright) (Citation: WikiStagefright)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1373", "url": "https://attack.mitre.org/techniques/T1373" }, { "description": "Joshua Drake. (2015, August 5). Stagefright: Scary Code in the Heart of Android. Retrieved March 29, 2017.", "source_name": "BlackHat Stagefright" }, { "description": "Wikipedia contributors. (2017, March 8). Stagefright (bug). Retrieved March 9, 2017.", "source_name": "WikiStagefright" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:22:23.446Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1150", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Easily executed technique to push an MMS-type message to the target which does not require interaction on the part of the target to be successful.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "For non-corporate cellular devices not joined to the corporate network, it is not possible to detect an adversary's use of the technique because messages traverse networks outside of the control of the employer. For corporate cellular devices which are joined to the corporate network, monitoring of messages and ability to patch against push attacks is possible, assuming they are fully monitored.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--acfcbe7a-4dbc-4471-be2b-134faf479e3e", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Receive KITs/KIQs and determine requirements", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1239).\n\nApplicable agencies and/or personnel receive intelligence requirements and evaluate them to determine sub-requirements related to topics, questions, or requirements. For example, an adversary's nuclear energy requirements may be further divided into nuclear facilities versus nuclear warhead capabilities. (Citation: AnalystsAndPolicymaking)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1239", "external_id": "T1239" }, { "source_name": "AnalystsAndPolicymaking", "description": "Jack Davis. (2002, September). Improving CIA Analytic Performance: Analysts and the Policymaking Process. Retrieved March 5, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1016", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-direction" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--7863b7f1-c18a-4aad-a6cf-4aa6d8797531", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Receive operator KITs/KIQs tasking", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1235).\n\nAnalysts may receive intelligence requirements from leadership and begin research process to satisfy a requirement. Part of this process may include delineating between needs and wants and thinking through all the possible aspects associating with satisfying a requirement. (Citation: FBIIntelligencePrimer)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1235", "external_id": "T1235" }, { "source_name": "FBIIntelligencePrimer", "description": "FBI. (n.d.). Intelligence Branch: Intelligence Primer. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1012", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-planning" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--9755ecdc-deb0-40e6-af49-713cb0f8ed92", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Remote access tool development", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1351).\n\nA remote access tool (RAT) is a piece of software that allows a remote user to control a system as if they had physical access to that system. An adversary may utilize existing RATs, modify existing RATs, or create their own RAT. (Citation: ActiveMalwareEnergy)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1351", "external_id": "T1351" }, { "source_name": "ActiveMalwareEnergy", "description": "Dan Goodin. (2014, June 30). Active malware operation let attackers sabotage US energy industry. Retrieved March 9, 2017.", "url": "https://arstechnica.com/information-technology/2014/06/active-malware-operation-let-attackers-sabotage-us-energy-industry/" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "build-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1128", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Many successful RATs exist for re-use/tailoring in addition to those an adversary may choose to build from scratch. The adversary's capabilities, target sensitivity, and needs will likely determine whether a previous RAT is modified for use a new one is built from scratch.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Adversary will likely use code repositories, but development will be performed on their local systems.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--0d759854-9b69-438c-8325-74b03cc80cf0", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Replace legitimate binary with malware", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nReplacing a legitimate binary with malware can be accomplished either by replacing a binary on a legitimate download site or standing up a fake or alternative site with the malicious binary. The intent is to have a user download and run the malicious binary thereby executing malware. (Citation: FSecureICS)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1378", "url": "https://attack.mitre.org/techniques/T1378" }, { "description": "Daavid and Antti. (2014, June 23). Havex Hunts For ICS/SCADA Systems. Retrieved March 9, 2017.", "source_name": "FSecureICS" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:23:46.977Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1155", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Requires the adversary to replace a binary on a website where users will download the binary (e.g., patch, firmware update, software application) as innately trusted. The additional challenge is the reduced set of vendor-trusted websites that are vulnerable.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_detectable_by_common_defenses_explanation": "On the host end user system, integrity checking (e.g., hash verification, code signing enforcement), application whitelisting, sandboxing, or behavioral-based/heuristic-based systems are most likely to be successful in detecting this technique. On the source webserver, detecting binary changes is easy to detect if performed.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--abd5bed1-4c12-45de-a623-ab8dc4ff862a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Research relevant vulnerabilities/CVEs", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1291).\n\nCommon Vulnerability Enumeration (CVE) is a dictionary of publicly known information about security vulnerabilities and exposures. An adversary can use this information to target specific software that may be vulnerable. (Citation: WeaponsVulnerable) (Citation: KasperskyCarbanak)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1291", "external_id": "T1291" }, { "source_name": "WeaponsVulnerable", "description": "Jack Smith IV. (2015, January 22). Pentagon Chief Weapons Tester: Almost All Military Programs Vulnerable to Cyber-Attacks. Retrieved March 5, 2017." }, { "source_name": "KasperskyCarbanak", "description": "Kaspersky Lab's Global Research & Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved March 27, 2017.", "url": "https://securelist.com/the-great-bank-robbery-the-carbanak-apt/68732/" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1068", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Using standard headers/fingerprints from normal traffic, it is often trivial to identify the SW or HW the target is running, which can be correlated against known CVEs and exploit packages.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Public source external to the defender's organization.", "x_mitre_detectable_by_common_defenses": "No", "x_mitre_deprecated": true }, { "id": "attack-pattern--b26babc7-9127-4bd5-9750-5e49748c9be3", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Research visibility gap of security vendors", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1290).\n\nIf an adversary can identify which security tools a victim is using they may be able to identify ways around those tools. (Citation: CrowdStrike Putter Panda)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1290", "external_id": "T1290" }, { "source_name": "CrowdStrike Putter Panda", "description": "Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.", "url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Public source external to the defender's organization.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Requires in-depth research and potentially other intrusions, requires unbounded amount of work to possibly find a return on investment", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1067", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--a16e4004-caac-4a0b-acd5-486f8fda1665", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Review logs and residual traces", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1358).\n\nExecution of code and network communications often result in logging or other system or network forensic artifacts. An adversary can run their code to identify what is recorded under different conditions. This may result in changes to their code or adding additional actions (such as deleting a record from a log) to the code. (Citation: EDB-39007) (Citation: infosec-covering-tracks)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1358", "external_id": "T1358" }, { "source_name": "EDB-39007", "description": "Tavis Ormandy and Natalie Silvanovich. (2015, December 16). FireEye - Wormable Remote Code Execution in MIP JAR Analysis. Retrieved March 9, 2017." }, { "source_name": "infosec-covering-tracks", "description": "Infosec Institute. (2015, September 9). Covering Tracks of Attacks. Retrieved May 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary controls the test and defender likely has no visibility.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Adversary has full control of environment to determine what level of auditing and traces exist on a system after execution.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1135", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "test-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--41086474-e6de-4fac-bb69-640db7fdf3d2", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Runtime code download and execution", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nMany mobile devices are configured to only allow applications to be installed from the mainstream vendor app stores (e.g., Apple App Store and Google Play Store). These app stores scan submitted applications for malicious behavior. However, applications can evade these scans by downloading and executing new code at runtime that was not included in the original application package. (Citation: Fruit vs Zombies) (Citation: Android Hax) (Citation: Execute This!) (Citation: HT Fake News App) (Citation: Anywhere Computing kill 2FA) (Citation: Android Security Review 2015)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1395", "url": "https://attack.mitre.org/techniques/T1395" }, { "description": "Claud Xiao. (2016). Fruit vs Zombies: Defeat Non-jailbroken iOS Malware. Retrieved April 12, 2017.", "source_name": "Fruit vs Zombies" }, { "description": "Jon Oberheide. (2010). Android Hax. Retrieved April 12, 2017.", "source_name": "Android Hax" }, { "description": "Sebastian Poeplau, Yanick Fratantonio, Antonio Bianchi, Christopher Kruegel, Giovanni Vigna. (2014). Execute This! Analyzing Unsafe and Malicious Dynamic Code Loading in Android Applications. Retrieved April 12, 2017.", "source_name": "Execute This!" }, { "description": "Wish Wu. (2016, July 15). Fake News App in Hacking Team Dump Designed to Bypass Google Play. Retrieved April 12, 2017.", "source_name": "HT Fake News App" }, { "description": "Radhesh Krishnan Konoth, Victor van der Veen and Herbert Bos. (2016). How Anywhere Computing Just Killed Your Phone-Based Two-Factor Authentication. Retrieved April 12, 2017.", "source_name": "Anywhere Computing kill 2FA" }, { "description": "Google. (2016, April). Android Security 2015 Year In Review. Retrieved April 12, 2017.", "source_name": "Android Security Review 2015" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:24:50.384Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1172", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Runtime code execution techniques and examples of their use are widely documented on both Apple iOS and Android.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Third-party mobile application security analysis services exist that scan for use of these techniques in iOS and Android applications. Additionally, Google specifically calls out the ability to \"identify attacks that require connection to a server and dynamic downloading of code\" in its Android Security 2015 Year in Review report. However, many applications use these techniques as part of their legitimate operation, increasing the difficulty of detecting or preventing malicious use.", "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_deprecated": true }, { "id": "attack-pattern--e34b9ca1-8778-41a3-bba5-8edaab4076dc", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "SSL certificate acquisition for domain", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1337).\n\nCertificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. Acquiring a certificate for a domain name similar to one that is expected to be trusted may allow an adversary to trick a user in to trusting the domain (e.g., vvachovia instead of [Wachovia](https://www.wellsfargo.com/about/corporate/wachovia) -- homoglyphs). (Citation: SubvertSSL) (Citation: PaypalScam)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1337", "external_id": "T1337" }, { "source_name": "SubvertSSL", "description": "Ryan Singel. (2010, March 24). Law Enforcement Appliance Subverts SSL. Retrieved March 2, 2017." }, { "source_name": "PaypalScam", "description": "Bob Sullivan. (2000, July 24). PayPal alert! Beware the 'PaypaI' scam. Retrieved March 2, 2017.", "url": "https://www.zdnet.com/article/paypal-alert-beware-the-paypai-scam-5000109103/" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1114", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "SSL certificates are readily available at little to no cost.