From 2ea56755e6c6548dc212533816dacca2efc203d1 Mon Sep 17 00:00:00 2001 From: Alex Schapiro Date: Wed, 28 Oct 2026 18:53:53 +0000 Subject: [PATCH] feat(report): tag findings with MITRE ATT&CK techniques Reports accept an optional attack_techniques list, validated against a pinned MITRE ATT&CK Enterprise v20.0 catalog of active techniques. The ids flow into vulnerabilities.json, the markdown report, and the SARIF result properties. --- strix/interface/cloud/render.py | 2 + strix/report/attack.py | 70 ++++++++++++++++++++++++++++++++ strix/report/attack_catalog.json | 1 + strix/report/sarif.py | 1 + strix/report/state.py | 4 ++ strix/report/writer.py | 1 + strix/tools/reporting/tool.py | 37 +++++++++++++++++ tests/test_reporting_fields.py | 54 ++++++++++++++++++++++++ tests/test_sarif.py | 7 ++++ 9 files changed, 177 insertions(+) create mode 100644 strix/report/attack.py create mode 100644 strix/report/attack_catalog.json diff --git a/strix/interface/cloud/render.py b/strix/interface/cloud/render.py index 69a497f3d..0e4603733 100644 --- a/strix/interface/cloud/render.py +++ b/strix/interface/cloud/render.py @@ -130,6 +130,8 @@ _DETAIL_PRIORITY_KEYS = ( "finding_type", "cve", "cwe", + "attack_techniques", + "attack_source", "cvss", "filed_at", "target", diff --git a/strix/report/attack.py b/strix/report/attack.py new file mode 100644 index 000000000..9472cba71 --- /dev/null +++ b/strix/report/attack.py @@ -0,0 +1,70 @@ +"""MITRE ATT&CK Enterprise technique ids for findings. + +The catalog is a pinned snapshot of the active (not revoked, not deprecated) +Enterprise techniques, generated from MITRE's ``attack-stix-data`` release. +""" + +from __future__ import annotations + +import json +import re +from functools import cache +from importlib.resources import files +from typing import Any + + +_TECHNIQUE_ID = re.compile(r"\bT\d{4}(?:\.\d{3})?\b", re.IGNORECASE) + + +@cache +def _catalog() -> dict[str, Any]: + raw = files("strix.report").joinpath("attack_catalog.json").read_text(encoding="utf-8") + data: dict[str, Any] = json.loads(raw) + return data + + +def attack_version() -> str: + return str(_catalog()["version"]) + + +def technique(technique_id: str) -> dict[str, Any] | None: + entry = _catalog()["techniques"].get(technique_id) + return entry if isinstance(entry, dict) else None + + +def technique_url(technique_id: str) -> str: + return f"https://attack.mitre.org/techniques/{technique_id.replace('.', '/')}/" + + +def normalize_attack_techniques(raw: Any) -> tuple[list[str], list[str]]: + """Parse technique ids from a list or string and check them against the catalog. + + Returns the ids in first-seen order and one error per id that is not an + active Enterprise technique. + """ + if raw is None: + return [], [] + items = raw if isinstance(raw, list) else [raw] + techniques: list[str] = [] + errors: list[str] = [] + for item in items: + text = str(item or "").strip() + if not text: + continue + found = [match.upper() for match in _TECHNIQUE_ID.findall(text)] + if not found: + errors.append( + f"invalid ATT&CK technique: '{text}' (expected an id like 'T1190' or 'T1059.007')" + ) + continue + for technique_id in found: + if technique_id in techniques: + continue + if technique(technique_id) is None: + errors.append( + f"unknown ATT&CK technique: '{technique_id}' is not an active " + f"MITRE ATT&CK Enterprise v{attack_version()} technique" + ) + continue + techniques.append(technique_id) + return techniques, errors diff --git a/strix/report/attack_catalog.json b/strix/report/attack_catalog.json new file mode 100644 index 000000000..be741d6ac --- /dev/null +++ b/strix/report/attack_catalog.json @@ -0,0 +1 @@ +{"domain":"enterprise-attack","version":"20.0","techniques":{"T1001":{"name":"Data Obfuscation","tactics":["command-and-control"]},"T1001.001":{"name":"Junk Data","tactics":["command-and-control"]},"T1001.002":{"name":"Steganography","tactics":["command-and-control"]},"T1001.003":{"name":"Protocol or Service Impersonation","tactics":["command-and-control"]},"T1003":{"name":"OS Credential Dumping","tactics":["credential-access"]},"T1003.001":{"name":"LSASS Memory","tactics":["credential-access"]},"T1003.002":{"name":"Security Account Manager","tactics":["credential-access"]},"T1003.003":{"name":"NTDS","tactics":["credential-access"]},"T1003.004":{"name":"LSA Secrets","tactics":["credential-access"]},"T1003.005":{"name":"Cached Domain Credentials","tactics":["credential-access"]},"T1003.006":{"name":"DCSync","tactics":["credential-access"]},"T1003.007":{"name":"Proc Filesystem","tactics":["credential-access"]},"T1003.008":{"name":"/etc/passwd and /etc/shadow","tactics":["credential-access"]},"T1005":{"name":"Data from Local System","tactics":["collection"]},"T1006":{"name":"Direct Volume Access","tactics":["stealth"]},"T1007":{"name":"System Service Discovery","tactics":["discovery"]},"T1008":{"name":"Fallback Channels","tactics":["command-and-control"]},"T1010":{"name":"Application Window Discovery","tactics":["discovery"]},"T1011":{"name":"Exfiltration Over Other Network Medium","tactics":["exfiltration"]},"T1011.001":{"name":"Exfiltration Over Bluetooth","tactics":["exfiltration"]},"T1012":{"name":"Query Registry","tactics":["discovery"]},"T1014":{"name":"Rootkit","tactics":["stealth"]},"T1016":{"name":"System Network Configuration Discovery","tactics":["discovery"]},"T1016.001":{"name":"Internet Connection Discovery","tactics":["discovery"]},"T1016.002":{"name":"Wi-Fi Discovery","tactics":["discovery"]},"T1018":{"name":"Remote System Discovery","tactics":["discovery"]},"T1020":{"name":"Automated Exfiltration","tactics":["exfiltration"]},"T1020.001":{"name":"Traffic Duplication","tactics":["exfiltration"]},"T1021":{"name":"Remote Services","tactics":["lateral-movement"]},"T1021.001":{"name":"Remote Desktop Protocol","tactics":["lateral-movement"]},"T1021.002":{"name":"SMB/Windows Admin Shares","tactics":["lateral-movement"]},"T1021.003":{"name":"Distributed Component Object Model","tactics":["lateral-movement"]},"T1021.004":{"name":"SSH","tactics":["lateral-movement"]},"T1021.005":{"name":"VNC","tactics":["lateral-movement"]},"T1021.006":{"name":"Windows Remote Management","tactics":["lateral-movement"]},"T1021.007":{"name":"Cloud Services","tactics":["lateral-movement"]},"T1021.008":{"name":"Direct Cloud VM Connections","tactics":["lateral-movement"]},"T1025":{"name":"Data from Removable Media","tactics":["collection"]},"T1027":{"name":"Obfuscated Files or Information","tactics":["stealth"]},"T1027.001":{"name":"Binary Padding","tactics":["stealth"]},"T1027.002":{"name":"Software Packing","tactics":["stealth"]},"T1027.003":{"name":"Steganography","tactics":["stealth"]},"T1027.004":{"name":"Compile After Delivery","tactics":["stealth"]},"T1027.005":{"name":"Indicator Removal from Tools","tactics":["stealth"]},"T1027.006":{"name":"HTML Smuggling","tactics":["stealth"]},"T1027.007":{"name":"Dynamic API Resolution","tactics":["stealth"]},"T1027.008":{"name":"Stripped Payloads","tactics":["stealth"]},"T1027.009":{"name":"Embedded Payloads","tactics":["stealth"]},"T1027.010":{"name":"Command Obfuscation","tactics":["stealth"]},"T1027.011":{"name":"Fileless Storage","tactics":["stealth"]},"T1027.012":{"name":"LNK