{ "security_incident": { "Confirmed": "Yes - Confirmed", "Suspected": "Suspected", "Near miss": "Near miss (actions did not compromise asset)", "False positive": "False positive (response triggered, but no incident)" }, "confidence": { "High": "High confidence", "Medium": "Medium confidence", "Low": "Low confidence", "None": "No confidence" }, "timeline": { "compromise": { "unit": { "Seconds": "Seconds", "Minutes": "Minutes", "Hours": "Hours", "Days": "Days", "Weeks": "Weeks", "Months": "Months", "Years": "Years", "Never": "Never", "NA": "Compromise does not apply in the context of the security event.", "Unknown": "Unknown" } }, "exfiltration": { "unit": { "Seconds": "Seconds", "Minutes": "Minutes", "Hours": "Hours", "Days": "Days", "Weeks": "Weeks", "Months": "Months", "Years": "Years", "Never": "Never", "NA": "Exfiltration does not apply in the context of the security event.", "Unknown": "Unknown" } }, "discovery": { "unit": { "Seconds": "Seconds", "Minutes": "Minutes", "Hours": "Hours", "Days": "Days", "Weeks": "Weeks", "Months": "Months", "Years": "Years", "Never": "Never", "NA": "Discovery does not apply in the context of the security event.", "Unknown": "Unknown" } }, "containment": { "unit": { "Seconds": "Seconds", "Minutes": "Minutes", "Hours": "Hours", "Days": "Days", "Weeks": "Weeks", "Months": "Months", "Years": "Years", "Never": "Never", "NA": "Containment does not apply in the context of the security event.", "Unknown": "Unknown" } } }, "victim": { "government": { "Federal": "The highest level of government of the country", "Regional": "Government of a subdividion of a country such as a region, state, province, parish, territory, etc", "Local": "The lowest level of government of the country", "Unknown": "The level of government was not known.", "Other": "The level of government was known but not listed. (Use sparingly. The top is Federal, the bottom is Local, everything else is regional.)", "NA": "The victim was not part of a government of any level" }, "employee_count": { "Small": "Small organizations (1,000 employees or less)", "1 to 10": "1 to 10 employees", "11 to 100": "11 to 100 employees", "101 to 1000": "101 to 1,000 employees", "Large": "Large organizations (over 1,000 employees)", "1001 to 10000": "1,001 to 10,000 employees", "10001 to 25000": "10,001 to 25,000 employees", "25001 to 50000": "25,001 to 50,000 employees", "50001 to 100000": "50,001 to 100,000 employees", "Over 100000": "Over 100,0001 employees", "Unknown": "Unknown number of employees" }, "country": { "Unknown": "Unknown", "AD": "Andorra", "AE": "United Arab Emirates", "AF": "Afghanistan", "AG": "Antigua and Barbuda", "AI": "Anguilla", "AL": "Albania", "AM": "Armenia", "AO": "Angola", "AQ": "Antarctica", "AR": "Argentina", "AS": "American Samoa", "AT": "Austria", "AU": "Australia", "AW": "Aruba", "AX": "Aland Islands", "AZ": "Azerbaijan", "BA": "Bosnia and Herzegovina", "BB": "Barbados", "BD": "Bangladesh", "BE": "Belgium", "BF": "Burkina Faso", "BG": "Bulgaria", "BH": "Bahrain", "BI": "Burundi", "BJ": "Benin", "BL": "Saint-Barthelemy", "BM": "Bermuda", "BN": "Brunei Darussalam", "BO": "Bolivia", "BQ": "Bonaire, Saint Eustatius and Saba", "BR": "Brazil", "BS": "Bahamas", "BT": "Bhutan", "BV": "Bouvet Island", "BW": "Botswana", "BY": "Belarus", "BZ": "Belize", "CA": "Canada", "CC": "Cocos (Keeling) Islands", "CD": "Congo, Democratic Republic of the", "CF": "Central African Republic", "CG": "Congo", "CH": "Switzerland", "CI": "Cote d'Ivoire", "CK": "Cook Islands", "CL": "Chile", "CM": "Cameroon", "CN": "China", "CO": "Colombia", "CR": "Costa Rica", "CU": "Cuba", "CV": "Cape Verde", "CW": "Curacao", "CX": "Christmas Island", "CY": "Cyprus", "CZ": "Czech Republic", "DE": "Germany", "DJ": "Djibouti", "DK": "Denmark", "DM": "Dominica", "DO": "Dominican Republic", "DZ": "Algeria", "EC": "Ecuador", "EE": "Estonia", "EG": "Egypt", "EH": "Western Sahara", "ER": "Eritrea", "ES": "Spain", "ET": "Ethiopia", "FI": "Finland", "FJ": "Fiji", "FK": "Faeroe Islands", "FM": "Micronesia (Federated States of)", "FO": "Falkland Islands (Malvinas)", "FR": "France", "GA": "Gabon", "GB": "United Kingdom", "GD": "Grenada", "GE": "Georgia", "GF": "French Guiana", "GG": "Guernsey", "GH": "Ghana", "GI": "Gibraltar", "GL": "Greenland", "GM": "Gambia", "GN": "Guinea", "GP": "Guadeloupe", "GQ": "Equatorial Guinea", "GR": "Greece", "GS": "South Georgia and the South Sandwich Islands", "GT": "Guatemala", "GU": "Guam", "GW": "Guinea-Bissau", "GY": "Guyana", "HK": "Hong Kong", "HM": "Heard Island and McDonal Islands", "HN": "Honduras", "HR": "Croatia", "HT": "Haiti", "HU": "Hungary", "ID": "Indonesia", "IE": "Ireland", "IL": "Israel", "IM": "Isle of Man", "IN": "India", "IO": "British Virgin Islands", "IQ": "Iraq", "IR": "Iran (Islamic Republic of)", "IS": "Iceland", "IT": "Italy", "JE": "Jersey", "JM": "Jamaica", "JO": "Jordan", "JP": "Japan", "KE": "Kenya", "KG": "Kyrgyzstan", "KH": "Cambodia", "KI": "Kiribati", "KM": "Comoros", "KN": "Saint Kitts and Nevis", "KP": "Korea, Democratic People's Republic of", "KR": "Korea, Republic of", "KW": "Kuwait", "KY": "Cayman Islands", "KZ": "Kazakhstan", "LA": "Lao People's Democratic Republic", "LB": "Lebanon", "LC": "Saint Lucia", "LI": "Liechtenstein", "LK": "Sri Lanka", "LR": "Liberia", "LS": "Lesotho", "LT": "Lithuania", "LU": "Luxembourg", "LV": "Latvia", "LY": "Libya", "MA": "Morocco", "MC": "Monaco", "MD": "Moldova, Republic of", "ME": "Montenegro", "MF": "Saint Martin (French part)", "MG": "Madagascar", "MH": "Marshall Islands", "MK": "Macedonia, The former Yugoslav Republic of", "ML": "Mali", "MM": "Myanmar", "MN": "Mongolia", "MO": "Macao", "MP": "Northern Mariana Islands", "MQ": "Martinique", "MR": "Mauritania", "MS": "Montserrat", "MT": "Malta", "MU": "Mauritius", "MV": "Maldives", "MW": "Malawi", "MX": "Mexico", "MY": "Malaysia", "MZ": "Mozambique", "NA": "Namibia", "NC": "New Caledonia", "NE": "Niger", "NF": "Norfolk Island", "NG": "Nigeria", "NI": "Nicaragua", "NL": "Netherlands", "NO": "Norway", "NP": "Nepal", "NR": "Nauru", "NU": "Niue", "NZ": "New Zealand", "OM": "Oman", "PA": "Panama", "PE": "Peru", "PF": "French Polynesia", "PG": "Papua New Guinea", "PH": "Philippines", "PK": "Pakistan", "PL": "Poland", "PM": "Saint Pierre and Miquelon", "PN": "Pitcairn", "PR": "Puerto Rico", "PS": "Palestinian Territory, Occupied", "PT": "Portugal", "PW": "Palau", "PY": "Paraguay", "QA": "Qatar", "RE": "Reunion", "RO": "Romania", "RS": "Serbia", "RU": "Russian Federation", "RW": "Rwanda", "SA": "Saudi Arabia", "SB": "Solomon Islands", "SC": "Seychelles", "SD": "Sudan", "SE": "Sweden", "SG": "Singapore", "SH": "Saint Helena", "SI": "Slovenia", "SJ": "Svalbard and Jan Mayen Islands", "SK": "Slovakia", "SL": "Sierra Leone", "SM": "San Marino", "SN": "Senegal", "SO": "Somalia", "SR": "Suriname", "SS": "South Sudan", "ST": "Sao Tome and Principe", "SV": "El Salvador", "SX": "Sint Maarten (Dutch part)", "SY": "Syrian Arab Republic", "SZ": "Swaziland", "TC": "Turks and Caicos Islands", "TD": "Chad", "TF": "French Southern Territories", "TG": "Togo", "TH": "Thailand", "TJ": "Tajikistan", "TK": "Tokelau", "TL": "Timor-Leste", "TM": "Turkmenistan", "TN": "Tunisia", "TO": "Tonga", "TR": "Turkey", "TT": "Trinidad and Tobago", "TV": "Tuvalu", "TW": "Taiwan, Province of China", "TZ": "Tanzania, United Republic of", "UA": "Ukraine", "UG": "Uganda", "UM": "United States Minor Outlying Islands", "US": "United States of America", "UY": "Uruguay", "UZ": "Uzbekistan", "VA": "Holy See", "VC": "Saint Vincent and the Grenadines", "VE": "Venezuela (Bolivarian Republic of)", "VG": "British Virgin Islands", "VI": "United States Virgin Islands", "VN": "Viet Nam", "VU": "Vanuatu", "WF": "Wallis and Futuna Islands", "WS": "Samoa", "YE": "Yemen", "YT": "Mayotte", "ZA": "South Africa", "ZM": "Zambia", "ZW": "Zimbabwe", "XK": "Kosovo", "Other": "Other" }, "revenue": { "iso_currency_code": { "AED": "AED - UAE Dirham", "AFN": "AFN - Afghani", "ALL": "ALL - Lek", "AMD": "AMD - Armenian Dram", "ANG": "ANG - Netherlands Antillean Guilder", "AOA": "AOA - Kwanza", "ARS": "ARS - Argentine Peso", "AUD": "AUD - Australian Dollar", "AWG": "AWG - Aruban Florin", "AZN": "AZN - Azerbaijanian Manat", "BAM": "BAM - Convertible Mark", "BBD": "BBD - Barbados Dollar", "BDT": "BDT - Taka", "BGN": "BGN - Bulgarian Lev", "BHD": "BHD - Bahraini Dinar", "BIF": "BIF - Burundi Franc", "BMD": "BMD - Bermudian Dollar", "BND": "BND - Brunei Dollar", "BOB": "BOB - Boliviano", "BRL": "BRL - Brazilian Real", "BSD": "BSD - Bahamian Dollar", "BTN": "BTN - Ngultrum", "BWP": "BWP - Pula", "BYR": "BYR - Belarussian Ruble", "BZD": "BZD - Belize Dollar", "CAD": "CAD - Canadian Dollar", "CDF": "CDF - Congolese Franc", "CHF": "CHF - Swiss Franc", "CLP": "CLP - Chilean Peso", "CNY": "CNY - Yuan Renminbi", "COP": "COP - Colombian Peso", "CRC": "CRC - Costa Rican Colon", "CUC": "CUC - Peso Convertible", "CUP": "CUP - Cuban Peso", "CVE": "CVE - Cape Verde Escudo", "CZK": "CZK - Czech Koruna", "DJF": "DJF - Djibouti Franc", "DKK": "DKK - Danish Krone", "DOP": "DOP - Dominican Peso", "DZD": "DZD - Algerian Dinar", "EGP": "EGP - Egyptian Pound", "ERN": "ERN - Nakfa", "ETB": "ETB - Ethiopian Birr", "EUR": "EUR - Euro", "FJD": "FJD - Fiji Dollar", "FKP": "FKP - Falkland Islands Pound", "GBP": "GBP - Pound Sterling", "GEL": "GEL - Lari", "GGP": "GGP - Guernsey pound", "GHS": "GHS - Ghana Cedi", "GIP": "GIP - Gibraltar Pound", "GMD": "GMD - Dalasi", "GNF": "GNF - Guinea Franc", "GTQ": "GTQ - Quetzal", "GYD": "GYD - Guyana Dollar", "HKD": "HKD - Hong Kong Dollar", "HNL": "HNL - Lempira", "HRK": "HRK - Croatian Kuna", "HTG": "HTG - Gourde", "HUF": "HUF - Forint", "IDR": "IDR - Rupiah", "ILS": "ILS - New Israeli Sheqel", "IMP": "IMP - Isle of Man Pound", "INR": "INR - Indian Rupee", "IQD": "IQD - Iraqi Dinar", "IRR": "IRR - Iranian Rial", "ISK": "ISK - Iceland Krona", "JEP": "JEP - Jersey pound", "JMD": "JMD - Jamaican Dollar", "JOD": "JOD - Jordanian Dinar", "JPY": "JPY - Yen", "KES": "KES - Kenyan Shilling", "KGS": "KGS - Som", "KHR": "KHR - Riel", "KMF": "KMF - Comoro Franc", "KPW": "KPW - North Korean Won", "KRW": "KRW - South Korean Won", "KWD": "KWD - Kuwaiti Dinar", "KYD": "KYD - Cayman Islands Dollar", "KZT": "KZT - Tenge", "LAK": "LAK - Kip", "LBP": "LBP - Lebanese Pound", "LKR": "LKR - Sri Lanka Rupee", "LRD": "LRD - Liberian Dollar", "LSL": "LSL - Loti", "LTL": "LTL - Lithuanian Litas", "LVL": "LVL - Latvian Lats", "LYD": "LYD - Libyan Dinar", "MAD": "MAD - Moroccan Dirham", "MDL": "MDL - Moldovan Leu", "MGA": "MGA - Malagasy Ariary", "MKD": "MKD - Denar", "MMK": "MMK - Kyat", "MNT": "MNT - Tugrik", "MOP": "MOP - Pataca", "MRO": "MRO - Ouguiya", "MUR": "MUR - Mauritius Rupee", "MVR": "MVR - Rufiyaa", "MWK": "MWK - Kwacha", "MXN": "MXN - Mexican Peso", "MYR": "MYR - Malaysian Ringgit", "MZN": "MZN - Mozambique Metical", "NAD": "NAD - Namibia Dollar", "NGN": "NGN - Naira", "NIO": "NIO - Cordoba Oro", "NOK": "NOK - Norwegian Krone", "NPR": "NPR - Nepalese Rupee", "NZD": "NZD - New Zealand Dollar", "OMR": "OMR - Rial Omani", "PAB": "PAB - Balboa", "PEN": "PEN - Nuevo Sol", "PGK": "PGK - Kina", "PHP": "PHP - Philippine Peso", "PKR": "PKR - Pakistan Rupee", "PLN": "PLN - Zloty", "PYG": "PYG - Guarani", "QAR": "QAR - Qatari Rial", "RON": "RON - New Romanian Leu", "RSD": "RSD - Serbian Dinar", "RUB": "RUB - Russian Ruble", "RWF": "RWF - Rwanda Franc", "SAR": "SAR - Saudi Riyal", "SBD": "SBD - Solomon Islands Dollar", "SCR": "SCR - Seychelles Rupee", "SDG": "SDG - Sudanese Pound", "SEK": "SEK - Swedish Krona", "SGD": "SGD - Singapore Dollar", "SHP": "SHP - Saint Helena Pound", "SLL": "SLL - Leone", "SOS": "SOS - Somali Shilling", "SPL": "SPL - Seborga Luigino", "SRD": "SRD - Surinam Dollar", "STD": "STD - Dobra", "SVC": "SVC - El Salvador Colon", "SYP": "SYP - Syrian Pound", "SZL": "SZL - Lilangeni", "THB": "THB - Baht", "TJS": "TJS - Somoni", "TMT": "TMT - Turkmenistan New Manat", "TND": "TND - Tunisian Dinar", "TOP": "TOP - Pa'anga", "TRY": "TRY - Turkish Lira", "TTD": "TTD - Trinidad and Tobago Dollar", "TVD": "TVD - Tuvalu Dollar", "TWD": "TWD - New Taiwan Dollar", "TZS": "TZS - Tanzanian Shilling", "UAH": "UAH - Hryvnia", "UGX": "UGX - Uganda Shilling", "USD": "USD - US Dollar", "UYU": "UYU - Peso Uruguayo", "UZS": "UZS - Uzbekistan Sum", "VEF": "VEF - Bolivar ", "VND": "VND - Dong", "VUV": "VUV - Vatu", "WST": "WST - Tala", "XAF": "XAF - CFA Franc BEAC", "XCD": "XCD - East Caribbean Dollar", "XDR": "XDR - SDR (Special Drawing Right)", "XOF": "XOF - CFA Franc BCEAO", "XPF": "XPF - CFP Franc", "YER": "YER - Yemeni Rial", "ZAR": "ZAR - South African Rand", "ZMK": "ZMK - Zambian Kwacha", "ZWD": "ZWD - Zimbabwean Dollar A/06", "XBT": "Bitcoin (also BTC)", "BCH": "BCH - Bitcoin Cash", "Ether": "ETH - Ether", "Litecoin": "LTC - Litecoin", "XMR": "Monero", "ZEC": "Zcash" } } }, "action": { "hacking": { "variety": { "Abuse of functionality": "Abuse of functionality.", "Backdoor": "Hacking action that creates a backdoor for use.", "Brute force": "Brute force or password guessing attacks.", "Buffer overflow": "Buffer overflow. Child of 'Exploit vuln'.", "Cache poisoning": "Cache poisoning. Child of 'Exploit vuln'.", "Cryptanalysis": "Cryptanalysis. Child of 'Exploit vuln'.", "CSRF": "Cross-site request forgery. Child of 'Exploit vuln'.", "Disable controls": "Disable or interfere with security controls", "DoS": "Denial of service", "Evade Defenses": "Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.", "Exploit misconfig": "Exploit a misconfiguration (vs vuln or weakness)", "Exploit vuln": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.", "Forced browsing": "Forced browsing or predictable resource location. Child of 'Exploit vuln'.", "Format string attack": "Format string attack. Child of 'Exploit vuln'.", "Fuzz testing": "Fuzz testing. Child of 'Exploit vuln'.", "Hijack": "To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes)", "HTTP request smuggling": "HTTP request smuggling. Child of 'Exploit vuln'.", "HTTP request splitting": "HTTP request splitting. Child of 'Exploit vuln'.", "HTTP response smuggling": "HTTP response smuggling. Child of 'Exploit vuln'.", "HTTP response splitting": "HTTP response splitting. Child of 'Exploit vuln'.", "Insecure deserialization": "iterating over sequential or obvious values. https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization. Child of 'Exploit vuln'.", "Integer overflows": "Integer overflows. Child of 'Exploit vuln'.", "LDAP injection": "LDAP injection. Child of 'Exploit vuln'.", "Mail command injection": "Mail command injection. Child of 'Exploit vuln'.", "AitM": "Adversary-in-the-middle attack. Child of 'Exploit vuln'.", "Null byte injection": "Null byte injection. Child of 'Exploit vuln'.", "Offline cracking": "Offline password or key cracking (e.g., rainbow tables, Hashcat, JtR)", "OS commanding": "OS commanding. Child of 'Exploit vuln'.", "Pass-the-hash": "Pass-the-hash", "Path traversal": "Path traversal. Child of 'Exploit vuln'.", "Profile host": "Enumerating the state of the current host", "Prompt injection": "Crafting malicious or misleading prompts to bypassing safety filters and executing unintended instructions in LLMs", "Reverse engineering": "Reverse engineering. Child of 'Exploit vuln'.", "RFI": "Remote file inclusion. Child of 'Exploit vuln'.", "Routing detour": "Routing detour. Child of 'Exploit vuln'.", "Scan network": "Enumerating the state of the network", "Session fixation": "Session fixation. Child of 'Exploit vuln'.", "Session prediction": "Credential or session prediction. Child of 'Exploit vuln'.", "Session replay": "Session replay. Child of 'Exploit vuln'.", "Soap array abuse": "Soap array abuse. Child of 'Exploit vuln'.", "Special element injection": "Special element injection. Child of 'Exploit vuln'.", "SQLi": "SQL injection. Child of 'Exploit vuln'.", "SSI injection": "SSI injection. Child of 'Exploit vuln'.", "URL redirector abuse": "URL redirector abuse. Child of 'Exploit vuln'.", "Use of stolen creds": "Use of stolen or default authentication credentials (including credential stuffing)", "User breakout": "Elevation of privilege by another customer in shared environment. Child of 'Exploit vuln'.", "Virtual machine escape": "Virtual machine escape. Child of 'Exploit vuln'.", "XML attribute blowup": "XML attribute blowup. Child of 'Exploit vuln'.", "XML entity expansion": "XML entity expansion. Child of 'Exploit vuln'.", "XML external entities": "XML external entities. Child of 'Exploit vuln'.", "XML injection": "XML injection. Child of 'Exploit vuln'.", "XPath injection": "XPath injection. Child of 'Exploit vuln'.", "XQuery injection": "XQuery injection. Child of 'Exploit vuln'.", "XSS": "Cross-site scripting. Child of 'Exploit vuln'.", "Other": "Other", "Unknown": "Unknown" }, "vector": { "3rd party desktop": "3rd party online desktop sharing (LogMeIn, Go2Assist)", "Backdoor": "Hacking actions taken through a backdoor. C2 is only used by malware.", "Command shell": "Remote shell", "Desktop sharing": "Graphical desktop sharing (RDP, VNC, PCAnywhere, Citrix)", "Desktop sharing software": "Superset of 'Desktop sharing' and '3rd party desktop'. Please use in place of the other two", "Hypervisor": "Hypervisor break-out attack", "Inter-tenant": "Penetration of another VM or web site on shared device or infrastructure", "Other network service": "Network service that is not remote access or a web application.", "Partner": "Partner connection or credential. (Indicates supply chain breach.)", "Physical access": "Physical access or connection (i.e., at keyboard or via cable) ", "VPN": "VPN", "Web application": "Web application", "Other": "Other", "Unknown": "Unknown" }, "result": { "Infiltrate": "The hacking action resulted in additional security access", "Exfiltrate": "The hacking action exfiltrated data from the victim", "Elevate": "The hacking action resulted in additional security permissions", "Lateral movement": "The hacking action used security access or permissions already acuired", "Deploy payload": "e.g. cryptomining, ransomware, etc", "Persist": "The action resulted in some form of persistence on the system", "Other": "The result of the hacking action is not listed", "Unknown": "The result of the hacking action is unknown", "NA": "The hacking action did not have a result" } }, "malware": { "variety": { "Adminware": "System or network utilities (e.g., PsTools, Netcat)", "Adware": "Adware", "Backdoor": "Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.", "Backdoor or C2": "Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.", "Brute force": "Brute force attack", "C2": "Malware creates Command and Control capability for malware. Child of 'Backdoor or C2'.", "Capture app data": "Capture data from application or system process", "Capture stored data": "Capture data stored on system disk", "Click fraud": "Click fraud, whether or not cryptocurrency mining. Also mark 'Click fraud or cryptocurrency mining'. Child of 'Click fraud and cryptocurrency mining'.", "Click fraud and cryptocurrency mining": "Click fraud or cryptocurrency mining. Parent of 'Click fraud' and 'Cryptocurrency mining'.", "Client-side attack": "Client-side or browser attack (e.g., redirection, XSS, AitB)", "Cryptocurrency mining": "Cryptocurrency mining, whether or not click fraud. Child of 'Click fraud and cryptocurrency mining'.", "Destroy data": "Destroy or corrupt stored data", "In-memory": "(malware never stored to persistent storage)", "AitM": "Adversary-in-the-middle attack. Child of 'Exploit vuln'.", "Modify data": "Malware which compromises a legitimate file rather than creating new filess", "Disable controls": "Disable or interfere with security controls", "DoS": "DoS attack", "Downloader": "Downloader (pull updates or other malware) ", "Exploit misconfig": "Exploit a misconfiguration (vs vuln or weakness)", "Evade Defenses": "Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.", "Exploit vuln": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.)", "Export data": "Export data to another site or system", "Packet sniffer": "Packet sniffer (capture data from network)", "Pass-the-hash": "Pass-the-hash", "Password dumper": "Password dumper (extract credential hashes)", "Profile host": "Enumerating the state of the current host", "RAM scraper": "RAM scraper or memory parser (capture data from volatile memory)", "Ransomware": "Ransomware (encrypt or seize stored data)", "RAT": "Remote Access