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Defender can monitor for domains similar to popular sites (possibly leverage [https://www.alexa.com Alexa] top ''N'' lists as starting point).", "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_deprecated": true }, { "id": "attack-pattern--54a42187-a20c-4e4e-ba31-8d15c9e1f57f", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "SSL certificate acquisition for trust breaking", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1338).\n\nFake certificates can be acquired by legal process or coercion. Or, an adversary can trick a Certificate Authority into issuing a certificate. These fake certificates can be used as a part of Man-in-the-Middle attacks. (Citation: SubvertSSL)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1338", "external_id": "T1338" }, { "source_name": "SubvertSSL", "description": "Ryan Singel. (2010, March 24). Law Enforcement Appliance Subverts SSL. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "The certificate authority who is hacked cannot easily see they've been compromised, but [https://www.google.com Google] has caught on to this occurring in previous attacks such as DigiNotarDigiNotar2016 and [https://www.verisign.com Verisign].", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "One example of it occurring in the real world is the DigiNotarDigiNotar2016 case. To be able to do this usually requires sophisticated skills and is traditionally done by a nation state to spy on its citizens.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1115", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--cc0faf66-4df2-4328-9c9c-b0ca5de915ad", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Secure and protect infrastructure", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1317).\n\nAn adversary may secure and protect their infrastructure just as defenders do. This could include the use of VPNs, security software, logging and monitoring, passwords, or other defensive measures. (Citation: KrebsTerracottaVPN)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1317", "external_id": "T1317" }, { "source_name": "KrebsTerracottaVPN", "description": "Brian Krebs. (2014, August 4). Chinese VPN Service as Attack Platform?. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Indistinguishable from standard security practices employed by legitimate operators.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Adversary benefits from our own advances, techniques, and software when securing and protecting their own development infrastructure.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1094", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "adversary-opsec" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--3f157dee-74f0-41fc-801e-f837b8985b0a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Shadow DNS", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1340).\n\nThe process of gathering domain account credentials in order to silently create subdomains pointed at malicious servers without tipping off the actual owner. (Citation: CiscoAngler) (Citation: ProofpointDomainShadowing)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1340", "external_id": "T1340" }, { "source_name": "CiscoAngler", "description": "Nick Biasini. (2015, March 3). Threat Spotlight: Angler Lurking in the Domain Shadows. Retrieved March 6, 2017.", "url": "https://blogs.cisco.com/security/talos/angler-domain-shadowing" }, { "source_name": "ProofpointDomainShadowing", "description": "Proofpoint Staff. (2015, December 15). The shadow knows: Malvertising campaigns use domain shadowing to pull in Angler EK. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_old_attack_id": "PRE-T1117", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "To successfully conduct this attack, an adversary usually phishes the individual behind the domain registrant account, logs in with credentials, and creates a large amount of subdomains.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Detection of this technique requires individuals to monitor their domain registrant accounts routinely. In addition, defenders have had success with blacklisting sites or IP addresses, but an adversary can defeat this by rotating either the subdomains or the IP addresses associated with the campaign.", "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_deprecated": true }, { "id": "attack-pattern--e24a9f99-cb76-42a3-a50b-464668773e97", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Spear phishing messages with malicious attachments", "description": "**This technique has been deprecated. Please use [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).**\n\nEmails with malicious attachments are designed to get a user to open/execute the attachment in order to deliver malware payloads. (Citation: APT1)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1367", "url": "https://attack.mitre.org/techniques/T1367" }, { "description": "Mandiant. (n.d.). APT1: Exposing One of China\u2019s Cyber Espionage Units. Retrieved March 5, 2017.", "source_name": "APT1" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:25:35.837Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1144", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Sending the emails is the simple part, ensuring they make it to the target (e.g., not being filtered) may be challenging. Over time, an adversary refines their techniques to minimize detection by making their emails seem legitimate in structure and content.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Many technologies exist to scan content and/or emulate a workstation prior to the target receiving and executing the attachment (detonation chambers) in order to reduce malicious emails and attachments being delivered to the intended target. However, encryption continues to be a stumbling block. In addition, there are a variety of commercial technologies available that enable users to screen for phishing messages and which are designed to enhance email security.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "Yes" }, { "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1369", "url": "https://attack.mitre.org/techniques/T1369" }, { "description": "Nick Johnston. (2014, March 13). Google Docs Users Targeted by Sophisticated Phishing Scam. Retrieved March 29, 2017.", "source_name": "GoogleDrive Phishing" }, { "description": "Bob Griffin. (2015, May 16). THE ON-GOING THREAT OF SOCIAL ENGINEERING. Retrieved March 9, 2017.", "source_name": "RSASEThreat" } ], "description": "**This technique has been deprecated. Please use [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002).**\n\nEmails with malicious links are designed to get a user to click on the link in order to deliver malware payloads. (Citation: GoogleDrive Phishing) (Citation: RSASEThreat)", "name": "Spear phishing messages with malicious links", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "id": "attack-pattern--489a7797-01c3-4706-8cd1-ec56a9db3adc", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:25:58.783Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses_explanation": "Defenders can implement mechanisms to analyze links and identify levels of concerns. However, the adversary has the advantage of creating new links or finding ways to obfuscate the link so that common detection lists can not identify it. Detection of a malicious link could be identified once the file has been downloaded.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Sending emails is trivial and expected. The adversary needs to ensure links don't get tampered, removed, or flagged as a previously black-listed site.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1146" }, { "id": "attack-pattern--2fc04aa5-48c1-49ec-919a-b88241ef1d17", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Spear phishing messages with text only", "description": "**This technique has been deprecated. Please use [Phishing](https://attack.mitre.org/techniques/T1566) where appropriate.**\n\nEmails with text only phishing messages do not contain any attachments or links to websites. They are designed to get a user to take a follow on action such as calling a phone number or wiring money. They can also be used to elicit an email response to confirm existence of an account or user. (Citation: Paypal Phone Scam)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1368", "url": "https://attack.mitre.org/techniques/T1368" }, { "description": "Sophos Labs. (2006, July 7). PayPal phone phish scam uses voice recording to steal money. Retrieved March 29, 2017.", "source_name": "Paypal Phone Scam" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:26:25.555Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1145", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Sending messages with text only should be accepted in most cases (e.g., not being filtered based on source, content).", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "End user training and awareness is the primary defense for flagging a plain text email so the end user does not respond or take any requested action (e.g., calling a designated number).", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--b182f29c-2505-4b32-a000-0440ef189f59", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Spearphishing for Information", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1397).\n\nSpearphishing for information is a specific variant of spearphishing. Spearphishing for information is different from other forms of spearphishing in that it it doesn't leverage malicious code. All forms of spearphishing are elctronically delivered social engineering targeted at a specific individual, company, or industry. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials, without involving malicious code. Spearphishing for information frequently involves masquerading as a source with a reason to collect information (such as a system administrator or a bank) and providing a user with a website link to visit. The given website often closely resembles a legitimate site in appearance and has a URL containing elements from the real site. From the fake website, information is gathered in web forms and sent to the attacker. Spearphishing for information may also try to obtain information directly through the exchange of emails, instant messengers or other electronic conversation means. (Citation: ATTACKREF GRIZZLY STEPPE JAR)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1397", "external_id": "T1397" }, { "source_name": "ATTACKREF GRIZZLY STEPPE JAR", "description": "Department of Homeland Security and Federal Bureau of Investigation. (2016, December 29). GRIZZLY STEPPE \u2013 Russian Malicious Cyber Activity. Retrieved January 11, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-information-gathering" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2018-04-18T17:59:24.739Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1174", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Sending emails is trivial, and, over time, an adversary can refine their technique to minimize detection by making their emails seem legitimate in structure and content.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Depending on the specific method of phishing, the detections can vary. For emails, filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed. When it comes to following links, network intrusion detection systems (NIDS), firewalls, removing links, exploding shortened links, proxy monitoring, blocking uncategorized sites, and site reputation based filtering can all provide detection opportunities.", "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_deprecated": true }, { "id": "attack-pattern--03da0598-ed46-4a73-bf43-0313b3522400", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Submit KITs, KIQs, and intelligence requirements", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1237).\n\nOnce they have been created, intelligence requirements, Key Intelligence Topics (KITs), and Key Intelligence Questions (KIQs) are submitted into a central management system. (Citation: ICD204) (Citation: KIT-Herring)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1237", "external_id": "T1237" }, { "source_name": "ICD204", "description": "Office of the Director of National Intelligence. (2015, January 02). Retrieved March 5, 2017." }, { "source_name": "KIT-Herring", "description": "Jan P. Herring. (1999). Key Intelligence Topics: A Process to Identify and Define Intelligence Needs. Retrieved May 19, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1014", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-direction" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--72923cae-6c8c-4da2-8f48-b73389529c25", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Targeted client-side exploitation", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nA technique used to compromise a specific group of end users by taking advantage of flaws in client-side applications. For example, infecting websites that members of a targeted group are known to visit with the goal to infect a targeted user's computer. (Citation: RSASEThreat) (Citation: WikiStagefright) (Citation: ForbesSecurityWeek) (Citation: StrongPity-waterhole)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1371", "url": "https://attack.mitre.org/techniques/T1371" }, { "description": "Bob Griffin. (2015, May 16). THE ON-GOING THREAT OF SOCIAL ENGINEERING. Retrieved March 9, 2017.", "source_name": "RSASEThreat" }, { "description": "Wikipedia contributors. (2017, March 8). Stagefright (bug). Retrieved March 9, 2017.", "source_name": "WikiStagefright" }, { "description": "Fahmida Y. Rashid. (2015, February 11). Chinese Attackers Hacked Forbes Website in Watering Hole Attack: Security Firms. Retrieved March 7, 2017.", "source_name": "ForbesSecurityWeek" }, { "description": "Kurt Baumgartner. (2016, October 3). On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users. Retrieved May 9, 2017.", "source_name": "StrongPity-waterhole" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:26:52.970Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1148", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Commonly executed technique to place an exploit on an often widely used public web site intended for driveby delivery. The additional challenge is the reduced set of options for web sites to compromise since the set is reduced to those often visited by targets of interest.