{"EAC0001": {"type": "Engagement", "goals": ["EGO0001"], "vulnerabilities": [{"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries utilize or abuse system features, software, or other resources, they may be vulnerable to monitoring or Man-in-the-Middle manipulation.", "id": "EAV0016"}, {"eav": "When adversaries interact with network or system resources, they are vulnerable to triggering tripwires or engaging in easily detectable, anomalous behavior.", "id": "EAV0010"}], "attack_techniques": [{"attack_tactics": ["discovery"], "name": "System Service Discovery", "id": "T1007"}, {"attack_tactics": ["discovery"], "name": "System Network Configuration Discovery", "id": "T1016"}, {"attack_tactics": ["discovery"], "name": "System Owner/User Discovery", "id": "T1033"}, {"attack_tactics": ["discovery"], "name": "System Network Connections Discovery", "id": "T1049"}, {"attack_tactics": ["defense-evasion"], "name": "Indicator Removal on Host", "id": "T1070"}, {"attack_tactics": ["discovery"], "name": "System Information Discovery", "id": "T1082"}, {"attack_tactics": ["discovery"], "name": "File and Directory Discovery", "id": "T1083"}, {"attack_tactics": ["lateral-movement", "initial-access"], "name": "Replication Through Removable Media", "id": "T1091"}, {"attack_tactics": ["execution"], "name": "Native API", "id": "T1106"}, {"attack_tactics": ["command-and-control"], "name": "Data Encoding", "id": "T1132"}, {"attack_tactics": ["defense-evasion", "privilege-escalation"], "name": "Access Token Manipulation", "id": "T1134"}, {"attack_tactics": ["defense-evasion"], "name": "Indirect Command Execution", "id": "T1202"}, {"attack_tactics": ["defense-evasion"], "name": "Signed Script Proxy Execution", "id": "T1216"}, {"attack_tactics": ["defense-evasion"], "name": "Signed Binary Proxy Execution", "id": "T1218"}, {"attack_tactics": ["defense-evasion"], "name": "XSL Script Processing", "id": "T1220"}, {"attack_tactics": ["impact"], "name": "Data Destruction", "id": "T1485"}, {"attack_tactics": ["impact"], "name": "Resource Hijacking", "id": "T1496"}, {"attack_tactics": ["defense-evasion"], "name": "Subvert Trust Controls", "id": "T1553"}, {"attack_tactics": ["credential-access", "defense-evasion", "persistence"], "name": "Modify Authentication Process", "id": "T1556"}, {"attack_tactics": ["execution"], "name": "Inter-Process Communication", "id": "T1559"}, {"attack_tactics": ["defense-evasion"], "name": "Hide Artifacts", "id": "T1564"}, {"attack_tactics": ["execution"], "name": "System Services", "id": "T1569"}, {"attack_tactics": ["discovery"], "name": "System Location Discovery", "id": "T1614"}], "attack_tactics": [{"name": "Discovery", "id": "TA0007"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Execution", "id": "TA0002"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Impact", "id": "TA0040"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Persistence", "id": "TA0003"}], "approaches": ["EAP0001"], "name": "API Monitoring", "description": "Monitor local APIs that might be used by adversary tools and activity.", "long_description": "API Monitoring involves capturing an internal OS function for its usage, accompanying arguments, and result. When a defender captures this information, the data gathered can be analyzed to gain insights into the activity of an adversary at a level deeper than normal system activity monitoring. This type of monitoring can also be used to produce high-fidelity detections. For example, the defender can trace activity through WinSock TCP API functions to view potentially malicious network events or trace usage of the Win32 DeleteFile() function to log all attempts at deleting a given file.", "references": [{"title": "Designing Robust API Monitoring Solutions", "url": "https://arxiv.org/pdf/2005.00323", "id": "REF0005"}, {"title": "International Workshop On Recent Advances In Intrusion Detection", "url": "https://link.springer.com/chapter/10.1007/978-3-642-41284-4_7", "id": "REF0006"}, {"title": "API Call Based Malware Detection Approach Using Recurrent Neural Network---LSTM", "url": "https://ajaymas.github.io/ISDA2019.pdf", "id": "REF0007"}], "EAV0001": [{"name": "Discovery", "id": "TA0007"}], "EAV0016": [{"name": "Discovery", "id": "TA0007"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Impact", "id": "TA0040"}, {"name": "Persistence", "id": "TA0003"}], "EAV0010": [{"name": "Initial Access", "id": "TA0001"}, {"name": "Impact", "id": "TA0040"}]}, "EAC0002": {"type": "Engagement", "goals": ["EGO0001"], "vulnerabilities": [{"eav": "When adversaries interact with network or system resources, they are vulnerable to triggering tripwires or engaging in easily detectable, anomalous behavior.", "id": "EAV0010"}, {"eav": "When adversaries use easily identifiable techniques, or generate signaturable patterns in data or traffic, they are vulnerable to detection of their activity.", "id": "EAV0023"}, {"eav": "When adversaries exfiltrate data, their data are vulnerable to observation or manipulation via Man-in-the-Middle activities. ", "id": "EAV0021"}], "attack_techniques": [{"attack_tactics": ["command-and-control"], "name": "Fallback Channels", "id": "T1008"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Other Network Medium", "id": "T1011"}, {"attack_tactics": ["exfiltration"], "name": "Automated Exfiltration", "id": "T1020"}, {"attack_tactics": ["lateral-movement"], "name": "Remote Services", "id": "T1021"}, {"attack_tactics": ["exfiltration"], "name": "Scheduled Transfer", "id": "T1029"}, {"attack_tactics": ["exfiltration"], "name": "Data Transfer Size Limits", "id": "T1030"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over C2 Channel", "id": "T1041"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Alternative Protocol", "id": "T1048"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Physical Medium", "id": "T1052"}, {"attack_tactics": ["command-and-control"], "name": "Application Layer Protocol", "id": "T1071"}, {"attack_tactics": ["command-and-control"], "name": "Proxy", "id": "T1090"}, {"attack_tactics": ["command-and-control"], "name": "Non-Application Layer Protocol", "id": "T1095"}, {"attack_tactics": ["command-and-control"], "name": "Web Service", "id": "T1102"}, {"attack_tactics": ["command-and-control"], "name": "Ingress Tool Transfer", "id": "T1105"}, {"attack_tactics": ["command-and-control"], "name": "Data Encoding", "id": "T1132"}, {"attack_tactics": ["defense-evasion", "persistence", "command-and-control"], "name": "Traffic Signaling", "id": "T1205"}, {"attack_tactics": ["impact"], "name": "Network Denial of Service", "id": "T1498"}, {"attack_tactics": ["exfiltration"], "name": "Transfer Data to Cloud Account", "id": "T1537"}, {"attack_tactics": ["credential-access", "collection"], "name": "Adversary-in-the-Middle", "id": "T1557"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Web Service", "id": "T1567"}, {"attack_tactics": ["lateral-movement"], "name": "Lateral Tool Transfer", "id": "T1570"}, {"attack_tactics": ["command-and-control"], "name": "Non-Standard Port", "id": "T1571"}, {"attack_tactics": ["command-and-control"], "name": "Protocol Tunneling", "id": "T1572"}, {"attack_tactics": ["defense-evasion"], "name": "Network Boundary Bridging", "id": "T1599"}, {"attack_tactics": ["defense-evasion"], "name": "Weaken Encryption", "id": "T1600"}], "attack_tactics": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Impact", "id": "TA0040"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Collection", "id": "TA0009"}], "approaches": ["EAP0001"], "name": "Network Monitoring", "description": "Monitor network traffic in order to detect adversary activity.", "long_description": "Network Monitoring involves capturing network activity data, including capturing server, firewall, and other relevant logs. A defender can send this data to a centralized collection location for further analysis. This analysis can be automated or manual. In either case, a defender can use Network Monitoring to identify anomalous traffic patterns, large or unexpected data transfers, and other activity that may reveal the presence of an adversary.  Monitoring is essential to maintain situational awareness of adversary activities to ensure operational safety and make progress towards the defender\u2019s goals. Careful pre-operational planning should be done to properly instrument the engagement environment to ensure that all key network traffic is collected. Some use cases of network monitoring include detecting unexpected outbound traffic, systems establishing connections using encapsulated protocols, and known adversary C2 protocols.", "references": [{"title": "A Survey On Network Security Monitoring Systems", "url": "https://www.researchgate.net/publication/309229246_A_Survey_on_Network_Security_Monitoring_Systems", "id": "REF0008"}, {"title": "Protecting Clock Synchronization: Adversary Detection Through Network Monitoring", "url": "https://www.hindawi.com/journals/jece/2016/6297476/", "id": "REF0009"}, {"title": "Bro: A System For Detecting Network Intruders In Real-Time", "url": "https://www.usenix.org/legacy/publications/library/proceedings/sec98/full_papers/paxson/paxson.pdf", "id": "REF0010"}, {"title": "Implementing A Generalized Tool For Network Monitoring", "url": "https://www.sciencedirect.com/science/article/pii/S1363412798800381", "id": "REF0011"}, {"title": "Spymon: Hidden Network Monitoring For Security In Wireless Sensor Networks", "url": "https://ieeexplore.ieee.org/abstract/document/4660030", "id": "REF0012"}], "EAV0010": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Impact", "id": "TA0040"}, {"name": "Collection", "id": "TA0009"}, {"name": "Defense Evasion", "id": "TA0005"}], "EAV0023": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Defense Evasion", "id": "TA0005"}], "EAV0021": [{"name": "Exfiltration", "id": "TA0010"}, {"name": "Command and Control", "id": "TA0011"}]}, "EAC0003": {"type": "Engagement", "goals": ["EGO0001"], "vulnerabilities": [{"eav": "When adversaries interact with network or system resources, they are vulnerable to triggering tripwires or engaging in easily detectable, anomalous behavior.", "id": "EAV0010"}, {"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries utilize or abuse system features, software, or other resources, they may be vulnerable to monitoring or Man-in-the-Middle manipulation.", "id": "EAV0016"}, {"eav": "When adversaries collect manipulated artifacts, they are vulnerable to revealing their presence when using or moving the artifacts elsewhere in the engagement environment.", "id": "EAV0028"}, {"eav": "When adversaries use previously stolen information to access or move laterally within an environment, they may reveal previous collection activities.", "id": "EAV0011"}, {"eav": "When adversaries use easily identifiable techniques, or generate signaturable patterns in data or traffic, they are vulnerable to detection of their activity.", "id": "EAV0023"}], "attack_techniques": [{"attack_tactics": ["credential-access"], "name": "OS Credential Dumping", "id": "T1003"}, {"attack_tactics": ["defense-evasion"], "name": "Masquerading", "id": "T1036"}, {"attack_tactics": ["execution", "persistence", "privilege-escalation"], "name": "Scheduled Task/Job", "id": "T1053"}, {"attack_tactics": ["defense-evasion"], "name": "Indicator Removal on Host", "id": "T1070"}, {"attack_tactics": ["defense-evasion", "persistence", "privilege-escalation", "initial-access"], "name": "Valid Accounts", "id": "T1078"}, {"attack_tactics": ["lateral-movement"], "name": "Taint Shared Content", "id": "T1080"}, {"attack_tactics": ["lateral-movement", "initial-access"], "name": "Replication Through Removable Media", "id": "T1091"}, {"attack_tactics": ["command-and-control"], "name": "Communication Through Removable Media", "id": "T1092"}, {"attack_tactics": ["persistence"], "name": "Account Manipulation", "id": "T1098"}, {"attack_tactics": ["credential-access"], "name": "Brute Force", "id": "T1110"}, {"attack_tactics": ["defense-evasion"], "name": "Modify Registry", "id": "T1112"}, {"attack_tactics": ["persistence", "initial-access"], "name": "External Remote Services", "id": "T1133"}, {"attack_tactics": ["persistence"], "name": "Create Account", "id": "T1136"}, {"attack_tactics": ["persistence"], "name": "Office Application Startup", "id": "T1137"}, {"attack_tactics": ["defense-evasion"], "name": "Rogue Domain Controller", "id": "T1207"}, {"attack_tactics": ["impact"], "name": "Inhibit System Recovery", "id": "T1490"}, {"attack_tactics": ["impact"], "name": "Firmware Corruption", "id": "T1495"}, {"attack_tactics": ["impact"], "name": "Account Access Removal", "id": "T1531"}, {"attack_tactics": ["credential-access"], "name": "Unsecured Credentials", "id": "T1552"}, {"attack_tactics": ["credential-access"], "name": "Credentials from Password Stores", "id": "T1555"}, {"attack_tactics": ["defense-evasion"], "name": "Impair Defenses", "id": "T1562"}, {"attack_tactics": ["initial-access"], "name": "Phishing", "id": "T1566"}], "attack_tactics": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Impact", "id": "TA0040"}], "approaches": ["EAP0001"], "name": "System Activity Monitoring", "description": "Collect system activity logs that can reveal adversary activity.", "long_description": "Capturing system logs can show logins, user and system events, etc. A defender can use such inherent system logging to study and collect first-hand observations about the adversary\u2019s actions and tools.  This data can be sent to a centralized collection location for further analysis. Careful planning should be used to guide which system logs are collected and at what level. If the logging level is set too high or too many system logs are collected, the defender may be blinded by the excess data. For example, understanding the adversary\u2019s known TTPs will highlight resources the adversary is likely to touch and therefore which system logs are likely to capture adversary activity.  Overall, System Activity Monitoring is essential to maintain situational awareness of adversarial activities in order to ensure operational safety and progress towards operational goals. Careful pre-operational planning should be done to properly instrument the engagement environment. This will ensure that all key network traffic is collected.", "references": [{"title": "Signature Based Intrusion Detection System Using SNORT", "url": "https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.462.1508&rep=rep1&type=pdf", "id": "REF0014"}, {"title": "Machine Learning Based Insider Threat Modelling And Detection", "url": "https://ieeexplore.ieee.org/abstract/document/8717892", "id": "REF0015"}, {"title": "Real-Time Detection System Against Malicious Tools By Monitoring Dll On Client Computers", "url": "https://ieeexplore.ieee.org/document/8968697", "id": "REF0016"}, {"title": "Detecting APT Malware Infections Based On Malicious DNS And Traffic Analysis", "url": "https://ieeexplore.ieee.org/document/7163279", "id": "REF0017"}], "EAV0010": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Impact", "id": "TA0040"}], "EAV0001": [{"name": "Lateral Movement", "id": "TA0008"}], "EAV0016": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Defense Evasion", "id": "TA0005"}], "EAV0028": [{"name": "Persistence", "id": "TA0003"}], "EAV0011": [{"name": "Credential Access", "id": "TA0006"}], "EAV0023": [{"name": "Persistence", "id": "TA0003"}]}, "EAC0004": {"type": "Engagement", "goals": ["EGO0001"], "vulnerabilities": [{"eav": "When adversaries use easily identifiable techniques, or generate signaturable patterns in data or traffic, they are vulnerable to detection of their activity.", "id": "EAV0023"}, {"eav": "When adversaries interact with network or system resources, they are vulnerable to triggering tripwires or engaging in easily detectable, anomalous behavior.", "id": "EAV0010"}, {"eav": "When adversaries attempt to exfiltrate, manipulate, or move massive data objects, they are vulnerable to wasting resources to accomplish the task.", "id": "EAV0029"}, {"eav": "When adversaries exfiltrate data, their data are vulnerable to observation or manipulation via Man-in-the-Middle activities. ", "id": "EAV0021"}], "attack_techniques": [{"attack_tactics": ["command-and-control"], "name": "Data Obfuscation", "id": "T1001"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Other Network Medium", "id": "T1011"}, {"attack_tactics": ["exfiltration"], "name": "Automated Exfiltration", "id": "T1020"}, {"attack_tactics": ["exfiltration"], "name": "Scheduled Transfer", "id": "T1029"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over C2 Channel", "id": "T1041"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Alternative Protocol", "id": "T1048"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Physical Medium", "id": "T1052"}, {"attack_tactics": ["collection"], "name": "Data Staged", "id": "T1074"}, {"attack_tactics": ["command-and-control"], "name": "Data Encoding", "id": "T1132"}, {"attack_tactics": ["exfiltration"], "name": "Transfer Data to Cloud Account", "id": "T1537"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Web Service", "id": "T1567"}, {"attack_tactics": ["command-and-control"], "name": "Encrypted Channel", "id": "T1573"}], "attack_tactics": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Collection", "id": "TA0009"}], "approaches": ["EAP0002"], "name": "Network Analysis", "description": "Analyze network traffic to gain intelligence on communications between systems.", "long_description": "Network analysis can be an automated or manual task to review communications between systems to expose adversary activity, such as C2 or data exfiltration traffic. This analysis is normally done by capturing and analyzing traffic on the wire or from previously collected packet capture.  