Icon Smuggling","tactics":["stealth"]},"T1027.013":{"name":"Encrypted/Encoded File","tactics":["stealth"]},"T1027.014":{"name":"Polymorphic Code","tactics":["stealth"]},"T1027.015":{"name":"Compression","tactics":["stealth"]},"T1027.016":{"name":"Junk Code Insertion","tactics":["stealth"]},"T1027.017":{"name":"SVG Smuggling","tactics":["stealth"]},"T1027.018":{"name":"Invisible Unicode","tactics":["stealth"]},"T1029":{"name":"Scheduled Transfer","tactics":["exfiltration"]},"T1030":{"name":"Data Transfer Size Limits","tactics":["exfiltration"]},"T1033":{"name":"System Owner/User Discovery","tactics":["discovery"]},"T1036":{"name":"Masquerading","tactics":["stealth"]},"T1036.001":{"name":"Invalid Code Signature","tactics":["stealth"]},"T1036.002":{"name":"Right-to-Left Override","tactics":["stealth"]},"T1036.003":{"name":"Rename Legitimate Utilities","tactics":["stealth"]},"T1036.004":{"name":"Masquerade Task or Service","tactics":["stealth"]},"T1036.005":{"name":"Match Legitimate Resource Name or Location","tactics":["stealth"]},"T1036.006":{"name":"Space after Filename","tactics":["stealth"]},"T1036.007":{"name":"Double File Extension","tactics":["stealth"]},"T1036.008":{"name":"Masquerade File Type","tactics":["stealth"]},"T1036.009":{"name":"Break Process Trees","tactics":["stealth"]},"T1036.010":{"name":"Masquerade Account Name","tactics":["stealth"]},"T1036.011":{"name":"Overwrite Process Arguments","tactics":["stealth"]},"T1036.012":{"name":"Browser Fingerprint","tactics":["stealth"]},"T1037":{"name":"Boot or Logon Initialization Scripts","tactics":["persistence","privilege-escalation"]},"T1037.001":{"name":"Logon Script (Windows)","tactics":["persistence","privilege-escalation"]},"T1037.002":{"name":"Login Hook","tactics":["persistence","privilege-escalation"]},"T1037.003":{"name":"Network Logon Script","tactics":["persistence","privilege-escalation"]},"T1037.004":{"name":"RC Scripts","tactics":["persistence","privilege-escalation"]},"T1037.005":{"name":"Startup Items","tactics":["persistence","privilege-escalation"]},"T1039":{"name":"Data from Network Shared Drive","tactics":["collection"]},"T1040":{"name":"Network Sniffing","tactics":["credential-access","discovery"]},"T1041":{"name":"Exfiltration Over C2 Channel","tactics":["exfiltration"]},"T1046":{"name":"Network Service Discovery","tactics":["discovery"]},"T1047":{"name":"Windows Management Instrumentation","tactics":["execution"]},"T1048":{"name":"Exfiltration Over Alternative Protocol","tactics":["exfiltration"]},"T1048.001":{"name":"Exfiltration Over Symmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"]},"T1048.002":{"name":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","tactics":["exfiltration"]},"T1048.003":{"name":"Exfiltration Over Unencrypted Non-C2 Protocol","tactics":["exfiltration"]},"T1049":{"name":"System Network Connections Discovery","tactics":["discovery"]},"T1052":{"name":"Exfiltration Over Physical Medium","tactics":["exfiltration"]},"T1052.001":{"name":"Exfiltration over USB","tactics":["exfiltration"]},"T1053":{"name":"Scheduled Task/Job","tactics":["execution","persistence","privilege-escalation"]},"T1053.002":{"name":"At","tactics":["execution","persistence","privilege-escalation"]},"T1053.003":{"name":"Cron","tactics":["execution","persistence","privilege-escalation"]},"T1053.005":{"name":"Scheduled Task","tactics":["execution","persistence","privilege-escalation"]},"T1053.006":{"name":"Systemd Timers","tactics":["execution","persistence","privilege-escalation"]},"T1053.007":{"name":"Container Orchestration Job","tactics":["execution","persistence","privilege-escalation"]},"T1055":{"name":"Process Injection","tactics":["privilege-escalation","stealth"]},"T1055.001":{"name":"Dynamic-link Library Injection","tactics":["privilege-escalation","stealth"]},"T1055.002":{"name":"Portable Executable Injection","tactics":["privilege-escalation","stealth"]},"T1055.003":{"name":"Thread Execution Hijacking","tactics":["privilege-escalation","stealth"]},"T1055.004":{"name":"Asynchronous Procedure Call","tactics":["privilege-escalation","stealth"]},"T1055.005":{"name":"Thread Local Storage","tactics":["privilege-escalation","stealth"]},"T1055.008":{"name":"Ptrace System Calls","tactics":["privilege-escalation","stealth"]},"T1055.009":{"name":"Proc Memory","tactics":["privilege-escalation","stealth"]},"T1055.011":{"name":"Extra Window Memory Injection","tactics":["privilege-escalation","stealth"]},"T1055.012":{"name":"Process Hollowing","tactics":["privilege-escalation","stealth"]},"T1055.013":{"name":"Process Doppelgänging","tactics":["privilege-escalation","stealth"]},"T1055.014":{"name":"VDSO Hijacking","tactics":["privilege-escalation","stealth"]},"T1055.015":{"name":"ListPlanting","tactics":["privilege-escalation","stealth"]},"T1056":{"name":"Input Capture","tactics":["collection","credential-access"]},"T1056.001":{"name":"Keylogging","tactics":["collection","credential-access"]},"T1056.002":{"name":"GUI Input Capture","tactics":["collection","credential-access"]},"T1056.003":{"name":"Web Portal Capture","tactics":["collection","credential-access"]},"T1056.004":{"name":"Credential API Hooking","tactics":["collection","credential-access"]},"T1057":{"name":"Process Discovery","tactics":["discovery"]},"T1059":{"name":"Command and Scripting Interpreter","tactics":["execution"]},"T1059.001":{"name":"PowerShell","tactics":["execution"]},"T1059.002":{"name":"AppleScript","tactics":["execution"]},"T1059.003":{"name":"Windows Command Shell","tactics":["execution"]},"T1059.004":{"name":"Unix Shell","tactics":["execution"]},"T1059.005":{"name":"Visual Basic","tactics":["execution"]},"T1059.006":{"name":"Python","tactics":["execution"]},"T1059.007":{"name":"JavaScript","tactics":["execution"]},"T1059.008":{"name":"Network Device CLI","tactics":["execution"]},"T1059.009":{"name":"Cloud API","tactics":["execution"]},"T1059.010":{"name":"AutoHotKey & AutoIT","tactics":["execution"]},"T1059.011":{"name":"Lua","tactics":["execution"]},"T1059.012":{"name":"Hypervisor CLI","tactics":["execution"]},"T1059.013":{"name":"Container CLI/API","tactics":["execution"]},"T1068":{"name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"]},"T1069":{"name":"Permission Groups Discovery","tactics":["discovery"]},"T1069.001":{"name":"Local Groups","tactics":["discovery"]},"T1069.002":{"name":"Domain Groups","tactics":["discovery"]},"T1069.003":{"name":"Cloud Groups","tactics":["discovery"]},"T1070":{"name":"Indicator Removal","tactics":["stealth"]},"T1070.003":{"name":"Clear Command History","tactics":["stealth"]},"T1070.004":{"name":"File Deletion","tactics":["stealth"]},"T1070.005":{"name":"Network Share Connection Removal","tactics":["stealth"]},"T1070.006":{"name":"Timestomp","tactics":["stealth"]},"T1070.007":{"name":"Clear Network Connection History and Configurations","tactics":["stealth"]},"T1070.008":{"name":"Clear Mailbox Data","tactics":["stealth"]},"T1070.009":{"name":"Clear Persistence","tactics":["stealth"]},"T1070.010":{"name":"Relocate Malware","tactics":["stealth"]},"T1071":{"name":"Application Layer Protocol","tactics":["command-and-control"]},"T1071.001":{"name":"Web Protocols","tactics":["command-and-control"]},"T1071.002":{"name":"File