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Defensive technologies exist to scan web content before delivery to the requested end user. However, this is not foolproof as some sites encrypt web communications and the adversary constantly moves to sites not previously flagged as malicious thus defeating this defense. Host-based defenses can also aid in detection/mitigation as well as detection by the web site that got compromised. The added challenge for a conditional watering hole is the reduced scope and likely reduced ability to detect or be informed. Determining deltas in content (e.g., differences files type/size/number/hashes) downloaded could also aid in detection.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "Yes" }, { "id": "attack-pattern--eb517589-eefc-480e-b8e3-7a8b1066f6f1", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Targeted social media phishing", "description": "**This technique has been deprecated. Please use [Spearphishing via Service](https://attack.mitre.org/techniques/T1566/003).**\n\nSending messages through social media platforms to individuals identified as a target. These messages may include malicious attachments or links to malicious sites or they may be designed to establish communications for future actions. (Citation: APT1) (Citation: Nemucod Facebook)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1366", "url": "https://attack.mitre.org/techniques/T1366" }, { "description": "Mandiant. (n.d.). APT1: Exposing One of China\u2019s Cyber Espionage Units. Retrieved March 5, 2017.", "source_name": "APT1" }, { "description": "Bart Blaze. (2016, November 20). Nemucod downloader spreading via Facebook. Retrieved March 28, 2017.", "source_name": "Nemucod Facebook" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:27:43.972Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1143", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Sending messages to individuals identified as a target follows normal tradecraft for using social media.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Extremely hard to identify (in the launch phase) what message via social media is hostile versus what is not. Increased use of encrypted communications increases the difficulty average defender's have in detecting use of this technique.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--b93bd611-da4e-4c84-a40f-325b712bed67", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Task requirements", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1240).\n\nOnce divided into the most granular parts, analysts work with collection managers to task the collection management system with requirements and sub-requirements. (Citation: Heffter) (Citation: JP2-01)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1240", "external_id": "T1240" }, { "source_name": "Heffter", "description": "Clyde R. Heffter. (2011, August 4). A Fresh Look at Collection Requirements. Retrieved March 2, 2017." }, { "source_name": "JP2-01", "description": "Joint Chiefs of Staff. (2012, January 05). Joint and National Intelligence Support to Military Operations. Retrieved March 2, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Normally, defender is unable to detect. Few agencies and commercial organizations may have unique insights.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Normal aspect of adversary planning lifecycle. May not be done by all adversaries.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1017", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "priority-definition-direction" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--c9e85b80-39e8-42df-b275-86a2afcea9e8", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Test ability to evade automated mobile application security analysis performed by app stores", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1393).\n\nMany mobile devices are configured to only allow applications to be installed from the mainstream vendor app stores (e.g., Apple App Store and Google Play Store). An adversary can submit multiple code samples to these stores deliberately designed to probe the stores' security analysis capabilities, with the goal of determining effective techniques to place malicious applications in the stores that could then be delivered to targeted devices. (Citation: Android Bouncer) (Citation: Adventures in BouncerLand) (Citation: Jekyll on iOS) (Citation: Fruit vs Zombies)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1393", "external_id": "T1393" }, { "source_name": "Android Bouncer", "description": "Jon Oberheide and Charlie Miller. (2012). DISSECTING THE ANDROID BOUNCER. Retrieved April 12, 2017." }, { "source_name": "Adventures in BouncerLand", "description": "Nicholas J. Percoco and Sean Schulte. (2012). Adventures in BouncerLand. Retrieved April 12, 2017." }, { "source_name": "Jekyll on iOS", "description": "Tielei Wang, Kangjie Lu, Long Lu, Simon Chung, and Wenke Lee. (2013). Jekyll on iOS: When Benign Apps Become Evil. Retrieved April 12, 2017." }, { "source_name": "Fruit vs Zombies", "description": "Claud Xiao. (2016). Fruit vs Zombies: Defeat Non-jailbroken iOS Malware. Retrieved April 12, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "The app store operators (e.g., Apple and Google) may detect the attempts, but it would not be observable to those being attacked.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "An adversary can submit code remotely using throwaway accounts, although a registration fee may need to be paid for each new account (e.g., $99 for Apple and $25 for Google Play Store).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1170", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "test-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--0649fc36-72a0-40a0-a2f9-3fc7e3231ad6", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Test callback functionality", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1356).\n\nCallbacks are malware communications seeking instructions. An adversary will test their malware to ensure the appropriate instructions are conveyed and the callback software can be reached. (Citation: LeeBeaconing)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1356", "external_id": "T1356" }, { "source_name": "LeeBeaconing", "description": "Tony Lee. (2012, December 11). Testing Your Defenses - Beaconing. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary controls the test and defender likely has no visibility.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Adversary controls or acquires all pieces of infrastructure and can test outside of defender's visibility.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1133", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "test-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--e042a41b-5ecf-4f3a-8f1f-1b528c534772", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Test malware in various execution environments", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1357).\n\nMalware may perform differently on different platforms (computer vs handheld) and different operating systems ([Ubuntu](http://www.ubuntu.com) vs [OS X](http://www.apple.com/osx)), and versions ([Windows](http://windows.microsoft.com) 7 vs 10) so malicious actors will test their malware in the environment(s) where they most expect it to be executed. (Citation: BypassMalwareDefense)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1357", "external_id": "T1357" }, { "source_name": "BypassMalwareDefense", "description": "Morton Christiansen. (2010, May 7). Bypassing Malware Defenses. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary controls the test and defender likely has no visibility.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Adversary can simulate most environments (e.g., variable operating systems, patch levels, application versions) with details available from other techniques.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1134", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "test-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--8b57a8f1-9cbc-4b95-b162-cc2a1add94f2", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Test malware to evade detection", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1359).\n\nAn adversary can run their code on systems with cyber security protections, such as antivirus products, in place to see if their code is detected. They can also test their malware on freely available public services. (Citation: MalwareQAZirtest)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1359", "external_id": "T1359" }, { "source_name": "MalwareQAZirtest", "description": "Damballa Day Before Zero Blog. (2009, December 17). Malware QA and Exploit Testing Services \u2013 Virtest.com. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Adversary controls the testing and can ensure data does not leak with proper OPSEC on testing.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Adversary has the ability to procure products and not have reporting return to vendors or can choose to use freely available services", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1136", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "test-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--18bfa01c-9fa9-409f-91f5-4a2822609d81", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Test physical access", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1360).\n\nAn adversary can test physical access options in preparation for the actual attack. This could range from observing behaviors and noting security precautions to actually attempting access. (Citation: OCIAC Pre Incident Indicators) (Citation: NewsAgencySpy)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1360", "external_id": "T1360" }, { "source_name": "OCIAC Pre Incident Indicators", "description": "Orange County Intelligence Assessment Center. (n.d.). Pre-Incident Indicators. Retrieved March 28, 2017." }, { "source_name": "NewsAgencySpy", "description": "The Canadian Press. (2012, August 22). Reporter says Chinese news agency asked him to spy. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Defender often install badging, cameras, security guards or other detection techniques for physical security and monitoring.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_difficulty_for_adversary_explanation": "Requires a physical presence in the space being entered and increased risk of being detected/detained (e.g., recorded on video camera)", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1137", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "test-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--57061a8a-d7c5-42a9-be60-f79526b95bf6", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Test signature detection", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1292).\n\nAn adversary can test the detections of malicious emails or files by using publicly available services, such as virus total, to see if their files or emails cause an alert. They can also use similar services that are not openly available and don't publicly publish results or they can test on their own internal infrastructure. (Citation: WiredVirusTotal)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1292", "external_id": "T1292" }, { "source_name": "WiredVirusTotal", "description": "Kim Zetter. (14, September 2). A Google Site Meant to Protect You Is Helping Hackers Attack You. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_detectable_by_common_defenses_explanation": "If using a common service like [https://www.virustotal.com VirusTotal], it is possible to detect. If the adversary uses a hostile, less well-known service, the defender would not be aware.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Easy to automate upload/email of a wide range of data packages.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1069", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "technical-weakness-identification" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--c9ac5715-ee5c-4380-baf4-6f12e304ca93", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Test signature detection for file upload/email filters", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1361).\n\nAn adversary can test their planned method of attack against existing security products such as email filters or intrusion detection sensors (IDS). (Citation: WiredVirusTotal)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1361", "external_id": "T1361" }, { "source_name": "WiredVirusTotal", "description": "Kim Zetter. (14, September 2). A Google Site Meant to Protect You Is Helping Hackers Attack You. Retrieved March 9, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Use of sites like [https://www.virustotal.com VirusTotal] to test signature detection often occurs to test detection. Defender can also look for newly added uploads as a precursor to an adversary's launch of an attack.