When custom protocols are in use, defenders can leverage protocol decoder frameworks. These are customized code modules that can read network traffic and contextualize activity between the C2 operator and the implant. These frameworks are often required to process complex encryption ciphers and custom protocols into a human-readable format for an analyst to interpret. Decoder creation requires malware analysis of the implant to understand the design of the protocol. While a high level of technical maturity is required to create such a decoder, once created they are invaluable to the defender.  For example, a defender can use a protocol decode to decrypt network capture data and expose an adversary\u2019s C2 or exfiltration activity. Not only does this data provide exquisite intelligence in regard to the adversary\u2019s communications channels and targeting preferences, but it also provides future opportunities for data manipulation to further operational goals.", "references": [{"title": "Utilizing Network Science And Honeynets For Software Induced Cyber Incident Analysis", "url": "https://sefcom.asu.edu/publications/utilizing-network-science-hicss2015.pdf", "id": "REF0018"}, {"title": "Detecting APT Malware Infections Based On Malicious DNS And Traffic Analysis", "url": "http://www.thucsnet.org/uploads/2/5/2/8/25289795/guodong_zhao_ieee_access_2015.pdf", "id": "REF0019"}], "EAV0023": [{"name": "Command and Control", "id": "TA0011"}], "EAV0010": [{"name": "Exfiltration", "id": "TA0010"}], "EAV0029": [{"name": "Collection", "id": "TA0009"}], "EAV0021": [{"name": "Command and Control", "id": "TA0011"}]}, "EAC0005": {"type": "Engagement", "goals": ["EGO0001", "EGO0002"], "vulnerabilities": [{"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries interact with engagement environments and personas, their future capability, targeting, and/or infrastructure requirements are vulnerable to influence.", "id": "EAV0007"}, {"eav": "When adversaries use previously stolen information to access or move laterally within an environment, they may reveal previous collection activities.", "id": "EAV0011"}, {"eav": "When adversaries discover enabled, accessible, or intentionally weakened/overly permissive resources in the environment, they are vulnerable to revealing additional or more advanced capabilities when exploiting or using said resource.", "id": "EAV0017"}, {"eav": "When adversaries collect manipulated artifacts, they are vulnerable to revealing their presence when using or moving the artifacts elsewhere in the engagement environment.", "id": "EAV0028"}, {"eav": "When adversaries interact with network or system resources, they are vulnerable to triggering tripwires or engaging in easily detectable, anomalous behavior.", "id": "EAV0010"}, {"eav": "When adversaries attempt to exfiltrate, manipulate, or move massive data objects, they are vulnerable to wasting resources to accomplish the task.", "id": "EAV0029"}, {"eav": "When adversaries exfiltrate data, their data are vulnerable to observation or manipulation via Man-in-the-Middle activities. ", "id": "EAV0021"}, {"eav": "When adversaries use brute-force techniques to access accounts or encrypted data, they are vulnerable to wasting resources if the artifact has no valid credentials or is locked in some other way.", "id": "EAV0022"}, {"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}, {"eav": "When adversaries maintain drive-by sites, they provide a pathway for beginning engagements and may be unable to differentiate real from deceptive victims.", "id": "EAV0008"}, {"eav": "When adversaries maintain drive-by sites and collect information about potential victims, they may reveal information about their targeting preferences by selecting or rejecting an arbitrary victim.", "id": "EAV0009"}, {"eav": "When adversaries maintain drive-by sites, they reveal information about their targeting capabilities.", "id": "EAV0026"}, {"eav": "When adversaries exploit a trusted relationship, such as using an account to access or move in the environment, they are vulnerable to triggering tripwires or engaging in anomalous behavior.", "id": "EAV0003"}, {"eav": "When adversaries exploit a trusted relationship, they are vulnerable to collecting and acting on manipulated data provided by the trusted party.", "id": "EAV0015"}], "attack_techniques": [{"attack_tactics": ["credential-access"], "name": "OS Credential Dumping", "id": "T1003"}, {"attack_tactics": ["collection"], "name": "Data from Local System", "id": "T1005"}, {"attack_tactics": ["discovery"], "name": "System Service Discovery", "id": "T1007"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Other Network Medium", "id": "T1011"}, {"attack_tactics": ["discovery"], "name": "Query Registry", "id": "T1012"}, {"attack_tactics": ["discovery"], "name": "System Network Configuration Discovery", "id": "T1016"}, {"attack_tactics": ["discovery"], "name": "Remote System Discovery", "id": "T1018"}, {"attack_tactics": ["exfiltration"], "name": "Automated Exfiltration", "id": "T1020"}, {"attack_tactics": ["lateral-movement"], "name": "Remote Services", "id": "T1021"}, {"attack_tactics": ["collection"], "name": "Data from Removable Media", "id": "T1025"}, {"attack_tactics": ["defense-evasion"], "name": "Obfuscated Files or Information", "id": "T1027"}, {"attack_tactics": ["exfiltration"], "name": "Scheduled Transfer", "id": "T1029"}, {"attack_tactics": ["exfiltration"], "name": "Data Transfer Size Limits", "id": "T1030"}, {"attack_tactics": ["discovery"], "name": "System Owner/User Discovery", "id": "T1033"}, {"attack_tactics": ["collection"], "name": "Data from Network Shared Drive", "id": "T1039"}, {"attack_tactics": ["credential-access", "discovery"], "name": "Network Sniffing", "id": "T1040"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over C2 Channel", "id": "T1041"}, {"attack_tactics": ["discovery"], "name": "Network Service Scanning", "id": "T1046"}, {"attack_tactics": ["execution"], "name": "Windows Management Instrumentation", "id": "T1047"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Alternative Protocol", "id": "T1048"}, {"attack_tactics": ["discovery"], "name": "System Network Connections Discovery", "id": "T1049"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Physical Medium", "id": "T1052"}, {"attack_tactics": ["execution", "persistence", "privilege-escalation"], "name": "Scheduled Task/Job", "id": "T1053"}, {"attack_tactics": ["collection", "credential-access"], "name": "Input Capture", "id": "T1056"}, {"attack_tactics": ["discovery"], "name": "Process Discovery", "id": "T1057"}, {"attack_tactics": ["privilege-escalation"], "name": "Exploitation for Privilege Escalation", "id": "T1068"}, {"attack_tactics": ["discovery"], "name": "Permission Groups Discovery", "id": "T1069"}, {"attack_tactics": ["execution", "lateral-movement"], "name": "Software Deployment Tools", "id": "T1072"}, {"attack_tactics": ["collection"], "name": "Data Staged", "id": "T1074"}, {"attack_tactics": ["defense-evasion", "persistence", "privilege-escalation", "initial-access"], "name": "Valid Accounts", "id": "T1078"}, {"attack_tactics": ["lateral-movement"], "name": "Taint Shared Content", "id": "T1080"}, {"attack_tactics": ["discovery"], "name": "File and Directory Discovery", "id": "T1083"}, {"attack_tactics": ["discovery"], "name": "Account Discovery", "id": "T1087"}, {"attack_tactics": ["persistence"], "name": "Account Manipulation", "id": "T1098"}, {"attack_tactics": ["command-and-control"], "name": "Web Service", "id": "T1102"}, {"attack_tactics": ["credential-access"], "name": "Brute Force", "id": "T1110"}, {"attack_tactics": ["credential-access"], "name": "Two-Factor Authentication Interception", "id": "T1111"}, {"attack_tactics": ["collection"], "name": "Email Collection", "id": "T1114"}, {"attack_tactics": ["collection"], "name": "Automated Collection", "id": "T1119"}, {"attack_tactics": ["collection"], "name": "Audio Capture", "id": "T1123"}, {"attack_tactics": ["collection"], "name": "Video Capture", "id": "T1125"}, {"attack_tactics": ["command-and-control"], "name": "Data Encoding", "id": "T1132"}, {"attack_tactics": ["persistence", "initial-access"], "name": "External Remote Services", "id": "T1133"}, {"attack_tactics": ["discovery"], "name": "Network Share Discovery", "id": "T1135"}, {"attack_tactics": ["persistence"], "name": "Office Application Startup", "id": "T1137"}, {"attack_tactics": ["persistence"], "name": "Browser Extensions", "id": "T1176"}, {"attack_tactics": ["collection"], "name": "Browser Session Hijacking", "id": "T1185"}, {"attack_tactics": ["credential-access"], "name": "Forced Authentication", "id": "T1187"}, {"attack_tactics": ["initial-access"], "name": "Drive-by Compromise", "id": "T1189"}, {"attack_tactics": ["initial-access"], "name": "Exploit Public-Facing Application", "id": "T1190"}, {"attack_tactics": ["initial-access"], "name": "Trusted Relationship", "id": "T1199"}, {"attack_tactics": ["execution"], "name": "Exploitation for Client Execution", "id": "T1203"}, {"attack_tactics": ["lateral-movement"], "name": "Exploitation of Remote Services", "id": "T1210"}, {"attack_tactics": ["defense-evasion"], "name": "Exploitation for Defense Evasion", "id": "T1211"}, {"attack_tactics": ["credential-access"], "name": "Exploitation for Credential Access", "id": "T1212"}, {"attack_tactics": ["collection"], "name": "Data from Information Repositories", "id": "T1213"}, {"attack_tactics": ["command-and-control"], "name": "Remote Access Software", "id": "T1219"}, {"attack_tactics": ["defense-evasion"], "name": "XSL Script Processing", "id": "T1220"}, {"attack_tactics": ["defense-evasion"], "name": "Template Injection", "id": "T1221"}, {"attack_tactics": ["defense-evasion"], "name": "Execution Guardrails", "id": "T1480"}, {"attack_tactics": ["impact"], "name": "Data Destruction", "id": "T1485"}, {"attack_tactics": ["impact"], "name": "Defacement", "id": "T1491"}, {"attack_tactics": ["discovery"], "name": "Software Discovery", "id": "T1518"}, {"attack_tactics": ["discovery"], "name": "Cloud Service Discovery", "id": "T1526"}, {"attack_tactics": ["credential-access"], "name": "Steal Application Access Token", "id": "T1528"}, {"attack_tactics": ["impact"], "name": "System Shutdown/Reboot", "id": "T1529"}, {"attack_tactics": ["collection"], "name": "Data from Cloud Storage Object", "id": "T1530"}, {"attack_tactics": ["impact"], "name": "Account Access Removal", "id": "T1531"}, {"attack_tactics": ["defense-evasion"], "name": "Unused/Unsupported Cloud Regions", "id": "T1535"}, {"attack_tactics": ["exfiltration"], "name": "Transfer Data to Cloud Account", "id": "T1537"}, {"attack_tactics": ["discovery"], "name": "Cloud Service Dashboard", "id": "T1538"}, {"attack_tactics": ["credential-access"], "name": "Steal Web Session Cookie", "id": "T1539"}, {"attack_tactics": ["defense-evasion", "lateral-movement"], "name": "Use Alternate Authentication Material", "id": "T1550"}, {"attack_tactics": ["credential-access"], "name": "Unsecured Credentials", "id": "T1552"}, {"attack_tactics": ["persistence"], "name": "Compromise Client Software Binary", "id": "T1554"}, {"attack_tactics": ["credential-access"], "name": "Credentials from Password Stores", "id": "T1555"}, {"attack_tactics": ["credential-access", "collection"], "name": "Adversary-in-the-Middle", "id": "T1557"}, {"attack_tactics": ["credential-access"], "name": "Steal or Forge Kerberos Tickets", "id": "T1558"}, {"attack_tactics": ["collection"], "name": "Archive Collected Data", "id": "T1560"}, {"attack_tactics": ["lateral-movement"], "name": "Remote Service Session Hijacking", "id": "T1563"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Web Service", "id": "T1567"}, {"attack_tactics": ["defense-evasion"], "name": "Modify Cloud Compute Infrastructure", "id": "T1578"}, {"attack_tactics": ["discovery"], "name": "Cloud Infrastructure Discovery", "id": "T1580"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Identity Information", "id": "T1589"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Network Information", "id": "T1590"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Org Information", "id": "T1591"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Host Information", "id": "T1592"}, {"attack_tactics": ["reconnaissance"], "name": "Search Victim-Owned Websites", "id": "T1594"}, {"attack_tactics": ["reconnaissance"], "name": "Active Scanning", "id": "T1595"}, {"attack_tactics": ["defense-evasion"], "name": "Modify System Image", "id": "T1601"}, {"attack_tactics": ["collection"], "name": "Data from Configuration Repository", "id": "T1602"}, {"attack_tactics": ["credential-access"], "name": "Forge Web Credentials", "id": "T1606"}, {"attack_tactics": ["discovery"], "name": "Container and Resource Discovery", "id": "T1613"}], "attack_tactics": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Collection", "id": "TA0009"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Impact", "id": "TA0040"}, {"name": "Reconnaissance", "id": "TA0043"}], "approaches": ["EAP0002", "EAP0004", "EAP0005"], "name": "Lures", "description": "Deceptive systems and artifacts intended to serve as decoys, breadcrumbs, or bait to elicit a specific response from the adversary.", "long_description": "Lures are intended to elicit a particular response from the adversary. For example, the defender may utilize Lures to enable or block the adversary\u2019s intended actions or encourage or discourage a specific action or response. Lures can take a variety of forms including credentials, accounts, files/directories, browser extensions/bookmarks, system processes, etc. Regardless of form, Lures provide opportunities to the defender to drive adversary behavior in ways that align with operational outcomes.", "references": [{"title": "Comparison Of Defense Effectiveness Between Moving Target Defense And Cyber Deception Defense", "url": "https://doi.org/10.1145/3478905.3478930", "id": "REF0002"}, {"title": "A Scalable High Fidelity Decoy Framework Against Sophisticated Cyber Attacks", "url": "https://doi.org/10.1145/3338468.3356826", "id": "REF0004"}, {"title": "Baiting Inside Attackers Using Decoy Documents", "url": "http://www.cs.columbia.edu/~bmbowen/papers/DecoyDocumentsCameraReadySECCOM09.pdf", "id": "REF0022"}, {"title": "A Scalable High Fidelity Decoy Framework Against Sophisticated Cyber Attacks", "url": "https://dl.acm.org/doi/abs/10.1145/3338468.3356826", "id": "REF0024"}, {"title": "Categorization Of Cyber Security Deception Events For Measuring The Severity Level Of Advanced Targeted Breaches", "url": "https://dl.acm.org/doi/abs/10.1145/3129790.3129805", "id": "REF0025"}, {"title": "Cyber-Physical System Security With Deceptive Virtual Hosts For Industrial Control Networks", "url": "http://www.people.vcu.edu/~mmanic/papers/2014/TII14_VolManic_CPSSecurityVirtualHost.pdf", "id": "REF0027"}, {"title": "Automating The Generation Of Enticing Text Content For High-Interaction Honeyfiles", "url": "https://scholarspace.manoa.hawaii.edu/handle/10125/41897", "id": "REF0028"}, {"title": "Honeyfiles: Deceptive Files For Intrusion Detection", "url": "https://faculty.nps.edu/dedennin/publications/honeyfiles.pdf", "id": "REF0029"}, {"title": "Deceptive Decoys: Combining Believable User and Network Activities and Deceptive Network Setup in Enhancing Effectiveness", "url": "https://www.academia.edu/49519275/DECEPTIVE_DECOYS_COMBINING_BELIEVABLE_USER_AND_NETWORK_ACTIVITIES_AND_DECEPTIVE_NETWORK_SETUP_IN_ENHANCING_EFFECTIVENESS?from=cover_page", "id": "REF0030"}, {"title": "Hackers Came but the French Were Prepared", "url": "https://www.nytimes.com/2017/05/09/world/europe/hackers-came-but-the-french-were-prepared.html", "id": "REF0084"}], "EAV0001": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Collection", "id": "TA0009"}, {"name": "Execution", "id": "TA0002"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Impact", "id": "TA0040"}, {"name": "Reconnaissance", "id": "TA0043"}], "EAV0007": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Collection", "id": "TA0009"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Impact", "id": "TA0040"}, {"name": "Reconnaissance", "id": "TA0043"}], "EAV0011": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Execution", "id": "TA0002"}, {"name": "Initial Access", "id": "TA0001"}], "EAV0017": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Defense Evasion", "id": "TA0005"}], "EAV0028": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Command and Control", "id": "TA0011"}], "EAV0010": [{"name": "Collection", "id": "TA0009"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Impact", "id": "TA0040"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Reconnaissance", "id": "TA0043"}], "EAV0029": [{"name": "Exfiltration", "id": "TA0010"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Collection", "id": "TA0009"}], "EAV0021": [{"name": "Command and Control", "id": "TA0011"}], "EAV0022": [{"name": "Credential Access", "id": "TA0006"}], "EAV0013": [{"name": "Persistence", "id": "TA0003"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Credential Access", "id": "TA0006"}], "EAV0008": [{"name": "Initial Access", "id": "TA0001"}], "EAV0009": [{"name": "Initial Access", "id": "TA0001"}], "EAV0026": [{"name": "Initial Access", "id": "TA0001"}], "EAV0003": [{"name": "Initial