Transfer Protocols","tactics":["command-and-control"]},"T1071.003":{"name":"Mail Protocols","tactics":["command-and-control"]},"T1071.004":{"name":"DNS","tactics":["command-and-control"]},"T1071.005":{"name":"Publish/Subscribe Protocols","tactics":["command-and-control"]},"T1072":{"name":"Software Deployment Tools","tactics":["execution","lateral-movement"]},"T1074":{"name":"Data Staged","tactics":["collection"]},"T1074.001":{"name":"Local Data Staging","tactics":["collection"]},"T1074.002":{"name":"Remote Data Staging","tactics":["collection"]},"T1078":{"name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"]},"T1078.001":{"name":"Default Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"]},"T1078.002":{"name":"Domain Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"]},"T1078.003":{"name":"Local Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"]},"T1078.004":{"name":"Cloud Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"]},"T1080":{"name":"Taint Shared Content","tactics":["lateral-movement"]},"T1082":{"name":"System Information Discovery","tactics":["discovery"]},"T1083":{"name":"File and Directory Discovery","tactics":["discovery"]},"T1087":{"name":"Account Discovery","tactics":["discovery"]},"T1087.001":{"name":"Local Account","tactics":["discovery"]},"T1087.002":{"name":"Domain Account","tactics":["discovery"]},"T1087.003":{"name":"Email Account","tactics":["discovery"]},"T1087.004":{"name":"Cloud Account","tactics":["discovery"]},"T1090":{"name":"Proxy","tactics":["command-and-control"]},"T1090.001":{"name":"Internal Proxy","tactics":["command-and-control"]},"T1090.002":{"name":"External Proxy","tactics":["command-and-control"]},"T1090.003":{"name":"Multi-hop Proxy","tactics":["command-and-control"]},"T1090.004":{"name":"Domain Fronting","tactics":["command-and-control"]},"T1091":{"name":"Replication Through Removable Media","tactics":["initial-access","lateral-movement"]},"T1092":{"name":"Communication Through Removable Media","tactics":["command-and-control"]},"T1095":{"name":"Non-Application Layer Protocol","tactics":["command-and-control"]},"T1098":{"name":"Account Manipulation","tactics":["persistence","privilege-escalation"]},"T1098.001":{"name":"Additional Cloud Credentials","tactics":["persistence","privilege-escalation"]},"T1098.002":{"name":"Additional Email Delegate Permissions","tactics":["persistence","privilege-escalation"]},"T1098.003":{"name":"Additional Cloud Roles","tactics":["persistence","privilege-escalation"]},"T1098.004":{"name":"SSH Authorized Keys","tactics":["persistence","privilege-escalation"]},"T1098.005":{"name":"Device Registration","tactics":["persistence","privilege-escalation"]},"T1098.006":{"name":"Additional Container Cluster Roles","tactics":["persistence","privilege-escalation"]},"T1098.007":{"name":"Additional Local or Domain Groups","tactics":["persistence","privilege-escalation"]},"T1102":{"name":"Web Service","tactics":["command-and-control"]},"T1102.001":{"name":"Dead Drop Resolver","tactics":["command-and-control"]},"T1102.002":{"name":"Bidirectional Communication","tactics":["command-and-control"]},"T1102.003":{"name":"One-Way Communication","tactics":["command-and-control"]},"T1104":{"name":"Multi-Stage Channels","tactics":["command-and-control"]},"T1105":{"name":"Ingress Tool Transfer","tactics":["command-and-control"]},"T1106":{"name":"Native API","tactics":["execution"]},"T1110":{"name":"Brute Force","tactics":["credential-access"]},"T1110.001":{"name":"Password Guessing","tactics":["credential-access"]},"T1110.002":{"name":"Password Cracking","tactics":["credential-access"]},"T1110.003":{"name":"Password Spraying","tactics":["credential-access"]},"T1110.004":{"name":"Credential Stuffing","tactics":["credential-access"]},"T1111":{"name":"Multi-Factor Authentication Interception","tactics":["credential-access"]},"T1112":{"name":"Modify Registry","tactics":["defense-impairment","persistence"]},"T1113":{"name":"Screen Capture","tactics":["collection"]},"T1114":{"name":"Email Collection","tactics":["collection"]},"T1114.001":{"name":"Local Email Collection","tactics":["collection"]},"T1114.002":{"name":"Remote Email Collection","tactics":["collection"]},"T1114.003":{"name":"Email Forwarding Rule","tactics":["collection"]},"T1115":{"name":"Clipboard Data","tactics":["collection"]},"T1119":{"name":"Automated Collection","tactics":["collection"]},"T1120":{"name":"Peripheral Device Discovery","tactics":["discovery"]},"T1123":{"name":"Audio Capture","tactics":["collection"]},"T1124":{"name":"System Time Discovery","tactics":["discovery"]},"T1125":{"name":"Video Capture","tactics":["collection"]},"T1127":{"name":"Trusted Developer Utilities Proxy Execution","tactics":["execution","stealth"]},"T1127.001":{"name":"MSBuild","tactics":["execution","stealth"]},"T1127.002":{"name":"ClickOnce","tactics":["execution","stealth"]},"T1127.003":{"name":"JamPlus","tactics":["execution","stealth"]},"T1129":{"name":"Shared Modules","tactics":["execution"]},"T1132":{"name":"Data Encoding","tactics":["command-and-control"]},"T1132.001":{"name":"Standard Encoding","tactics":["command-and-control"]},"T1132.002":{"name":"Non-Standard Encoding","tactics":["command-and-control"]},"T1133":{"name":"External Remote Services","tactics":["initial-access","persistence"]},"T1134":{"name":"Access Token Manipulation","tactics":["privilege-escalation","stealth"]},"T1134.001":{"name":"Token Impersonation/Theft","tactics":["privilege-escalation","stealth"]},"T1134.002":{"name":"Create Process with Token","tactics":["privilege-escalation","stealth"]},"T1134.003":{"name":"Make and Impersonate Token","tactics":["privilege-escalation","stealth"]},"T1134.004":{"name":"Parent PID Spoofing","tactics":["privilege-escalation","stealth"]},"T1134.005":{"name":"SID-History Injection","tactics":["privilege-escalation","stealth"]},"T1135":{"name":"Network Share Discovery","tactics":["discovery"]},"T1136":{"name":"Create Account","tactics":["persistence"]},"T1136.001":{"name":"Local Account","tactics":["persistence"]},"T1136.002":{"name":"Domain Account","tactics":["persistence"]},"T1136.003":{"name":"Cloud Account","tactics":["persistence"]},"T1137":{"name":"Office Application Startup","tactics":["persistence"]},"T1137.001":{"name":"Office Template Macros","tactics":["persistence"]},"T1137.002":{"name":"Office Test","tactics":["persistence"]},"T1137.003":{"name":"Outlook Forms","tactics":["persistence"]},"T1137.004":{"name":"Outlook Home Page","tactics":["persistence"]},"T1137.005":{"name":"Outlook Rules","tactics":["persistence"]},"T1137.006":{"name":"Add-ins","tactics":["persistence"]},"T1140":{"name":"Deobfuscate/Decode Files or Information","tactics":["stealth"]},"T1176":{"name":"Software Extensions","tactics":["persistence"]},"T1176.001":{"name":"Browser Extensions","tactics":["persistence"]},"T1176.002":{"name":"IDE Extensions","tactics":["persistence"]},"T1185":{"name":"Browser Session Hijacking","tactics":["collection"]},"T1187":{"name":"Forced Authentication","tactics":["credential-access"]},"T1189":{"name":"Drive-by Compromise","tactics":["initial-access"]},"T1190":{"name":"Exploit Public-Facing Application","tactics":["initial-access"]},"T1195":{"name":"Supply