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Current open source technologies and websites exist to facilitate adversary testing of malware against signatures.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1138", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "test-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--b3253d9e-ba11-430f-b5a3-4db844ce5413", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Unauthorized user introduces compromise delivery mechanism", "description": "**This technique has been deprecated. Please use [Hardware Additions](https://attack.mitre.org/techniques/T1200) where appropriate.**\n\nIf an adversary can gain physical access to the target's environment they can introduce a variety of devices that provide compromise mechanisms. This could include installing keyboard loggers, adding routing/wireless equipment, or connecting computing devices. (Citation: Credit Card Skimmers)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1387", "url": "https://attack.mitre.org/techniques/T1387" }, { "description": "Jeremy Kirk. (2008, December 16). Swedish Police Warn of Tampered Credit Card Terminals. Retrieved April 2, 2017.", "source_name": "Credit Card Skimmers" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "compromise" } ], "modified": "2020-03-30T14:28:39.840Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1164", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "This likely requires the adversary to have close or insider access to introduce the mechanism of compromise.", "x_mitre_difficulty_for_adversary": "No", "x_mitre_detectable_by_common_defenses_explanation": "This varies depending on the amount of monitoring within the environment. Highly secure environments might have more innate monitoring and catch an adversary doing this more easily.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "No" }, { "id": "attack-pattern--58d0b955-ae3d-424a-a537-2804dab38793", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Unconditional client-side exploitation/Injected Website/Driveby", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nA technique used to compromise victims wherein the victims visit a compromised website that redirects their browser to a malicious web site, such as an exploit kit's landing page. The exploit kit landing page will probe the victim's operating system, web browser, or other software to find an exploitable vulnerability to infect the victim. (Citation: GeorgeDriveBy) (Citation: BellDriveBy)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1372", "url": "https://attack.mitre.org/techniques/T1372" }, { "description": "Torsten George. (2014, October 15). The Internet's Big Threat: Drive-by Attacks. Retrieved March 7, 2017.", "source_name": "GeorgeDriveBy" }, { "description": "Lee Bell. (2013, January 8). Drive-by exploits are the top web security threat, says ENISA. Retrieved March 7, 2017.", "source_name": "BellDriveBy" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:29:19.081Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1149", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Placing an exploit on a public web site for driveby types of delivery is not impossible. However, gaining access to a web site with high enough traffic to meet specific objectives could be the challenge.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "With the use of malware detonation chambers (e.g., for web or email traffic), this improves detection. Encryption and other techniques reduces the efficacy of these defenses.", "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_deprecated": true }, { "id": "attack-pattern--2ec57bf1-fcc3-4c19-9516-79b7fde483af", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Untargeted client-side exploitation", "description": "**This technique has been deprecated. Please see ATT&CK's Initial Access and Execution tactics for replacement techniques.**\n\nA technique that takes advantage of flaws in client-side applications without targeting specific users. For example, an exploit placed on an often widely used public web site intended for drive-by delivery to whomever visits the site. (Citation: CitizenLabGreatCannon)", "external_references": [ { "source_name": "mitre-pre-attack", "external_id": "T1370", "url": "https://attack.mitre.org/techniques/T1370" }, { "description": "Bill Marczak, Jakub Dalek, John Scott-Railton, Ron Deibert, Sarah McKune. (2015, April 10). China\u2019s Great Cannon. Retrieved March 9, 2017.", "source_name": "CitizenLabGreatCannon" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "launch" } ], "modified": "2020-03-30T14:30:45.039Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_is_subtechnique": false, "x_mitre_old_attack_id": "PRE-T1147", "x_mitre_version": "1.0", "x_mitre_difficulty_for_adversary_explanation": "Commonly executed technique to place an exploit on an often widely used public web site intended for driveby delivery.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_detectable_by_common_defenses_explanation": "Defensive technologies exist to scan web content before delivery to the requested end user. However, this is not fool proof as some sites encrypt web communications and the adversary constantly moves to sites not previously flagged as malicious thus defeating this defense. Host-based defenses can also aid in detection/mitigation as well as detection by the web site that got compromised.", "x_mitre_deprecated": true, "x_mitre_detectable_by_common_defenses": "Yes" }, { "id": "attack-pattern--e8471f43-2742-4fd7-9af7-8ed1330ada37", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Upload, install, and configure software/tools", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1362).\n\nAn adversary may stage software and tools for use during later stages of an attack. The software and tools may be placed on systems legitimately in use by the adversary or may be placed on previously compromised infrastructure. (Citation: APT1) (Citation: RedOctober)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1362", "external_id": "T1362" }, { "source_name": "APT1", "description": "Mandiant. (n.d.). APT1: Exposing One of China\u2019s Cyber Espionage Units. Retrieved March 5, 2017." }, { "source_name": "RedOctober", "description": "GReAT. (2013, January 17). \u201cRed October\u201d. Detailed Malware Description 4. Second Stage of Attack. Retrieved March 7, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "No", "x_mitre_detectable_by_common_defenses_explanation": "Infrastructure is (typically) outside of control/visibility of defender and as such as tools are staged for specific campaigns, it will not be observable to those being attacked.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Adversary has control of the infrastructure and will likely be able to add/remove tools to infrastructure, whether acquired via hacking or standard computer acquisition (e.g., [https://aws.amazon.com AWS], VPS providers).", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1139", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "stage-capabilities" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "attack-pattern--616238cb-990b-4c71-8f50-d8b10ed8ce6b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Use multiple DNS infrastructures", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/techniques/T1327).\n\nA technique used by the adversary similar to Dynamic DNS with the exception that the use of multiple DNS infrastructures likely have whois records. (Citation: KrebsStLouisFed)", "external_references": [ { "source_name": "mitre-pre-attack", "url": "https://attack.mitre.org/techniques/T1327", "external_id": "T1327" }, { "source_name": "KrebsStLouisFed", "description": "Brian Krebs. (2015, May 18). St. Louis Federal Reserve Suffers DNS Breach. Retrieved March 6, 2017." } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_detectable_by_common_defenses": "Partial", "x_mitre_detectable_by_common_defenses_explanation": "This is by design captured in public registration logs. Various tools and services exist to track/query/monitor domain name registration information. However, tracking multiple DNS infrastructures will likely require multiple tools/services or more advanced analytics.", "x_mitre_difficulty_for_adversary": "Yes", "x_mitre_difficulty_for_adversary_explanation": "Requires more planning, but feasible.", "x_mitre_version": "1.0", "x_mitre_old_attack_id": "PRE-T1104", "type": "attack-pattern", "kill_chain_phases": [ { "kill_chain_name": "mitre-pre-attack", "phase_name": "establish-&-maintain-infrastructure" } ], "modified": "2020-10-26T13:42:49.342Z", "created": "2017-12-14T16:46:06.044Z", "x_mitre_deprecated": true }, { "id": "relationship--bbb1c074-a93a-4e40-b11e-2151403f7f1d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--0722cd65-0c83-4c89-9502-539198467ab1", "relationship_type": "related-to", "target_ref": "attack-pattern--c721b235-679a-4d76-9ae9-e08921fccf84" }, { "id": "relationship--0adf353d-688b-46ce-88bb-62a008675fe0", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[Night Dragon](https://attack.mitre.org/groups/G0014) used servers in China, the U.S., and the Netherlands in an attempt to hide their operations.(Citation: McAfee Night Dragon)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "McAfee Night Dragon", "description": "McAfee\u00ae Foundstone\u00ae Professional Services and McAfee Labs\u2122. (2011, February 10). Global Energy Cyberattacks: \u201cNight Dragon\u201d. Retrieved February 19, 2018.", "url": "https://securingtomorrow.mcafee.com/wp-content/uploads/2011/02/McAfee_NightDragon_wp_draft_to_customersv1-1.pdf" } ], "source_ref": "intrusion-set--23b6a0f5-fa95-46f9-a6f3-4549c5e45ec8", "relationship_type": "uses", "target_ref": "attack-pattern--286cc500-4291-45c2-99a1-e760db176402", "type": "relationship", "modified": "2019-03-25T14:36:29.818Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--c6e43693-2a6d-4ba8-8fa7-ec1ab5239528", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[Night Dragon](https://attack.mitre.org/groups/G0014) used third party hosting services in the U.S. in an attempt to hide their operations.(Citation: McAfee Night Dragon)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "McAfee Night Dragon", "description": "McAfee\u00ae Foundstone\u00ae Professional Services and McAfee Labs\u2122. (2011, February 10). Global Energy Cyberattacks: \u201cNight Dragon\u201d. Retrieved February 19, 2018.", "url": "https://securingtomorrow.mcafee.com/wp-content/uploads/2011/02/McAfee_NightDragon_wp_draft_to_customersv1-1.pdf" } ], "source_ref": "intrusion-set--23b6a0f5-fa95-46f9-a6f3-4549c5e45ec8", "relationship_type": "uses", "target_ref": "attack-pattern--488da8ed-2887-4ef6-a39a-5b69bc6682c6", "type": "relationship", "modified": "2019-03-25T14:36:29.820Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--46f1e7d4-4d73-4e33-b88b-b3bcde5d81fb", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--a757670d-d600-48d9-8ae9-601d42c184a5", "relationship_type": "related-to", "target_ref": "attack-pattern--af358cad-eb71-4e91-a752-236edc237dae" }, { "id": "relationship--ef32147c-d309-4867-aaba-998088290e32", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--7718e92f-b011-4f88-b822-ae245a1de407", "relationship_type": "related-to", "target_ref": "attack-pattern--0722cd65-0c83-4c89-9502-539198467ab1" }, { "id": "relationship--e4501560-7850-4467-8422-2cf336429e8a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--856a9371-4f0f-4ea9-946e-f3144204240f", "relationship_type": "related-to", "target_ref": "attack-pattern--dfa4eaf4-50d9-49de-89e9-d33f579f3e05" }, { "id": "relationship--db10491f-a854-4404-9271-600349484bc3", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT1](https://attack.mitre.org/groups/G0006) hijacked FQDNs associated with legitimate websites hosted by hop points. Mandiant considers them to be \u201chijacked\u201d since they were originally registered for a legitimate reason but are used by APT1 for malicious purposes.(Citation: Mandiant APT1)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "Mandiant APT1", "description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.", "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf" } ], "source_ref": "intrusion-set--6a2e693f-24e5-451a-9f88-b36a108e5662", "relationship_type": "uses", "target_ref": "attack-pattern--aadaee0d-794c-4642-8293-7ec22a99fb1a", "type": "relationship", "modified": "2019-08-20T13:08:13.223Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--f8559304-7ef6-4c48-8d76-a56ebf37c0be", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT16](https://attack.mitre.org/groups/G0023) has compromised otherwise legitimate sites as staging servers for second-stage payloads.