Trojan. Parent of 'Backdoor' and 'Trojan'", "Rootkit": "Rootkit (maintain local privileges and stealth)", "Scan network": "Enumerating the state of the network", "Spam": "Send spam", "Spyware/Keylogger": "Spyware, keylogger or form-grabber (capture user input or activity)", "Trojan": "An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor'", "Worm": "Worm (propagate to other systems or devices)", "Other": "Other", "Unknown": "Unknown" }, "vector": { "C2": "Malware actions taken through a Command and Control (C2) channel. Backdoor is only used by hacking.", "Direct install": "Directly installed or inserted by threat agent (after system access)", "Download by malware": "Downloaded and installed by local malware", "Email": "Email. Parent to 'Email attachment', 'Email autoexecute', 'Email link', 'Email unknown'", "Email attachment": "Email via user-executed attachment. Child of 'Email'", "Email autoexecute": "Email via automatic execution. Child of 'Email'", "Email link": "Email via embedded link. Child of 'Email'", "Email unknown": "Email but sub-variety (attachment, autoexecute, link, etc) not known. Child of 'Email'", "Email other": "Email sub-variety known, but not one of those listed (attachment, link, autoexecute, etc). Child of 'Email'", "Instant messaging": "Instant Messaging", "Network propagation": "Network propagation", "Partner": "Partner connection or credential. (Indicates supply chain breach.)", "Remote injection": "Remotely injected by agent (i.e. via SQLi)", "Removable media": "Removable storage media or devices", "Software update": "Included in automated software update", "Web application": "Web application. Parent of 'Web application - download' and 'Web application - drive-by.", "Web application - download": "Web via user-executed or downloaded content. Child of 'Web application'.", "Web application - drive-by": "Web via auto-executed or \"drive-by\" infection. Child of 'Web application'.", "Other": "Other", "Unknown": "Unknown" }, "result": { "Infiltrate": "The malware action resulted in additional security access", "Exfiltrate": "The malware action exfiltrated data from the victim", "Elevate": "The malware action resulted in additional security permissions", "Lateral movement": "The malware action used security access or permissions already acuired", "Deploy payload": "e.g. cryptomining, ransomware, etc", "Persist": "The action resulted in some form of persistence on the system", "Other": "The result of the malware action is not listed", "Unknown": "The result of the malware action is unknown", "NA": "The malware action did not have a result" } }, "social": { "variety": { "Baiting": "Prepare malicious content in a location where a victim is likely to interact with it. (e.g. SEO - vect: websites, left usbs- vect: removable media, etc)", "Bribery": "Bribery or solicitation", "Elicitation": "Elicitation (subtle extraction of info through conversation)", "Evade Defenses": "Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.", "Extortion": "Extortion or blackmail", "Forgery": "Forgery or counterfeiting (fake hardware, software, documents, etc)", "Influence": "Influence tactics (Leveraging authority or obligation, framing, etc)", "Phishing": "Any type of *ishing. Phishing always involves getting data from the victim. Phishing usually has some element of pretexting, but often it doesn’t rise to the level of an invented scenario. E.g. A fake google login page isn’t really pretexting.", "Pretexting": "Pretexting (dialogue leveraging invented scenario). Unlike 'Phishing', does not transfer data. (A fraudulent transfer or changing a bank account on a business account is not really disclosing data.", "Prompt bombing": "Bombarding the user with MFA prompts to get them to accept the login request", "Propaganda": "Propaganda or disinformation", "Scam": "Online scam or hoax (e.g., scareware, 419 scam, auction fraud)", "Spam": "Spam (unsolicited or undesired email and advertisements)", "Other": "Other", "Unknown": "Unknown" }, "vector": { "Documents": "Documents", "Email": "Email", "IM": "Instant messaging", "In-person": "In-person", "Partner": "Partner connection or credential. (Indicates supply chain breach.)", "Phone": "Phone", "Removable media": "Removable storage media", "SMS": "SMS or texting", "Social media": "Social media or networking", "Software": "Software", "Virtual meeting": "Virtual meeting", "Web application": "Web application", "Other": "Other", "Unknown": "Unknown" }, "target": { "Auditor": "Auditor", "Call center": "Call center staff", "Cashier": "Cashier, teller or waiter", "Customer": "Customer (B2C)", "Developer": "Software developer", "End-user": "End-user of the victim's products and/or services. Child of 'End-user or employee'", "End-user or employee": "End-user or regular employee not otherwise listed. Parent of 'End-user' or 'Other employee'", "Executive": "Senior staff with legal responsibility such as board members and corporate officers", "Finance": "Finance or accounting staff", "Former employee": "Former employee", "Guard": "Security guard", "Helpdesk": "Helpdesk staff", "Human resources": "Human resources staff", "Maintenance": "Maintenance or janitorial staff", "Manager": "Manager or supervisor", "Other employee": "Regular employee not otherwise listed. Child of 'End-user or employee'", "Partner": "Partner (B2B)", "System admin": "System or network administrator", "Other": "Other", "Unknown": "Unknown" }, "result": { "Infiltrate": "The social action resulted in additional security access", "Exfiltrate": "The social action exfiltrated data from the victim", "Elevate": "The social action resulted in additional security permissions", "Lateral movement": "The social action used security access or permissions already acuired", "Deploy payload": "e.g. cryptomining, ransomware, etc", "Persist": "The action resulted in some form of persistence on the system", "Other": "The result of the social action is not listed", "Unknown": "The result of the social action is unknown", "NA": "The social action did not have a result" } }, "error": { "variety": { "Capacity shortage": "Poor capacity planning", "Classification error": "Classification or labeling error", "Data entry error": "Data entry error", "Disposal error": "Disposal error", "Gaffe": "Gaffe (social or verbal slip)", "Inadequate containment": "Failure to enforce technical or logical boundaries around an agentic system", "Loss": "Loss or misplacement", "Maintenance error": "Maintenance error", "Malfunction": "Technical malfunction or glitch", "Misconfiguration": "Misconfiguration", "Misdelivery": "Misdelivery (send wrong info or to wrong recipient)", "Misinformation": "Misinformation (unintentionally giving false info)", "Physical accidents": "Physical accidents (e.g., drops, bumps, spills)", "Programming error": "Programming error (flaws or bugs in custom code). This is the error equivalent of the hacking/malware 'Exploit vuln' enumerations.", "Publishing error": "Publishing error (private info to public doc or site)", "Other": "Other", "Unknown": "Unknown" }, "vector": { "Carelessness": "Carelessness. An honest mistake due to inattention to detail. Use it when it is known to be so.", "Inadequate personnel": "Inadequate or insufficient personnel", "Inadequate processes": "Inadequate or insufficient processes", "Inadequate technology": "Inadequate or insufficient technology resources", "Other": "Other", "Random error": "Random error (no reason, no fault)", "Web application": "Web application", "Unknown": "Unknown" } }, "misuse": { "variety": { "Data mishandling": "Handling of data in an unapproved manner", "Email misuse": "Inappropriate use of email or IM", "Evade Defenses": "Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.", "Illicit content": "Storage or distribution of illicit content", "Knowledge abuse": "Abuse of private or entrusted knowledge", "Net misuse": "Inappropriate use of network or Web access including cloud services", "Password or Session Sharing": "Sharing of a legitimate user's credential or session", "Possession abuse": "Abuse of physical access to asset", "Privilege abuse": "Abuse of system access privileges", "Snap picture": "Actor photographs the confidentiality data variety.", "Unapproved hardware": "Use of unapproved hardware or devices", "Unapproved software": "Use of unapproved software or services", "Unapproved workaround": "Unapproved workaround or shortcut", "Other": " Other", "Unknown": "Unknown" }, "vector": { "LAN access": "Local network access within corporate facility", "Non-corporate": "Non-corporate facilities or networks", "Physical access": "Physical access within corporate facility", "Remote access": "Remote access connection to corporate network (i.e. VPN)", "Web application": "Web application", "Other": "Other", "Unknown": "Unknown" }, "result": { "Infiltrate": "Do not use. Misuse inherently implies having permission so none can be gained.", "Exfiltrate": "The misuse action exfiltrated data from the victim", "Elevate": "Do not use. Misuse inherently implies having permission so none can be elevated.", "Lateral movement": "The misuse action used security access or permissions already acuired", "Deploy payload": "e.g. cryptomining, ransomware, etc", "Persist": "The action resulted in some form of persistence on the system", "Other": "The result of the misuse action is not listed", "Unknown": "The result of the misuse action is unknown", "NA": "The misuse action did not have a result" } }, "physical": { "variety": { "Assault": "Assault (threats or acts of physical violence)", "Bypassed controls": "Bypassed physical barriers or controls", "Connection": "Connection", "Destruction": "Destruction (deliberate damaging or disabling)", "Disabled controls": "Disabled physical barriers or controls", "Evade Defenses": "Modification of the action (rather than the system, as in 'Disable controls') to avoid detection.", "Skimmer": "Installing card skimming device", "Snooping": "Snooping (sneak about to gain info or access)", "Surveillance": "Surveillance (monitoring and observation)", "Tampering": "Tampering (alter physical form or function)", "Theft": "Theft (taking assets without permission)", "Wiretapping": "Wiretapping (Physical tap