Chain Compromise","tactics":["initial-access"]},"T1195.001":{"name":"Compromise Software Dependencies and Development Tools","tactics":["initial-access"]},"T1195.002":{"name":"Compromise Software Supply Chain","tactics":["initial-access"]},"T1195.003":{"name":"Compromise Hardware Supply Chain","tactics":["initial-access"]},"T1197":{"name":"BITS Jobs","tactics":["execution","persistence","stealth"]},"T1199":{"name":"Trusted Relationship","tactics":["initial-access"]},"T1200":{"name":"Hardware Additions","tactics":["initial-access"]},"T1201":{"name":"Password Policy Discovery","tactics":["discovery"]},"T1202":{"name":"Indirect Command Execution","tactics":["stealth"]},"T1203":{"name":"Exploitation for Client Execution","tactics":["execution"]},"T1204":{"name":"User Execution","tactics":["execution"]},"T1204.001":{"name":"Malicious Link","tactics":["execution"]},"T1204.002":{"name":"Malicious File","tactics":["execution"]},"T1204.003":{"name":"Malicious Image","tactics":["execution"]},"T1204.004":{"name":"Malicious Copy and Paste","tactics":["execution"]},"T1204.005":{"name":"Malicious Library","tactics":["execution"]},"T1205":{"name":"Traffic Signaling","tactics":["command-and-control","persistence","stealth"]},"T1205.001":{"name":"Port Knocking","tactics":["command-and-control","persistence","stealth"]},"T1205.002":{"name":"Socket Filters","tactics":["command-and-control","persistence","stealth"]},"T1207":{"name":"Rogue Domain Controller","tactics":["defense-impairment"]},"T1210":{"name":"Exploitation of Remote Services","tactics":["lateral-movement"]},"T1211":{"name":"Exploitation for Stealth","tactics":["stealth"]},"T1212":{"name":"Exploitation for Credential Access","tactics":["credential-access"]},"T1213":{"name":"Data from Information Repositories","tactics":["collection"]},"T1213.001":{"name":"Confluence","tactics":["collection"]},"T1213.002":{"name":"Sharepoint","tactics":["collection"]},"T1213.003":{"name":"Code Repositories","tactics":["collection"]},"T1213.004":{"name":"Customer Relationship Management Software","tactics":["collection"]},"T1213.005":{"name":"Messaging Applications","tactics":["collection"]},"T1213.006":{"name":"Databases","tactics":["collection"]},"T1216":{"name":"System Script Proxy Execution","tactics":["stealth"]},"T1216.001":{"name":"PubPrn","tactics":["stealth"]},"T1216.002":{"name":"SyncAppvPublishingServer","tactics":["stealth"]},"T1217":{"name":"Browser Information Discovery","tactics":["discovery"]},"T1218":{"name":"System Binary Proxy Execution","tactics":["stealth"]},"T1218.001":{"name":"Compiled HTML File","tactics":["stealth"]},"T1218.002":{"name":"Control Panel","tactics":["stealth"]},"T1218.003":{"name":"CMSTP","tactics":["stealth"]},"T1218.004":{"name":"InstallUtil","tactics":["stealth"]},"T1218.005":{"name":"Mshta","tactics":["stealth"]},"T1218.007":{"name":"Msiexec","tactics":["stealth"]},"T1218.008":{"name":"Odbcconf","tactics":["stealth"]},"T1218.009":{"name":"Regsvcs/Regasm","tactics":["stealth"]},"T1218.010":{"name":"Regsvr32","tactics":["stealth"]},"T1218.011":{"name":"Rundll32","tactics":["stealth"]},"T1218.012":{"name":"Verclsid","tactics":["stealth"]},"T1218.013":{"name":"Mavinject","tactics":["stealth"]},"T1218.014":{"name":"MMC","tactics":["stealth"]},"T1218.015":{"name":"Electron Applications","tactics":["stealth"]},"T1219":{"name":"Remote Access Tools","tactics":["command-and-control"]},"T1219.001":{"name":"IDE Tunneling","tactics":["command-and-control"]},"T1219.002":{"name":"Remote Desktop Software","tactics":["command-and-control"]},"T1219.003":{"name":"Remote Access Hardware","tactics":["command-and-control"]},"T1220":{"name":"XSL Script Processing","tactics":["stealth"]},"T1221":{"name":"Template Injection","tactics":["stealth"]},"T1222":{"name":"File and Directory Permissions Modification","tactics":["defense-impairment"]},"T1222.001":{"name":"Windows Permissions","tactics":["defense-impairment"]},"T1222.002":{"name":"Linux and Mac Permissions","tactics":["defense-impairment"]},"T1480":{"name":"Execution Guardrails","tactics":["stealth"]},"T1480.001":{"name":"Environmental Keying","tactics":["stealth"]},"T1480.002":{"name":"Mutual Exclusion","tactics":["stealth"]},"T1482":{"name":"Domain Trust Discovery","tactics":["discovery"]},"T1484":{"name":"Domain or Tenant Policy Modification","tactics":["defense-impairment","privilege-escalation"]},"T1484.001":{"name":"Group Policy Modification","tactics":["defense-impairment","privilege-escalation"]},"T1484.002":{"name":"Trust Modification","tactics":["defense-impairment","privilege-escalation"]},"T1485":{"name":"Data Destruction","tactics":["impact"]},"T1485.001":{"name":"Lifecycle-Triggered Deletion","tactics":["impact"]},"T1486":{"name":"Data Encrypted for Impact","tactics":["impact"]},"T1489":{"name":"Service Stop","tactics":["impact"]},"T1490":{"name":"Inhibit System Recovery","tactics":["impact"]},"T1491":{"name":"Defacement","tactics":["impact"]},"T1491.001":{"name":"Internal Defacement","tactics":["impact"]},"T1491.002":{"name":"External Defacement","tactics":["impact"]},"T1495":{"name":"Firmware Corruption","tactics":["impact"]},"T1496":{"name":"Resource Hijacking","tactics":["impact"]},"T1496.001":{"name":"Compute Hijacking","tactics":["impact"]},"T1496.002":{"name":"Bandwidth Hijacking","tactics":["impact"]},"T1496.003":{"name":"SMS Pumping","tactics":["impact"]},"T1496.004":{"name":"Cloud Service Hijacking","tactics":["impact"]},"T1497":{"name":"Virtualization/Sandbox Evasion","tactics":["discovery","stealth"]},"T1497.001":{"name":"System Checks","tactics":["discovery","stealth"]},"T1497.002":{"name":"User Activity Based Checks","tactics":["discovery","stealth"]},"T1497.003":{"name":"Time Based Checks","tactics":["discovery","stealth"]},"T1498":{"name":"Network Denial of Service","tactics":["impact"]},"T1498.001":{"name":"Direct Network Flood","tactics":["impact"]},"T1498.002":{"name":"Reflection Amplification","tactics":["impact"]},"T1499":{"name":"Endpoint Denial of Service","tactics":["impact"]},"T1499.001":{"name":"OS Exhaustion Flood","tactics":["impact"]},"T1499.002":{"name":"Service Exhaustion Flood","tactics":["impact"]},"T1499.003":{"name":"Application Exhaustion Flood","tactics":["impact"]},"T1499.004":{"name":"Application or System Exploitation","tactics":["impact"]},"T1505":{"name":"Server Software Component","tactics":["persistence"]},"T1505.001":{"name":"SQL Stored Procedures","tactics":["persistence"]},"T1505.002":{"name":"Transport Agent","tactics":["persistence"]},"T1505.003":{"name":"Web Shell","tactics":["persistence"]},"T1505.004":{"name":"IIS Components","tactics":["persistence"]},"T1505.005":{"name":"Terminal Services DLL","tactics":["persistence"]},"T1505.006":{"name":"vSphere Installation Bundles","tactics":["persistence"]},"T1518":{"name":"Software Discovery","tactics":["discovery"]},"T1518.001":{"name":"Security Software Discovery","tactics":["discovery"]},"T1518.002":{"name":"Backup Software Discovery","tactics":["discovery"]},"T1525":{"name":"Implant Internal Image","tactics":["persistence"]},"T1526":{"name":"Cloud Service Discovery","tactics":["discovery"]},"T1528":{"name":"Steal Application Access Token","tactics":["credential-access"]},"T1529":{"name":"System