Access", "id": "TA0001"}], "EAV0015": [{"name": "Initial Access", "id": "TA0001"}]}, "EAC0006": {"type": "Engagement", "goals": ["EGO0003"], "vulnerabilities": [{"eav": "When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to revealing their targeting preferences and capabilities.", "id": "EAV0019"}], "attack_techniques": [{"attack_tactics": ["discovery"], "name": "Application Window Discovery", "id": "T1010"}, {"attack_tactics": ["lateral-movement"], "name": "Remote Services", "id": "T1021"}, {"attack_tactics": ["collection", "credential-access"], "name": "Input Capture", "id": "T1056"}, {"attack_tactics": ["privilege-escalation"], "name": "Exploitation for Privilege Escalation", "id": "T1068"}, {"attack_tactics": ["execution", "lateral-movement"], "name": "Software Deployment Tools", "id": "T1072"}, {"attack_tactics": ["persistence"], "name": "Office Application Startup", "id": "T1137"}, {"attack_tactics": ["initial-access"], "name": "Exploit Public-Facing Application", "id": "T1190"}, {"attack_tactics": ["execution"], "name": "Exploitation for Client Execution", "id": "T1203"}, {"attack_tactics": ["lateral-movement"], "name": "Exploitation of Remote Services", "id": "T1210"}, {"attack_tactics": ["defense-evasion"], "name": "Exploitation for Defense Evasion", "id": "T1211"}, {"attack_tactics": ["credential-access"], "name": "Exploitation for Credential Access", "id": "T1212"}, {"attack_tactics": ["command-and-control"], "name": "Remote Access Software", "id": "T1219"}, {"attack_tactics": ["impact"], "name": "Resource Hijacking", "id": "T1496"}, {"attack_tactics": ["persistence"], "name": "Server Software Component", "id": "T1505"}, {"attack_tactics": ["discovery"], "name": "Software Discovery", "id": "T1518"}, {"attack_tactics": ["persistence"], "name": "Implant Internal Image", "id": "T1525"}, {"attack_tactics": ["impact"], "name": "Account Access Removal", "id": "T1531"}, {"attack_tactics": ["defense-evasion"], "name": "Subvert Trust Controls", "id": "T1553"}, {"attack_tactics": ["persistence"], "name": "Compromise Client Software Binary", "id": "T1554"}, {"attack_tactics": ["collection"], "name": "Archive Collected Data", "id": "T1560"}, {"attack_tactics": ["defense-evasion"], "name": "Impair Defenses", "id": "T1562"}, {"attack_tactics": ["defense-evasion"], "name": "Modify Cloud Compute Infrastructure", "id": "T1578"}, {"attack_tactics": ["discovery"], "name": "Container and Resource Discovery", "id": "T1613"}], "attack_tactics": [{"name": "Discovery", "id": "TA0007"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Collection", "id": "TA0009"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Execution", "id": "TA0002"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Impact", "id": "TA0040"}], "approaches": ["EAP0006", "EAP0007"], "name": "Application Diversity", "description": "Present the adversary with a variety of installed applications and services.", "long_description": "Application Diversity presents an array of software targets to the adversary. On a single target system, defenders can configure multiple services or software applications. This diversity may include not only a variety of different types of applications, but also various versions of the same application. Application Diversity can be used to encourage engagement by offering a broad attack surface. By monitoring adversary activity in a diverse environment, the defender can gain information on the adversary\u2019s capabilities and targeting preferences. For example, a defender can install one or more applications with a variety of patch levels to see how the adversary\u2019s response differs across versions.  Additionally, a diverse set of applications provides a variety of avenues for the defender to present additional information throughout an operation. This information can be used to introduce additional attack surfaces, motivate or demotivate the adversary, or further the engagement narrative. For example, if the adversary is close to uncovering something that might raise suspicion around a target, the defender can add an event to a shared calendar application or a message in a notes application that the system will be offline for scheduled maintenance. Having a variety of applications on the system provides the defender with multiple engagement avenues to handle whatever events happen during the operation. Finally, diversity can increase the adversary\u2019s overall comfort level by adding to the believability of the environment. ", "references": [{"title": "An Interface Diversified Honeypot For Malware Analysis", "url": "https://dl.acm.org/doi/abs/10.1145/2993412.2993417", "id": "REF0031"}, {"title": "Defending Cyberspace With Fake Honeypots", "url": "https://core.ac.uk/download/pdf/36728948.pdf", "id": "REF0032"}, {"title": "Software Diversity For Cyber Deception", "url": "https://ieeexplore.ieee.org/abstract/document/9348122", "id": "REF0033"}, {"title": "Software Diversity For Cyber Deception", "url": "https://ieeexplore.ieee.org/iel7/9322055/9321973/09348122.pdf", "id": "REF0034"}], "EAV0019": [{"name": "Discovery", "id": "TA0007"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Execution", "id": "TA0002"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Impact", "id": "TA0040"}, {"name": "Collection", "id": "TA0009"}]}, "EAC0007": {"type": "Engagement", "goals": ["EGO0003"], "vulnerabilities": [{"eav": "When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to revealing their targeting preferences and capabilities.", "id": "EAV0019"}], "attack_techniques": [{"attack_tactics": ["discovery"], "name": "Remote System Discovery", "id": "T1018"}, {"attack_tactics": ["credential-access", "discovery"], "name": "Network Sniffing", "id": "T1040"}, {"attack_tactics": ["discovery"], "name": "Network Service Scanning", "id": "T1046"}, {"attack_tactics": ["persistence", "initial-access"], "name": "External Remote Services", "id": "T1133"}, {"attack_tactics": ["discovery"], "name": "Network Share Discovery", "id": "T1135"}, {"attack_tactics": ["impact"], "name": "Endpoint Denial of Service", "id": "T1499"}, {"attack_tactics": ["collection"], "name": "Data from Cloud Storage Object", "id": "T1530"}, {"attack_tactics": ["discovery"], "name": "Cloud Service Dashboard", "id": "T1538"}, {"attack_tactics": ["discovery"], "name": "Cloud Infrastructure Discovery", "id": "T1580"}, {"attack_tactics": ["reconnaissance"], "name": "Active Scanning", "id": "T1595"}], "attack_tactics": [{"name": "Discovery", "id": "TA0007"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Impact", "id": "TA0040"}, {"name": "Collection", "id": "TA0009"}, {"name": "Reconnaissance", "id": "TA0043"}], "approaches": ["EAP0006", "EAP0007"], "name": "Network Diversity", "description": "Use a diverse set of devices on the network to help establish the legitimacy of a deceptive network.", "long_description": "Network Diversity involves the use of an assorted collection of network resources such as networking devices, firewalls, printers, phones, etc. Network Diversity can be used to encourage adversaries to engage by offering a broad attack surface. Additionally, diversity can increase the adversary\u2019s overall comfort level by adding to the believability of the environment. By monitoring adversary activity in a diverse environment, the defender can gain information on the adversary\u2019s capabilities and targeting preferences. For example, a defender can deploy a variety of network resources to identify which devices are targeted by the adversary.", "references": [{"title": "A Technique For Network Topology Deception", "url": "https://core.ac.uk/download/pdf/36729002.pdf", "id": "REF0036"}], "EAV0019": [{"name": "Discovery", "id": "TA0007"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Impact", "id": "TA0040"}, {"name": "Collection", "id": "TA0009"}, {"name": "Reconnaissance", "id": "TA0043"}]}, "EAC0008": {"type": "Engagement", "goals": ["EGO0003"], "vulnerabilities": [{"eav": "When adversaries interact with the environment or personas, they are vulnerable to collecting, or in some way interacting with, manipulated or decoy data. In those cases the data may increase their tolerance for imperfections in the environment and improve the overall believability of the ruse.", "id": "EAV0002"}, {"eav": "When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to revealing their targeting preferences and capabilities.", "id": "EAV0019"}], "attack_techniques": [{"attack_tactics": ["collection"], "name": "Data from Local System", "id": "T1005"}, {"attack_tactics": ["discovery"], "name": "Query Registry", "id": "T1012"}, {"attack_tactics": ["discovery"], "name": "System Network Configuration Discovery", "id": "T1016"}, {"attack_tactics": ["discovery"], "name": "System Network Connections Discovery", "id": "T1049"}, {"attack_tactics": ["discovery"], "name": "Process Discovery", "id": "T1057"}, {"attack_tactics": ["defense-evasion", "persistence", "privilege-escalation", "initial-access"], "name": "Valid Accounts", "id": "T1078"}, {"attack_tactics": ["discovery"], "name": "System Information Discovery", "id": "T1082"}, {"attack_tactics": ["collection"], "name": "Email Collection", "id": "T1114"}, {"attack_tactics": ["persistence", "initial-access"], "name": "External Remote Services", "id": "T1133"}, {"attack_tactics": ["collection"], "name": "Browser Session Hijacking", "id": "T1185"}, {"attack_tactics": ["collection"], "name": "Data from Cloud Storage Object", "id": "T1530"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Host Information", "id": "T1592"}, {"attack_tactics": ["collection"], "name": "Data from Configuration Repository", "id": "T1602"}], "attack_tactics": [{"name": "Collection", "id": "TA0009"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Reconnaissance", "id": "TA0043"}], "approaches": ["EAP0006"], "name": "Burn-In", "description": "Exercise a target system in a manner where it will generate desirable system artifacts.", "long_description": "Burn-In involves exercising the system to create desirable system artifacts such as web browsing history, file system usage, or the running of user applications. At times, Burn-In can be accomplished by simply letting a system or application run for an extended period of time. Other times, the defender engages with the environment to produce the Burn-In artifacts, such as when the defender logs into a decoy account or accesses a decoy website to generate session cookies and browser history. These tasks can be accomplished manually or via automated tooling.  Burn-In should occur pre-operation and continue as appropriate during the operation. The artifacts generated during the Burn-In process can reassure the adversary of the environment\u2019s legitimacy by creating an environment that more closely resembles a real, lived in, system or network.", "references": [], "EAV0002": [{"name": "Collection", "id": "TA0009"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Reconnaissance", "id": "TA0043"}], "EAV0019": [{"name": "Collection", "id": "TA0009"}]}, "EAC0009": {"type": "Engagement", "goals": ["EGO0002", "EGO0003"], "vulnerabilities": [{"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries interact with the environment or personas, they are vulnerable to collecting, or in some way interacting with, manipulated or decoy data. In those cases the data may increase their tolerance for imperfections in the environment and improve the overall believability of the ruse.", "id": "EAV0002"}, {"eav": "When adversaries interact with engagement environments and personas, their future capability, targeting, and/or infrastructure requirements are vulnerable to influence.", "id": "EAV0007"}, {"eav": "When adversaries use phishing emails to gain access to victim systems, they have no control over where a malicious attachment is detonated from, or where a link is clicked.", "id": "EAV0004"}], "attack_techniques": [{"attack_tactics": ["collection"], "name": "Email Collection", "id": "T1114"}, {"attack_tactics": ["collection"], "name": "Automated Collection", "id": "T1119"}, {"attack_tactics": ["initial-access"], "name": "Phishing", "id": "T1566"}], "attack_tactics": [{"name": "Collection", "id": "TA0009"}, {"name": "Initial Access", "id": "TA0001"}], "approaches": ["EAP0004", "EAP0006"], "name": "Email Manipulation", "description": "Modify the flow of email in the environment.", "long_description": "Email Manipulation covers the various ways email flows in the environment can be affected. Email Manipulation can affect which mail appliances process mail flows, where mail is forwarded, or what mail is present in an inbox. A common use case for email manipulation is as a vector to introduce malware into the engagement environment.  Suspicious emails may be removed from production mailbox and placed into an inbox in an engagement environment. Then, any suspicious attachments or links could be detonated from within the environment. As another example, emails collected over a long period of time from a legitimate inbox outside the environment may be moved into the environment to reassure the adversary of the environment\u2019s legitimacy by creating a mailbox that more closely resembles a real, lived-in inbox.", "references": [{"title": "Hackers Came but the French Were Prepared", "url": "https://www.nytimes.com/2017/05/09/world/europe/hackers-came-but-the-french-were-prepared.html", "id": "REF0084"}], "EAV0001": [{"name": "Collection", "id": "TA0009"}, {"name": "Initial Access", "id": "TA0001"}], "EAV0002": [{"name": "Collection", "id": "TA0009"}], "EAV0007": [{"name": "Collection", "id": "TA0009"}, {"name": "Initial Access", "id": "TA0001"}], "EAV0004": [{"name": "Initial Access", "id": "TA0001"}]}, "EAC0010": {"type": "Engagement", "goals": ["EGO0002", "EGO0003"], "vulnerabilities": [{"eav": "When adversaries discover enabled, accessible, or intentionally weakened/overly permissive resources in the environment, they are vulnerable to revealing additional or more advanced capabilities when exploiting or using said resource.", "id": "EAV0017"}, {"eav": "When adversaries use hardware peripherals, they must rely on physical access or have limited control over when and where hardware additions are connected in the target network.", "id": "EAV0012"}, {"eav": "When adversaries interact with network or system resources, they are vulnerable to triggering tripwires or engaging in easily detectable, anomalous behavior.", "id": "EAV0010"}, {"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries interact with engagement environments and personas, their future capability, targeting, and/or infrastructure requirements are vulnerable to influence.", "id": "EAV0007"}, {"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}, {"eav": "When adversaries move data across the network or interact with remote resources, they are vulnerable to network manipulations such as impacts to network availability, traffic filtering, degraded speeds, etc.", "id": "EAV0020"}], "attack_techniques": [{"attack_tactics": ["collection"], "name": "Data from Removable Media", "id": "T1025"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Physical Medium", "id": "T1052"}, {"attack_tactics": ["lateral-movement", "initial-access"], "name": "Replication Through Removable Media", "id": "T1091"}, {"attack_tactics": ["command-and-control"], "name": "Communication Through Removable Media", "id": "T1092"}, {"attack_tactics": ["discovery"], "name": "Peripheral Device Discovery", "id": "T1120"}, {"attack_tactics": ["collection"], "name": "Audio Capture", "id": "T1123"}, {"attack_tactics": ["collection"], "name": "Video Capture", "id": "T1125"}, {"attack_tactics": ["discovery"], "name": "Network Share Discovery", "id": "T1135"}], "attack_tactics": [{"name": "Collection", "id": "TA0009"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Discovery", "id": "TA0007"}], "approaches": ["EAP0004", "EAP0006"], "name": "Peripheral Management", "description": "Manage peripheral devices used on systems within the network for engagement purposes.", "long_description": "Peripheral Management is the administration of peripheral devices used on systems within the engagement environment. A defender can choose to allow or deny certain types of peripherals from being used on systems to either motivate or demotivate adversary activity or to direct the adversary towards specific targets. Defenders can also introduce peripherals to an adversary-controlled system to see how the adversary reacts. For example, the defender can introduce external Wi-Fi adapters, USB devices, etc. to determine if adversaries attempt to use them for exfiltration purposes.  