to comms line)", "Other": "Other", "Unknown": "Unknown" }, "vector": { "Partner facility": "Partner facility or area", "Partner vehicle": "Partner vehicle (e.g., delivery truck)", "Personal residence": "Personal residence", "Personal vehicle": "Personal vehicle", "Public facility": "Public facility or area", "Public vehicle": "Public vehicle (e.g., plane, taxi)", "Victim grounds": "Victim outdoor grounds", "Victim public area": "Victim public or customer area (e.g., lobby, storefront)", "Victim secure area": "Victim high security area (e.g., server room, R&D labs)", "Victim work area": "Victim private or work area (e.g., office space)", "Unknown": "Unknown", "Other": "Other" }, "result": { "Infiltrate": "The physical action resulted in additional security access", "Exfiltrate": "The physical action exfiltrated data from the victim", "Elevate": "The physical action resulted in additional security permissions", "Lateral movement": "The physical action used security access or permissions already acuired", "Deploy payload": "e.g. cryptomining, ransomware, etc", "Persist": "The action resulted in some form of persistence on the system", "Other": "The result of the physical action is not listed", "Unknown": "The result of the physical action is unknown", "NA": "The physical action did not have a result" } }, "environmental": { "variety": { "Deterioration": "Deterioration and degradation", "Earthquake": "Earthquake", "EMI": "Electromagnetic interference (EMI)", "ESD": "Electrostatic discharge (ESD)", "Fire": "Fire", "Flood": "Flood", "Hazmat": "Hazardous material", "Humidity": "Humidity", "Hurricane": "Hurricane", "Ice": "Ice and snow", "Landslide": "Landslide", "Leak": "Water leak", "Lightning": "Lightning", "Meteorite": "Meteorite", "Particulates": "Particulate matter (e.g., dust, smoke)", "Pathogen": "Pathogen", "Power failure": "Power failure or fluctuation", "Temperature": "Extreme temperature", "Tornado": "Tornado", "Tsunami": "Tsunami", "Vermin": "Vermin", "Volcano": "Volcanic eruption", "Wind": "Wind", "Other": "Other", "Unknown": "Unknown" } }, "unknown": { "result": { "Infiltrate": "The environmental action resulted in additional security access", "Exfiltrate": "The environmental action exfiltrated data from the victim", "Elevate": "The environmental action resulted in additional security permissions", "Lateral movement": "The environmental action used security access or permissions already acuired", "Deploy payload": "e.g. cryptomining, ransomware, etc", "Persist": "The action resulted in some form of persistence on the system", "Other": "The result of the environmental action is not listed", "Unknown": "The result of the environmental action is unknown", "NA": "The environmental action did not have a result" } } }, "actor": { "external": { "variety": { "Acquaintance": "Relative or acquaintance of employee", "Activist": "Activist group", "Auditor": "Auditor", "Agentic system": "A computational system capable of planning and executing goal-directed actions without direct human intervention", "Competitor": "Competitor", "Customer": "Customer (B2C)", "Force majeure": "Force majeure (nature and chance)", "Former employee": "Former employee (no longer had access)", "Nation-state": "Nation-state", "Organized crime": "Any criminal(s) or group with a level of organization", "State-affiliated": "State-sponsored or affiliated group", "Terrorist": "Terrorist group", "Unaffiliated": "Unaffiliated person(s)", "Other": "Other", "Unknown": "Unknown" }, "motive": { "Convenience": "Convenience of expediency", "Espionage": "Espionage or competitive advantage", "Fear": "Fear or duress", "Financial": "Financial or personal gain", "Fun": "Fun, curiosity, or pride", "Grudge": "Grudge or personal offense", "Ideology": "Ideology or protest", "Misalignment": "Not intended or permitted by its operator but executed by an agentic system to fulfill an assigned task.", "NA": "Not Applicable (unintentional action)", "Secondary": "Aid in a different attack", "Other": "Other", "Unknown": "Unknown" }, "country": { "Unknown": "Unknown", "AD": "Andorra", "AE": "United Arab Emirates", "AF": "Afghanistan", "AG": "Antigua and Barbuda", "AI": "Anguilla", "AL": "Albania", "AM": "Armenia", "AO": "Angola", "AQ": "Antarctica", "AR": "Argentina", "AS": "American Samoa", "AT": "Austria", "AU": "Australia", "AW": "Aruba", "AX": "Aland Islands", "AZ": "Azerbaijan", "BA": "Bosnia and Herzegovina", "BB": "Barbados", "BD": "Bangladesh", "BE": "Belgium", "BF": "Burkina Faso", "BG": "Bulgaria", "BH": "Bahrain", "BI": "Burundi", "BJ": "Benin", "BL": "Saint-Barthelemy", "BM": "Bermuda", "BN": "Brunei Darussalam", "BO": "Bolivia", "BQ": "Bonaire, Saint Eustatius and Saba", "BR": "Brazil", "BS": "Bahamas", "BT": "Bhutan", "BV": "Bouvet Island", "BW": "Botswana", "BY": "Belarus", "BZ": "Belize", "CA": "Canada", "CC": "Cocos (Keeling) Islands", "CD": "Congo, Democratic Republic of the", "CF": "Central African Republic", "CG": "Congo", "CH": "Switzerland", "CI": "Cote d'Ivoire", "CK": "Cook Islands", "CL": "Chile", "CM": "Cameroon", "CN": "China", "CO": "Colombia", "CR": "Costa Rica", "CU": "Cuba", "CV": "Cape Verde", "CW": "Curacao", "CX": "Christmas Island", "CY": "Cyprus", "CZ": "Czech Republic", "DE": "Germany", "DJ": "Djibouti", "DK": "Denmark", "DM": "Dominica", "DO": "Dominican Republic", "DZ": "Algeria", "EC": "Ecuador", "EE": "Estonia", "EG": "Egypt", "EH": "Western Sahara", "ER": "Eritrea", "ES": "Spain", "ET": "Ethiopia", "FI": "Finland", "FJ": "Fiji", "FK": "Faeroe Islands", "FM": "Micronesia (Federated States of)", "FO": "Falkland Islands (Malvinas)", "FR": "France", "GA": "Gabon", "GB": "United Kingdom", "GD": "Grenada", "GE": "Georgia", "GF": "French Guiana", "GG": "Guernsey", "GH": "Ghana", "GI": "Gibraltar", "GL": "Greenland", "GM": "Gambia", "GN": "Guinea", "GP": "Guadeloupe", "GQ": "Equatorial Guinea", "GR": "Greece", "GS": "South Georgia and the South Sandwich Islands", "GT": "Guatemala", "GU": "Guam", "GW": "Guinea-Bissau", "GY": "Guyana", "HK": "Hong Kong", "HM": "Heard Island and McDonal Islands", "HN": "Honduras", "HR": "Croatia", "HT": "Haiti", "HU": "Hungary", "ID": "Indonesia", "IE": "Ireland", "IL": "Israel", "IM": "Isle of Man", "IN": "India", "IO": "British Virgin Islands", "IQ": "Iraq", "IR": "Iran (Islamic Republic of)", "IS": "Iceland", "IT": "Italy", "JE": "Jersey", "JM": "Jamaica", "JO": "Jordan", "JP": "Japan", "KE": "Kenya", "KG": "Kyrgyzstan", "KH": "Cambodia", "KI": "Kiribati", "KM": "Comoros", "KN": "Saint Kitts and Nevis", "KP": "Korea, Democratic People's Republic of", "KR": "Korea, Republic of", "KW": "Kuwait", "KY": "Cayman Islands", "KZ": "Kazakhstan", "LA": "Lao People's Democratic Republic", "LB": "Lebanon", "LC": "Saint Lucia", "LI": "Liechtenstein", "LK": "Sri Lanka", "LR": "Liberia", "LS": "Lesotho", "LT": "Lithuania", "LU": "Luxembourg", "LV": "Latvia", "LY": "Libya", "MA": "Morocco", "MC": "Monaco", "MD": "Moldova, Republic of", "ME": "Montenegro", "MF": "Saint Martin (French part)", "MG": "Madagascar", "MH": "Marshall Islands", "MK": "Macedonia, The former Yugoslav Republic of", "ML": "Mali", "MM": "Myanmar", "MN": "Mongolia", "MO": "Macao", "MP": "Northern Mariana Islands", "MQ": "Martinique", "MR": "Mauritania", "MS": "Montserrat", "MT": "Malta", "MU": "Mauritius", "MV": "Maldives", "MW": "Malawi", "MX": "Mexico", "MY": "Malaysia", "MZ": "Mozambique", "NA": "Namibia", "NC": "New Caledonia", "NE": "Niger", "NF": "Norfolk Island", "NG": "Nigeria", "NI": "Nicaragua", "NL": "Netherlands", "NO": "Norway", "NP": "Nepal", "NR": "Nauru", "NU": "Niue", "NZ": "New Zealand", "OM": "Oman", "PA": "Panama", "PE": "Peru", "PF": "French Polynesia", "PG": "Papua New Guinea", "PH": "Philippines", "PK": "Pakistan", "PL": "Poland", "PM": "Saint Pierre and Miquelon", "PN": "Pitcairn", "PR": "Puerto Rico", "PS": "Palestinian Territory, Occupied", "PT": "Portugal", "PW": "Palau", "PY": "Paraguay", "QA": "Qatar", "RE": "Reunion", "RO": "Romania", "RS": "Serbia", "RU": "Russian Federation", "RW": "Rwanda", "SA": "Saudi Arabia", "SB": "Solomon Islands", "SC": "Seychelles", "SD": "Sudan", "SE": "Sweden", "SG": "Singapore", "SH": "Saint Helena", "SI": "Slovenia", "SJ": "Svalbard and Jan Mayen Islands", "SK": "Slovakia", "SL": "Sierra Leone", "SM": "San Marino", "SN": "Senegal", "SO": "Somalia", "SR": "Suriname", "SS": "South Sudan", "ST": "Sao Tome and Principe", "SV": "El Salvador", "SX": "Sint Maarten (Dutch part)", "SY": "Syrian Arab Republic", "SZ": "Swaziland", "TC": "Turks and Caicos Islands", "TD": "Chad", "TF": "French Southern Territories", "TG": "Togo", "TH": "Thailand", "TJ": "Tajikistan", "TK": "Tokelau", "TL": "Timor-Leste", "TM": "Turkmenistan", "TN": "Tunisia", "TO": "Tonga", "TR": "Turkey", "TT": "Trinidad and Tobago", "TV": "Tuvalu", "TW": "Taiwan, Province of China", "TZ": "Tanzania, United Republic of", "UA": "Ukraine", "UG": "Uganda", "UM": "United States Minor Outlying Islands", "US": "United States of America", "UY": "Uruguay", "UZ": "Uzbekistan", "VA": "Holy See", "VC": "Saint Vincent and the Grenadines", "VE": "Venezuela (Bolivarian Republic of)", "VG": "British Virgin Islands", "VI": "United States Virgin Islands", "VN": "Viet Nam", "VU": "Vanuatu", "WF": "Wallis and Futuna Islands", "WS": "Samoa", "YE": "Yemen", "YT": "Mayotte", "ZA": "South Africa", "ZM": "Zambia", "ZW": "Zimbabwe", "XK": "Kosovo", "Other": "Other" } }, "internal": { "variety": { "Auditor": "Auditor", "Agentic system": "A computational system capable of planning and executing goal-directed actions without direct human intervention", "Call center": "Call center staff", "Cashier": "Cashier, teller, or waiter", "Developer": "Software developer", "End-user": "End-user or regular employee", "Executive": "Senior staff with legal responsibility such as board members and corporate officers", "Finance": "Finance or accounting staff", "Guard": "Security guard", "Helpdesk": "Helpdesk staff", "Human resources": "Human resources staff", "Maintenance": "Maintenance or janitorial staff", "Manager": "Manager or supervisor", "System admin": "System or network administrator", "Doctor or nurse": "A doctor or a nurse", "Other": "Other", "Unknown": "Unknown" }, "motive": { "Convenience": "Convenience