Shutdown/Reboot","tactics":["impact"]},"T1530":{"name":"Data from Cloud Storage","tactics":["collection"]},"T1531":{"name":"Account Access Removal","tactics":["impact"]},"T1534":{"name":"Internal Spearphishing","tactics":["lateral-movement"]},"T1535":{"name":"Unused/Unsupported Cloud Regions","tactics":["stealth"]},"T1537":{"name":"Transfer Data to Cloud Account","tactics":["exfiltration"]},"T1538":{"name":"Cloud Service Dashboard","tactics":["discovery"]},"T1539":{"name":"Steal Web Session Cookie","tactics":["credential-access"]},"T1542":{"name":"Pre-OS Boot","tactics":["persistence","stealth"]},"T1542.001":{"name":"System Firmware","tactics":["persistence","stealth"]},"T1542.002":{"name":"Component Firmware","tactics":["persistence","stealth"]},"T1542.003":{"name":"Bootkit","tactics":["persistence","stealth"]},"T1542.004":{"name":"ROMMONkit","tactics":["persistence","stealth"]},"T1542.005":{"name":"TFTP Boot","tactics":["persistence","stealth"]},"T1543":{"name":"Create or Modify System Process","tactics":["persistence","privilege-escalation"]},"T1543.001":{"name":"Launch Agent","tactics":["persistence","privilege-escalation"]},"T1543.002":{"name":"Systemd Service","tactics":["persistence","privilege-escalation"]},"T1543.003":{"name":"Windows Service","tactics":["persistence","privilege-escalation"]},"T1543.004":{"name":"Launch Daemon","tactics":["persistence","privilege-escalation"]},"T1543.005":{"name":"Container Service","tactics":["persistence","privilege-escalation"]},"T1546":{"name":"Event Triggered Execution","tactics":["persistence","privilege-escalation"]},"T1546.001":{"name":"Change Default File Association","tactics":["persistence","privilege-escalation"]},"T1546.002":{"name":"Screensaver","tactics":["persistence","privilege-escalation"]},"T1546.003":{"name":"Windows Management Instrumentation Event Subscription","tactics":["persistence","privilege-escalation"]},"T1546.004":{"name":"Unix Shell Configuration Modification","tactics":["persistence","privilege-escalation"]},"T1546.005":{"name":"Trap","tactics":["persistence","privilege-escalation"]},"T1546.006":{"name":"LC_LOAD_DYLIB Addition","tactics":["persistence","privilege-escalation"]},"T1546.007":{"name":"Netsh Helper DLL","tactics":["persistence","privilege-escalation"]},"T1546.008":{"name":"Accessibility Features","tactics":["persistence","privilege-escalation"]},"T1546.009":{"name":"AppCert DLLs","tactics":["persistence","privilege-escalation"]},"T1546.010":{"name":"AppInit DLLs","tactics":["persistence","privilege-escalation"]},"T1546.011":{"name":"Application Shimming","tactics":["persistence","privilege-escalation"]},"T1546.012":{"name":"Image File Execution Options Injection","tactics":["persistence","privilege-escalation"]},"T1546.013":{"name":"PowerShell Profile","tactics":["persistence","privilege-escalation"]},"T1546.014":{"name":"Emond","tactics":["persistence","privilege-escalation"]},"T1546.015":{"name":"Component Object Model Hijacking","tactics":["persistence","privilege-escalation"]},"T1546.016":{"name":"Installer Packages","tactics":["persistence","privilege-escalation"]},"T1546.017":{"name":"Udev Rules","tactics":["persistence","privilege-escalation"]},"T1546.018":{"name":"Python Startup Hooks","tactics":["persistence","privilege-escalation"]},"T1547":{"name":"Boot or Logon Autostart Execution","tactics":["persistence","privilege-escalation"]},"T1547.001":{"name":"Registry Run Keys / Startup Folder","tactics":["persistence","privilege-escalation"]},"T1547.002":{"name":"Authentication Package","tactics":["persistence","privilege-escalation"]},"T1547.003":{"name":"Time Providers","tactics":["persistence","privilege-escalation"]},"T1547.004":{"name":"Winlogon Helper DLL","tactics":["persistence","privilege-escalation"]},"T1547.005":{"name":"Security Support Provider","tactics":["persistence","privilege-escalation"]},"T1547.006":{"name":"Kernel Modules and Extensions","tactics":["persistence","privilege-escalation"]},"T1547.007":{"name":"Re-opened Applications","tactics":["persistence","privilege-escalation"]},"T1547.008":{"name":"LSASS Driver","tactics":["persistence","privilege-escalation"]},"T1547.009":{"name":"Shortcut Modification","tactics":["persistence","privilege-escalation"]},"T1547.010":{"name":"Port Monitors","tactics":["persistence","privilege-escalation"]},"T1547.012":{"name":"Print Processors","tactics":["persistence","privilege-escalation"]},"T1547.013":{"name":"XDG Autostart Entries","tactics":["persistence","privilege-escalation"]},"T1547.014":{"name":"Active Setup","tactics":["persistence","privilege-escalation"]},"T1547.015":{"name":"Login Items","tactics":["persistence","privilege-escalation"]},"T1548":{"name":"Abuse Elevation Control Mechanism","tactics":["privilege-escalation"]},"T1548.001":{"name":"Setuid and Setgid","tactics":["privilege-escalation"]},"T1548.002":{"name":"Bypass User Account Control","tactics":["privilege-escalation"]},"T1548.003":{"name":"Sudo and Sudo Caching","tactics":["privilege-escalation"]},"T1548.004":{"name":"Elevated Execution with Prompt","tactics":["privilege-escalation"]},"T1548.005":{"name":"Temporary Elevated Cloud Access","tactics":["privilege-escalation"]},"T1548.006":{"name":"TCC Manipulation","tactics":["privilege-escalation"]},"T1550":{"name":"Use Alternate Authentication Material","tactics":["lateral-movement"]},"T1550.001":{"name":"Application Access Token","tactics":["lateral-movement"]},"T1550.002":{"name":"Pass the Hash","tactics":["lateral-movement"]},"T1550.003":{"name":"Pass the Ticket","tactics":["lateral-movement"]},"T1550.004":{"name":"Web Session Cookie","tactics":["lateral-movement"]},"T1552":{"name":"Unsecured Credentials","tactics":["credential-access"]},"T1552.001":{"name":"Credentials In Files","tactics":["credential-access"]},"T1552.002":{"name":"Credentials in Registry","tactics":["credential-access"]},"T1552.003":{"name":"Shell History","tactics":["credential-access"]},"T1552.004":{"name":"Private Keys","tactics":["credential-access"]},"T1552.005":{"name":"Cloud Instance Metadata API","tactics":["credential-access"]},"T1552.006":{"name":"Group Policy Preferences","tactics":["credential-access"]},"T1552.007":{"name":"Container API","tactics":["credential-access"]},"T1552.008":{"name":"Chat Messages","tactics":["credential-access"]},"T1553":{"name":"Subvert Trust Controls","tactics":["defense-impairment"]},"T1553.001":{"name":"Gatekeeper Bypass","tactics":["defense-impairment"]},"T1553.002":{"name":"Code Signing","tactics":["defense-impairment"]},"T1553.003":{"name":"SIP and Trust Provider Hijacking","tactics":["defense-impairment"]},"T1553.004":{"name":"Install Root Certificate","tactics":["defense-impairment"]},"T1553.005":{"name":"Mark-of-the-Web Bypass","tactics":["defense-impairment"]},"T1553.006":{"name":"Code Signing Policy Modification","tactics":["defense-impairment"]},"T1554":{"name":"Compromise Host Software Binary","tactics":["persistence"]},"T1555":{"name":"Credentials from Password Stores","tactics":["credential-access"]},"T1555.001":{"name":"Keychain","tactics":["credential-access"]},"T1555.002":{"name":"Securityd Memory","tactics":["credential-access"]},"T1555.003":{"name":"Credentials from Web