Additionally, peripherals provide an avenue for the defender to present new or additional information to the adversary. This information can be used to introduce an additional attack surface, motivate or demotivate adversary activity, or to further the deception story. For example, the defender may include data on a connected USB device or stage an important conversation near an externally connected camera or microphone. Depending on the contents of this data, the adversary may be encouraged to take a specific action and/or reassured about the legitimacy of the environment.", "references": [], "EAV0017": [{"name": "Collection", "id": "TA0009"}, {"name": "Exfiltration", "id": "TA0010"}], "EAV0012": [{"name": "Exfiltration", "id": "TA0010"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Discovery", "id": "TA0007"}], "EAV0010": [{"name": "Initial Access", "id": "TA0001"}], "EAV0001": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Discovery", "id": "TA0007"}], "EAV0007": [{"name": "Discovery", "id": "TA0007"}], "EAV0013": [{"name": "Collection", "id": "TA0009"}], "EAV0020": [{"name": "Discovery", "id": "TA0007"}]}, "EAC0011": {"type": "Engagement", "goals": ["EGO0003"], "vulnerabilities": [{"eav": "When adversaries interact with the environment or personas, they are vulnerable to collecting, or in some way interacting with, manipulated or decoy data. In those cases the data may increase their tolerance for imperfections in the environment and improve the overall believability of the ruse.", "id": "EAV0002"}, {"eav": "When adversaries collect manipulated artifacts, they are vulnerable to revealing their presence when using or moving the artifacts elsewhere in the engagement environment.", "id": "EAV0028"}, {"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to revealing their targeting preferences and capabilities.", "id": "EAV0019"}], "attack_techniques": [{"attack_tactics": ["credential-access"], "name": "OS Credential Dumping", "id": "T1003"}, {"attack_tactics": ["collection"], "name": "Data from Local System", "id": "T1005"}, {"attack_tactics": ["discovery"], "name": "System Service Discovery", "id": "T1007"}, {"attack_tactics": ["discovery"], "name": "Application Window Discovery", "id": "T1010"}, {"attack_tactics": ["discovery"], "name": "Query Registry", "id": "T1012"}, {"attack_tactics": ["discovery"], "name": "System Network Configuration Discovery", "id": "T1016"}, {"attack_tactics": ["discovery"], "name": "Remote System Discovery", "id": "T1018"}, {"attack_tactics": ["exfiltration"], "name": "Automated Exfiltration", "id": "T1020"}, {"attack_tactics": ["collection"], "name": "Data from Removable Media", "id": "T1025"}, {"attack_tactics": ["discovery"], "name": "System Owner/User Discovery", "id": "T1033"}, {"attack_tactics": ["collection"], "name": "Data from Network Shared Drive", "id": "T1039"}, {"attack_tactics": ["credential-access", "discovery"], "name": "Network Sniffing", "id": "T1040"}, {"attack_tactics": ["discovery"], "name": "Network Service Scanning", "id": "T1046"}, {"attack_tactics": ["execution"], "name": "Windows Management Instrumentation", "id": "T1047"}, {"attack_tactics": ["discovery"], "name": "System Network Connections Discovery", "id": "T1049"}, {"attack_tactics": ["collection", "credential-access"], "name": "Input Capture", "id": "T1056"}, {"attack_tactics": ["discovery"], "name": "Process Discovery", "id": "T1057"}, {"attack_tactics": ["discovery"], "name": "Permission Groups Discovery", "id": "T1069"}, {"attack_tactics": ["defense-evasion", "persistence", "privilege-escalation", "initial-access"], "name": "Valid Accounts", "id": "T1078"}, {"attack_tactics": ["discovery"], "name": "System Information Discovery", "id": "T1082"}, {"attack_tactics": ["discovery"], "name": "File and Directory Discovery", "id": "T1083"}, {"attack_tactics": ["discovery"], "name": "Account Discovery", "id": "T1087"}, {"attack_tactics": ["collection"], "name": "Screen Capture", "id": "T1113"}, {"attack_tactics": ["collection"], "name": "Email Collection", "id": "T1114"}, {"attack_tactics": ["collection"], "name": "Clipboard Data", "id": "T1115"}, {"attack_tactics": ["collection"], "name": "Automated Collection", "id": "T1119"}, {"attack_tactics": ["discovery"], "name": "Peripheral Device Discovery", "id": "T1120"}, {"attack_tactics": ["collection"], "name": "Audio Capture", "id": "T1123"}, {"attack_tactics": ["discovery"], "name": "System Time Discovery", "id": "T1124"}, {"attack_tactics": ["collection"], "name": "Video Capture", "id": "T1125"}, {"attack_tactics": ["persistence", "initial-access"], "name": "External Remote Services", "id": "T1133"}, {"attack_tactics": ["discovery"], "name": "Network Share Discovery", "id": "T1135"}, {"attack_tactics": ["collection"], "name": "Browser Session Hijacking", "id": "T1185"}, {"attack_tactics": ["collection"], "name": "Data from Information Repositories", "id": "T1213"}, {"attack_tactics": ["discovery"], "name": "Browser Bookmark Discovery", "id": "T1217"}, {"attack_tactics": ["command-and-control"], "name": "Remote Access Software", "id": "T1219"}, {"attack_tactics": ["impact"], "name": "Data Destruction", "id": "T1485"}, {"attack_tactics": ["defense-evasion", "discovery"], "name": "Virtualization/Sandbox Evasion", "id": "T1497"}, {"attack_tactics": ["discovery"], "name": "Software Discovery", "id": "T1518"}, {"attack_tactics": ["discovery"], "name": "Cloud Service Discovery", "id": "T1526"}, {"attack_tactics": ["collection"], "name": "Data from Cloud Storage Object", "id": "T1530"}, {"attack_tactics": ["discovery"], "name": "Cloud Service Dashboard", "id": "T1538"}, {"attack_tactics": ["credential-access"], "name": "Credentials from Password Stores", "id": "T1555"}, {"attack_tactics": ["credential-access", "collection"], "name": "Adversary-in-the-Middle", "id": "T1557"}, {"attack_tactics": ["lateral-movement"], "name": "Remote Service Session Hijacking", "id": "T1563"}, {"attack_tactics": ["impact"], "name": "Data Manipulation", "id": "T1565"}, {"attack_tactics": ["initial-access"], "name": "Phishing", "id": "T1566"}, {"attack_tactics": ["discovery"], "name": "Cloud Infrastructure Discovery", "id": "T1580"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Identity Information", "id": "T1589"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Network Information", "id": "T1590"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Org Information", "id": "T1591"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Host Information", "id": "T1592"}, {"attack_tactics": ["reconnaissance"], "name": "Active Scanning", "id": "T1595"}, {"attack_tactics": ["reconnaissance"], "name": "Phishing for Information", "id": "T1598"}, {"attack_tactics": ["defense-evasion"], "name": "Weaken Encryption", "id": "T1600"}, {"attack_tactics": ["collection"], "name": "Data from Configuration Repository", "id": "T1602"}, {"attack_tactics": ["discovery"], "name": "Container and Resource Discovery", "id": "T1613"}, {"attack_tactics": ["discovery"], "name": "System Location Discovery", "id": "T1614"}], "attack_tactics": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Collection", "id": "TA0009"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Execution", "id": "TA0002"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Impact", "id": "TA0040"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Reconnaissance", "id": "TA0043"}], "approaches": ["EAP0006"], "name": "Pocket Litter", "description": "Data used to support the engagement narrative.", "long_description": "Pocket Litter is data placed on a system to help tell the engagement narrative, to increase the credibility of an environment, and/or to establish a cognitive bias to raise the adversary\u2019s tolerance to weaknesses in the environment. Unlike Lures, Pocket Litter does not necessarily aim to encourage the adversary to take a specific action, but rather it supports the overall deception story.  Pocket Litter can include documents, pictures, registry entries, installed software, log history, browsing history, connection history, and other user data that an adversary would expect to exist on a user\u2019s computer. For example, a defender might conduct a series of web searches to generate browser artifacts, or scatter a variety of photos and documents across the desktop to make the computer feel lived in.", "references": [{"title": "Enhancing Cohesion And Coherence Of Fake Text To Improve Believability For Deceiving Cyber Attackers", "url": "https://aclanthology.org/W18-4104.pdf", "id": "REF0038"}, {"title": "Phantomfs: File-Based Deception Technology For Thwarting Malicious Users", "url": "https://ieeexplore.ieee.org/abstract/document/8998256", "id": "REF0039"}], "EAV0002": [{"name": "Credential Access", "id": "TA0006"}, {"name": "Collection", "id": "TA0009"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Execution", "id": "TA0002"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Impact", "id": "TA0040"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Reconnaissance", "id": "TA0043"}, {"name": "Defense Evasion", "id": "TA0005"}], "EAV0028": [{"name": "Exfiltration", "id": "TA0010"}], "EAV0001": [{"name": "Discovery", "id": "TA0007"}], "EAV0019": [{"name": "Impact", "id": "TA0040"}]}, "EAC0012": {"type": "Engagement", "goals": ["EGO0003"], "vulnerabilities": [{"eav": "When adversaries interact with the environment or personas, they are vulnerable to collecting, or in some way interacting with, manipulated or decoy data. In those cases the data may increase their tolerance for imperfections in the environment and improve the overall believability of the ruse.", "id": "EAV0002"}, {"eav": "When adversaries discover enabled, accessible, or intentionally weakened/overly permissive resources in the environment, they are vulnerable to revealing additional or more advanced capabilities when exploiting or using said resource.", "id": "EAV0017"}, {"eav": "When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to revealing their targeting preferences and capabilities.", "id": "EAV0019"}, {"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries interact directly with victims, they are vulnerable to being socially engineered or otherwise manipulated by an aware user.", "id": "EAV0018"}, {"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}, {"eav": "When adversaries collect manipulated artifacts, they are vulnerable to revealing their presence when using or moving the artifacts elsewhere in the engagement environment.", "id": "EAV0028"}, {"eav": "When adversaries collect targeting information from open or closed data sources, they are vulnerable to being influenced by manipulated or misleading data.", "id": "EAV0006"}, {"eav": "When adversaries collect targeting information from open or closed data sources, they may reveal their targeting preferences.", "id": "EAV0025"}], "attack_techniques": [{"attack_tactics": ["discovery"], "name": "System Owner/User Discovery", "id": "T1033"}, {"attack_tactics": ["discovery"], "name": "Permission Groups Discovery", "id": "T1069"}, {"attack_tactics": ["defense-evasion", "persistence", "privilege-escalation", "initial-access"], "name": "Valid Accounts", "id": "T1078"}, {"attack_tactics": ["discovery"], "name": "File and Directory Discovery", "id": "T1083"}, {"attack_tactics": ["discovery"], "name": "Account Discovery", "id": "T1087"}, {"attack_tactics": ["command-and-control"], "name": "Communication Through Removable Media", "id": "T1092"}, {"attack_tactics": ["persistence"], "name": "Account Manipulation", "id": "T1098"}, {"attack_tactics": ["collection"], "name": "Screen Capture", "id": "T1113"}, {"attack_tactics": ["collection"], "name": "Automated Collection", "id": "T1119"}, {"attack_tactics": ["collection"], "name": "Video Capture", "id": "T1125"}, {"attack_tactics": ["initial-access"], "name": "Trusted Relationship", "id": "T1199"}, {"attack_tactics": ["execution"], "name": "User Execution", "id": "T1204"}, {"attack_tactics": ["credential-access"], "name": "Exploitation for Credential Access", "id": "T1212"}, {"attack_tactics": ["discovery"], "name": "Browser Bookmark Discovery", "id": "T1217"}, {"attack_tactics": ["command-and-control"], "name": "Remote Access Software", "id": "T1219"}, {"attack_tactics": ["impact"], "name": "Account Access Removal", "id": "T1531"}, {"attack_tactics": ["credential-access"], "name": "Credentials from Password Stores", "id": "T1555"}, {"attack_tactics": ["initial-access"], "name": "Phishing", "id": "T1566"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Identity Information", "id": "T1589"}, {"attack_tactics": ["reconnaissance"], "name": "Search Open Websites/Domains", "id": "T1593"}, {"attack_tactics": ["reconnaissance"], "name": "Search Victim-Owned Websites", "id": "T1594"}, {"attack_tactics": ["reconnaissance"], "name": "Phishing for Information", "id": "T1598"}], "attack_tactics": [{"name": "Discovery", "id": "TA0007"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Collection", "id": "TA0009"}, {"name": "Execution", "id": "TA0002"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Impact", "id": "TA0040"}, {"name": "Reconnaissance", "id": "TA0043"}], "approaches": ["EAP0007"], "name": "Personas", "description": "Create fictitious human user(s) through a combination of planted data and revealed behavior patterns.", "long_description": "A Persona is used to establish background information about a victim to increase the believability of the target. To create a Persona, the defender must develop a backstory and seed the environment with varying data in support of this story. Depending on the need for realism, the constructed persona can be supported by evidence of hobbies, social and professional interactions, consumer transactions, employment, browsing habits, etc.  In addition to lending legitimacy to the environment, personas can be used to engage directly with adversaries, such as during phishing email exchanges. Additionally, personas can make changes to the environment during the operation, such as adding or removing a USB device or introducing new decoy documents or credentials.", "references": [], "EAV0002": [{"name": "Discovery", "id": "TA0007"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Collection", "id": "TA0009"}], "EAV0017": [{"name": "Initial Access", "id": "TA0001"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Impact", "id": "TA0040"}], "EAV0019": [{"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}], "EAV0001": [{"name": "Discovery", "id": "TA0007"}, {"name": "Collection", "id": "TA0009"}, {"name": "Reconnaissance", "id": "TA0043"}], "EAV0018": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Execution", "id": "TA0002"}, {"name": "Reconnaissance", "id": "TA0043"}], "EAV0013": [{"name": "Collection", "id": "TA0009"}, {"name": "Credential Access", "id": "TA0006"}], "EAV0028": [{"name": "Credential Access", "id": "TA0006"}], "EAV0006": [{"name": "Reconnaissance", "id": "TA0043"}], "EAV0025": [{"name": "Reconnaissance", "id": "TA0043"}]}, "EAC0013": {"type": "Engagement", "goals": ["EGO0001", "EGO0002", "EGO0003"], "vulnerabilities": [{"eav": "When adversaries\u2019 malware is detonated, they are vulnerable to dynamic analysis, which can reveal how the malware interacts with system resources.", "id": "EAV0027"}, {"eav": "When adversaries\u2019 malware is detonated, they may be encouraged to operate in an unintended environment.", "id": "EAV0005"}, {"eav": "When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to revealing their targeting preferences and capabilities.", "id": "EAV0019"}], "attack_techniques": [{"attack_tactics": ["defense-evasion"], "name": "Obfuscated Files or Information", "id": "T1027"}, {"attack_tactics": ["execution"], "name": "Windows Management Instrumentation", "id": "T1047"}, {"attack_tactics": ["command-and-control"], "name": "Communication Through Removable Media", "id": "T1092"}, {"attack_tactics": ["execution"], "name": "User Execution", "id": "T1204"}, {"attack_tactics": ["defense-evasion"], "name": "Signed Script Proxy Execution", "id": "T1216"}, {"attack_tactics": ["defense-evasion"], "name": "Signed Binary Proxy Execution", "id": "T1218"}, {"attack_tactics": ["command-and-control"], "name": "Remote Access Software", "id": "T1219"}, {"attack_tactics": ["defense-evasion"], "name": "XSL Script Processing", "id": "T1220"}, {"attack_tactics": ["defense-evasion"], "name": "Template Injection", "id": "T1221"}, {"attack_tactics": ["impact"], "name": "Disk Wipe", "id": "T1561"}, {"attack_tactics": ["execution"], "name": "System Services", "id": "T1569"}], "attack_tactics": [{"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Impact", "id": "TA0040"}], "approaches": ["EAP0002", "EAP0004", "EAP0007"], "name": "Malware Detonation", "description": "Execute malware under controlled conditions to analyze its functionality.", "long_description": "Malware can be detonated in a controlled and safe environment. Clear goals and safety procedures should always be established before detonation to ensure that the operation is focused and safe. The malware can be detonated in an execution environment ranging from a somewhat sterile commercial malware execution appliance to a bespoke engagement environment crafted to support an extended engagement.  