of expediency", "Espionage": "Espionage or competitive advantage", "Fear": "Fear or duress", "Financial": "Financial or personal gain", "Fun": "Fun, curiosity, or pride", "Grudge": "Grudge or personal offense", "Ideology": "Ideology or protest", "Misalignment": "Not intended or permitted by its operator but executed by an agentic system to fulfill an assigned task.", "Secondary": "Aid in a different attack", "NA": "Not Applicable (unintentional action)", "Other": "Other", "Unknown": "Unknown" }, "job_change": { "Demoted": "Recently demoted or hours reduced", "Hired": "Recently hired", "Job eval": "Recent poor job evaluation", "Lateral move": "Lateral move", "Let go": "Fired, laid off, or let go", "Passed over": "Recently passed over for promotion", "Personal issues": "Personal issues", "Promoted": "Recently promoted", "Reprimanded": "Recently reprimanded", "Resigned": "Preparing to resign", "Other": "Other", "Unknown": "Unknown" } }, "partner": { "motive": { "Convenience": "Convenience of expediency", "Espionage": "Espionage or competitive advantage", "Fear": "Fear or duress", "Financial": "Financial or personal gain", "Fun": "Fun, curiosity, or pride", "Grudge": "Grudge or personal offense", "Ideology": "Ideology or protest", "Secondary": "Aid in a different attack", "NA": "Not Applicable (unintentional action)", "Other": "Other", "Unknown": "Unknown" }, "country": { "Unknown": "Unknown", "AD": "Andorra", "AE": "United Arab Emirates", "AF": "Afghanistan", "AG": "Antigua and Barbuda", "AI": "Anguilla", "AL": "Albania", "AM": "Armenia", "AO": "Angola", "AQ": "Antarctica", "AR": "Argentina", "AS": "American Samoa", "AT": "Austria", "AU": "Australia", "AW": "Aruba", "AX": "Aland Islands", "AZ": "Azerbaijan", "BA": "Bosnia and Herzegovina", "BB": "Barbados", "BD": "Bangladesh", "BE": "Belgium", "BF": "Burkina Faso", "BG": "Bulgaria", "BH": "Bahrain", "BI": "Burundi", "BJ": "Benin", "BL": "Saint-Barthelemy", "BM": "Bermuda", "BN": "Brunei Darussalam", "BO": "Bolivia", "BQ": "Bonaire, Saint Eustatius and Saba", "BR": "Brazil", "BS": "Bahamas", "BT": "Bhutan", "BV": "Bouvet Island", "BW": "Botswana", "BY": "Belarus", "BZ": "Belize", "CA": "Canada", "CC": "Cocos (Keeling) Islands", "CD": "Congo, Democratic Republic of the", "CF": "Central African Republic", "CG": "Congo", "CH": "Switzerland", "CI": "Cote d'Ivoire", "CK": "Cook Islands", "CL": "Chile", "CM": "Cameroon", "CN": "China", "CO": "Colombia", "CR": "Costa Rica", "CU": "Cuba", "CV": "Cape Verde", "CW": "Curacao", "CX": "Christmas Island", "CY": "Cyprus", "CZ": "Czech Republic", "DE": "Germany", "DJ": "Djibouti", "DK": "Denmark", "DM": "Dominica", "DO": "Dominican Republic", "DZ": "Algeria", "EC": "Ecuador", "EE": "Estonia", "EG": "Egypt", "EH": "Western Sahara", "ER": "Eritrea", "ES": "Spain", "ET": "Ethiopia", "FI": "Finland", "FJ": "Fiji", "FK": "Faeroe Islands", "FM": "Micronesia (Federated States of)", "FO": "Falkland Islands (Malvinas)", "FR": "France", "GA": "Gabon", "GB": "United Kingdom", "GD": "Grenada", "GE": "Georgia", "GF": "French Guiana", "GG": "Guernsey", "GH": "Ghana", "GI": "Gibraltar", "GL": "Greenland", "GM": "Gambia", "GN": "Guinea", "GP": "Guadeloupe", "GQ": "Equatorial Guinea", "GR": "Greece", "GS": "South Georgia and the South Sandwich Islands", "GT": "Guatemala", "GU": "Guam", "GW": "Guinea-Bissau", "GY": "Guyana", "HK": "Hong Kong", "HM": "Heard Island and McDonal Islands", "HN": "Honduras", "HR": "Croatia", "HT": "Haiti", "HU": "Hungary", "ID": "Indonesia", "IE": "Ireland", "IL": "Israel", "IM": "Isle of Man", "IN": "India", "IO": "British Virgin Islands", "IQ": "Iraq", "IR": "Iran (Islamic Republic of)", "IS": "Iceland", "IT": "Italy", "JE": "Jersey", "JM": "Jamaica", "JO": "Jordan", "JP": "Japan", "KE": "Kenya", "KG": "Kyrgyzstan", "KH": "Cambodia", "KI": "Kiribati", "KM": "Comoros", "KN": "Saint Kitts and Nevis", "KP": "Korea, Democratic People's Republic of", "KR": "Korea, Republic of", "KW": "Kuwait", "KY": "Cayman Islands", "KZ": "Kazakhstan", "LA": "Lao People's Democratic Republic", "LB": "Lebanon", "LC": "Saint Lucia", "LI": "Liechtenstein", "LK": "Sri Lanka", "LR": "Liberia", "LS": "Lesotho", "LT": "Lithuania", "LU": "Luxembourg", "LV": "Latvia", "LY": "Libya", "MA": "Morocco", "MC": "Monaco", "MD": "Moldova, Republic of", "ME": "Montenegro", "MF": "Saint Martin (French part)", "MG": "Madagascar", "MH": "Marshall Islands", "MK": "Macedonia, The former Yugoslav Republic of", "ML": "Mali", "MM": "Myanmar", "MN": "Mongolia", "MO": "Macao", "MP": "Northern Mariana Islands", "MQ": "Martinique", "MR": "Mauritania", "MS": "Montserrat", "MT": "Malta", "MU": "Mauritius", "MV": "Maldives", "MW": "Malawi", "MX": "Mexico", "MY": "Malaysia", "MZ": "Mozambique", "NA": "Namibia", "NC": "New Caledonia", "NE": "Niger", "NF": "Norfolk Island", "NG": "Nigeria", "NI": "Nicaragua", "NL": "Netherlands", "NO": "Norway", "NP": "Nepal", "NR": "Nauru", "NU": "Niue", "NZ": "New Zealand", "OM": "Oman", "PA": "Panama", "PE": "Peru", "PF": "French Polynesia", "PG": "Papua New Guinea", "PH": "Philippines", "PK": "Pakistan", "PL": "Poland", "PM": "Saint Pierre and Miquelon", "PN": "Pitcairn", "PR": "Puerto Rico", "PS": "Palestinian Territory, Occupied", "PT": "Portugal", "PW": "Palau", "PY": "Paraguay", "QA": "Qatar", "RE": "Reunion", "RO": "Romania", "RS": "Serbia", "RU": "Russian Federation", "RW": "Rwanda", "SA": "Saudi Arabia", "SB": "Solomon Islands", "SC": "Seychelles", "SD": "Sudan", "SE": "Sweden", "SG": "Singapore", "SH": "Saint Helena", "SI": "Slovenia", "SJ": "Svalbard and Jan Mayen Islands", "SK": "Slovakia", "SL": "Sierra Leone", "SM": "San Marino", "SN": "Senegal", "SO": "Somalia", "SR": "Suriname", "SS": "South Sudan", "ST": "Sao Tome and Principe", "SV": "El Salvador", "SX": "Sint Maarten (Dutch part)", "SY": "Syrian Arab Republic", "SZ": "Swaziland", "TC": "Turks and Caicos Islands", "TD": "Chad", "TF": "French Southern Territories", "TG": "Togo", "TH": "Thailand", "TJ": "Tajikistan", "TK": "Tokelau", "TL": "Timor-Leste", "TM": "Turkmenistan", "TN": "Tunisia", "TO": "Tonga", "TR": "Turkey", "TT": "Trinidad and Tobago", "TV": "Tuvalu", "TW": "Taiwan, Province of China", "TZ": "Tanzania, United Republic of", "UA": "Ukraine", "UG": "Uganda", "UM": "United States Minor Outlying Islands", "US": "United States of America", "UY": "Uruguay", "UZ": "Uzbekistan", "VA": "Holy See", "VC": "Saint Vincent and the Grenadines", "VE": "Venezuela (Bolivarian Republic of)", "VG": "British Virgin Islands", "VI": "United States Virgin Islands", "VN": "Viet Nam", "VU": "Vanuatu", "WF": "Wallis and Futuna Islands", "WS": "Samoa", "YE": "Yemen", "YT": "Mayotte", "ZA": "South Africa", "ZM": "Zambia", "ZW": "Zimbabwe", "XK": "Kosovo", "Other": "Other" } } }, "asset": { "assets": { "variety": { "M - Disk drive": "Media - Hard disk drive", "M - Disk media": "Media - Disk media (e.g., CDs, DVDs)", "M - Documents": "Media - Documents", "M - Flash drive": "Media - Flash drive or card", "M - Payment card": "Media - Payment card (e.g., magstripe, EMV)", "M - Smart card": "Media - Identity smart card", "M - SIM card": "Media - Subscriber Identity Module found in mobile devices ", "M - Tapes": "Media - Backup tapes", "M - Other": "Media - Variety known but not listed", "M - Unknown": "Media - Variety not known", "M - Fax": "Media - The output of a fax machine", "N - Access reader": "Network - Access control reader (e.g., badge, biometric)", "N - Broadband": "Network - Mobile broadband network", "N - Camera": "Network - Camera or surveillance system", "N - Firewall": "Network - Firewall", "N - IDS": "Network - IDS or IPs", "N - LAN": "Network - Wired LAN", "N - NAS": "Network - Network area storage (NAS)", "N - PBX": "Network - Private branch exchange (PBX)", "N - PLC": "Network - Programmable logic controller (PLC)", "N - Private WAN": "Network - Private WAN", "N - Public WAN": "Network - Public WAN", "N - Remote access": "Network - Remote access", "N - Router or switch": "Network - Router or switch", "N - RTU": "Network - Remote terminal unit (RTU)", "N - SAN": "Network - Storage area network (SAN)", "N - Telephone": "Network - Telephone", "N - VoIP adapter": "Network - VoIP adapter", "N - WLAN": "Network - Wireless LAN", "N - Other": "Network - Variety known but not listed", "N - Unknown": "Network - Variety not known", "P - Auditor": "People - Auditor", "P - Call center": "People - Call center", "P - Cashier": "People - Cashier", "P - Customer": "People - Customer", "P - Developer": "People - Developer", "P - End-user": "People - End-user of the victim's products and/or services. Child of 'P - End-user or employee'", "P - End-user or employee": "Person - End-user or regular employee not otherwise listed. Parent of 'P - End-user' or 'P - Other employee'", "P - Executive": "People - Senior staff with legal responsibility such as board members and corporate officers", "P - Finance": "People - Finance", "P - Former employee": "People - Former employee", "P - Guard": "People - Guard", "P - Helpdesk": "People - Helpdesk", "P - Human resources": "People - Human resources", "P - Maintenance": "People - Maintenance", "P - Manager": "People - Manager", "P - Other employee": "Person - Regular employee not otherwise listed. Child of 'P - End-user or employee'", "P - Partner": "People - Partner (B2B)", "P - System admin": "People - Administrator", "P - Other": "People - Variety known but not listed", "P - Unknown": "People - Variety not known", "S - Authentication": "Server - Authentication", "S - Backup": "Server - Backup", "S - Configuration or patch management": "Servers maintaining or deploying configurations or patches to other assets", "S - Code repository": "Server - Code repository", "S - Database": "Server - Database", "S - DCS": "Server - Distributed control system (DCS)", "S - DHCP": "Server - DHCP", "S - Directory": "Server - Directory (LDAP, AD)", "S - DNS": "Server - DNS", "S - File": "Server - File", "S - ICS": "Server - Industrial Control System (ICS). Includes Supervisory Control And Data Acquisition (SCADA) systems.", "S - LLM application": "Server - Large Language Model application, including chatbots and custom coded applications", "S - Log": "Server - Log or event management", "S - Mail": "Server - Mail", "S - Mainframe": "Server - Mainframe", "S - Payment switch": "Server - Payment switch or gateway", "S - POS controller": "Server - POS controller", "S - Print": "Server - Print", "S - Proxy": "Server - Proxy", "S - Secrets vault": "Server - Secrets vault used to store passwords for use in the environment", "S - VM host": "Server - Virtual Host", "S - Web application": "Server - Web application", "S - Other": "Server - Variety known but not listed", "S - Unknown": "Server - Variety not known", "T - ATM": "Public Terminal - Automated Teller Machine (ATM)", "T - Gas terminal": "Public Terminal - Gas \"pay-at-the-pump\" terminal", "T - Kiosk": "Public Terminal - Self-service kiosk", "T - PED pad": "Public Terminal - Detached PIN pad or card reader", "T - Other": "Public Terminal - Variety known but not listed", "T - Unknown": "Public Terminal - Variety not known", "U - Auth token": "User Device - Authentication token or device", "U - Desktop": "User Device - Desktop or workstation. Child to 'U - Desktop or laptop'", "U - Desktop or laptop": "User Device - Desktop, workstation, or laptop. Parent to 'U - Desktop' and 'U - Laptop'", "U - Laptop": "User Device - Laptop. Child to 'U - Desktop or laptop'", "U - Media": "User Device - Media player or recorder", "U - Mobile phone": "User Device - Mobile phone or smartphone", "U - Peripheral": "User Device - Peripheral (e.g., printer, copier, fax)", "U - POS terminal": "User Device - POS terminal", "U - Tablet": "User Device - Tablet", "U - Telephone": "User Device - Telephone", "U - VoIP phone": "User Device - VoIP phone", "U - Other": "User Device - Variety known but not listed", "U - Unknown": "User Device - Variety not known", "E - Telemetry": "Embedded - A dedicated device that collects data about the physical world", "E - Telematics": "Embedded - A dedicated device that affects the real world", "E - Other": "Embedded - Variety known but not listed", "E - Unknown": "Embedded - Variety not known", "Unknown": "Unknown type of asset", "Other": "Asset type known but not User Device, Server, Public Terminal, Server, People, Network, or Media" } }, "ownership": { "Customer": "The affected assets is consumer owned – an example would be credentials stolen from a banking customer then reused to access a banking application", "Employee": "The asset was owned by an employee of the victim organization. BYOD assets would be categorized under this label. Currently", "NA": "Ownership label is not applicable, a Human asset that clicks a malicious attachment is a common example.", "Partner": "The asset (regardless of physical location) was the property of a business partner, including a cloud provider.", "Unknown": "Ownership of the asset was not known to the incident responder or not recorded.", "Victim": "The affected asset is property of the victim organization", "Other": "Owner known but not listed" }, "cloud": { "On-Premise Asset(s)": "On premise (including colo) assets were involved in the incident.", "External Cloud Asset(s)": "(cloud.Yes) Cloud assets were involved in the incident", "Other": "Cloud hosting known but not listed", "Unknown": "The involvement of cloud assets was not measured", "NA": " (cloud.No) Cloud is not applicable to this incident. Only use if computer's weren't involved (people, media, etc). Do not use for Desktops or other user assets." }, "hosting": { "External - unknown environment": "A third party provided hosted the affected asset, but it is unknown whether the victim organization’s environment was shared or dedicated.", "External - dedicated environment": "A third party provider hosted the affected asset on servers dedicated to the victim organization.", "External - shared environment": "A third party provider hosted the affected asset on a shared physical device. This is common in web hosting services where multiple organizations’ web applications are resident on the same physical server.", "Internal": "The affected asset was hosted within the victim organization’s location.", "NA": "Hosting label is not applicable, a Human asset that clicks a malicious attachment is a common example as is portable assets like laptops or paper documents.", "Other": "Hosting arrangement known but not listed", "Unknown": "The hosting arrangement of the asset was not known to the incident responder or not recorded." }, "management": { "External": "The affected asset was managed and maintained by a third party service provider or business partner.", "Internal": "The affected asset was managed and maintained by employees of the victim organization.", "Co-managed": "The affected asset was managed and maintained by both internal administrators as well as a third party provider or partner. There is a level of shared responsibility.", "NA": "Management label is not applicable, a Human asset that clicks a malicious attachment is a common example.", "Unknown": "The responsibility for management and maintenance of the affected asset was not known to the incident responder or not recorded.", "Other": "Ownership known but not listed" }, "role": { "IT": "Information Technology", "OT": "Operational Technology", "Unknown": "Unknown", "Other": "Known but not IT or OT", "NA": "The concept of a role is not applicable to the asset." }, "country": { "Unknown": "Unknown", "AD": "Andorra", "AE": "United Arab Emirates", "AF": "Afghanistan", "AG": "Antigua and Barbuda", "AI": "Anguilla", "AL": "Albania", "AM": "Armenia", "AO": "Angola", "AQ": "Antarctica", "AR": "Argentina", "AS": "American Samoa", "AT": "Austria", "AU": "Australia", "AW": "Aruba", "AX": "Aland Islands", "AZ": "Azerbaijan", "BA": "Bosnia and Herzegovina", "BB": "Barbados", "BD": "Bangladesh", "BE": "Belgium", "BF": "Burkina Faso", "BG": "Bulgaria", "BH": "Bahrain", "BI": "Burundi", "BJ": "Benin", "BL": "Saint-Barthelemy", "BM": "Bermuda", "BN": "Brunei Darussalam", "BO": "Bolivia", "BQ": "Bonaire, Saint Eustatius and Saba", "BR": "Brazil", "BS": "Bahamas", "BT": "Bhutan", "BV": "Bouvet Island", "BW": "Botswana", "BY": "Belarus", "BZ": "Belize", "CA": "Canada", "CC": "Cocos (Keeling) Islands", "CD": "Congo, Democratic Republic of the", "CF": "Central African Republic", "CG": "Congo", "CH": "Switzerland", "CI": "Cote d'Ivoire", "CK": "Cook Islands", "CL": "Chile", "CM": "Cameroon", "CN": "China", "CO": "Colombia", "CR": "Costa Rica", "CU": "Cuba", "CV": "Cape Verde", "CW": "Curacao", "CX": "Christmas Island", "CY": "Cyprus", "CZ": "Czech Republic", "DE": "Germany", "DJ": "Djibouti", "DK": "Denmark", "DM": "Dominica", "DO": "Dominican Republic", "DZ": "Algeria", "EC": "Ecuador", "EE": "Estonia", "EG": "Egypt", "EH": "Western Sahara", "ER": "Eritrea", "ES": "Spain", "ET": "Ethiopia", "FI": "Finland", "FJ": "Fiji", "FK": "Faeroe Islands", "FM": "Micronesia (Federated States of)", "FO": "Falkland Islands (Malvinas)", "FR": "France", "GA": "Gabon", "GB": "United Kingdom", "GD": "Grenada", "GE": "Georgia", "GF": "French Guiana", "GG": "Guernsey", "GH": "Ghana", "GI": "Gibraltar", "GL": "Greenland", "GM": "Gambia", "GN": "Guinea", "GP": "Guadeloupe", "GQ": "Equatorial Guinea", "GR": "Greece", "GS": "South Georgia and the South Sandwich Islands", "GT": "Guatemala", "GU": "Guam", "GW": "Guinea-Bissau", "GY": "Guyana", "HK": "Hong Kong", "HM": "Heard Island and McDonal Islands", "HN": "Honduras", "HR": "Croatia", "HT": "Haiti", "HU": "Hungary", "ID": "Indonesia", "IE": "Ireland", "IL": "Israel", "IM": "Isle of Man", "IN": "India", "IO": "British Virgin Islands", "IQ": "Iraq", "IR": "Iran (Islamic Republic of)", "IS": "Iceland", "IT": "Italy", "JE": "Jersey", "JM": "Jamaica", "JO": "Jordan", "JP": "Japan", "KE": "Kenya", "KG": "Kyrgyzstan", "KH": "Cambodia", "KI": "Kiribati", "KM": "Comoros", "KN": "Saint Kitts and Nevis", "KP": "Korea, Democratic People's Republic of", "KR": "Korea, Republic of", "KW": "Kuwait", "KY": "Cayman Islands", "KZ": "Kazakhstan", "LA": "Lao People's Democratic Republic", "LB": "Lebanon", "LC": "Saint Lucia", "LI": "Liechtenstein", "LK": "Sri Lanka", "LR": "Liberia", "LS": "Lesotho", "LT": "Lithuania", "LU": "Luxembourg", "LV": "Latvia", "LY": "Libya", "MA": "Morocco", "MC": "Monaco", "MD": "Moldova, Republic of", "ME": "Montenegro", "MF": "Saint Martin (French part)", "MG": "Madagascar", "MH": "Marshall Islands", "MK": "Macedonia, The former Yugoslav Republic of", "ML": "Mali", "MM": "Myanmar", "MN": "Mongolia", "MO": "Macao", "MP": "Northern Mariana Islands", "MQ": "Martinique", "MR": "Mauritania", "MS": "Montserrat", "MT": "Malta", "MU": "Mauritius", "MV": "Maldives", "MW": "Malawi", "MX": "Mexico", "MY": "Malaysia", "MZ": "Mozambique", "NA": "Namibia", "NC": "New Caledonia", "NE": "Niger", "NF": "Norfolk Island", "NG": "Nigeria", "NI": "Nicaragua", "NL": "Netherlands", "NO": "Norway", "NP": "Nepal", "NR": "Nauru", "NU": "Niue", "NZ": "New Zealand", "OM": "Oman", "PA": "Panama", "PE": "Peru", "PF": "French Polynesia", "PG": "Papua New Guinea", "PH": "Philippines", "PK": "Pakistan", "PL": "Poland", "PM": "Saint Pierre and Miquelon", "PN": "Pitcairn", "PR": "Puerto Rico", "PS": "Palestinian Territory, Occupied", "PT": "Portugal", "PW": "Palau", "PY": "Paraguay", "QA": "Qatar", "RE": "Reunion", "RO": "Romania", "RS": "Serbia", "RU": "Russian Federation", "RW": "Rwanda", "SA": "Saudi Arabia", "SB": "Solomon Islands", "SC": "Seychelles", "SD": "Sudan", "SE": "Sweden", "SG": "Singapore", "SH": "Saint Helena", "SI": "Slovenia", "SJ": "Svalbard and Jan Mayen Islands", "SK": "Slovakia", "SL": "Sierra Leone", "SM": "San Marino", "SN": "Senegal", "SO": "Somalia", "SR": "Suriname", "SS": "South Sudan", "ST": "Sao Tome and Principe", "SV": "El Salvador", "SX": "Sint Maarten (Dutch part)", "SY": "Syrian Arab Republic", "SZ": "Swaziland", "TC": "Turks and Caicos Islands", "TD": "Chad", "TF": "French Southern Territories", "TG": "Togo", "TH": "Thailand", "TJ": "Tajikistan", "TK": "Tokelau", "TL": "Timor-Leste", "TM": "Turkmenistan", "TN": "Tunisia", "TO": "Tonga", "TR": "Turkey", "TT": "Trinidad and Tobago", "TV": "Tuvalu", "TW": "Taiwan, Province of China", "TZ": "Tanzania, United Republic of", "UA": "Ukraine", "UG": "Uganda", "UM": "United States Minor Outlying Islands", "US": "United States of America", "UY": "Uruguay", "UZ": "Uzbekistan", "VA": "Holy