Browsers","tactics":["credential-access"]},"T1555.004":{"name":"Windows Credential Manager","tactics":["credential-access"]},"T1555.005":{"name":"Password Managers","tactics":["credential-access"]},"T1555.006":{"name":"Cloud Secrets Management Stores","tactics":["credential-access"]},"T1556":{"name":"Modify Authentication Process","tactics":["credential-access","defense-impairment","persistence"]},"T1556.001":{"name":"Domain Controller Authentication","tactics":["credential-access","defense-impairment","persistence"]},"T1556.002":{"name":"Password Filter DLL","tactics":["credential-access","defense-impairment","persistence"]},"T1556.003":{"name":"Pluggable Authentication Modules","tactics":["credential-access","defense-impairment","persistence"]},"T1556.004":{"name":"Network Device Authentication","tactics":["credential-access","defense-impairment","persistence"]},"T1556.005":{"name":"Reversible Encryption","tactics":["credential-access","defense-impairment","persistence"]},"T1556.006":{"name":"Multi-Factor Authentication","tactics":["credential-access","defense-impairment","persistence"]},"T1556.007":{"name":"Hybrid Identity","tactics":["credential-access","defense-impairment","persistence"]},"T1556.008":{"name":"Network Provider DLL","tactics":["credential-access","defense-impairment","persistence"]},"T1556.009":{"name":"Conditional Access Policies","tactics":["credential-access","defense-impairment","persistence"]},"T1557":{"name":"Adversary-in-the-Middle","tactics":["collection","credential-access"]},"T1557.001":{"name":"Name Resolution Poisoning and SMB Relay","tactics":["collection","credential-access"]},"T1557.002":{"name":"ARP Cache Poisoning","tactics":["collection","credential-access"]},"T1557.003":{"name":"DHCP Spoofing","tactics":["collection","credential-access"]},"T1557.004":{"name":"Evil Twin","tactics":["collection","credential-access"]},"T1558":{"name":"Steal or Forge Kerberos Tickets","tactics":["credential-access"]},"T1558.001":{"name":"Golden Ticket","tactics":["credential-access"]},"T1558.002":{"name":"Silver Ticket","tactics":["credential-access"]},"T1558.003":{"name":"Kerberoasting","tactics":["credential-access"]},"T1558.004":{"name":"AS-REP Roasting","tactics":["credential-access"]},"T1558.005":{"name":"Ccache Files","tactics":["credential-access"]},"T1559":{"name":"Inter-Process Communication","tactics":["execution"]},"T1559.001":{"name":"Component Object Model","tactics":["execution"]},"T1559.002":{"name":"Dynamic Data Exchange","tactics":["execution"]},"T1559.003":{"name":"XPC Services","tactics":["execution"]},"T1560":{"name":"Archive Collected Data","tactics":["collection"]},"T1560.001":{"name":"Archive via Utility","tactics":["collection"]},"T1560.002":{"name":"Archive via Library","tactics":["collection"]},"T1560.003":{"name":"Archive via Custom Method","tactics":["collection"]},"T1561":{"name":"Disk Wipe","tactics":["impact"]},"T1561.001":{"name":"Disk Content Wipe","tactics":["impact"]},"T1561.002":{"name":"Disk Structure Wipe","tactics":["impact"]},"T1563":{"name":"Remote Service Session Hijacking","tactics":["lateral-movement"]},"T1563.001":{"name":"SSH Hijacking","tactics":["lateral-movement"]},"T1563.002":{"name":"RDP Hijacking","tactics":["lateral-movement"]},"T1564":{"name":"Hide Artifacts","tactics":["stealth"]},"T1564.001":{"name":"Hidden Files and Directories","tactics":["stealth"]},"T1564.002":{"name":"Hidden Users","tactics":["stealth"]},"T1564.003":{"name":"Hidden Window","tactics":["stealth"]},"T1564.004":{"name":"NTFS File Attributes","tactics":["stealth"]},"T1564.005":{"name":"Hidden File System","tactics":["stealth"]},"T1564.006":{"name":"Run Virtual Instance","tactics":["stealth"]},"T1564.007":{"name":"VBA Stomping","tactics":["stealth"]},"T1564.008":{"name":"Email Hiding Rules","tactics":["stealth"]},"T1564.009":{"name":"Resource Forking","tactics":["stealth"]},"T1564.010":{"name":"Process Argument Spoofing","tactics":["stealth"]},"T1564.011":{"name":"Ignore Process Interrupts","tactics":["stealth"]},"T1564.012":{"name":"File/Path Exclusions","tactics":["stealth"]},"T1564.013":{"name":"Bind Mounts","tactics":["stealth"]},"T1564.014":{"name":"Extended Attributes","tactics":["stealth"]},"T1565":{"name":"Data Manipulation","tactics":["impact"]},"T1565.001":{"name":"Stored Data Manipulation","tactics":["impact"]},"T1565.002":{"name":"Transmitted Data Manipulation","tactics":["impact"]},"T1565.003":{"name":"Runtime Data Manipulation","tactics":["impact"]},"T1566":{"name":"Phishing","tactics":["initial-access"]},"T1566.001":{"name":"Spearphishing Attachment","tactics":["initial-access"]},"T1566.002":{"name":"Spearphishing Link","tactics":["initial-access"]},"T1566.003":{"name":"Spearphishing via Service","tactics":["initial-access"]},"T1566.004":{"name":"Spearphishing Voice","tactics":["initial-access"]},"T1567":{"name":"Exfiltration Over Web Service","tactics":["exfiltration"]},"T1567.001":{"name":"Exfiltration to Code Repository","tactics":["exfiltration"]},"T1567.002":{"name":"Exfiltration to Cloud Storage","tactics":["exfiltration"]},"T1567.003":{"name":"Exfiltration to Text Storage Sites","tactics":["exfiltration"]},"T1567.004":{"name":"Exfiltration Over Webhook","tactics":["exfiltration"]},"T1568":{"name":"Dynamic Resolution","tactics":["command-and-control"]},"T1568.001":{"name":"Fast Flux DNS","tactics":["command-and-control"]},"T1568.002":{"name":"Domain Generation Algorithms","tactics":["command-and-control"]},"T1568.003":{"name":"DNS Calculation","tactics":["command-and-control"]},"T1569":{"name":"System Services","tactics":["execution"]},"T1569.001":{"name":"Launchctl","tactics":["execution"]},"T1569.002":{"name":"Service Execution","tactics":["execution"]},"T1569.003":{"name":"Systemctl","tactics":["execution"]},"T1570":{"name":"Lateral Tool Transfer","tactics":["lateral-movement"]},"T1571":{"name":"Non-Standard Port","tactics":["command-and-control"]},"T1572":{"name":"Protocol Tunneling","tactics":["command-and-control"]},"T1573":{"name":"Encrypted Channel","tactics":["command-and-control"]},"T1573.001":{"name":"Symmetric Cryptography","tactics":["command-and-control"]},"T1573.002":{"name":"Asymmetric Cryptography","tactics":["command-and-control"]},"T1574":{"name":"Hijack Execution Flow","tactics":["execution","stealth"]},"T1574.001":{"name":"DLL","tactics":["execution","stealth"]},"T1574.004":{"name":"Dylib Hijacking","tactics":["execution","stealth"]},"T1574.005":{"name":"Executable Installer File Permissions Weakness","tactics":["execution","stealth"]},"T1574.006":{"name":"Dynamic Linker Hijacking","tactics":["execution","stealth"]},"T1574.007":{"name":"Path Interception by PATH Environment Variable","tactics":["execution","stealth"]},"T1574.008":{"name":"Path Interception by Search Order Hijacking","tactics":["execution","stealth"]},"T1574.009":{"name":"Path Interception by Unquoted Path","tactics":["execution","stealth"]},"T1574.010":{"name":"Services File Permissions Weakness","tactics":["execution","stealth"]},"T1574.011":{"name":"Services Registry Permissions Weakness","tactics":["execution","stealth"]},"T1574.012":{"name":"COR_PROFILER","tactics":["execution","stealth"]},"T1574.013":{"name":"KernelCallbackTable","tactics":["execution","stealth"]},"T1574.014":{"name":"AppDomainManager","tactics":["execution","stealth"]},"T1578":{"name":"Modify