(Citation: FireEye EPS Awakens Part 2)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "url": "https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html", "description": "Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.", "source_name": "FireEye EPS Awakens Part 2" } ], "source_ref": "intrusion-set--d6e88e18-81e8-4709-82d8-973095da1e70", "relationship_type": "uses", "target_ref": "attack-pattern--e51398e6-53dc-4e9f-a323-e54683d8672b", "type": "relationship", "modified": "2019-03-22T14:20:45.685Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--6ba71250-1dc7-4b8d-88e7-698440ea18a0", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--028ad431-84c5-4eb7-a364-2b797c234f88", "relationship_type": "related-to", "target_ref": "attack-pattern--2b9a666e-bd59-4f67-9031-ed41b428e04a" }, { "id": "relationship--984d13eb-ba9c-4e7c-8675-85dde9877a81", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--af358cad-eb71-4e91-a752-236edc237dae", "relationship_type": "related-to", "target_ref": "attack-pattern--a757670d-d600-48d9-8ae9-601d42c184a5" }, { "id": "relationship--f8504a07-758c-4c51-ac94-c2e7ba652e29", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--74a3288e-eee9-4f8e-973a-fbc128e033f1", "relationship_type": "related-to", "target_ref": "attack-pattern--af358cad-eb71-4e91-a752-236edc237dae" }, { "id": "relationship--28bf7e8b-9948-40a8-945b-6b5f2c78ec53", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--2b9a666e-bd59-4f67-9031-ed41b428e04a", "relationship_type": "related-to", "target_ref": "attack-pattern--028ad431-84c5-4eb7-a364-2b797c234f88" }, { "id": "relationship--f24a6bf4-c60f-4fa6-8f6a-f2806ae92cdd", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--20a66013-8dab-4ca3-a67d-766c842c561c", "relationship_type": "related-to", "target_ref": "attack-pattern--54eb2bab-125f-4d1c-b999-0c692860bafe" }, { "id": "relationship--60b6c9a6-7705-4c72-93bb-67de0caf11f4", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--784ff1bc-1483-41fe-a172-4cd9ae25c06b", "relationship_type": "related-to", "target_ref": "attack-pattern--028ad431-84c5-4eb7-a364-2b797c234f88" }, { "id": "relationship--a7f177e4-7e7f-4883-af3d-c95db9ea7a53", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--dfa4eaf4-50d9-49de-89e9-d33f579f3e05", "relationship_type": "related-to", "target_ref": "attack-pattern--856a9371-4f0f-4ea9-946e-f3144204240f" }, { "id": "relationship--4a69750c-47d5-40f5-b753-c6bb2a27a359", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--eacd1efe-ee30-4b03-b58f-5b3b1adfe45d", "relationship_type": "related-to", "target_ref": "attack-pattern--103d72e6-7e0d-4b3a-9373-c38567305c33" }, { "id": "relationship--c124f0ba-f4bc-430a-b40c-eebe0577f812", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--59369f72-3005-4e54-9095-3d00efcece73", "relationship_type": "related-to", "target_ref": "attack-pattern--7860e21e-7514-4a3f-8a9d-56405ccfdb0c" }, { "id": "relationship--f43faad4-a016-4da0-8de6-53103d429268", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[Cleaver](https://attack.mitre.org/groups/G0003) has used zhCat to encrypt traffic or use inline obfuscation to make detection more difficult. zhCat makes message traffic look benign.(Citation: Cylance Cleaver)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "Cylance Cleaver", "description": "Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.", "url": "https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf" } ], "source_ref": "intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063", "relationship_type": "uses", "target_ref": "attack-pattern--c2ffd229-11bb-4fd8-9208-edbe97b14c93", "type": "relationship", "modified": "2019-03-22T20:00:23.837Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--a34c16e9-bc7e-45f5-a9a2-8b05d868e6a0", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[Night Dragon](https://attack.mitre.org/groups/G0014) used privately developed and customized remote access tools.(Citation: McAfee Night Dragon)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "McAfee Night Dragon", "description": "McAfee\u00ae Foundstone\u00ae Professional Services and McAfee Labs\u2122. (2011, February 10). Global Energy Cyberattacks: \u201cNight Dragon\u201d. Retrieved February 19, 2018.", "url": "https://securingtomorrow.mcafee.com/wp-content/uploads/2011/02/McAfee_NightDragon_wp_draft_to_customersv1-1.pdf" } ], "source_ref": "intrusion-set--23b6a0f5-fa95-46f9-a6f3-4549c5e45ec8", "relationship_type": "uses", "target_ref": "attack-pattern--9755ecdc-deb0-40e6-af49-713cb0f8ed92", "type": "relationship", "modified": "2019-03-25T14:36:29.918Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--5dc0b076-5f25-4bda-83c7-1d8bd214b81a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--286cc500-4291-45c2-99a1-e760db176402", "relationship_type": "related-to", "target_ref": "attack-pattern--795c1a92-3a26-453e-b99a-6a566aa94dc6" }, { "id": "relationship--8bcaccd1-403b-40f1-82d3-ac4d873263f8", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--c721b235-679a-4d76-9ae9-e08921fccf84", "relationship_type": "related-to", "target_ref": "attack-pattern--0722cd65-0c83-4c89-9502-539198467ab1" }, { "id": "relationship--ab313887-ff00-4aa9-8edb-ab107c517c19", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--c721b235-679a-4d76-9ae9-e08921fccf84", "relationship_type": "related-to", "target_ref": "attack-pattern--7718e92f-b011-4f88-b822-ae245a1de407" }, { "id": "relationship--a29f2adc-c328-4cf3-9984-2c0c72ec7061", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--78e41091-d10d-4001-b202-89612892b6ff", "relationship_type": "related-to", "target_ref": "attack-pattern--59369f72-3005-4e54-9095-3d00efcece73" }, { "id": "relationship--1143e6a6-deef-4dbd-8c91-7bf537d8f5ce", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--784ff1bc-1483-41fe-a172-4cd9ae25c06b", "relationship_type": "related-to", "target_ref": "attack-pattern--2b9a666e-bd59-4f67-9031-ed41b428e04a" }, { "id": "relationship--ac1dfc58-d5a2-4b6f-9bf4-c6c0d2d3ae80", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--73e7d7d5-1782-4cd0-a4d7-00c7ec051c2a", "relationship_type": "related-to", "target_ref": "attack-pattern--5b6ce031-bb86-407a-9984-2b9700ac4549" }, { "id": "relationship--614f64d8-c221-4789-b1e1-787e9326a37b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT17](https://attack.mitre.org/groups/G0025) created biographical sections on TechNet profile pages to appear more legitimate.(Citation: FireEye APT17)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "url": "https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf", "description": "FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.", "source_name": "FireEye APT17" } ], "source_ref": "intrusion-set--090242d7-73fc-4738-af68-20162f7a5aae", "relationship_type": "uses", "target_ref": "attack-pattern--271e6d40-e191-421a-8f87-a8102452c201", "type": "relationship", "modified": "2019-03-22T14:21:19.541Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--ab356c7a-6922-4143-90eb-5be632e2f6cd", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[Cleaver](https://attack.mitre.org/groups/G0003) created fake LinkedIn profiles.(Citation: Dell Threat Group 2889)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "url": "http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/", "description": "Dell SecureWorks. (2015, October 7). Suspected Iran-Based Hacker Group Creates Network of Fake LinkedIn Profiles. Retrieved January 14, 2016.", "source_name": "Dell Threat Group 2889" } ], "source_ref": "intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063", "relationship_type": "uses", "target_ref": "attack-pattern--9108e212-1c94-4f8d-be76-1aad9b4c86a4", "type": "relationship", "modified": "2019-03-22T20:00:23.846Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--7bd3d2ba-f114-4835-97b6-1c3e2208d3f3", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--092f05e3-f7c0-4cd2-91be-3a8d6ed3cadc", "relationship_type": "related-to", "target_ref": "attack-pattern--96eb59d1-6c46-44bb-bfcd-56be02a00d41" }, { "id": "relationship--94daf955-fb3e-4f13-af60-0e3ffa185be0", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--54eb2bab-125f-4d1c-b999-0c692860bafe", "relationship_type": "related-to", "target_ref": "attack-pattern--20a66013-8dab-4ca3-a67d-766c842c561c" }, { "id": "relationship--2b0ec032-eaca-4f0c-be55-39471f0f2bf5", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT1](https://attack.mitre.org/groups/G0006) used publicly available privilege escalation tools.(Citation: Mandiant APT1)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "Mandiant APT1", "description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.", "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf" } ], "source_ref": "intrusion-set--6a2e693f-24e5-451a-9f88-b36a108e5662", "relationship_type": "uses", "target_ref": "attack-pattern--27f3ddf8-1b77-4cc2-a4c0-e6da3d31a768", "type": "relationship", "modified": "2019-08-20T13:08:13.337Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--9a1f729c-72a9-4735-9d48-ecb54ea018a9", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--795c1a92-3a26-453e-b99a-6a566aa94dc6", "relationship_type": "related-to", "target_ref": "attack-pattern--286cc500-4291-45c2-99a1-e760db176402" }, { "id": "relationship--bc165934-7ef6-4aed-a0d7-81d3372589f4", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--e51398e6-53dc-4e9f-a323-e54683d8672b", "relationship_type": "related-to", "target_ref": "attack-pattern--4900fabf-1142-4c1f-92f5-0b590e049077" }, { "id": "relationship--22d4f32c-63c1-400f-8e2c-10e4a200d133", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--7718e92f-b011-4f88-b822-ae245a1de407", "relationship_type": "related-to", "target_ref": "attack-pattern--c721b235-679a-4d76-9ae9-e08921fccf84" }, { "id": "relationship--9ad9966d-4a8d-4b15-b503-c5d27104fcdd", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--78e41091-d10d-4001-b202-89612892b6ff", "relationship_type": "related-to", "target_ref": "attack-pattern--7860e21e-7514-4a3f-8a9d-56405ccfdb0c" }, { "id": "relationship--545cd36e-572e-413d-82b9-db65788791f9", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT17](https://attack.mitre.org/groups/G0025) posted in forum threads and created profile pages in Microsoft TechNet.(Citation: FireEye APT17)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "url": "https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf", "description": "FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.", "source_name": "FireEye APT17" } ], "source_ref": "intrusion-set--090242d7-73fc-4738-af68-20162f7a5aae", "relationship_type": "uses", "target_ref": "attack-pattern--9108e212-1c94-4f8d-be76-1aad9b4c86a4", "type": "relationship", "modified": "2019-03-22T14:21:19.554Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--715a66b4-7925-40b4-868a-e47aba879f8b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--7baccb84-356c-4e89-8c5d-58e701f033fc", "relationship_type": "related-to", "target_ref": "attack-pattern--96eb59d1-6c46-44bb-bfcd-56be02a00d41" }, { "id": "relationship--db4dfa09-7f19-437a-9d79-15f2dc8ba0da", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--72c8d526-1247-42d4-919c-6d7a31ca8f39", "relationship_type": "related-to", "target_ref": "attack-pattern--e6ca2820-a564-4b74-b42a-b6bdf052e5b6" }, { "id": "relationship--0e52753e-0a02-4bec-88f9-f8ee21b46bae", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--028ad431-84c5-4eb7-a364-2b797c234f88", "relationship_type": "related-to", "target_ref": "attack-pattern--784ff1bc-1483-41fe-a172-4cd9ae25c06b" }, { "id": "relationship--be031f72-737b-4afd-b2c1-c565f5ab7369", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--2b9a666e-bd59-4f67-9031-ed41b428e04a", "relationship_type": "related-to", "target_ref": "attack-pattern--784ff1bc-1483-41fe-a172-4cd9ae25c06b" }, { "id": "relationship--2bf984b5-1a48-4d9a-a4f2-e97801254b84", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--488da8ed-2887-4ef6-a39a-5b69bc6682c6", "relationship_type": "related-to", "target_ref": "attack-pattern--1a295f87-af63-4d94-b130-039d6221fb11" }, { "id": "relationship--28815a00-1cf4-4fbc-9039-306a9542c7fd", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--4900fabf-1142-4c1f-92f5-0b590e049077", "relationship_type": "related-to", "target_ref": "attack-pattern--e51398e6-53dc-4e9f-a323-e54683d8672b" }, { "id": "relationship--41be9f31-9d2b-44b8-a7dc-31f8c4519751", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--e6ca2820-a564-4b74-b42a-b6bdf052e5b6", "relationship_type": "related-to", "target_ref": "attack-pattern--72c8d526-1247-42d4-919c-6d7a31ca8f39" }, { "id": "relationship--9c44b2ec-70b0-4f5c-800e-426477330658", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--7860e21e-7514-4a3f-8a9d-56405ccfdb0c", "relationship_type": "related-to", "target_ref": "attack-pattern--78e41091-d10d-4001-b202-89612892b6ff" }, { "id": "relationship--4eb0e01c-85ae-466a-a8ff-0cf7891c5ab2", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT16](https://attack.mitre.org/groups/G0023) spearphished journalists, apparently targeting those interested in contact information for DPP members or politicians.