See", "VC": "Saint Vincent and the Grenadines", "VE": "Venezuela (Bolivarian Republic of)", "VG": "British Virgin Islands", "VI": "United States Virgin Islands", "VN": "Viet Nam", "VU": "Vanuatu", "WF": "Wallis and Futuna Islands", "WS": "Samoa", "YE": "Yemen", "YT": "Mayotte", "ZA": "South Africa", "ZM": "Zambia", "ZW": "Zimbabwe", "XK": "Kosovo", "Other": "Other" } }, "attribute": { "confidentiality": { "data_disclosure": { "No": "No", "Potentially": "Potentially (at risk)", "Yes": "Yes (confirmed)", "Unknown": "Unknown" }, "data": { "variety": { "API key": "Application Programing Interface key are used for programmatic access to applications, if unsure, use Credentials", "Bank": "Bank account data", "Classified": "Classified information", "Copyrighted": "Copyrighted material", "Credentials": "Authentication credentials, such as username and password", "Digital certificate": "Digital certificate", "Internal": "Sensitive internal data (e.g., plans, reports, emails)", "Medical": "Medical records", "Multi-factor credential": "Any additional authentication methods, aside from Username and password (e.g., OTP, biometrics)", "Payment": "Payment card data (e.g., PAN, PIN, CVV2, Expiration)", "Personal": "Personal or identifying information (e.g., addr, Email address, credit score)", "Sensitive Personal": "Data which impacts a person's livelihood, quality of life, and ability to participate in daily activities such as SSNs or other National ID", "Secrets": "Trade secrets", "Session key": "Session keys associated with an existing connection and used to identify the client, if unsure, use Credentials", "Source code": "Source code", "System": "System information (e.g., config info, open services)", "Virtual currency": "Virtual currency", "Other": "Other", "Unknown": "Unknown" } }, "data_victim": { "Customer": "Customer, member, or constituent", "Employee": "Employee", "Partner": "Partner", "Patient": "Patient", "Student": "Student", "Victim organization": "The data was that of the victim organization rather than a customer, employee, etc.", "Other": "Other", "Unknown": "Unknown" }, "state": { "Processed": "Processed", "Stored": "Stored (either encrypted, unencrypted, or where encryption is unknown.", "Stored encrypted": "Stored encrypted. (Also mark 'Stored'.)", "Stored unencrypted": "Stored unencrypted. (Also mark 'Stored'.)", "Transmitted": "Transmitted", "Transmitted encrypted": "Transmitted encrypted. (Also mark 'Transmitted.')", "Transmitted unencrypted": "Transmitted unencrypted. (Also mark 'Transmitted.')", "Other": "Data state known but not listed.", "Unknown": "Data state not known", "Printed": "Data printed in human-readable format" } }, "integrity": { "variety": { "Alter behavior": "Influence or alter human behavior", "Created account": "Created new user account", "Defacement": "Deface content", "Fraudulent transaction": "Initiate fraudulent transaction", "Hardware tampering": "Hardware tampering or physical alteration", "Log tampering": "Log tampering or modification", "Misrepresentation": "compromise of authenticity (e.g. masquerading as the legitimate owner of an account)", "Modify authentication": "Modified how a user account is authenticated, such as removing MFA device", "Modify configuration": "Modified configuration or services", "Modify data": "Modified stored data or content", "Modify privileges": "Modified privileges or permissions", "Register MFA device": "Register an attacker controlled MFA device to an account", "Repurpose": "Repurposed asset for unauthorized function", "Software installation": "On-disk software installation or code modification", "Other": "Other", "Unknown": "Unknown" } }, "availability": { "variety": { "Acceleration": "Acceleration", "Degradation": "Performance degradation", "Destruction": "Destruction", "Interruption": "Interruption", "Loss": "Loss", "Obscuration": "Conversion or obscuration (ransomware)", "Other": "Other", "Unknown": "Unknown" }, "duration": { "unit": { "Seconds": "Seconds", "Minutes": "Minutes", "Hours": "Hours", "Days": "Days", "Weeks": "Weeks", "Months": "Months", "Years": "Years", "Never": "Never", "NA": "NA", "Unknown": "Unknown" } } } }, "targeted": { "Opportunistic": "Opportunistic: victim attacked because they exhibited a weakness the actor knew how to exploit", "Targeted": "Targeted: victim chosen as target then actor determined what weaknesses could be exploited", "NA": "Not applicable. Use when actor does not have a practical choice of targets or no intent (i.e. Error).", "Unknown": "Unknown" }, "discovery_method": { "external": { "variety": { "Actor disclosure": "disclosed by threat agent (e.g., public brag, private blackmail)", "Audit": "security audit or scan", "Customer": "reported by customer or partner affected by the incident", "Emergency response team": "Emergency response team", "Found documents": "Found documents", "Fraud detection": "fraud detection (e.g., CPP)", "Incident response": "Notified while investigating another incident", "Law enforcement": "notified by law enforcement or government agency", "Security researcher": "security researcher attempting to identify insecure data", "Suspicious traffic": "Report of suspicious traffic", "Unrelated 3rd party": "Discovered by person unaffiliated with victim or threat actor", "Other": "Discovery method was external and known but not listed including related 3rd parties", "Unknown": "unknown" } }, "internal": { "variety": { "Antivirus": "antivirus alert", "Break in discovered": "employee discovered evidence of a break in", "Data loss prevention": "Data loss prevention software", "Financial audit": "financial audit and reconciliation process", "Fraud detection": "fraud detection mechanism", "Hids": "host IDS or file integrity monitoring", "Incident response": "discovered while responding to another (separate) incident", "Infrastructure monitoring": "Health and welfare monitoring of assets such as utilization, uptime, and SNMP alerts", "It review": "Any routine maintenance, testing or review of it assets. (Includes inspect of assets, vulnerability scans, etc.)", "Log review": "log review process or SIEM", "Nids": "All network", "Offboarding": "Use when the incident is discovered during the exit interview or offboarding/decommissioning of an employee.", "Reported by employee": "reported by employee who saw something odd", "Security alarm": "physical security system alarm", "Other": "Discovery method was internal and known but not listed", "Unknown": "unknown" } }, "partner": { "variety": { "Antivirus": "Notified by antivirus company but not through AV product", "Audit": "Audit performed by a partner organization", "Incident response": "notified while investigating another incident", "Monitoring service": "Reported by a monitoring service", "Other": "Discovery method was partner and known but not listed", "Unknown": "Unknown" } } }, "value_chain": { "development": { "variety": { "Bot": "A small program that can be distributed, installed, and controlled en mass.", "Email": "Develop an email such as for phishing.", "Exploit": "Code to exploit a vulnerability, including web injects.", "Exploit Kits": "Code sets capable of selecting and trying multiple exploits against a target.", "Payload": "The portion a program that causes a negative effect.", "Persona": "A fake representation of a person, such as fake social media profiles", "Physical": "Development of something physical such as a skimming device", "Ransomware": "Ransomware (encrypt or seize stored data)", "Trojan": "A program which masquerades as another program to get a target to execute malicious content", "Website": "Development of any full website controlled by the attacker", "NA": "No type of development was necessary", "Other": "The variety of development required is known, but is not listed.", "Unknown": "Nothing is known about the need for or type of development investment other than it was present." } }, "non-distribution services": { "variety": { "C2": "Command and control. Separate from distribution of mawlare or bots, this is how they are maintained", "Counter AV": "Services for testing if malware is detected by anti-virus", "DNS": "DNS services including fast flux", "Escrow": "Something kept in the custody of a third party until a condition has been fulfilled.", "Hashcracking": "i.e. converting hashes into the text that produce them", "Marketplace": "Use of a marketplace was required as part of this incident.", "Proxy": "A proxy service (either formally or informally hosted) is used by the actor to obscure their source", "VPN": "A VPN service (either formally or informally hosted) is used by the actor to obscure their source", "NA": "No type of non-distribution service was necessary", "Other": "The variety of non-distribution service required is known, but is not listed", "Unknown": "Nothing is known about the need for or type of non-distribution service investment other than it was present." } }, "targeting": { "variety": { "Default credentials": "Credentials the system came with", "Email addresses": "Email addresses", "Lost or stolen credentials": "lost or stolen credentials, including credental stuffing, used to pick an organization as a target", "Misconfigurations": "Knowledge of system misconfigurations used to pick an organization as a target", "Partner": "The actor used access to a partner to target the victim.", "Personal Information": "Information on individuals such as title, interests, physical location, etc, used to pick an organization as a target", "Physical": "Targeting through physical means such as geographic location.", "Organizational Information": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "Vulnerabilities": "Knowledge of software vulnerabilities, both at an organization or associated with a specific vendor's product, used to pick them as a target.", "Weaknesses": "Knowledge of weaknesses other than vulnerability and misconfigurations used to pick an organization as a target", "NA": "No type of targeting was necessary. (This includes targeted.Targeted since the victim was chosen without targeting.", "Other": "The variety of targeting was known, but is not listed", "Unknown": "Nothing is known about the need for or type of