Cloud Compute Infrastructure","tactics":["defense-impairment"]},"T1578.001":{"name":"Create Snapshot","tactics":["defense-impairment"]},"T1578.002":{"name":"Create Cloud Instance","tactics":["defense-impairment"]},"T1578.003":{"name":"Delete Cloud Instance","tactics":["defense-impairment"]},"T1578.004":{"name":"Revert Cloud Instance","tactics":["defense-impairment"]},"T1578.005":{"name":"Modify Cloud Compute Configurations","tactics":["defense-impairment"]},"T1580":{"name":"Cloud Infrastructure Discovery","tactics":["discovery"]},"T1583":{"name":"Acquire Infrastructure","tactics":["resource-development"]},"T1583.001":{"name":"Domains","tactics":["resource-development"]},"T1583.002":{"name":"DNS Server","tactics":["resource-development"]},"T1583.003":{"name":"Virtual Private Server","tactics":["resource-development"]},"T1583.004":{"name":"Server","tactics":["resource-development"]},"T1583.005":{"name":"Botnet","tactics":["resource-development"]},"T1583.006":{"name":"Web Services","tactics":["resource-development"]},"T1583.007":{"name":"Serverless","tactics":["resource-development"]},"T1583.008":{"name":"Malvertising","tactics":["resource-development"]},"T1584":{"name":"Compromise Infrastructure","tactics":["resource-development"]},"T1584.001":{"name":"Domains","tactics":["resource-development"]},"T1584.002":{"name":"DNS Server","tactics":["resource-development"]},"T1584.003":{"name":"Virtual Private Server","tactics":["resource-development"]},"T1584.004":{"name":"Server","tactics":["resource-development"]},"T1584.005":{"name":"Botnet","tactics":["resource-development"]},"T1584.006":{"name":"Web Services","tactics":["resource-development"]},"T1584.007":{"name":"Serverless","tactics":["resource-development"]},"T1584.008":{"name":"Network Devices","tactics":["resource-development"]},"T1585":{"name":"Establish Accounts","tactics":["resource-development"]},"T1585.001":{"name":"Social Media Accounts","tactics":["resource-development"]},"T1585.002":{"name":"Email Accounts","tactics":["resource-development"]},"T1585.003":{"name":"Cloud Accounts","tactics":["resource-development"]},"T1586":{"name":"Compromise Accounts","tactics":["resource-development"]},"T1586.001":{"name":"Social Media Accounts","tactics":["resource-development"]},"T1586.002":{"name":"Email Accounts","tactics":["resource-development"]},"T1586.003":{"name":"Cloud Accounts","tactics":["resource-development"]},"T1587":{"name":"Develop Capabilities","tactics":["resource-development"]},"T1587.001":{"name":"Malware","tactics":["resource-development"]},"T1587.002":{"name":"Code Signing Certificates","tactics":["resource-development"]},"T1587.003":{"name":"Digital Certificates","tactics":["resource-development"]},"T1587.004":{"name":"Exploits","tactics":["resource-development"]},"T1588":{"name":"Obtain Capabilities","tactics":["resource-development"]},"T1588.001":{"name":"Malware","tactics":["resource-development"]},"T1588.002":{"name":"Tool","tactics":["resource-development"]},"T1588.003":{"name":"Code Signing Certificates","tactics":["resource-development"]},"T1588.004":{"name":"Digital Certificates","tactics":["resource-development"]},"T1588.005":{"name":"Exploits","tactics":["resource-development"]},"T1588.006":{"name":"Vulnerabilities","tactics":["resource-development"]},"T1588.007":{"name":"Artificial Intelligence","tactics":["resource-development"]},"T1589":{"name":"Gather Victim Identity Information","tactics":["reconnaissance"]},"T1589.001":{"name":"Credentials","tactics":["reconnaissance"]},"T1589.002":{"name":"Email Addresses","tactics":["reconnaissance"]},"T1589.003":{"name":"Employee Names","tactics":["reconnaissance"]},"T1590":{"name":"Gather Victim Network Information","tactics":["reconnaissance"]},"T1590.001":{"name":"Domain Properties","tactics":["reconnaissance"]},"T1590.002":{"name":"DNS","tactics":["reconnaissance"]},"T1590.003":{"name":"Network Trust Dependencies","tactics":["reconnaissance"]},"T1590.004":{"name":"Network Topology","tactics":["reconnaissance"]},"T1590.005":{"name":"IP Addresses","tactics":["reconnaissance"]},"T1590.006":{"name":"Network Security Appliances","tactics":["reconnaissance"]},"T1591":{"name":"Gather Victim Org Information","tactics":["reconnaissance"]},"T1591.001":{"name":"Determine Physical Locations","tactics":["reconnaissance"]},"T1591.002":{"name":"Business Relationships","tactics":["reconnaissance"]},"T1591.003":{"name":"Identify Business Tempo","tactics":["reconnaissance"]},"T1591.004":{"name":"Identify Roles","tactics":["reconnaissance"]},"T1592":{"name":"Gather Victim Host Information","tactics":["reconnaissance"]},"T1592.001":{"name":"Hardware","tactics":["reconnaissance"]},"T1592.002":{"name":"Software","tactics":["reconnaissance"]},"T1592.003":{"name":"Firmware","tactics":["reconnaissance"]},"T1592.004":{"name":"Client Configurations","tactics":["reconnaissance"]},"T1593":{"name":"Search Open Websites/Domains","tactics":["reconnaissance"]},"T1593.001":{"name":"Social Media","tactics":["reconnaissance"]},"T1593.002":{"name":"Search Engines","tactics":["reconnaissance"]},"T1593.003":{"name":"Code Repositories","tactics":["reconnaissance"]},"T1594":{"name":"Search Victim-Owned Websites","tactics":["reconnaissance"]},"T1595":{"name":"Active Scanning","tactics":["reconnaissance"]},"T1595.001":{"name":"Scanning IP Blocks","tactics":["reconnaissance"]},"T1595.002":{"name":"Vulnerability Scanning","tactics":["reconnaissance"]},"T1595.003":{"name":"Wordlist Scanning","tactics":["reconnaissance"]},"T1596":{"name":"Search Open Technical Databases","tactics":["reconnaissance"]},"T1596.001":{"name":"DNS/Passive DNS","tactics":["reconnaissance"]},"T1596.002":{"name":"WHOIS","tactics":["reconnaissance"]},"T1596.003":{"name":"Digital Certificates","tactics":["reconnaissance"]},"T1596.004":{"name":"CDNs","tactics":["reconnaissance"]},"T1596.005":{"name":"Scan Databases","tactics":["reconnaissance"]},"T1597":{"name":"Search Closed Sources","tactics":["reconnaissance"]},"T1597.001":{"name":"Threat Intel Vendors","tactics":["reconnaissance"]},"T1597.002":{"name":"Purchase Technical Data","tactics":["reconnaissance"]},"T1598":{"name":"Phishing for Information","tactics":["reconnaissance"]},"T1598.001":{"name":"Spearphishing Service","tactics":["reconnaissance"]},"T1598.002":{"name":"Spearphishing Attachment","tactics":["reconnaissance"]},"T1598.003":{"name":"Spearphishing Link","tactics":["reconnaissance"]},"T1598.004":{"name":"Spearphishing Voice","tactics":["reconnaissance"]},"T1599":{"name":"Network Boundary Bridging","tactics":["defense-impairment"]},"T1599.001":{"name":"Network Address Translation Traversal","tactics":["defense-impairment"]},"T1600":{"name":"Weaken Encryption","tactics":["defense-impairment"]},"T1600.001":{"name":"Reduce Key Space","tactics":["defense-impairment"]},"T1600.002":{"name":"Disable Crypto Hardware","tactics":["defense-impairment"]},"T1601":{"name":"Modify System Image","tactics":["defense-impairment"]},"T1601.001":{"name":"Patch System Image","tactics":["defense-impairment"]},"T1601.002":{"name":"Downgrade System Image","tactics":["defense-impairment"]},"T1602":{"name":"Data