Depending on operational objectives, the outcome of a malware detonation operation can include: collecting new IOCs during dynamic analysis,  observing additional TTPs by detonating the malware in a target rich environment, and/or negatively impacting the adversary and their operation. ", "references": [{"title": "Utilizing Network Science And Honeynets For Software Induced Cyber Incident Analysis", "url": "https://sefcom.asu.edu/publications/utilizing-network-science-hicss2015.pdf", "id": "REF0018"}, {"title": "Duping The Soviets: The Farewell Dossier", "url": "https://apps.dtic.mil/sti/pdfs/ADA527328.pdf", "id": "REF0075"}], "EAV0027": [{"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}], "EAV0005": [{"name": "Execution", "id": "TA0002"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Impact", "id": "TA0040"}], "EAV0019": [{"name": "Command and Control", "id": "TA0011"}]}, "EAC0014": {"type": "Engagement", "goals": ["EGO0001", "EGO0002"], "vulnerabilities": [{"eav": "When adversaries utilize or abuse system features, software, or other resources, they may be vulnerable to monitoring or Man-in-the-Middle manipulation.", "id": "EAV0016"}, {"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries interact with engagement environments and personas, their future capability, targeting, and/or infrastructure requirements are vulnerable to influence.", "id": "EAV0007"}, {"eav": "When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to revealing their targeting preferences and capabilities.", "id": "EAV0019"}, {"eav": "When adversaries interact with network or system resources, they are vulnerable to triggering tripwires or engaging in easily detectable, anomalous behavior.", "id": "EAV0010"}, {"eav": "When adversaries use brute-force techniques to access accounts or encrypted data, they are vulnerable to wasting resources if the artifact has no valid credentials or is locked in some other way.", "id": "EAV0022"}, {"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}], "attack_techniques": [{"attack_tactics": ["command-and-control"], "name": "Data Obfuscation", "id": "T1001"}, {"attack_tactics": ["collection"], "name": "Data from Local System", "id": "T1005"}, {"attack_tactics": ["defense-evasion"], "name": "Direct Volume Access", "id": "T1006"}, {"attack_tactics": ["discovery"], "name": "System Service Discovery", "id": "T1007"}, {"attack_tactics": ["discovery"], "name": "Query Registry", "id": "T1012"}, {"attack_tactics": ["discovery"], "name": "System Network Configuration Discovery", "id": "T1016"}, {"attack_tactics": ["discovery"], "name": "Remote System Discovery", "id": "T1018"}, {"attack_tactics": ["defense-evasion"], "name": "Obfuscated Files or Information", "id": "T1027"}, {"attack_tactics": ["discovery"], "name": "System Owner/User Discovery", "id": "T1033"}, {"attack_tactics": ["credential-access", "discovery"], "name": "Network Sniffing", "id": "T1040"}, {"attack_tactics": ["discovery"], "name": "Network Service Scanning", "id": "T1046"}, {"attack_tactics": ["execution"], "name": "Windows Management Instrumentation", "id": "T1047"}, {"attack_tactics": ["discovery"], "name": "System Network Connections Discovery", "id": "T1049"}, {"attack_tactics": ["execution", "persistence", "privilege-escalation"], "name": "Scheduled Task/Job", "id": "T1053"}, {"attack_tactics": ["discovery"], "name": "Process Discovery", "id": "T1057"}, {"attack_tactics": ["execution"], "name": "Command and Scripting Interpreter", "id": "T1059"}, {"attack_tactics": ["discovery"], "name": "Permission Groups Discovery", "id": "T1069"}, {"attack_tactics": ["execution", "lateral-movement"], "name": "Software Deployment Tools", "id": "T1072"}, {"attack_tactics": ["discovery"], "name": "System Information Discovery", "id": "T1082"}, {"attack_tactics": ["discovery"], "name": "File and Directory Discovery", "id": "T1083"}, {"attack_tactics": ["discovery"], "name": "Account Discovery", "id": "T1087"}, {"attack_tactics": ["lateral-movement", "initial-access"], "name": "Replication Through Removable Media", "id": "T1091"}, {"attack_tactics": ["execution"], "name": "Native API", "id": "T1106"}, {"attack_tactics": ["credential-access"], "name": "Brute Force", "id": "T1110"}, {"attack_tactics": ["collection"], "name": "Automated Collection", "id": "T1119"}, {"attack_tactics": ["discovery"], "name": "Peripheral Device Discovery", "id": "T1120"}, {"attack_tactics": ["discovery"], "name": "System Time Discovery", "id": "T1124"}, {"attack_tactics": ["execution"], "name": "Shared Modules", "id": "T1129"}, {"attack_tactics": ["defense-evasion", "privilege-escalation"], "name": "Access Token Manipulation", "id": "T1134"}, {"attack_tactics": ["discovery"], "name": "Network Share Discovery", "id": "T1135"}, {"attack_tactics": ["defense-evasion"], "name": "Deobfuscate/Decode Files or Information", "id": "T1140"}, {"attack_tactics": ["defense-evasion", "persistence"], "name": "BITS Jobs", "id": "T1197"}, {"attack_tactics": ["discovery"], "name": "Password Policy Discovery", "id": "T1201"}, {"attack_tactics": ["defense-evasion"], "name": "Indirect Command Execution", "id": "T1202"}, {"attack_tactics": ["defense-evasion"], "name": "Signed Script Proxy Execution", "id": "T1216"}, {"attack_tactics": ["discovery"], "name": "Browser Bookmark Discovery", "id": "T1217"}, {"attack_tactics": ["defense-evasion"], "name": "Signed Binary Proxy Execution", "id": "T1218"}, {"attack_tactics": ["defense-evasion"], "name": "XSL Script Processing", "id": "T1220"}, {"attack_tactics": ["impact"], "name": "Data Destruction", "id": "T1485"}, {"attack_tactics": ["impact"], "name": "Data Encrypted for Impact", "id": "T1486"}, {"attack_tactics": ["impact"], "name": "Resource Hijacking", "id": "T1496"}, {"attack_tactics": ["discovery"], "name": "Software Discovery", "id": "T1518"}, {"attack_tactics": ["impact"], "name": "Account Access Removal", "id": "T1531"}, {"attack_tactics": ["persistence"], "name": "Compromise Client Software Binary", "id": "T1554"}, {"attack_tactics": ["execution"], "name": "Inter-Process Communication", "id": "T1559"}, {"attack_tactics": ["collection"], "name": "Archive Collected Data", "id": "T1560"}, {"attack_tactics": ["impact"], "name": "Disk Wipe", "id": "T1561"}, {"attack_tactics": ["defense-evasion"], "name": "Hide Artifacts", "id": "T1564"}, {"attack_tactics": ["execution"], "name": "System Services", "id": "T1569"}, {"attack_tactics": ["command-and-control"], "name": "Encrypted Channel", "id": "T1573"}, {"attack_tactics": ["defense-evasion"], "name": "Modify Cloud Compute Infrastructure", "id": "T1578"}, {"attack_tactics": ["discovery"], "name": "Container and Resource Discovery", "id": "T1613"}, {"attack_tactics": ["discovery"], "name": "System Location Discovery", "id": "T1614"}], "attack_tactics": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Collection", "id": "TA0009"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Execution", "id": "TA0002"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Impact", "id": "TA0040"}], "approaches": ["EAP0001", "EAP0004", "EAP0005"], "name": "Software Manipulation", "description": "Make changes to a system\u2019s software properties and functions to achieve a desired effect.", "long_description": "Software Manipulation allows a defender to alter or replace elements of the OS, file system, or other software installed and executed on a system. These alterations can affect outputs, degrade effectiveness, and/or prevent the software from functioning altogether. For example, the defender can manipulate software by changing the output of commonly used discovery commands to hide legitimate systems and artifacts and/or reveal deceptive artifacts and systems.  Alternatively, the defender can change the output of the password policy description for an adversary attempting to brute-force credentials. This manipulation may cause the adversary to waste resources brute-forcing passwords with inaccurate complexity requirements. If the defender wanted to degrade software effectiveness, they might weaken algorithms to expose data that is being archived, encoded, and/or encrypted.  Finally, to prevent software from functioning altogether, the defender may cause failures in software typically used to delete data or hide adversary artifacts. For some Software Manipulation use cases, it may be possible to make changes in such a way that adversary actions and legitimate user actions are handled differently. For example, the defender could show all files when viewed in a graphical application but hide files or introduce decoy files when viewed via a terminal command. This setup would allow legitimate users full access to the file system, while manipulating access for adversaries using a reverse shell.", "references": [{"title": "A Deception Based Approach For Defeating OS And Service Fingerprinting", "url": "https://ieeexplore.ieee.org/abstract/document/7346842/", "id": "REF0040"}, {"title": "From Patches To Honey-Patches: Lightweight Attacker Misdirection, Deception, And Disinformation", "url": "https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.696.2803&rep=rep1&type=pdf", "id": "REF0042"}, {"title": "Using Deception To Hide Things From Hackers: Processes, Principles, And Techniques", "url": "https://apps.dtic.mil/sti/pdfs/ADA485003.pdf", "id": "REF0043"}], "EAV0016": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Collection", "id": "TA0009"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Execution", "id": "TA0002"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Impact", "id": "TA0040"}, {"name": "Persistence", "id": "TA0003"}], "EAV0001": [{"name": "Discovery", "id": "TA0007"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Impact", "id": "TA0040"}], "EAV0007": [{"name": "Discovery", "id": "TA0007"}], "EAV0019": [{"name": "Discovery", "id": "TA0007"}], "EAV0010": [{"name": "Initial Access", "id": "TA0001"}], "EAV0022": [{"name": "Credential Access", "id": "TA0006"}], "EAV0013": [{"name": "Persistence", "id": "TA0003"}, {"name": "Defense Evasion", "id": "TA0005"}]}, "EAC0015": {"type": "Engagement", "goals": ["EGO0003"], "vulnerabilities": [{"eav": "When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to revealing their targeting preferences and capabilities.", "id": "EAV0019"}, {"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries interact with engagement environments and personas, their future capability, targeting, and/or infrastructure requirements are vulnerable to influence.", "id": "EAV0007"}, {"eav": "When adversaries collect manipulated artifacts, they are vulnerable to revealing their presence when using or moving the artifacts elsewhere in the engagement environment.", "id": "EAV0028"}, {"eav": "When adversaries interact directly with victims, they are vulnerable to being socially engineered or otherwise manipulated by an aware user.", "id": "EAV0018"}, {"eav": "When adversaries collect targeting information from open or closed data sources, they are vulnerable to being influenced by manipulated or misleading data.", "id": "EAV0006"}, {"eav": "When adversaries collect targeting information from open or closed data sources, they may reveal their targeting preferences.", "id": "EAV0025"}, {"eav": "When adversaries discover enabled, accessible, or intentionally weakened/overly permissive resources in the environment, they are vulnerable to revealing additional or more advanced capabilities when exploiting or using said resource.", "id": "EAV0017"}], "attack_techniques": [{"attack_tactics": ["command-and-control"], "name": "Data Obfuscation", "id": "T1001"}, {"attack_tactics": ["collection"], "name": "Data from Local System", "id": "T1005"}, {"attack_tactics": ["discovery"], "name": "System Service Discovery", "id": "T1007"}, {"attack_tactics": ["discovery"], "name": "Application Window Discovery", "id": "T1010"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Other Network Medium", "id": "T1011"}, {"attack_tactics": ["discovery"], "name": "System Network Configuration Discovery", "id": "T1016"}, {"attack_tactics": ["exfiltration"], "name": "Automated Exfiltration", "id": "T1020"}, {"attack_tactics": ["collection"], "name": "Data from Removable Media", "id": "T1025"}, {"attack_tactics": ["defense-evasion"], "name": "Obfuscated Files or Information", "id": "T1027"}, {"attack_tactics": ["exfiltration"], "name": "Scheduled Transfer", "id": "T1029"}, {"attack_tactics": ["exfiltration"], "name": "Data Transfer Size Limits", "id": "T1030"}, {"attack_tactics": ["collection"], "name": "Data from Network Shared Drive", "id": "T1039"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over C2 Channel", "id": "T1041"}, {"attack_tactics": ["execution"], "name": "Windows Management Instrumentation", "id": "T1047"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Alternative Protocol", "id": "T1048"}, {"attack_tactics": ["discovery"], "name": "System Network Connections Discovery", "id": "T1049"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Physical Medium", "id": "T1052"}, {"attack_tactics": ["lateral-movement"], "name": "Taint Shared Content", "id": "T1080"}, {"attack_tactics": ["discovery"], "name": "System Information Discovery", "id": "T1082"}, {"attack_tactics": ["discovery"], "name": "File and Directory Discovery", "id": "T1083"}, {"attack_tactics": ["discovery"], "name": "Account Discovery", "id": "T1087"}, {"attack_tactics": ["collection"], "name": "Screen Capture", "id": "T1113"}, {"attack_tactics": ["collection"], "name": "Email Collection", "id": "T1114"}, {"attack_tactics": ["collection"], "name": "Clipboard Data", "id": "T1115"}, {"attack_tactics": ["collection"], "name": "Automated Collection", "id": "T1119"}, {"attack_tactics": ["collection"], "name": "Audio Capture", "id": "T1123"}, {"attack_tactics": ["discovery"], "name": "System Time Discovery", "id": "T1124"}, {"attack_tactics": ["collection"], "name": "Video Capture", "id": "T1125"}, {"attack_tactics": ["command-and-control"], "name": "Data Encoding", "id": "T1132"}, {"attack_tactics": ["discovery"], "name": "Network Share Discovery", "id": "T1135"}, {"attack_tactics": ["discovery"], "name": "Password Policy Discovery", "id": "T1201"}, {"attack_tactics": ["execution"], "name": "User Execution", "id": "T1204"}, {"attack_tactics": ["collection"], "name": "Data from Information Repositories", "id": "T1213"}, {"attack_tactics": ["discovery"], "name": "Browser Bookmark Discovery", "id": "T1217"}, {"attack_tactics": ["defense-evasion"], "name": "Execution Guardrails", "id": "T1480"}, {"attack_tactics": ["discovery"], "name": "Domain Trust Discovery", "id": "T1482"}, {"attack_tactics": ["impact"], "name": "Data Destruction", "id": "T1485"}, {"attack_tactics": ["impact"], "name": "Data Encrypted for Impact", "id": "T1486"}, {"attack_tactics": ["impact"], "name": "Defacement", "id": "T1491"}, {"attack_tactics": ["defense-evasion", "discovery"], "name": "Virtualization/Sandbox Evasion", "id": "T1497"}, {"attack_tactics": ["collection"], "name": "Data from Cloud Storage Object", "id": "T1530"}, {"attack_tactics": ["exfiltration"], "name": "Transfer Data to Cloud Account", "id": "T1537"}, {"attack_tactics": ["discovery"], "name": "Cloud Service Dashboard", "id": "T1538"}, {"attack_tactics": ["impact"], "name": "Disk Wipe", "id": "T1561"}, {"attack_tactics": ["impact"], "name": "Data Manipulation", "id": "T1565"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Web Service", "id": "T1567"}, {"attack_tactics": ["reconnaissance"], "name": "Search Open Websites/Domains", "id": "T1593"}, {"attack_tactics": ["reconnaissance"], "name": "Search Victim-Owned Websites", "id": "T1594"}, {"attack_tactics": ["reconnaissance"], "name": "Search Open Technical Databases", "id": "T1596"}, {"attack_tactics": ["reconnaissance"], "name": "Search Closed Sources", "id": "T1597"}, {"attack_tactics": ["reconnaissance"], "name": "Phishing for Information", "id": "T1598"}, {"attack_tactics": ["defense-evasion"], "name": "Weaken Encryption", "id": "T1600"}, {"attack_tactics": ["collection"], "name": "Data from Configuration Repository", "id": "T1602"}, {"attack_tactics": ["discovery"], "name": "System Location Discovery", "id": "T1614"}], "attack_tactics": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Collection", "id": "TA0009"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Impact", "id": "TA0040"}, {"name": "Reconnaissance", "id": "TA0043"}], "approaches": ["EAP0006", "EAP0007"], "name": "Information Manipulation", "description": "Conceal and reveal both facts and fictions to support a deception story", "long_description": "Information Manipulation is used to support the engagement narrative and directly impact adversary activities. Revealed facts and fictions can be used to adjust the adversary\u2019s trust in the environment. Concealed facts and fiction can be used to adjust the adversary\u2019s sense of uncertainty towards the environment. Revealed facts may include OS type and version, geographic location, hardware type and version, accounts, credentials, etc. Revealed fictions may include the content of decoy files, emails, messages, etc. Revealed facts and fictions may or may not be believed by the adversary.  If an adversary believes a revealed fact or fiction, it may lend credibility to the environment or encourage a specific action. If an adversary is suspicious or does not believe a revealed fact or fiction, it may erode adversary trust in the environment or discourage a specific action. Therefore, revealed facts and fictions can be used to adjust the adversary\u2019s trust in the environment in ways that support the operational objectives.  <br><br>Concealed facts may include virtualized systems disguised as physical systems, monitoring software, or collection efforts. Concealed fictions may include an encrypted, interestingly named, decoy file or a partially deleted email thread referencing high value, but decoy, assets. Concealed facts and fictions may or may not be discovered by the adversary. If the adversary discovers a concealed fact or fiction, it may increase the ambiguity of the environment and affect the adversary\u2019s sense of uncertainty.  