(Citation: FireEye EPS Awakens Part 2)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "url": "https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html", "description": "Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.", "source_name": "FireEye EPS Awakens Part 2" } ], "source_ref": "intrusion-set--d6e88e18-81e8-4709-82d8-973095da1e70", "relationship_type": "uses", "target_ref": "attack-pattern--5b6ce031-bb86-407a-9984-2b9700ac4549", "type": "relationship", "modified": "2019-03-22T14:20:45.708Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--d5bd7a33-a249-46e5-bb19-a498eba42bdb", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--092f05e3-f7c0-4cd2-91be-3a8d6ed3cadc", "relationship_type": "related-to", "target_ref": "attack-pattern--7baccb84-356c-4e89-8c5d-58e701f033fc" }, { "id": "relationship--3d781e9a-d3f8-4e9f-bb23-ba6c2ff22267", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--1a295f87-af63-4d94-b130-039d6221fb11", "relationship_type": "related-to", "target_ref": "attack-pattern--488da8ed-2887-4ef6-a39a-5b69bc6682c6" }, { "id": "relationship--9524754d-7743-47b3-8395-3cbfb633c020", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--5b6ce031-bb86-407a-9984-2b9700ac4549", "relationship_type": "related-to", "target_ref": "attack-pattern--73e7d7d5-1782-4cd0-a4d7-00c7ec051c2a" }, { "id": "relationship--689ebb39-52f4-4b2f-8678-72cfed67cb9f", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--0722cd65-0c83-4c89-9502-539198467ab1", "relationship_type": "related-to", "target_ref": "attack-pattern--7718e92f-b011-4f88-b822-ae245a1de407" }, { "id": "relationship--b180dee5-0d48-448f-94b9-4997f0c584d5", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--96eb59d1-6c46-44bb-bfcd-56be02a00d41", "relationship_type": "related-to", "target_ref": "attack-pattern--7baccb84-356c-4e89-8c5d-58e701f033fc" }, { "id": "relationship--7aaa32b6-73f3-4b6e-98ae-da16976e6003", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--7860e21e-7514-4a3f-8a9d-56405ccfdb0c", "relationship_type": "related-to", "target_ref": "attack-pattern--59369f72-3005-4e54-9095-3d00efcece73" }, { "id": "relationship--9c87b627-de61-42da-a658-7bdb33358754", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT17](https://attack.mitre.org/groups/G0025) obfuscated infrastructure using a multi-layered malware beaconing approach. (Citation: FireEye APT17)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "url": "https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf", "description": "FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.", "source_name": "FireEye APT17" } ], "source_ref": "intrusion-set--090242d7-73fc-4738-af68-20162f7a5aae", "relationship_type": "uses", "target_ref": "attack-pattern--72c8d526-1247-42d4-919c-6d7a31ca8f39", "type": "relationship", "modified": "2019-03-22T14:21:19.564Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--36990d75-9fbd-43f0-9966-ae58f0388e1d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--96eb59d1-6c46-44bb-bfcd-56be02a00d41", "relationship_type": "related-to", "target_ref": "attack-pattern--092f05e3-f7c0-4cd2-91be-3a8d6ed3cadc" }, { "id": "relationship--2dbdcf5e-af75-4f92-b4ad-942a06aab259", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--7baccb84-356c-4e89-8c5d-58e701f033fc", "relationship_type": "related-to", "target_ref": "attack-pattern--092f05e3-f7c0-4cd2-91be-3a8d6ed3cadc" }, { "id": "relationship--87239038-7693-49b3-b595-b828cc2be1ba", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--103d72e6-7e0d-4b3a-9373-c38567305c33", "relationship_type": "related-to", "target_ref": "attack-pattern--eacd1efe-ee30-4b03-b58f-5b3b1adfe45d" }, { "id": "relationship--709bb5af-c484-48f2-bb19-bd7630e42e2d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT28](https://attack.mitre.org/groups/G0007) reused the SOURFACE downloader as the payload of a lure document.(Citation: FireEye APT28)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "FireEye APT28", "description": "FireEye. (2015). APT28: A WINDOW INTO RUSSIA\u2019S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.", "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf" } ], "source_ref": "intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c", "relationship_type": "uses", "target_ref": "attack-pattern--27f3ddf8-1b77-4cc2-a4c0-e6da3d31a768", "type": "relationship", "modified": "2019-09-09T17:44:35.673Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--3d65fc7e-87a5-4113-bd9c-09453fba4d1e", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT28](https://attack.mitre.org/groups/G0007) registered domains imitating NATO, OSCE security websites, Caucasus information resources and other organizations.(Citation: FireEye APT28) (Citation: US District Court Indictment GRU Oct 2018)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "FireEye APT28", "description": "FireEye. (2015). APT28: A WINDOW INTO RUSSIA\u2019S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.", "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf" }, { "source_name": "US District Court Indictment GRU Oct 2018", "url": "https://www.justice.gov/opa/page/file/1098481/download", "description": "Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020." } ], "source_ref": "intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c", "relationship_type": "uses", "target_ref": "attack-pattern--45242287-2964-4a3e-9373-159fad4d8195", "type": "relationship", "modified": "2020-10-01T18:55:39.213Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--d26a1746-b577-4a89-be5e-c49611e8c65a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[Cleaver](https://attack.mitre.org/groups/G0003) fake personas included profile photos, details, and network connections.(Citation: Dell Threat Group 2889)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "url": "http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/", "description": "Dell SecureWorks. (2015, October 7). Suspected Iran-Based Hacker Group Creates Network of Fake LinkedIn Profiles. Retrieved January 14, 2016.", "source_name": "Dell Threat Group 2889" } ], "source_ref": "intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063", "relationship_type": "uses", "target_ref": "attack-pattern--271e6d40-e191-421a-8f87-a8102452c201", "type": "relationship", "modified": "2019-03-22T20:00:23.896Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--66e4da4a-6eb6-46e0-9baf-74059f341b4a", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--74a3288e-eee9-4f8e-973a-fbc128e033f1", "relationship_type": "related-to", "target_ref": "attack-pattern--a757670d-d600-48d9-8ae9-601d42c184a5" }, { "id": "relationship--51c20b46-16cc-4b58-80d7-89d48b14b064", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--a757670d-d600-48d9-8ae9-601d42c184a5", "relationship_type": "related-to", "target_ref": "attack-pattern--74a3288e-eee9-4f8e-973a-fbc128e033f1" }, { "id": "relationship--432c700b-4bf3-4824-a530-a6e86882c4b7", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--59369f72-3005-4e54-9095-3d00efcece73", "relationship_type": "related-to", "target_ref": "attack-pattern--78e41091-d10d-4001-b202-89612892b6ff" }, { "id": "relationship--b09b41c4-670f-4f00-b8d5-a8c6a2dcfcfb", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[Cleaver](https://attack.mitre.org/groups/G0003) has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.(Citation: Cylance Cleaver)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "Cylance Cleaver", "description": "Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.", "url": "https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf" } ], "source_ref": "intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063", "relationship_type": "uses", "target_ref": "attack-pattern--fddd81e9-dd3d-477e-9773-4fb8ae227234", "type": "relationship", "modified": "2019-03-22T20:00:23.891Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--ad510f42-e745-42d0-8b54-4bf7a2f3cf34", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "relationship", "modified": "2018-10-17T00:14:20.652Z", "created": "2017-12-14T16:46:06.044Z", "source_ref": "attack-pattern--af358cad-eb71-4e91-a752-236edc237dae", "relationship_type": "related-to", "target_ref": "attack-pattern--74a3288e-eee9-4f8e-973a-fbc128e033f1" }, { "id": "relationship--39db1df8-f786-480c-9faf-5b870de2250b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT1](https://attack.mitre.org/groups/G0006) used third party email services in the registration of whois records.(Citation: Mandiant APT1)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "Mandiant APT1", "description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.", "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf" } ], "source_ref": "intrusion-set--6a2e693f-24e5-451a-9f88-b36a108e5662", "relationship_type": "uses", "target_ref": "attack-pattern--488da8ed-2887-4ef6-a39a-5b69bc6682c6", "type": "relationship", "modified": "2019-08-20T13:08:13.437Z", "created": "2017-12-14T16:46:06.044Z" }, { "id": "relationship--0e7905fd-77c8-43cb-b499-7d6e37fefbeb", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "description": "[APT1](https://attack.mitre.org/groups/G0006) used dynamic DNS to register hundreds of FQDNs.(Citation: Mandiant APT1)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "Mandiant APT1", "description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.", "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf" } ], "source_ref": "intrusion-set--6a2e693f-24e5-451a-9f88-b36a108e5662", "relationship_type": "uses", "target_ref": "attack-pattern--54eb2bab-125f-4d1c-b999-0c692860bafe", "type": "relationship", "modified": "2019-08-20T13:08:13.554Z", "created": "2017-12-14T16:46:06.044Z" }, { "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "source_ref": "attack-pattern--03f4a766-7a21-4b5e-9ccf-e0cf422ab983", "target_ref": "attack-pattern--e5164428-03ca-4336-a9a7-4d9ea1417e59", "relationship_type": "related-to", "id": "relationship--1aafdefb-304e-4998-87cc-81aad295f721", "type": "relationship", "modified": "2019-02-19T18:56:56.136Z", "created": "2019-02-19T18:56:56.136Z" }, { "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "source_ref": "attack-pattern--e5164428-03ca-4336-a9a7-4d9ea1417e59", "target_ref": "attack-pattern--03f4a766-7a21-4b5e-9ccf-e0cf422ab983", "relationship_type": "related-to", "id": "relationship--83379e43-4bc5-4c49-b0b3-f41161e8e96d", "type": "relationship", "modified": "2019-02-19T18:56:56.770Z", "created": "2019-02-19T18:56:56.770Z" }, { "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "source_ref": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4", "target_ref": "attack-pattern--795c1a92-3a26-453e-b99a-6a566aa94dc6", "external_references": [ { "description": "Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.", "url": "https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html", "source_name": "FireEye TRITON 2019" } ], "description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) has used Virtual Private Server (VPS) infrastructure.(Citation: FireEye TRITON 2019)", "relationship_type": "uses", "id": "relationship--2d95ed6f-52e7-4708-af15-9a6c08390454", "type": "relationship", "modified": "2019-04-29T18:59:16.595Z", "created": "2019-04-24T19:45:44.205Z" }, { "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "source_ref": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4", "target_ref": "attack-pattern--20a66013-8dab-4ca3-a67d-766c842c561c", "external_references": [ { "description": "Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.", "url": "https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html", "source_name": "FireEye TRITON 2019" } ], "description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) has used dynamic DNS.(Citation: FireEye TRITON 2019)", "relationship_type": "uses", "id": "relationship--21842707-0f15-43bf-bc42-2bceadf2cfa2", "type": "relationship", "modified": "2019-04-29T18:59:16.596Z", "created": "2019-04-24T19:45:44.212Z" }, { "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "source_ref": "intrusion-set--6a2e693f-24e5-451a-9f88-b36a108e5662", "target_ref": "attack-pattern--4900fabf-1142-4c1f-92f5-0b590e049077", "external_references": [ { "source_name": "Mandiant APT1", "description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.", "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf" } ], "description": "[APT1](https://attack.mitre.org/groups/G0006) compromised a vast set of 3rd party victim hop points as part of their network infrastructure. For example, [APT1](https://attack.mitre.org/groups/G0006) hijacked FQDNs associated with legitimate websites hosted by hop points. Mandiant considers them to be \u201chijacked\u201d since they were originally registered for a legitimate reason but were used by APT1 for malicious purposes.(Citation: Mandiant APT1)", "relationship_type": "uses", "id": "relationship--980656e3-ba60-49ee-9ce8-cbe1a0dc65c5", "type": "relationship", "modified": "2020-03-25T13:59:27.774Z", "created": "2020-03-25T13:59:27.774Z" }, { "id": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "The MITRE Corporation", "identity_class": "organization", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "identity", "modified": "2017-06-01T00:00:00.000Z", "created": "2017-06-01T00:00:00.000Z" }, { "type": "intrusion-set", "id": "intrusion-set--6a2e693f-24e5-451a-9f88-b36a108e5662", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "APT1", "description": "[APT1](https://attack.mitre.org/groups/G0006) is a Chinese threat group that has been attributed to the 2nd Bureau of the People\u2019s Liberation Army (PLA) General Staff Department\u2019s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/groups/G0006", "external_id": "G0006" }, { "source_name": "APT1", "description": "(Citation: Mandiant APT1)" }, { "source_name": "Comment Crew", "description": "(Citation: Mandiant APT1)" }, { "source_name": "Comment Group", "description": "(Citation: Mandiant APT1)" }, { "source_name": "Comment Panda", "description": "(Citation: CrowdStrike Putter Panda)" }, { "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf", "description": "Mandiant. (n.d.). APT1 Exposing One of China\u2019s Cyber Espionage Units. Retrieved July 18, 2016.", "source_name": "Mandiant APT1" }, { "url": "http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf", "description": "Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.", "source_name": "CrowdStrike Putter Panda" } ], "aliases": [ "APT1", "Comment Crew", "Comment Group", "Comment Panda" ], "modified": "2020-10-22T18:35:55.290Z", "created": "2017-05-31T21:31:47.955Z", "x_mitre_version": "1.3" }, { "type": "intrusion-set", "id": "intrusion-set--d6e88e18-81e8-4709-82d8-973095da1e70", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "APT16", "description": "[APT16](https://attack.mitre.org/groups/G0023) is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. (Citation: FireEye EPS Awakens Part 2)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/groups/G0023", "external_id": "G0023" }, { "source_name": "APT16", "description": "(Citation: FireEye EPS Awakens Part 2)" }, { "source_name": "FireEye EPS Awakens Part 2", "description": "Winters, R.. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.", "url": "https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html" } ], "aliases": [ "APT16" ], "modified": "2020-10-12T19:54:58.537Z", "created": "2017-05-31T21:31:56.270Z", "x_mitre_version": "1.1" }, { "type": "intrusion-set", "id": "intrusion-set--090242d7-73fc-4738-af68-20162f7a5aae", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "APT17", "description": "[APT17](https://attack.mitre.org/groups/G0025) is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. (Citation: FireEye APT17)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/groups/G0025", "external_id": "G0025" }, { "source_name": "APT17", "description": "(Citation: FireEye APT17)" }, { "source_name": "Deputy Dog", "description": "(Citation: FireEye APT17)" }, { "url": "https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf", "description": "FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved January 22, 2016.", "source_name": "FireEye APT17" } ], "aliases": [ "APT17", "Deputy Dog" ], "modified": "2020-10-13T22:33:14.018Z", "created": "2017-05-31T21:31:57.307Z", "x_mitre_version": "1.1" }, { "type": "intrusion-set", "id": "intrusion-set--bef4c620-0787-42a8-a96d-b7eb6e85917c", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "APT28", "description": "[APT28](https://attack.mitre.org/groups/G0007) is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub August 2020) This group has been active since at least 2004.(Citation: DOJ GRU Indictment Jul 2018) (Citation: Ars Technica GRU indictment Jul 2018) (Citation: Crowdstrike DNC June 2016) (Citation: FireEye APT28) (Citation: SecureWorks TG-4127) (Citation: FireEye APT28 January 2017) (Citation: GRIZZLY STEPPE JAR) (Citation: Sofacy DealersChoice) (Citation: Palo Alto Sofacy 06-2018) (Citation: Symantec APT28 Oct 2018) (Citation: ESET Zebrocy May 2019)\n\n[APT28](https://attack.mitre.org/groups/G0007) reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election. (Citation: Crowdstrike DNC June 2016) In 2018, the US indicted five GRU Unit 26165 officers associated with [APT28](https://attack.mitre.org/groups/G0007) for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.(Citation: US District Court Indictment GRU Oct 2018) Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as [Sandworm Team](https://attack.mitre.org/groups/G0034). ", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "external_id": "G0007", "url": "https://attack.mitre.org/groups/G0007", "source_name": "mitre-attack" }, { "source_name": "APT28", "description": "(Citation: FireEye APT28) (Citation: SecureWorks TG-4127) (Citation: Crowdstrike DNC June 2016) (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 3) (Citation: Ars Technica GRU indictment Jul 2018)(Citation: Talos Seduploader Oct 2017)(Citation: Symantec APT28 Oct 2018)(Citation: Securelist Sofacy Feb 2018)" }, { "source_name": "SNAKEMACKEREL", "description": "(Citation: Accenture SNAKEMACKEREL Nov 2018)" }, { "source_name": "Swallowtail", "description": "(Citation: Symantec APT28 Oct 2018)" }, { "source_name": "Group 74", "description": "(Citation: Talos Seduploader Oct 2017)" }, { "source_name": "Sednit", "description": "This designation has been used in reporting both to refer to the threat group and its associated malware JHUHUGIT. (Citation: FireEye APT28 January 2017) (Citation: SecureWorks TG-4127) (Citation: Kaspersky Sofacy) (Citation: Ars Technica GRU indictment Jul 2018)" }, { "source_name": "Sofacy", "description": "This designation has been used in reporting both to refer to the threat group and its associated malware. (Citation: FireEye APT28) (Citation: SecureWorks TG-4127) (Citation: Crowdstrike DNC June 2016) (Citation: ESET Sednit Part 3) (Citation: Ars Technica GRU indictment Jul 2018)(Citation: Talos Seduploader Oct 2017)" }, { "source_name": "Pawn Storm", "description": "(Citation: SecureWorks TG-4127) (Citation: ESET Sednit Part 3)" }, { "source_name": "Fancy Bear", "description": "(Citation: Crowdstrike DNC June 2016) (Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 3) (Citation: Ars Technica GRU indictment Jul 2018)(Citation: Talos Seduploader Oct 2017)(Citation: Symantec APT28 Oct 2018)(Citation: Securelist Sofacy Feb 2018)" }, { "source_name": "STRONTIUM", "description": "(Citation: Kaspersky Sofacy) (Citation: ESET Sednit Part 3) (Citation: Microsoft STRONTIUM Aug 2019) (Citation: Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020)" }, { "source_name": "Tsar Team", "description": "(Citation: ESET Sednit Part 3)(Citation: Talos Seduploader Oct 2017)(Citation: Talos Seduploader Oct 2017)" }, { "source_name": "Threat Group-4127", "description": "(Citation: SecureWorks TG-4127)" }, { "source_name": "TG-4127", "description": "(Citation: SecureWorks TG-4127)" }, { "source_name": "NSA/FBI Drovorub August 2020", "url": "https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF", "description": "NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020." }, { "source_name": "DOJ GRU Indictment Jul 2018", "description": "Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.", "url": "https://www.justice.gov/file/1080281/download" }, { "url": "https://arstechnica.com/information-technology/2018/07/from-bitly-to-x-agent-how-gru-hackers-targeted-the-2016-presidential-election/", "description": "Gallagher, S. (2018, July 27). How they did it (and will likely try again): GRU hackers vs. US elections. Retrieved September 13, 2018.", "source_name": "Ars Technica GRU indictment Jul 2018" }, { "source_name": "Crowdstrike DNC June 2016", "description": "Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.", "url": "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/" }, { "source_name": "FireEye APT28", "description": "FireEye. (2015). APT28: A WINDOW INTO RUSSIA\u2019S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.", "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf" }, { "url": "https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign", "description": "SecureWorks Counter Threat Unit Threat Intelligence. (2016, June 16). Threat Group-4127 Targets Hillary Clinton Presidential Campaign. Retrieved August 3, 2016.", "source_name": "SecureWorks TG-4127" }, { "source_name": "FireEye APT28 January 2017", "description": "FireEye iSIGHT Intelligence. (2017, January 11). APT28: At the Center of the Storm. Retrieved January 11, 2017.", "url": "https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf" }, { "source_name": "GRIZZLY STEPPE JAR", "description": "Department of Homeland Security and Federal Bureau of Investigation. (2016, December 29). GRIZZLY STEPPE \u2013 Russian Malicious Cyber Activity. Retrieved January 11, 2017.", "url": "https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf" }, { "source_name": "Sofacy DealersChoice", "description": "Falcone, R. (2018, March 15). Sofacy Uses DealersChoice to Target European Government Agency. Retrieved June 4, 2018.", "url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/" }, { "source_name": "Palo Alto Sofacy 06-2018", "description": "Lee, B., Falcone, R. (2018, June 06). Sofacy Group\u2019s Parallel Attacks. Retrieved June 18, 2018.", "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/" }, { "source_name": "Symantec APT28 Oct 2018", "url": "https://www.symantec.com/blogs/election-security/apt28-espionage-military-government", "description": "Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018." }, { "description": "ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.", "url": "https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/", "source_name": "ESET Zebrocy May 2019" }, { "source_name": "US District Court Indictment GRU Oct 2018", "url": "https://www.justice.gov/opa/page/file/1098481/download", "description": "Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020." }, { "source_name": "Kaspersky Sofacy", "description": "Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.", "url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/" }, { "source_name": "ESET Sednit Part 3", "description": "ESET. (2016, October). En Route with Sednit - Part 3: A Mysterious Downloader. Retrieved November 21, 2016.", "url": "http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf" }, { "description": "Mercer, W., et al. (2017, October 22). \"Cyber Conflict\" Decoy Document Used in Real Cyber Conflict. Retrieved November 2, 2018.", "url": "https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html", "source_name": "Talos Seduploader Oct 2017" }, { "source_name": "Securelist Sofacy Feb 2018", "url": "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/", "description": "Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018." }, { "source_name": "Accenture SNAKEMACKEREL Nov 2018", "url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50", "description": "Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019." }, { "description": "MSRC Team. (2019, August 5). Corporate IoT \u2013 a path to intrusion. Retrieved August 16, 2019.", "url": "https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/", "source_name": "Microsoft STRONTIUM Aug 2019" }, { "source_name": "Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020", "url": "https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/", "description": "Microsoft Threat Intelligence Center (MSTIC). (2020, September 10). STRONTIUM: Detecting new patterns in credential harvesting. Retrieved September 11, 2020." } ], "aliases": [ "APT28", "SNAKEMACKEREL", "Swallowtail", "Group 74", "Sednit", "Sofacy", "Pawn Storm", "Fancy Bear", "STRONTIUM", "Tsar Team", "Threat Group-4127", "TG-4127" ], "modified": "2020-10-06T23:32:21.793Z", "created": "2017-05-31T21:31:48.664Z", "x_mitre_contributors": [ "S\u00e9bastien Ruel, CGI", "Drew Church, Splunk", "Emily Ratliff, IBM", "Richard Gold, Digital Shadows" ], "x_mitre_version": "3.0" }, { "type": "intrusion-set", "id": "intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Cleaver", "description": "[Cleaver](https://attack.mitre.org/groups/G0003) is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/groups/G0003", "external_id": "G0003" }, { "source_name": "Cleaver", "description": "(Citation: Cylance Cleaver)" }, { "source_name": "Threat Group 2889", "description": "(Citation: Dell Threat Group 2889)" }, { "source_name": "TG-2889", "description": "(Citation: Dell Threat Group 2889)" }, { "source_name": "Cylance Cleaver", "description": "Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.", "url": "https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf" }, { "url": "http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/", "description": "Dell SecureWorks. (2015, October 7). Suspected Iran-Based Hacker Group Creates Network of Fake LinkedIn Profiles. Retrieved January 14, 2016.", "source_name": "Dell Threat Group 2889" } ], "aliases": [ "Cleaver", "Threat Group 2889", "TG-2889" ], "modified": "2020-10-15T16:59:26.732Z", "created": "2017-05-31T21:31:46.390Z", "x_mitre_version": "1.2" }, { "type": "intrusion-set", "id": "intrusion-set--23b6a0f5-fa95-46f9-a6f3-4549c5e45ec8", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Night Dragon", "description": "[Night Dragon](https://attack.mitre.org/groups/G0014) is a campaign name for activity involving a threat group that has conducted activity originating primarily in China. (Citation: McAfee Night Dragon)", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "source_name": "mitre-attack", "url": "https://attack.mitre.org/groups/G0014", "external_id": "G0014" }, { "source_name": "Night Dragon", "description": "(Citation: McAfee Night Dragon)" }, { "source_name": "McAfee Night Dragon", "description": "McAfee\u00ae Foundstone\u00ae Professional Services and McAfee Labs\u2122. (2011, February 10). Global Energy Cyberattacks: \u201cNight Dragon\u201d. Retrieved February 19, 2018.", "url": "https://securingtomorrow.mcafee.com/wp-content/uploads/2011/02/McAfee_NightDragon_wp_draft_to_customersv1-1.pdf" } ], "aliases": [ "Night Dragon" ], "modified": "2020-10-15T00:54:00.656Z", "created": "2017-05-31T21:31:51.643Z", "x_mitre_version": "1.3" }, { "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "external_references": [ { "url": "https://attack.mitre.org/groups/G0088", "source_name": "mitre-attack", "external_id": "G0088" }, { "source_name": "TEMP.Veles", "description": "(Citation: FireEye TRITON 2019)" }, { "source_name": "XENOTIME", "description": "The activity group XENOTIME, as defined by Dragos, has overlaps with activity reported upon by FireEye about TEMP.Veles as well as the actors behind TRITON.(Citation: Dragos Xenotime 2018)(Citation: Pylos Xenotime 2019)(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018 )" }, { "description": "Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.", "url": "https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html", "source_name": "FireEye TRITON 2019" }, { "description": "FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.", "url": "https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html ", "source_name": "FireEye TEMP.Veles 2018" }, { "source_name": "FireEye TEMP.Veles JSON April 2019", "url": "https://www.fireeye.com/content/dam/fireeye-www/blog/files/TRITON_Appendix_C.html", "description": "Miller, S., et al. (2019, April 10). TRITON Appendix C. Retrieved April 29, 2019." }, { "description": "Dragos, Inc.. (n.d.). Xenotime. Retrieved April 16, 2019.", "url": "https://dragos.com/resource/xenotime/", "source_name": "Dragos Xenotime 2018" }, { "description": "Slowik, J.. (2019, April 12). A XENOTIME to Remember: Veles in the Wild. Retrieved April 16, 2019.", "url": "https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/", "source_name": "Pylos Xenotime 2019" }, { "source_name": "FireEye TEMP.Veles 2018 ", "url": "https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html ", "description": "FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019." } ], "name": "TEMP.Veles", "description": "[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)", "type": "intrusion-set", "id": "intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4", "aliases": [ "TEMP.Veles", "XENOTIME" ], "modified": "2020-10-04T23:31:36.937Z", "created": "2019-04-16T15:14:38.533Z", "x_mitre_version": "1.2" }, { "id": "x-mitre-tactic--4652199e-eef5-4523-bd18-2b5070f56cd8", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Adversary OPSEC", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0021/).