targeting investment other than it was present." } }, "distribution": { "variety": { "Botnet": "For content distributed from a collection of bots.", "Compromised server": "malicious content added to a benign server, such as a webserver, by the actor, without the permission or necessarily knowledge of the server’s owner", "Direct": "Distributed directly from the actor's computer", "Email": "Distribution by email including anonymous/one time and spam", "Loader": "malware that loads other malware", "Partner": "The actor distributed the attack to the victim through a partner. (Indicates supply chain breach.)", "Phone": "Distribution over the Plain Old Telephone System (POTS).", "Physical": "Physical distribution.", "Website": "Malicious content shared intentionally, including bullet-proof hosting", "NA": "No type of distribution was necessary", "Other": "The variety of distribution was known, but is not listed", "Unknown": "Nothing is known about the need for or type of distribution investment other than it was present." } }, "cash-out": { "variety": { "Cryptocurrency": "exchange (sale or otherwise) for cryptocurrency", "Direct": "i.e. stole money", "Fraud": "Financial, Medical, Tax, etc", "Hijacked rewards": "Recieve value meant for someone else, (such as redirected affiliate proceeds or click fraud", "Provide service": "See distribution and non-distribution services for potential examples", "Sell stolen goods": "likely the data.variety for breaches or asset for stolen assets", "Purchase stolen goods": "Purchase physical goods as a means of transferring a compromised account's content or currency to the actor.", "NA": "No type of cash-out was necessary", "Other": "The variety of cash-out was known, but is not listed", "Unknown": "Nothing is known about the need for or type of cash-out investment other than it was present." } }, "money laundering": { "variety": { "Bank": "Financial institution based money laundering.", "Company": "Trade-based, shell companies, under/over paying, cash-intensive businesses, etc, used for money laundering", "Cryptocurrency tumbling": "Breaking an amount of cryptocurrency into smaller amounts and quickly filtering it through multiple accounts", "Employment": "An individual believes they are legitimately employed, and launders money/items during the course of their employment.", "Gambling": "Gambling related money laundering. (e.g. Converting to chips and back or big wins and losses.", "Physical": "Physically smuggling money", "Provide service": "See distribution and non-distribution services for potential examples", "Re-shipping": "Individuals receive packages purchased through fraudulent means and subsequently repackage the merchandise for shipment, usually abroad.", "Smurfing": "Breaking non-crypt currency up into smaller amounts to transfer", "Sell stolen goods": "likely paired with value_chain.cash-out.variety.Purchase stolen goods", "NA": "No type of money laundering was necessary", "Other": "The variety of money laundering was known, but is not listed", "Unknown": "Nothing is known about the need for or type of money laundering other than it was present." } } }, "impact": { "loss": { "variety": { "Asset and fraud": "Asset (including physical currency) and fraud-related losses", "Brand damage": "Brand and market damage", "Business disruption": "Business disruption", "Competitive advantage": "Loss of competitive advantage", "Legal and regulatory": "Legal and regulatory costs", "Operating costs": "Increased operating costs", "Response and recovery": "Response and recovery costs", "Other": "Impact variety known but not listed." }, "rating": { "Major": "Major", "Moderate": "Moderate", "Minor": "Minor", "None": "None", "Unknown": "Unknown" } }, "overall_rating": { "Catastrophic": "Catastrophic: A business-ending event (don't choose this if the victim will continue operations)", "Damaging": "Damaging: Real and serious effect on the \"bottom line\" and/or long-term ability to generate revenue", "Painful": "Painful: Moderate \"hard costs\", and impact felt through having to deal with the incident rather than conducting normal duties has quantifiable indirect costs", "Distracting": "Distracting: Limited \"hard costs\", but impact felt through having to deal with the incident rather than conducting normal duties", "Insignificant": "Insignificant: Impact absorbed by normal activities", "Unknown": "Unknown" }, "iso_currency_code": { "AED": "AED - UAE Dirham", "AFN": "AFN - Afghani", "ALL": "ALL - Lek", "AMD": "AMD - Armenian Dram", "ANG": "ANG - Netherlands Antillean Guilder", "AOA": "AOA - Kwanza", "ARS": "ARS - Argentine Peso", "AUD": "AUD - Australian Dollar", "AWG": "AWG - Aruban Florin", "AZN": "AZN - Azerbaijanian Manat", "BAM": "BAM - Convertible Mark", "BBD": "BBD - Barbados Dollar", "BDT": "BDT - Taka", "BGN": "BGN - Bulgarian Lev", "BHD": "BHD - Bahraini Dinar", "BIF": "BIF - Burundi Franc", "BMD": "BMD - Bermudian Dollar", "BND": "BND - Brunei Dollar", "BOB": "BOB - Boliviano", "BRL": "BRL - Brazilian Real", "BSD": "BSD - Bahamian Dollar", "BTN": "BTN - Ngultrum", "BWP": "BWP - Pula", "BYR": "BYR - Belarussian Ruble", "BZD": "BZD - Belize Dollar", "CAD": "CAD - Canadian Dollar", "CDF": "CDF - Congolese Franc", "CHF": "CHF - Swiss Franc", "CLP": "CLP - Chilean Peso", "CNY": "CNY - Yuan Renminbi", "COP": "COP - Colombian Peso", "CRC": "CRC - Costa Rican Colon", "CUC": "CUC - Peso Convertible", "CUP": "CUP - Cuban Peso", "CVE": "CVE - Cape Verde Escudo", "CZK": "CZK - Czech Koruna", "DJF": "DJF - Djibouti Franc", "DKK": "DKK - Danish Krone", "DOP": "DOP - Dominican Peso", "DZD": "DZD - Algerian Dinar", "EGP": "EGP - Egyptian Pound", "ERN": "ERN - Nakfa", "ETB": "ETB - Ethiopian Birr", "EUR": "EUR - Euro", "FJD": "FJD - Fiji Dollar", "FKP": "FKP - Falkland Islands Pound", "GBP": "GBP - Pound Sterling", "GEL": "GEL - Lari", "GGP": "GGP - Guernsey pound", "GHS": "GHS - Ghana Cedi", "GIP": "GIP - Gibraltar Pound", "GMD": "GMD - Dalasi", "GNF": "GNF - Guinea Franc", "GTQ": "GTQ - Quetzal", "GYD": "GYD - Guyana Dollar", "HKD": "HKD - Hong Kong Dollar", "HNL": "HNL - Lempira", "HRK": "HRK - Croatian Kuna", "HTG": "HTG - Gourde", "HUF": "HUF - Forint", "IDR": "IDR - Rupiah", "ILS": "ILS - New Israeli Sheqel", "IMP": "IMP - Isle of Man Pound", "INR": "INR - Indian Rupee", "IQD": "IQD - Iraqi Dinar", "IRR": "IRR - Iranian Rial", "ISK": "ISK - Iceland Krona", "JEP": "JEP - Jersey pound", "JMD": "JMD - Jamaican Dollar", "JOD": "JOD - Jordanian Dinar", "JPY": "JPY - Yen", "KES": "KES - Kenyan Shilling", "KGS": "KGS - Som", "KHR": "KHR - Riel", "KMF": "KMF - Comoro Franc", "KPW": "KPW - North Korean Won", "KRW": "KRW - South Korean Won", "KWD": "KWD - Kuwaiti Dinar", "KYD": "KYD - Cayman Islands Dollar", "KZT": "KZT - Tenge", "LAK": "LAK - Kip", "LBP": "LBP - Lebanese Pound", "LKR": "LKR - Sri Lanka Rupee", "LRD": "LRD - Liberian Dollar", "LSL": "LSL - Loti", "LTL": "LTL - Lithuanian Litas", "LVL": "LVL - Latvian Lats", "LYD": "LYD - Libyan Dinar", "MAD": "MAD - Moroccan Dirham", "MDL": "MDL - Moldovan Leu", "MGA": "MGA - Malagasy Ariary", "MKD": "MKD - Denar", "MMK": "MMK - Kyat", "MNT": "MNT - Tugrik", "MOP": "MOP - Pataca", "MRO": "MRO - Ouguiya", "MUR": "MUR - Mauritius Rupee", "MVR": "MVR - Rufiyaa", "MWK": "MWK - Kwacha", "MXN": "MXN - Mexican Peso", "MYR": "MYR - Malaysian Ringgit", "MZN": "MZN - Mozambique Metical", "NAD": "NAD - Namibia Dollar", "NGN": "NGN - Naira", "NIO": "NIO - Cordoba Oro", "NOK": "NOK - Norwegian Krone", "NPR": "NPR - Nepalese Rupee", "NZD": "NZD - New Zealand Dollar", "OMR": "OMR - Rial Omani", "PAB": "PAB - Balboa", "PEN": "PEN - Nuevo Sol", "PGK": "PGK - Kina", "PHP": "PHP - Philippine Peso", "PKR": "PKR - Pakistan Rupee", "PLN": "PLN - Zloty", "PYG": "PYG - Guarani", "QAR": "QAR - Qatari Rial", "RON": "RON - New Romanian Leu", "RSD": "RSD - Serbian Dinar", "RUB": "RUB - Russian Ruble", "RWF": "RWF - Rwanda Franc", "SAR": "SAR - Saudi Riyal", "SBD": "SBD - Solomon Islands Dollar", "SCR": "SCR - Seychelles Rupee", "SDG": "SDG - Sudanese Pound", "SEK": "SEK - Swedish Krona", "SGD": "SGD - Singapore Dollar", "SHP": "SHP - Saint Helena Pound", "SLL": "SLL - Leone", "SOS": "SOS - Somali Shilling", "SPL": "SPL - Seborga Luigino", "SRD": "SRD - Surinam Dollar", "STD": "STD - Dobra", "SVC": "SVC - El Salvador Colon", "SYP": "SYP - Syrian Pound", "SZL": "SZL - Lilangeni", "THB": "THB - Baht", "TJS": "TJS - Somoni", "TMT": "TMT - Turkmenistan New Manat", "TND": "TND - Tunisian Dinar", "TOP": "TOP - Pa'anga", "TRY": "TRY - Turkish Lira", "TTD": "TTD - Trinidad and Tobago Dollar", "TVD": "TVD - Tuvalu Dollar", "TWD": "TWD - New Taiwan Dollar", "TZS": "TZS - Tanzanian Shilling", "UAH": "UAH - Hryvnia", "UGX": "UGX - Uganda Shilling", "USD": "USD - US Dollar", "UYU": "UYU - Peso Uruguayo", "UZS": "UZS - Uzbekistan Sum", "VEF": "VEF - Bolivar ", "VND": "VND - Dong", "VUV": "VUV - Vatu", "WST": "WST - Tala", "XAF": "XAF - CFA Franc BEAC", "XCD": "XCD - East Caribbean Dollar", "XDR": "XDR - SDR (Special Drawing Right)", "XOF": "XOF - CFA Franc BCEAO", "XPF": "XPF - CFP Franc", "YER": "YER - Yemeni Rial", "ZAR": "ZAR - South African Rand", "ZMK": "ZMK - Zambian Kwacha", "ZWD": "ZWD - Zimbabwean Dollar A/06", "XBT": "Bitcoin (also BTC)", "BCH": "BCH - Bitcoin Cash", "Ether": "ETH - Ether", "Litecoin": "LTC - Litecoin", "XMR": "Monero", "ZEC": "Zcash" } }, "cost_corrective_action": { "Difficult and expensive": "Difficult and expensive", "Something in-between": "Something in-between", "Simple and cheap": "Simple and cheap", "Unknown": "Unknown" }, "plus": { "attribute": { "confidentiality": { "data_abuse": { "Yes": "Data was misused or abused", "Yes - Data ransomed": "Data was ransomed by the threat actor, child of Yes", "Yes - Identity theft": "The data was used stealing individuals identity, child of Yes", "Yes - Financial fraud": "The data was directly used for financial fraud (ie using stolen payment cards), child of Yes", "Yes - Posted on personal forum": "The data was posted on a personal blog post or social media, child of Yes", "No": "Data was not misused or abused", "Other": "Neither 'yes' nor 'no' describes data abuse in this case.", "Unknown": "No information is known about if the data was abused" } } } } }