In this way, concealed facts and fictions can be used to adjust the ambiguity and affect the adversary\u2019s sense of uncertainty in ways that support the operational objectives", "references": [{"title": "Using Word Embeddings To Deter Intellectual Property Theft Through Automated Generation Of Fake Documents", "url": "https://dl.acm.org/doi/abs/10.1145/3418289", "id": "REF0044"}, {"title": "Duping The Soviets: The Farewell Dossier", "url": "https://apps.dtic.mil/sti/pdfs/ADA527328.pdf", "id": "REF0075"}, {"title": "Hackers Came but the French Were Prepared", "url": "https://www.nytimes.com/2017/05/09/world/europe/hackers-came-but-the-french-were-prepared.html", "id": "REF0084"}], "EAV0019": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Collection", "id": "TA0009"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Impact", "id": "TA0040"}], "EAV0001": [{"name": "Collection", "id": "TA0009"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}, {"name": "Impact", "id": "TA0040"}, {"name": "Reconnaissance", "id": "TA0043"}], "EAV0007": [{"name": "Collection", "id": "TA0009"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Execution", "id": "TA0002"}, {"name": "Defense Evasion", "id": "TA0005"}], "EAV0028": [{"name": "Collection", "id": "TA0009"}], "EAV0018": [{"name": "Execution", "id": "TA0002"}], "EAV0006": [{"name": "Reconnaissance", "id": "TA0043"}], "EAV0025": [{"name": "Reconnaissance", "id": "TA0043"}], "EAV0017": [{"name": "Defense Evasion", "id": "TA0005"}]}, "EAC0016": {"type": "Engagement", "goals": ["EGO0002"], "vulnerabilities": [{"eav": "When adversaries move data across the network or interact with remote resources, they are vulnerable to network manipulations such as impacts to network availability, traffic filtering, degraded speeds, etc.", "id": "EAV0020"}, {"eav": "When adversaries exfiltrate data, their data are vulnerable to observation or manipulation via Man-in-the-Middle activities. ", "id": "EAV0021"}, {"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}, {"eav": "When adversaries attempt to exfiltrate, manipulate, or move massive data objects, they are vulnerable to wasting resources to accomplish the task.", "id": "EAV0029"}, {"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}, {"eav": "When adversaries use easily identifiable techniques, or generate signaturable patterns in data or traffic, they are vulnerable to detection of their activity.", "id": "EAV0023"}], "attack_techniques": [{"attack_tactics": ["command-and-control"], "name": "Fallback Channels", "id": "T1008"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Other Network Medium", "id": "T1011"}, {"attack_tactics": ["discovery"], "name": "Remote System Discovery", "id": "T1018"}, {"attack_tactics": ["exfiltration"], "name": "Automated Exfiltration", "id": "T1020"}, {"attack_tactics": ["lateral-movement"], "name": "Remote Services", "id": "T1021"}, {"attack_tactics": ["exfiltration"], "name": "Scheduled Transfer", "id": "T1029"}, {"attack_tactics": ["exfiltration"], "name": "Data Transfer Size Limits", "id": "T1030"}, {"attack_tactics": ["collection"], "name": "Data from Network Shared Drive", "id": "T1039"}, {"attack_tactics": ["credential-access", "discovery"], "name": "Network Sniffing", "id": "T1040"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over C2 Channel", "id": "T1041"}, {"attack_tactics": ["discovery"], "name": "Network Service Scanning", "id": "T1046"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Alternative Protocol", "id": "T1048"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Physical Medium", "id": "T1052"}, {"attack_tactics": ["command-and-control"], "name": "Application Layer Protocol", "id": "T1071"}, {"attack_tactics": ["lateral-movement"], "name": "Taint Shared Content", "id": "T1080"}, {"attack_tactics": ["command-and-control"], "name": "Proxy", "id": "T1090"}, {"attack_tactics": ["command-and-control"], "name": "Non-Application Layer Protocol", "id": "T1095"}, {"attack_tactics": ["command-and-control"], "name": "Web Service", "id": "T1102"}, {"attack_tactics": ["command-and-control"], "name": "Multi-Stage Channels", "id": "T1104"}, {"attack_tactics": ["command-and-control"], "name": "Ingress Tool Transfer", "id": "T1105"}, {"attack_tactics": ["credential-access"], "name": "Two-Factor Authentication Interception", "id": "T1111"}, {"attack_tactics": ["collection"], "name": "Automated Collection", "id": "T1119"}, {"attack_tactics": ["collection"], "name": "Audio Capture", "id": "T1123"}, {"attack_tactics": ["collection"], "name": "Video Capture", "id": "T1125"}, {"attack_tactics": ["command-and-control"], "name": "Data Encoding", "id": "T1132"}, {"attack_tactics": ["discovery"], "name": "Network Share Discovery", "id": "T1135"}, {"attack_tactics": ["credential-access"], "name": "Forced Authentication", "id": "T1187"}, {"attack_tactics": ["initial-access"], "name": "Hardware Additions", "id": "T1200"}, {"attack_tactics": ["defense-evasion", "persistence", "command-and-control"], "name": "Traffic Signaling", "id": "T1205"}, {"attack_tactics": ["command-and-control"], "name": "Remote Access Software", "id": "T1219"}, {"attack_tactics": ["impact"], "name": "Network Denial of Service", "id": "T1498"}, {"attack_tactics": ["impact"], "name": "Endpoint Denial of Service", "id": "T1499"}, {"attack_tactics": ["collection"], "name": "Data from Cloud Storage Object", "id": "T1530"}, {"attack_tactics": ["exfiltration"], "name": "Transfer Data to Cloud Account", "id": "T1537"}, {"attack_tactics": ["lateral-movement"], "name": "Remote Service Session Hijacking", "id": "T1563"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Web Service", "id": "T1567"}, {"attack_tactics": ["command-and-control"], "name": "Dynamic Resolution", "id": "T1568"}, {"attack_tactics": ["lateral-movement"], "name": "Lateral Tool Transfer", "id": "T1570"}, {"attack_tactics": ["command-and-control"], "name": "Non-Standard Port", "id": "T1571"}, {"attack_tactics": ["command-and-control"], "name": "Protocol Tunneling", "id": "T1572"}, {"attack_tactics": ["command-and-control"], "name": "Encrypted Channel", "id": "T1573"}, {"attack_tactics": ["discovery"], "name": "Cloud Infrastructure Discovery", "id": "T1580"}, {"attack_tactics": ["reconnaissance"], "name": "Active Scanning", "id": "T1595"}, {"attack_tactics": ["defense-evasion"], "name": "Network Boundary Bridging", "id": "T1599"}, {"attack_tactics": ["defense-evasion", "execution"], "name": "Deploy Container", "id": "T1610"}], "attack_tactics": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Collection", "id": "TA0009"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Impact", "id": "TA0040"}, {"name": "Reconnaissance", "id": "TA0043"}, {"name": "Execution", "id": "TA0002"}], "approaches": ["EAP0003", "EAP0004", "EAP0005"], "name": "Network Manipulation", "description": "Make changes to network properties and functions to achieve a desired effect.", "long_description": "Network Manipulation allows a defender to throttle network speeds, segment the network, maintain a unique IP addressing scheme, add a kill switch to cut off network access, etc. These types of manipulations can affect the adversary\u2019s ability to achieve their operational objectives by incurring an increased resource cost, forcing them to change tactics, or stopping them altogether.  For example, a defender can limit the allowed ports or network requests to force the adversary to alter their planned C2 or exfiltration channels. As another example, a defender could allow or deny outbound SMB requests from a network to affect the success of forced authentication. Additionally, the defender can degrade network speeds and reliability to impose a resource cost as adversaries exfiltrate large quantities of data. Finally, a defender can block primary C2 domains and IPs to determine if the adversary has additional infrastructure. While there are a range of network manipulation options, in all cases, the defender has an opportunity to learn about or influence the adversaries operating in the environment.", "references": [{"title": "Ensuring Deception Consistency For FTP Services Hardened Against Advanced Persistent Threats", "url": "https://doi.org/10.1145/3268966.3268971", "id": "REF0003"}, {"title": "Deceptive Decoys: Combining Believable User and Network Activities and Deceptive Network Setup in Enhancing Effectiveness", "url": "https://www.academia.edu/49519275/DECEPTIVE_DECOYS_COMBINING_BELIEVABLE_USER_AND_NETWORK_ACTIVITIES_AND_DECEPTIVE_NETWORK_SETUP_IN_ENHANCING_EFFECTIVENESS?from=cover_page", "id": "REF0030"}, {"title": "Cyber Deception: Virtual Networks To Defend Insider Reconnaissance", "url": "https://dl.acm.org/doi/abs/10.1145/2995959.2995962", "id": "REF0046"}, {"title": "Deceiving Network Reconnaissance Using SDN-Based Virtual Topologies", "url": "https://ieeexplore.ieee.org/abstract/document/7971943", "id": "REF0047"}, {"title": "Deceptor-In-The-Middle (Ditm): Cyber Deception For Security In Wireless Network Virtualization", "url": "https://ieeexplore.ieee.org/abstract/document/9045164", "id": "REF0048"}, {"title": "Uncovering Network Tarpits With Degreaser", "url": "https://calhoun.nps.edu/handle/10945/46358", "id": "REF0051"}, {"title": "Hiding Computer Network Proactive Security Tools Unmasking Features", "url": "http://ceur-ws.org/Vol-2081/paper19.pdf", "id": "REF0052"}, {"title": "Now You See Me Now You Don't: Advancing Network Defense Through Network Deception", "url": "https://www.osti.gov/biblio/1466480", "id": "REF0053"}, {"title": "A Technique For Network Topology Deception", "url": "https://core.ac.uk/download/pdf/36729002.pdf", "id": "REF0054"}], "EAV0020": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Collection", "id": "TA0009"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Impact", "id": "TA0040"}, {"name": "Reconnaissance", "id": "TA0043"}, {"name": "Defense Evasion", "id": "TA0005"}], "EAV0021": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Exfiltration", "id": "TA0010"}], "EAV0001": [{"name": "Lateral Movement", "id": "TA0008"}], "EAV0029": [{"name": "Command and Control", "id": "TA0011"}], "EAV0013": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Execution", "id": "TA0002"}], "EAV0023": [{"name": "Command and Control", "id": "TA0011"}]}, "EAC0017": {"type": "Engagement", "goals": ["EGO0002"], "vulnerabilities": [{"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}], "attack_techniques": [{"attack_tactics": ["collection"], "name": "Screen Capture", "id": "T1113"}, {"attack_tactics": ["collection"], "name": "Audio Capture", "id": "T1123"}, {"attack_tactics": ["collection"], "name": "Video Capture", "id": "T1125"}], "attack_tactics": [{"name": "Collection", "id": "TA0009"}], "approaches": ["EAP0003"], "name": "Hardware Manipulation", "description": "Alter the hardware configuration of a system to limit what an adversary can do with the device.", "long_description": "Hardware Manipulation can include physical adjustments or configuration changes to the hardware in the environment. This manipulation can include physically removing a system\u2019s microphone, camera, on-board Wi-Fi adapter, etc. or using software controls to disable those devices. These types of manipulations can affect the adversary\u2019s ability to achieve their operational objectives by incurring an increased resource cost, forcing them to change tactics, or stopping them altogether.  Hardware Manipulation is often required to maintain operational safety. For example, if the operation includes Malware Detonation using a laptop physically located in a shared space, it is likely that the defender will not have the ability to hide the legitimate conversations and individuals present in the space. Unless the defender can control the background sounds and visuals, it is likely too risky to leave the camera and microphone connected to the machine.", "references": [{"title": "Cyber Deception Via System Manipulation", "url": "https://books.google.com/books?hl=en&lr=&id=uYiRDgAAQBAJ&oi=fnd&pg=PA194&ots=gLR_G-9dbA&sig=QSJ2NxcWqBfhZXpuM8x23r1AAg8#v=onepage&q&f=false", "id": "REF0055"}], "EAV0013": [{"name": "Collection", "id": "TA0009"}]}, "EAC0018": {"type": "Engagement", "goals": ["EGO0002"], "vulnerabilities": [{"eav": "When adversaries discover enabled, accessible, or intentionally weakened/overly permissive resources in the environment, they are vulnerable to revealing additional or more advanced capabilities when exploiting or using said resource.", "id": "EAV0017"}, {"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}, {"eav": "When adversaries discover inaccessible but valuable data, they are vulnerable to wasting resources or revealing additional capabilities in an effort to access the content.", "id": "EAV0024"}, {"eav": "When adversaries utilize or abuse system features, software, or other resources, they may be vulnerable to monitoring or Man-in-the-Middle manipulation.", "id": "EAV0016"}, {"eav": "When adversaries move data across the network or interact with remote resources, they are vulnerable to network manipulations such as impacts to network availability, traffic filtering, degraded speeds, etc.", "id": "EAV0020"}, {"eav": "When adversaries interact with the environment or personas, they are vulnerable when they collect, observe, or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.", "id": "EAV0001"}], "attack_techniques": [{"attack_tactics": ["collection"], "name": "Data from Local System", "id": "T1005"}, {"attack_tactics": ["command-and-control"], "name": "Fallback Channels", "id": "T1008"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Other Network Medium", "id": "T1011"}, {"attack_tactics": ["defense-evasion"], "name": "Rootkit", "id": "T1014"}, {"attack_tactics": ["exfiltration"], "name": "Automated Exfiltration", "id": "T1020"}, {"attack_tactics": ["exfiltration"], "name": "Scheduled Transfer", "id": "T1029"}, {"attack_tactics": ["exfiltration"], "name": "Data Transfer Size Limits", "id": "T1030"}, {"attack_tactics": ["collection"], "name": "Data from Network Shared Drive", "id": "T1039"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over C2 Channel", "id": "T1041"}, {"attack_tactics": ["execution"], "name": "Windows Management Instrumentation", "id": "T1047"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Alternative Protocol", "id": "T1048"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Physical Medium", "id": "T1052"}, {"attack_tactics": ["defense-evasion", "privilege-escalation"], "name": "Process Injection", "id": "T1055"}, {"attack_tactics": ["execution"], "name": "Command and Scripting Interpreter", "id": "T1059"}, {"attack_tactics": ["privilege-escalation"], "name": "Exploitation for Privilege Escalation", "id": "T1068"}, {"attack_tactics": ["defense-evasion"], "name": "Indicator Removal on Host", "id": "T1070"}, {"attack_tactics": ["execution", "lateral-movement"], "name": "Software Deployment Tools", "id": "T1072"}, {"attack_tactics": ["lateral-movement"], "name": "Taint Shared Content", "id": "T1080"}, {"attack_tactics": ["lateral-movement", "initial-access"], "name": "Replication Through Removable Media", "id": "T1091"}, {"attack_tactics": ["command-and-control"], "name": "Communication Through Removable Media", "id": "T1092"}, {"attack_tactics": ["persistence"], "name": "Account Manipulation", "id": "T1098"}, {"attack_tactics": ["credential-access"], "name": "Brute Force", "id": "T1110"}, {"attack_tactics": ["credential-access"], "name": "Two-Factor Authentication Interception", "id": "T1111"}, {"attack_tactics": ["defense-evasion"], "name": "Modify Registry", "id": "T1112"}, {"attack_tactics": ["defense-evasion", "privilege-escalation"], "name": "Access Token Manipulation", "id": "T1134"}, {"attack_tactics": ["discovery"], "name": "Network Share Discovery", "id": "T1135"}, {"attack_tactics": ["persistence"], "name": "Create Account", "id": "T1136"}, {"attack_tactics": ["credential-access"], "name": "Forced Authentication", "id": "T1187"}, {"attack_tactics": ["defense-evasion", "persistence"], "name": "BITS Jobs", "id": "T1197"}, {"attack_tactics": ["initial-access"], "name": "Trusted Relationship", "id": "T1199"}, {"attack_tactics": ["initial-access"], "name": "Hardware Additions", "id": "T1200"}, {"attack_tactics": ["execution"], "name": "Exploitation for Client Execution", "id": "T1203"}, {"attack_tactics": ["defense-evasion"], "name": "Rogue Domain Controller", "id": "T1207"}, {"attack_tactics": ["lateral-movement"], "name": "Exploitation of Remote Services", "id": "T1210"}, {"attack_tactics": ["defense-evasion"], "name": "Exploitation for Defense Evasion", "id": "T1211"}, {"attack_tactics": ["credential-access"], "name": "Exploitation for Credential Access", "id": "T1212"}, {"attack_tactics": ["collection"], "name": "Data from Information Repositories", "id": "T1213"}, {"attack_tactics": ["defense-evasion"], "name": "File and Directory Permissions Modification", "id": "T1222"}, {"attack_tactics": ["impact"], "name": "Service Stop", "id": "T1489"}, {"attack_tactics": ["persistence"], "name": "Implant Internal Image", "id": "T1525"}, {"attack_tactics": ["credential-access"], "name": "Steal Application Access Token", "id": "T1528"}, {"attack_tactics": ["collection"], "name": "Data from Cloud Storage Object", "id": "T1530"}, {"attack_tactics": ["impact"], "name": "Account Access Removal", "id": "T1531"}, {"attack_tactics": ["defense-evasion"], "name": "Unused/Unsupported Cloud Regions", "id": "T1535"}, {"attack_tactics": ["exfiltration"], "name": "Transfer Data to Cloud Account", "id": "T1537"}, {"attack_tactics": ["credential-access"], "name": "Steal Web Session Cookie", "id": "T1539"}, {"attack_tactics": ["defense-evasion", "persistence"], "name": "Pre-OS Boot", "id": "T1542"}, {"attack_tactics": ["persistence", "privilege-escalation"], "name": "Create or Modify System Process", "id": "T1543"}, {"attack_tactics": ["privilege-escalation", "persistence"], "name": "Event Triggered Execution", "id": "T1546"}, {"attack_tactics": ["privilege-escalation", "defense-evasion"], "name": "Abuse Elevation Control Mechanism", "id": "T1548"}, {"attack_tactics": ["defense-evasion", "lateral-movement"], "name": "Use Alternate Authentication Material", "id": "T1550"}, {"attack_tactics": ["defense-evasion"], "name": "Subvert Trust Controls", "id": "T1553"}, {"attack_tactics": ["credential-access", "defense-evasion", "persistence"], "name": "Modify Authentication Process", "id": "T1556"}, {"attack_tactics": ["credential-access"], "name": "Steal or Forge Kerberos Tickets", "id": "T1558"}, {"attack_tactics": ["defense-evasion"], "name": "Impair Defenses", "id": "T1562"}, {"attack_tactics": ["lateral-movement"], "name": "Remote Service Session Hijacking", "id": "T1563"}, {"attack_tactics": ["exfiltration"], "name": "Exfiltration Over Web Service", "id": "T1567"}, {"attack_tactics": ["persistence", "privilege-escalation", "defense-evasion"], "name": "Hijack Execution Flow", "id": "T1574"}, {"attack_tactics": ["defense-evasion"], "name": "Network Boundary Bridging", "id": "T1599"}, {"attack_tactics": ["defense-evasion"], "name": "Weaken Encryption", "id": "T1600"}, {"attack_tactics": ["defense-evasion"], "name": "Modify System Image", "id": "T1601"}, {"attack_tactics": ["collection"], "name": "Data from Configuration Repository", "id": "T1602"}, {"attack_tactics": ["credential-access"], "name": "Forge Web Credentials", "id": "T1606"}, {"attack_tactics": ["execution"], "name": "Container Administration Command", "id": "T1609"}, {"attack_tactics": ["privilege-escalation"], "name": "Escape to Host", "id": "T1611"}, {"attack_tactics": ["defense-evasion"], "name": "Build Image on Host", "id": "T1612"}], "attack_tactics": [{"name": "Collection", "id": "TA0009"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Exfiltration", "id": "TA0010"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Impact", "id": "TA0040"}], "approaches": ["EAP0003", "EAP0004"], "name": "Security Controls", "description": "Alter security controls to make the system more or less vulnerable to attack.", "long_description": "Manipulating Security Controls involves making configuration changes to a system\u2019s security settings including modifying Group Policies, disabling/enabling autorun for removable media, tightening or relaxing system firewalls, etc. Such security controls can be tightened to dissuade or prevent adversary activity. Conversely, security controls can be weakened or left overly permissive to encourage or enable adversary activity.  