\n\nAdversary OPSEC consists of the use of various technologies or 3rd party services to obfuscate, hide, or blend in with accepted network traffic or system behavior. The adversary may use these techniques to evade defenses, reduce attribution, minimize discovery, and/or increase the time and effort required to analyze.", "external_references": [ { "external_id": "TA0021", "url": "https://attack.mitre.org/tactics/TA0021", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "adversary-opsec", "type": "x-mitre-tactic", "modified": "2020-10-22T15:36:37.579Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--d849365b-3496-4e5c-b599-019da1b35266", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Build Capabilities", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0024/).\n\nBuilding capabilities consists of developing and/or acquiring the software, data and techniques used at different phases of an operation. This is the process of identifying development requirements and implementing solutions such as malware, delivery mechanisms, obfuscation/cryptographic protections, and call back and O&M functions.", "external_references": [ { "external_id": "TA0024", "url": "https://attack.mitre.org/tactics/TA0024", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "build-capabilities", "type": "x-mitre-tactic", "modified": "2020-10-22T15:38:02.517Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--2289489d-8824-42fb-8c94-411aca6f664c", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Establish & Maintain Infrastructure", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0022/).\n\nEstablishing and maintaining infrastructure consists of building, purchasing, co-opting, and maintaining systems and services used to conduct cyber operations. An adversary will need to establish infrastructure used to communicate with and control assets used throughout the course of their operations.", "external_references": [ { "external_id": "TA0022", "url": "https://attack.mitre.org/tactics/TA0022", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "establish-&-maintain-infrastructure", "type": "x-mitre-tactic", "modified": "2020-10-22T15:37:16.235Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--b9f8a273-6167-47cb-89e6-02774d067e24", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Organizational Information Gathering", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0017/).\n\nOrganizational information gathering consists of the process of identifying critical organizational elements of intelligence an adversary will need about a target in order to best attack.\u00a0 Similar to competitive intelligence, organizational intelligence gathering focuses on understanding the operational tempo of an organization and gathering a deep understanding of the organization and how it operates, in order to best develop a strategy to target it.", "external_references": [ { "external_id": "TA0017", "url": "https://attack.mitre.org/tactics/TA0017", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "organizational-information-gathering", "type": "x-mitre-tactic", "modified": "2020-10-22T15:34:54.996Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--c6b17c99-31c1-490a-8b2b-a79502d6131b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Organizational Weakness Identification", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0020/).\n\nOrganizational weakness identification consists of identifying and analyzing weaknesses and vulnerabilities from the intelligence gathering phases which can be leveraged to gain access to target or intermediate target organizations of interest.", "external_references": [ { "external_id": "TA0020", "url": "https://attack.mitre.org/tactics/TA0020", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "organizational-weakness-identification", "type": "x-mitre-tactic", "modified": "2020-10-22T15:36:16.863Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--d90bd741-2edb-4e74-8a6f-435143ad7bbb", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "People Information Gathering", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0016/).\n\nPeople Information Gathering consists of the process of identifying critical personnel elements of intelligence an adversary will need about a target in order to best attack.\u00a0 People intelligence gathering focuses on identifying key personnel or individuals with critical accesses in order to best approach a target for attack.\u00a0 It may involve aspects of social engineering, elicitation, mining social media sources, or be thought of as understanding the personnel element of competitive intelligence.", "external_references": [ { "external_id": "TA0016", "url": "https://attack.mitre.org/tactics/TA0016", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "people-information-gathering", "type": "x-mitre-tactic", "modified": "2020-10-22T15:34:26.736Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--f30c2753-e6b2-4186-818d-99b8b1a0322b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "People Weakness Identification", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0019/).\n\nPeople weakness identification consists of identifying and analyzing weaknesses and vulnerabilities from the intelligence gathering phases which can be leveraged to gain access to target or intermediate target persons of interest or social trust relationships.", "external_references": [ { "external_id": "TA0019", "url": "https://attack.mitre.org/tactics/TA0019", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "people-weakness-identification", "type": "x-mitre-tactic", "modified": "2020-10-22T15:35:52.355Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--d3909f10-8193-4a94-9bbb-1f2d5cb2373e", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Persona Development", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0023/).\n\nPersona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.", "external_references": [ { "external_id": "TA0023", "url": "https://attack.mitre.org/tactics/TA0023", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "persona-development", "type": "x-mitre-tactic", "modified": "2020-10-22T15:37:42.444Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--0f0ff9a7-3c8d-4af6-8e45-f6d359553ffd", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Priority Definition Direction", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0013/).\n\nPriority definition direction consists of the process of collecting and assigning requirements for meeting Key Intelligence Topics (KIT) or Key Intelligence Questions (KIQ) as determined by leadership.", "external_references": [ { "external_id": "TA0013", "url": "https://attack.mitre.org/tactics/TA0013", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "priority-definition-direction", "type": "x-mitre-tactic", "modified": "2020-10-22T15:32:47.554Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--b2a086f2-d3db-408b-b4d4-e09a1c84f940", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Priority Definition Planning", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0012/).\n\nPriority definition planning consists of the process of determining the set of Key Intelligence Topics (KIT) or Key Intelligence Questions (KIQ) required for meeting key strategic, operational, or tactical goals. Leadership outlines the priority definition (may be considered a goal) around which the adversary designs target selection and a plan to achieve. An analyst may outline the priority definition when in the course of determining gaps in existing KITs or KIQs.", "external_references": [ { "external_id": "TA0012", "url": "https://attack.mitre.org/tactics/TA0012", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "priority-definition-planning", "type": "x-mitre-tactic", "modified": "2020-10-22T15:31:37.810Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--d8c84771-a3fa-4f64-914e-4db3a2be2607", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Stage Capabilities", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0026/).\n\nStaging capabilities consists of preparing operational environment required to conduct the operation. This includes activities such as deploying software, uploading data, enabling command and control infrastructure.", "external_references": [ { "external_id": "TA0026", "url": "https://attack.mitre.org/tactics/TA0026", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "stage-capabilities", "type": "x-mitre-tactic", "modified": "2020-10-22T15:38:57.122Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--84f3ed3d-c72f-45d8-a3b8-4c18c2b188e6", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Target Selection", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0014/).\n\nTarget selection consists of an iterative process in which an adversary determines a target by first beginning at the strategic level and then narrowing down operationally and tactically until a specific target is chosen.\u00a0 A target may be defined as an entity or object that performs a function considered for possible engagement or other action.", "external_references": [ { "external_id": "TA0014", "url": "https://attack.mitre.org/tactics/TA0014", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "target-selection", "type": "x-mitre-tactic", "modified": "2020-10-22T15:33:25.361Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--0abac415-7b49-4085-93b3-662ba1258b4b", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Technical Information Gathering", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0015/).\n\nTechnical information gathering consists of the process of identifying critical technical elements of intelligence an adversary will need about a target in order to best attack.\u00a0 Technical intelligence gathering includes, but is not limited to, understanding the target's network architecture, IP space, network services, email format, and security procedures.", "external_references": [ { "external_id": "TA0015", "url": "https://attack.mitre.org/tactics/TA0015", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "technical-information-gathering", "type": "x-mitre-tactic", "modified": "2020-10-22T15:33:53.838Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--97689bbd-d5c4-4293-bde7-f11750cea2ec", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Technical Weakness Identification", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0018/).\n\nTechnical weakness identification consists of identifying and analyzing weaknesses and vulnerabilities collected during the intelligence gathering phases to determine best approach based on technical complexity and adversary priorities (e.g., expediency, stealthiness).", "external_references": [ { "external_id": "TA0018", "url": "https://attack.mitre.org/tactics/TA0018", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "technical-weakness-identification", "type": "x-mitre-tactic", "modified": "2020-10-22T15:35:24.309Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-tactic--bc5c0e21-7c93-4809-a01e-249bcc42b0a2", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "Test Capabilities", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/tactics/TA0025/).\n\nTesting capabilities takes place when adversaries may need to test capabilities externally to refine development goals and criteria and to ensure success during an operation. Certain testing may be done after a capability is staged.", "external_references": [ { "external_id": "TA0025", "url": "https://attack.mitre.org/tactics/TA0025", "source_name": "mitre-attack" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "x_mitre_shortname": "test-capabilities", "type": "x-mitre-tactic", "modified": "2020-10-22T15:38:29.580Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "id": "x-mitre-matrix--2e2c97c3-1908-4e2d-a711-a27d3859eb1d", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "name": "PRE-ATT&CK", "description": "This object is deprecated as its content has been merged into the enterprise domain. Please see the [PRE](http://attack.mitre.org/matrices/enterprise/pre/) matrix for its replacement. The prior content of this page has been preserved [here](https://attack.mitre.org/versions/v7/matrices/pre/).\n\nBelow are the tactics and techniques representing the MITRE PRE-ATT&CK Matrix.", "external_references": [ { "external_id": "pre-attack", "source_name": "mitre-attack", "url": "https://attack.mitre.org/matrices/pre" } ], "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "type": "x-mitre-matrix", "tactic_refs": [ "x-mitre-tactic--b2a086f2-d3db-408b-b4d4-e09a1c84f940", "x-mitre-tactic--0f0ff9a7-3c8d-4af6-8e45-f6d359553ffd", "x-mitre-tactic--84f3ed3d-c72f-45d8-a3b8-4c18c2b188e6", "x-mitre-tactic--0abac415-7b49-4085-93b3-662ba1258b4b", "x-mitre-tactic--d90bd741-2edb-4e74-8a6f-435143ad7bbb", "x-mitre-tactic--b9f8a273-6167-47cb-89e6-02774d067e24", "x-mitre-tactic--97689bbd-d5c4-4293-bde7-f11750cea2ec", "x-mitre-tactic--f30c2753-e6b2-4186-818d-99b8b1a0322b", "x-mitre-tactic--c6b17c99-31c1-490a-8b2b-a79502d6131b", "x-mitre-tactic--4652199e-eef5-4523-bd18-2b5070f56cd8", "x-mitre-tactic--2289489d-8824-42fb-8c94-411aca6f664c", "x-mitre-tactic--d3909f10-8193-4a94-9bbb-1f2d5cb2373e", "x-mitre-tactic--d849365b-3496-4e5c-b599-019da1b35266", "x-mitre-tactic--bc5c0e21-7c93-4809-a01e-249bcc42b0a2", "x-mitre-tactic--d8c84771-a3fa-4f64-914e-4db3a2be2607" ], "modified": "2020-10-22T15:43:48.844Z", "created": "2018-10-17T00:14:20.652Z", "x_mitre_deprecated": true }, { "type": "marking-definition", "id": "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168", "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "created": "2017-06-01T00:00:00Z", "definition_type": "statement", "definition": { "statement": "Copyright 2015-2020, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation." } } ] }