Tightening security controls can typically be done by implementing any of the mitigations described in MITRE ATT&CK. See https://attack.mitre.org/mitigations/enterprise/ for a full list of mitigation strategies. While loosening security controls may seem obvious (i.e., simply don\u2019t employ a given mitigation strategy), there is an additional level of nuance that must be considered. Some security controls are considered so routine that its absence may be suspicious.  For example, completely turning off Windows Defender would likely raise the adversary\u2019s suspicion. However, it is possible to turn off Windows Defender in certain shared drives to encourage adversary activity in predetermined locations. Therefore, it will likely be far less suspicious to turn off Windows Defender in a single directory or share. When assessing the likelihood that removing a given security control is overly suspicious, it is important to consider how prevalent that security control is, the target adversary\u2019s sophistication, and the engagement narrative.", "references": [{"title": "Ersatzpasswords: Ending Password Cracking And Detecting Password Leakage", "url": "https://dl.acm.org/doi/abs/10.1145/2818000.2818015", "id": "REF0056"}, {"title": "From Patches To Honey-Patches: Lightweight Attacker Misdirection, Deception, And Disinformation", "url": "https://dl.acm.org/doi/abs/10.1145/2660267.2660329", "id": "REF0057"}, {"title": "Toward An Insider Threat Detection Framework Using Honey Permissions", "url": "http://isyou.info/jisis/vol5/no3/jisis-2015-vol5-no3-02.pdf", "id": "REF0058"}], "EAV0017": [{"name": "Collection", "id": "TA0009"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Impact", "id": "TA0040"}], "EAV0013": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Execution", "id": "TA0002"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Lateral Movement", "id": "TA0008"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Credential Access", "id": "TA0006"}], "EAV0024": [{"name": "Exfiltration", "id": "TA0010"}, {"name": "Defense Evasion", "id": "TA0005"}], "EAV0016": [{"name": "Execution", "id": "TA0002"}, {"name": "Privilege Escalation", "id": "TA0004"}], "EAV0020": [{"name": "Credential Access", "id": "TA0006"}], "EAV0001": [{"name": "Privilege Escalation", "id": "TA0004"}]}, "EAC0019": {"type": "Engagement", "goals": ["EGO0002"], "vulnerabilities": [{"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}, {"eav": "When adversaries interact with network or system resources, they are vulnerable to triggering tripwires or engaging in easily detectable, anomalous behavior.", "id": "EAV0010"}, {"eav": "When adversaries\u2019 malware is detonated, they may be encouraged to operate in an unintended environment.", "id": "EAV0005"}, {"eav": "When adversaries utilize or abuse system features, software, or other resources, they may be vulnerable to monitoring or Man-in-the-Middle manipulation.", "id": "EAV0016"}], "attack_techniques": [{"attack_tactics": ["defense-evasion"], "name": "Rootkit", "id": "T1014"}, {"attack_tactics": ["persistence", "privilege-escalation"], "name": "Boot or Logon Initialization Scripts", "id": "T1037"}, {"attack_tactics": ["defense-evasion"], "name": "Modify Registry", "id": "T1112"}, {"attack_tactics": ["persistence"], "name": "Create Account", "id": "T1136"}, {"attack_tactics": ["persistence"], "name": "Office Application Startup", "id": "T1137"}, {"attack_tactics": ["persistence"], "name": "Browser Extensions", "id": "T1176"}, {"attack_tactics": ["defense-evasion"], "name": "Execution Guardrails", "id": "T1480"}, {"attack_tactics": ["impact"], "name": "Inhibit System Recovery", "id": "T1490"}, {"attack_tactics": ["persistence"], "name": "Server Software Component", "id": "T1505"}, {"attack_tactics": ["persistence", "privilege-escalation"], "name": "Create or Modify System Process", "id": "T1543"}, {"attack_tactics": ["privilege-escalation", "persistence"], "name": "Event Triggered Execution", "id": "T1546"}, {"attack_tactics": ["persistence", "privilege-escalation"], "name": "Boot or Logon Autostart Execution", "id": "T1547"}, {"attack_tactics": ["impact"], "name": "Disk Wipe", "id": "T1561"}, {"attack_tactics": ["defense-evasion"], "name": "Modify System Image", "id": "T1601"}], "attack_tactics": [{"name": "Defense Evasion", "id": "TA0005"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Impact", "id": "TA0040"}], "approaches": ["EAP0003"], "name": "Baseline", "description": "Identify key system elements to establish a baseline and be prepared to reset a system to that baseline when necessary.", "long_description": "To determine the system Baseline, the defender must identify software and configuration elements that are critical to a set of objectives. The defender must define the proper values and be prepared to reset a running system to its intended state. Reverting to a Baseline configuration can be essential when restoring an operational environment to a safe state or when looking to impose a cost on adversaries by preventing their activity.  For example, the defender can watch for an adversary to make changes in the environment and then revert the environment with the goal of either forcing the adversary to target elsewhere in the network or to display a new, possibly more advanced, TTP. The Baseline values will also be crucial post-operation when analyzing changes to the environment over time.", "references": [], "EAV0013": [{"name": "Defense Evasion", "id": "TA0005"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Persistence", "id": "TA0003"}], "EAV0010": [{"name": "Defense Evasion", "id": "TA0005"}, {"name": "Impact", "id": "TA0040"}], "EAV0005": [{"name": "Impact", "id": "TA0040"}], "EAV0016": [{"name": "Impact", "id": "TA0040"}]}, "EAC0020": {"type": "Engagement", "goals": ["EGO0002"], "vulnerabilities": [{"eav": "When adversaries use hardware peripherals, they must rely on physical access or have limited control over when and where hardware additions are connected in the target network.", "id": "EAV0012"}, {"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}, {"eav": "When adversaries manipulate supply chain mechanisms prior to receipt by a final consumer, they forfeit control over when and where the product is connected in the target network.", "id": "EAV0014"}, {"eav": "When adversaries\u2019 malware is detonated, they may be encouraged to operate in an unintended environment.", "id": "EAV0005"}], "attack_techniques": [{"attack_tactics": ["lateral-movement", "initial-access"], "name": "Replication Through Removable Media", "id": "T1091"}, {"attack_tactics": ["command-and-control"], "name": "Communication Through Removable Media", "id": "T1092"}, {"attack_tactics": ["command-and-control"], "name": "Ingress Tool Transfer", "id": "T1105"}, {"attack_tactics": ["initial-access"], "name": "Supply Chain Compromise", "id": "T1195"}, {"attack_tactics": ["initial-access"], "name": "Hardware Additions", "id": "T1200"}, {"attack_tactics": ["execution"], "name": "User Execution", "id": "T1204"}], "attack_tactics": [{"name": "Lateral Movement", "id": "TA0008"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Execution", "id": "TA0002"}], "approaches": ["EAP0003", "EAP0005"], "name": "Isolation", "description": "Configure devices, systems, networks, etc. to contain activity and data, thus preventing the expansion of an engagement beyond desired limits.", "long_description": "Using Isolation, a defender can limit the effectiveness and scope of malicious activity and/or lower exposure to unintended risks. When a system or resource is isolated, a defender can observe adversary behaviors or tools with limited, or no, lateral movement allowed. For example, a defender may detonate a piece of malware on an isolated system to perform dynamic analysis without risk to other network resources.  Determining which systems should be isolated in an operation is a critical decision when calculating acceptable operational risk. However, if the adversary expects to find an entire corporate network but instead finds only an isolated system, they may not be interested in engaging with the target. Balancing acceptable risk, believability, and operational objectives is essential when determining if or when a system should be isolated.", "references": [], "EAV0012": [{"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}], "EAV0013": [{"name": "Command and Control", "id": "TA0011"}], "EAV0014": [{"name": "Initial Access", "id": "TA0001"}], "EAV0005": [{"name": "Execution", "id": "TA0002"}]}, "EAC0021": {"type": "Engagement", "goals": ["EGO0002"], "vulnerabilities": [{"eav": "When adversaries use hardware peripherals, they must rely on physical access or have limited control over when and where hardware additions are connected in the target network.", "id": "EAV0012"}, {"eav": "When adversaries rely on specific resources to be enabled, accessible, and/or vulnerable, they are vulnerable to their operations being disrupted if the resources are disabled, removed, or otherwise made invulnerable.", "id": "EAV0013"}, {"eav": "When adversaries manipulate supply chain mechanisms prior to receipt by a final consumer, they forfeit control over when and where the product is connected in the target network.", "id": "EAV0014"}, {"eav": "When adversaries\u2019 malware is detonated, they may be encouraged to operate in an unintended environment.", "id": "EAV0005"}, {"eav": "When adversaries use phishing emails to gain access to victim systems, they have no control over where a malicious attachment is detonated from, or where a link is clicked.", "id": "EAV0004"}], "attack_techniques": [{"attack_tactics": ["lateral-movement", "initial-access"], "name": "Replication Through Removable Media", "id": "T1091"}, {"attack_tactics": ["command-and-control"], "name": "Communication Through Removable Media", "id": "T1092"}, {"attack_tactics": ["command-and-control"], "name": "Multi-Stage Channels", "id": "T1104"}, {"attack_tactics": ["initial-access"], "name": "Supply Chain Compromise", "id": "T1195"}, {"attack_tactics": ["execution"], "name": "User Execution", "id": "T1204"}, {"attack_tactics": ["persistence"], "name": "Compromise Client Software Binary", "id": "T1554"}, {"attack_tactics": ["initial-access"], "name": "Phishing", "id": "T1566"}], "attack_tactics": [{"name": "Lateral Movement", "id": "TA0008"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}, {"name": "Execution", "id": "TA0002"}, {"name": "Persistence", "id": "TA0003"}], "approaches": ["EAP0004"], "name": "Attack Vector Migration", "description": "Move a malicious link, file, or device from its intended location to an engagement system or network for execution/use.", "long_description": "When a defender Migrates an Attack Vector, the defender intercepts a malicious element and moves it to a safe environment, such as a decoy system within a decoy network, for continued engagement or analysis. A defender may choose to Attack Vector Migrations, which may appear in the form of phishing emails, suspicious email attachments, or malicious USBs. For example, a defender might move a suspicious attachment from a corporate inbox to an inbox on a system that, while in the corporate IP space, is completely segmented from the enterprise network. This segregated environment will allow the adversary to move laterally throughout the environment without risk to enterprise resources.  Determining when an engagement should be moved to an engagement environment is a critical decision when calculating acceptable operational risk. However, if the adversary sent a custom malware sample to a phishing victim, but ultimately find themselves on an unrelated victim, they may be suspicious. Balancing this acceptable risk, believability, and operational goals is essential when determining if or when to migrate an attack vector.", "references": [{"title": "Ensuring Deception Consistency For FTP Services Hardened Against Advanced Persistent Threats", "url": "https://doi.org/10.1145/3268966.3268971", "id": "REF0003"}, {"title": "Honeywords: Making Password-Cracking Detectable", "url": "https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.310.2514&rep=rep1&type=pdf", "id": "REF0060"}], "EAV0012": [{"name": "Initial Access", "id": "TA0001"}, {"name": "Command and Control", "id": "TA0011"}], "EAV0013": [{"name": "Command and Control", "id": "TA0011"}, {"name": "Persistence", "id": "TA0003"}], "EAV0014": [{"name": "Initial Access", "id": "TA0001"}], "EAV0005": [{"name": "Execution", "id": "TA0002"}], "EAV0004": [{"name": "Initial Access", "id": "TA0001"}]}, "EAC0022": {"type": "Engagement", "goals": ["EGO0003"], "vulnerabilities": [{"eav": "When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to revealing their targeting preferences and capabilities.", "id": "EAV0019"}], "attack_techniques": [{"attack_tactics": ["discovery"], "name": "Process Discovery", "id": "T1057"}, {"attack_tactics": ["execution"], "name": "Command and Scripting Interpreter", "id": "T1059"}, {"attack_tactics": ["discovery"], "name": "Permission Groups Discovery", "id": "T1069"}, {"attack_tactics": ["defense-evasion", "persistence", "privilege-escalation", "initial-access"], "name": "Valid Accounts", "id": "T1078"}, {"attack_tactics": ["discovery"], "name": "File and Directory Discovery", "id": "T1083"}, {"attack_tactics": ["discovery"], "name": "Account Discovery", "id": "T1087"}, {"attack_tactics": ["discovery"], "name": "Peripheral Device Discovery", "id": "T1120"}, {"attack_tactics": ["persistence"], "name": "Browser Extensions", "id": "T1176"}, {"attack_tactics": ["defense-evasion"], "name": "Template Injection", "id": "T1221"}, {"attack_tactics": ["defense-evasion"], "name": "File and Directory Permissions Modification", "id": "T1222"}, {"attack_tactics": ["discovery"], "name": "Domain Trust Discovery", "id": "T1482"}, {"attack_tactics": ["impact"], "name": "Data Encrypted for Impact", "id": "T1486"}, {"attack_tactics": ["impact"], "name": "Service Stop", "id": "T1489"}, {"attack_tactics": ["discovery"], "name": "Cloud Service Discovery", "id": "T1526"}, {"attack_tactics": ["impact"], "name": "System Shutdown/Reboot", "id": "T1529"}, {"attack_tactics": ["credential-access"], "name": "Unsecured Credentials", "id": "T1552"}, {"attack_tactics": ["defense-evasion"], "name": "Hide Artifacts", "id": "T1564"}, {"attack_tactics": ["reconnaissance"], "name": "Gather Victim Host Information", "id": "T1592"}, {"attack_tactics": ["defense-evasion"], "name": "Modify System Image", "id": "T1601"}, {"attack_tactics": ["collection"], "name": "Data from Configuration Repository", "id": "T1602"}, {"attack_tactics": ["credential-access"], "name": "Forge Web Credentials", "id": "T1606"}], "attack_tactics": [{"name": "Discovery", "id": "TA0007"}, {"name": "Execution", "id": "TA0002"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Impact", "id": "TA0040"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Reconnaissance", "id": "TA0043"}, {"name": "Collection", "id": "TA0009"}], "approaches": ["EAP0006", "EAP0007"], "name": "Artifact Diversity", "description": "Present the adversary with a variety of network and system artifacts.", "long_description": "Artifact Diversity means presenting multiple network and system artifacts to the adversary including accounts, files/directories, credentials, logs, web browsing history, browser cookies, etc. These artifacts can be legitimate artifacts created as the result of natural usage over time or manually added to the environment by the defender. Artifact Diversity can be used to encourage the adversary to engage by offering a broad attack surface or can increase the adversary\u2019s overall comfort level by adding to the believability of the environment.  Additionally, these artifacts may be Lures intended to elicit a specific response from the adversary. In any case, by monitoring adversary activity in a diverse environment, the defender can gain information on the adversary\u2019s capabilities and targeting preferences. For example, a defender can include a diverse set of accounts and credentials and then monitor to determine which accounts the adversary targets in the future.", "references": [], "EAV0019": [{"name": "Discovery", "id": "TA0007"}, {"name": "Execution", "id": "TA0002"}, {"name": "Initial Access", "id": "TA0001"}, {"name": "Persistence", "id": "TA0003"}, {"name": "Defense Evasion", "id": "TA0005"}, {"name": "Impact", "id": "TA0040"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Reconnaissance", "id": "TA0043"}, {"name": "Collection", "id": "TA0009"}]}, "EAC0023": {"type": "Engagement", "goals": ["EGO0001", "EGO0002", "EGO0003"], "vulnerabilities": [{"eav": "When adversaries interact with engagement environments and personas, their future capability, targeting, and/or infrastructure requirements are vulnerable to influence.", "id": "EAV0007"}, {"eav": "When adversaries interact with network or system resources, they are vulnerable to triggering tripwires or engaging in easily detectable, anomalous behavior.", "id": "EAV0010"}, {"eav": "When adversaries utilize or abuse system features, software, or other resources, they may be vulnerable to monitoring or Man-in-the-Middle manipulation.", "id": "EAV0016"}, {"eav": "When adversaries discover enabled, accessible, or intentionally weakened/overly permissive resources in the environment, they are vulnerable to revealing additional or more advanced capabilities when exploiting or using said resource.", "id": "EAV0017"}], "attack_techniques": [{"attack_tactics": ["privilege-escalation"], "name": "Exploitation for Privilege Escalation", "id": "T1068"}, {"attack_tactics": ["credential-access", "discovery"], "name": "Network Sniffing", "id": "T1040"}, {"attack_tactics": ["discovery"], "name": "Network Service Scanning", "id": "T1046"}, {"attack_tactics": ["execution", "lateral-movement"], "name": "Software Deployment Tools", "id": "T1072"}], "attack_tactics": [{"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Credential Access", "id": "TA0006"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Execution", "id": "TA0002"}, {"name": "Lateral Movement", "id": "TA0008"}], "approaches": ["EAP0002", "EAP0004", "EAP0007"], "name": "Introduced Vulnerabilities", "description": "Intentionally introduce vulnerabilities into the environment for the adversary to exploit.", "long_description": "By intentionally Introducing Vulnerabilities into the engagement environment, the defender can attempt to motivate the adversary to target specific resources. This targeting may serve to move the adversary towards a particular resource, or away from another resource. At other times, the defender may Introduce Vulnerabilities as a mean of encouraging the adversary to reveal targeting preferences, available capabilities, or even to influence future targeting decisions. The operational objectives will drive how and why the defender Introduces Vulnerabilities in the engagement environment.", "references": [], "EAV0007": [{"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Lateral Movement", "id": "TA0008"}], "EAV0010": [{"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Lateral Movement", "id": "TA0008"}], "EAV0016": [{"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Lateral Movement", "id": "TA0008"}], "EAV0017": [{"name": "Privilege Escalation", "id": "TA0004"}, {"name": "Discovery", "id": "TA0007"}, {"name": "Lateral Movement", "id": "TA0008"}]}, "SAC0001": {"type": "Strategic", "goals": ["SGO0001"], "vulnerabilities": [], "attack_techniques": [], "attack_tactics": [], "approaches": ["SAP0001"], "name": "Operational Objective", "description": "Define the objective of the desired end-state of your adversary engagement operations.", "long_description": "The Operational Objective is  the goal(s) that drive all of the approaches and activities used in an adversary engagement operation. Articulating the operational objective allows the defender to align their actions to reach the desired end-state. There are three high-level Engagement Goals in adversary engagement operations: to Expose adversaries on the network, to Affect adversaries on the network, or to Elicit new information about adversaries.  These larger themes should help the defender create more focused operational objectives. For example, realistic operational objectives include: protecting a specific high-value technology or person by exposing adversaries targeting that technology or person, protecting against insider threats by affecting the adversary\u2019s ability to steal sensitive data, or increasing the defender\u2019s understanding of the threat landscape by eliciting new adversary TTPs, etc. Every action taken in the planning, execution, and analysis of an operation should be aligned with the operational objective. It is important to define this objective early on. Input from any involved stakeholders should be considered when choosing the operational objectives.  ", "references": [{"title": "Three Decades Of Deception Techniques In Active Cyber Defense-Retrospect And Outlook", "url": "https://arxiv.org/pdf/2104.03594.pdf", "id": "REF0073"}]}, "SAC0002": {"type": "Strategic", "goals": ["SGO0001"], "vulnerabilities": [], "attack_techniques": [], "attack_tactics": [], "approaches": ["SAP0001"], "name": "Persona Creation", "description": "Plan and create a fictitious human user through a combination of planted data and revealed behavior patterns.", "long_description": "Persona Creation is the process of planning for and creating the personas required to support the engagement narrative. This process should be informed by the previously generated threat model for the defender\u2019s target adversary. For example, if the adversary targets a specific industry, the persona might be created to look like someone who works in that industry. The persona outline should include basic information about the persona itself such as their name, their relationship to the environment, and geographic location. Often, and especially for a short-term engagement operation, these persona traits can be broad.  For example, it is unlikely that a persona used in a short-term ransomware detonation operation would require a lot of details to be effective. However, for a longer-term insider threat protection operation, the defender may need to create a persona with the online presence of a corporate employee, including name, birthday, address, etc. Many factors should be considered when determining how in-depth a persona should be, including adversary sophistication, defender resources, and engagement narrative.  Once the persona traits have been decided, the planning process should determine how these traits will manifest in the environment. Persona creation is important to running an operation, as personas are often the predominant means through which the defender can engage with the adversary or change the environment during the operation. Careful planning is important as personas can be resource intensive to create and maintain and can reveal the ruse if discovered as fake by the adversary. ", "references": []}, "SAC0003": {"type": "Strategic", "goals": ["SGO0001"], "vulnerabilities": [], "attack_techniques": [], "attack_tactics": [], "approaches": ["SAP0001"], "name": "Storyboarding", "description": "Plan and create the deception story.", "long_description": "Storyboarding is the process of creating the deception story through a sequence of events, interactions, the persona\u2019s pattern of life, etc. A large part of Storyboarding is creating this pattern of life for the persona(s) using the system(s). The pattern of life can include behaviors such as using email or chat software, browsing the Internet, using system software, or physically moving the device (particularly important for mobile devices and laptops).  The defender must determine how the Persona\u2019s behavior and other events in the environment will be generated. Personas may be generated automatically with tooling, manually with human operators, or some combination of both. The availability of defender resources may greatly impact the frequency of manually executing behaviors.  Not every action taken in the environment needs to be planned in advance. However, the defender should have a general idea of what actions will be taken. Setting up a storyboard early in the planning process will allow the operation to run smoothly, efficiently, and most importantly, consistently, regardless of operator, so as not to reveal the ruse.", "references": [{"title": "Defensive Computer-Security Deception Operations: Processes, Principles And Techniques", "url": "https://repository.lib.ncsu.edu/bitstream/handle/1840.16/5648/etd.pdf", "id": "REF0074"}, {"title": "Duping The Soviets: The Farewell Dossier", "url": "https://apps.dtic.mil/sti/pdfs/ADA527328.pdf", "id": "REF0075"}]}, "SAC0004": {"type": "Strategic", "goals": ["SGO0001", "SGO0002"], "vulnerabilities": [], "attack_techniques": [], "attack_tactics": [], "approaches": ["SAP0001", "SAP0002"], "name": "Cyber Threat Intelligence", "description": "The process of analyzing actionable knowledge about adversaries and their malicious activities, enabling defenders and their organizations to reduce harm through better security decision-making", "long_description": "Cyber Threat Intelligence (CTI) allows an organization to understand the threat landscape. CTI data can be informed by a combination of open and closed source research. Additionally, it can be supplemented with internal and external threat intelligence feeds, including information gleaned from previous engagement operations.  The understanding gained through CTI data allows the defender to identify and understand the target adversary for a given operation. For example, if the defender\u2019s intended operational outcome is to expose adversaries on the network, the defender should prioritize adversaries that historically target their organization or similar organizations and/or have displayed TTPs that are likely to evade current defenses. Additionally, storyboarding should look at CTI data for the target adversary to make informed estimations on what the adversary may do in the environment and how they might react to what they find.  Once one or more adversaries have been selected as the target adversary, the relevant CTI data should guide the creation of the engagement environment and storyboard including hardware and software requirements, the required level of realism for lures and pocket Litter, and acceptable operational risk. This definition was based on the work presented by MITRE ATT&CK as seen here.", "references": [{"title": "Deceived: Under Target Online", "url": "http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.106.7476&rep=rep1&type=pdf", "id": "REF0076"}, {"title": "A Boosting Ensemble For The Recognition Of Code Sharing In Malware", "url": "https://vx-underground.org/archive/other/VxHeavenPdfs/A boosting ensemble for the recognition of code sharing in malware.pdf", "id": "REF0078"}, {"title": "Cyber Threat Intelligence Model: An Evaluation Of Taxonomies, Sharing Standards, And Ontologies Within Cyber Threat Intelligence", "url": "https://www.academia.edu/download/66108290/CTI_Mavroeidis.pdf", "id": "REF0079"}]}, "SAC0005": {"type": "Strategic", "goals": ["SGO0001"], "vulnerabilities": [], "attack_techniques": [], "attack_tactics": [], "approaches": ["SAP0001"], "name": "Gating Criteria", "description": "Define the set of events that would lead to the unnegotiable pause or conclusion to the operation.", "long_description": "Gating Criteria are the event or sequence of events that are agreed to be the unnegotiable immediate pause or end to the operation. Sometimes, these events include the successful completion of the agreed upon operational objectives. Other times, these events may signify the operation has reached a hard stop. This stop is often necessary because future operational safety cannot be guaranteed. Alternatively, the operation may need to end because events have occurred that outweigh the agreed upon acceptable risk. Finally, it may just be that if the adversary operates any longer, they may learn something the defender doesn\u2019t want them to know.  Multiple parties from the technical operations, threat intel, legal, and management perspectives should be included when defining Gating Criteria. For example, if an adversary begins to use the engagement environment as a platform to operate against other targets, stakeholders may decide that the operation must be suspended until the unacceptable traffic can be blocked. Defining the operational Gating Criteria is an essential step to ensure operational safety.", "references": []}, "SAC0006": {"type": "Strategic", "goals": ["SGO0002"], "vulnerabilities": [], "attack_techniques": [], "attack_tactics": [], "approaches": ["SAP0002"], "name": "After-Action Review", "description": "Review of operational activities.", "long_description": "The After Action Review (AAR) is the opportunity for the team to review the events of the operation to ensure progress towards strategic outcomes. This retrospective can include a review of the entire operational process from planning, implementation, execution, and impact. In addition to the operation itself, the AAR is an important time to assess the communication and teamwork of the operations team and all contributing stakeholders. While an AAR should always occur at the end of an operation, periodic reviews during long-running operations are vital to ensure alignment and progress towards the operational objectives.", "references": [{"title": "Strategies For Learning From Failure", "url": "http://understandingrequirements.com/resources/7.4  Strategies for Learning from Failure.pdf", "id": "REF0077"}]}, "SAC0012": {"type": "Strategic", "goals": ["SGO0001"], "vulnerabilities": [], "attack_techniques": [], "attack_tactics": [], "approaches": ["SAP0001"], "name": "Engagement Environment", "description": "Design the systems and network for the operation.", "long_description": "The Engagement Environment is the set of carefully tailored, highly instrumented systems designed on an engagement-by-engagement basis as the backdrop to the engagement narrative. It is the actual environment that the adversary will operate in. It is important to ensure that the Engagement Environment complements, rather than competes with, the engagement narrative. Additionally, these systems should provide conduits to allow the target adversary necessary movement throughout the environment, as needed to meet operational outcomes. <br><br>While not strictly part of the Engagement Environment, the collection system is the set of systems used to gather artifacts and other data from an operation to monitor the engagement to ensure operational safety. It is important to consider the collection system while designing the engagement environment. By designing these environments in lockstep, the defender guarantees that all aspects of the engagement environment can be monitored. This is essential to ensure operations remain within the guardrails set by the Rules of Engagement. For example, available resources, capabilities, or skills may limit the type of assets in, or size of, the engagement environment.", "references": [{"title": "Approaches For Preventing Honeypot Detection And Compromise", "url": "https://www.researchgate.net/profile/Nicolas-Sklavos/publication/328430317_Approaches_for_Preventing_Honeypot_Detection_and_Compromise/links/5bd874da299bf1124fae1d52/Approaches-for-Preventing-Honeypot-Detection-and-Compromise.pdf", "id": "REF0026"}]}, "SAC0009": {"type": "Strategic", "goals": ["SGO0001", "SGO0002"], "vulnerabilities": [], "attack_techniques": [], "attack_tactics": [], "approaches": ["SAP0001", "SAP0002"], "name": "Threat Model", "description": "A risk assessment that models organizational strengths and weaknesses \u00a0\u00a0", "long_description": "Among other things, threat models require that the defender assesses the strengths, weaknesses, and importance of the their own organization, including trusted partners, infrastructure, and critical cyber assets. This understanding will inform operational objectives by outlining the defender\u2019s attack surface and highlighting areas that may be of particular interest to a given adversary. The organization\u2019s threat model should be understood at the onset of an operation to drive operational objective development and revisited at the conclusion of an operation to ensure operational outcomes are captured. These process of defining and informing the organization\u2019s threat model should enable better security decision-making both in future operations and elsewhere in the organization.", "references": []}}