from Configuration Repository","tactics":["collection"]},"T1602.001":{"name":"SNMP (MIB Dump)","tactics":["collection"]},"T1602.002":{"name":"Network Device Configuration Dump","tactics":["collection"]},"T1606":{"name":"Forge Web Credentials","tactics":["credential-access"]},"T1606.001":{"name":"Web Cookies","tactics":["credential-access"]},"T1606.002":{"name":"SAML Tokens","tactics":["credential-access"]},"T1608":{"name":"Stage Capabilities","tactics":["resource-development"]},"T1608.001":{"name":"Upload Malware","tactics":["resource-development"]},"T1608.002":{"name":"Upload Tool","tactics":["resource-development"]},"T1608.003":{"name":"Install Digital Certificate","tactics":["resource-development"]},"T1608.004":{"name":"Drive-by Target","tactics":["resource-development"]},"T1608.005":{"name":"Link Target","tactics":["resource-development"]},"T1608.006":{"name":"SEO Poisoning","tactics":["resource-development"]},"T1608.007":{"name":"AI Result Poisoning","tactics":["resource-development"]},"T1609":{"name":"Container Administration Command","tactics":["execution"]},"T1610":{"name":"Deploy Container","tactics":["execution"]},"T1611":{"name":"Escape to Host","tactics":["privilege-escalation"]},"T1612":{"name":"Build Image on Host","tactics":["stealth"]},"T1613":{"name":"Container and Resource Discovery","tactics":["discovery"]},"T1614":{"name":"System Location Discovery","tactics":["discovery"]},"T1614.001":{"name":"System Language Discovery","tactics":["discovery"]},"T1615":{"name":"Group Policy Discovery","tactics":["discovery"]},"T1619":{"name":"Cloud Storage Object Discovery","tactics":["discovery"]},"T1620":{"name":"Reflective Code Loading","tactics":["stealth"]},"T1621":{"name":"Multi-Factor Authentication Request Generation","tactics":["credential-access"]},"T1622":{"name":"Debugger Evasion","tactics":["discovery","stealth"]},"T1647":{"name":"Plist File Modification","tactics":["defense-impairment"]},"T1648":{"name":"Serverless Execution","tactics":["execution"]},"T1649":{"name":"Steal or Forge Authentication Certificates","tactics":["credential-access"]},"T1650":{"name":"Acquire Access","tactics":["resource-development"]},"T1651":{"name":"Cloud Administration Command","tactics":["execution"]},"T1652":{"name":"Device Driver Discovery","tactics":["discovery"]},"T1653":{"name":"Power Settings","tactics":["persistence"]},"T1654":{"name":"Log Enumeration","tactics":["discovery"]},"T1657":{"name":"Financial Theft","tactics":["impact"]},"T1659":{"name":"Content Injection","tactics":["command-and-control","initial-access"]},"T1665":{"name":"Hide Infrastructure","tactics":["command-and-control"]},"T1666":{"name":"Modify Cloud Resource Hierarchy","tactics":["defense-impairment"]},"T1667":{"name":"Email Bombing","tactics":["impact"]},"T1668":{"name":"Exclusive Control","tactics":["persistence"]},"T1669":{"name":"Wi-Fi Networks","tactics":["initial-access"]},"T1671":{"name":"Cloud Application Integration","tactics":["persistence"]},"T1673":{"name":"Virtual Machine Discovery","tactics":["discovery"]},"T1674":{"name":"Input Injection","tactics":["execution"]},"T1675":{"name":"ESXi Administration Command","tactics":["execution"]},"T1677":{"name":"Poisoned Pipeline Execution","tactics":["execution"]},"T1678":{"name":"Delay Execution","tactics":["stealth"]},"T1679":{"name":"Selective Exclusion","tactics":["stealth"]},"T1680":{"name":"Local Storage Discovery","tactics":["discovery"]},"T1681":{"name":"Search Threat Vendor Data","tactics":["reconnaissance"]},"T1682":{"name":"Query Public AI Services","tactics":["reconnaissance"]},"T1683":{"name":"Generate Content","tactics":["resource-development"]},"T1683.001":{"name":"Written Content","tactics":["resource-development"]},"T1683.002":{"name":"Audio-Visual Content","tactics":["resource-development"]},"T1684":{"name":"Social Engineering","tactics":["stealth"]},"T1684.001":{"name":"Impersonation","tactics":["stealth"]},"T1684.002":{"name":"Email Spoofing","tactics":["stealth"]},"T1685":{"name":"Disable or Modify Tools","tactics":["defense-impairment"]},"T1685.001":{"name":"Disable or Modify Windows Event Log","tactics":["defense-impairment"]},"T1685.002":{"name":"Disable or Modify Cloud Log","tactics":["defense-impairment"]},"T1685.003":{"name":"Modify or Spoof Tool UI","tactics":["defense-impairment"]},"T1685.004":{"name":"Disable or Modify Linux Audit System Log","tactics":["defense-impairment"]},"T1685.005":{"name":"Clear Windows Event Logs","tactics":["defense-impairment"]},"T1685.006":{"name":"Clear Linux or Mac System Logs","tactics":["defense-impairment"]},"T1685.007":{"name":"Impair Autonomous Defenses","tactics":["defense-impairment"]},"T1686":{"name":"Disable or Modify System Firewall","tactics":["defense-impairment"]},"T1686.001":{"name":"Cloud Firewall","tactics":["defense-impairment"]},"T1686.002":{"name":"Network Device Firewall","tactics":["defense-impairment"]},"T1686.003":{"name":"Windows Host Firewall","tactics":["defense-impairment"]},"T1687":{"name":"Exploitation for Defense Impairment","tactics":["defense-impairment"]},"T1688":{"name":"Safe Mode Boot","tactics":["defense-impairment"]},"T1689":{"name":"Downgrade Attack","tactics":["defense-impairment"]},"T1690":{"name":"Prevent Command History Logging","tactics":["defense-impairment"]},"T1696":{"name":"Anti-Automation Evasion","tactics":["stealth"]},"T1696.001":{"name":"Automate CAPTCHA Completion","tactics":["stealth"]},"T1696.002":{"name":"Avoid CAPTCHA","tactics":["stealth"]},"T1697":{"name":"Steal Application Specific Passwords","tactics":["credential-access"]},"T1698":{"name":"Indirect Prompt Injection","tactics":["execution"]},"T1699":{"name":"Direct Prompt Injection","tactics":["execution"]},"T1700":{"name":"AI-Enabled Exfiltration","tactics":["exfiltration"]}}} diff --git a/strix/report/sarif.py b/strix/report/sarif.py index 821fffbc0..188191e07 100644 --- a/strix/report/sarif.py +++ b/strix/report/sarif.py @@ -543,6 +543,7 @@ def _result_properties( "method", "cve", "cwe", + "attack_techniques", "impact", "technical_analysis", "remediation_steps", diff --git a/strix/report/state.py b/strix/report/state.py index 104e4af4c..6f8869088 100644 --- a/strix/report/state.py +++ b/strix/report/state.py @@ -91,6 +91,7 @@ UPDATABLE_REPORT_FIELDS = frozenset( "method", "cve", "cwe", + "attack_techniques", "code_locations", "http_exchange_ids", "fix_verification", @@ -353,6 +354,7 @@ class ReportState: method: str | None = None, cve: str | None = None, cwe: str | None = None, + attack_techniques: list[str] | None = None, code_locations: list[dict[str, Any]] | None = None, http_exchange_ids: list[str] | None = None, fix_verification: str | None = None, @@ -411,6 +413,8 @@ class ReportState: report["cve"] = cve.strip() if cwe: report["cwe"] = cwe.strip() + if attack_techniques: + report["attack_techniques"] = list(attack_techniques) if code_locations: report["code_locations"] = code_locations if http_exchange_ids: diff --git a/strix/report/writer.py b/strix/report/writer.py index cf858f7d7..55a14c9d3 100644 --- a/strix/report/writer.py +++ b/strix/report/writer.py @@ -241,6 +241,7 @@ def render_vulnerability_md(report: dict[str, Any]) -> str: # noqa: PLR0912, PL ("Method", report.get("method")), ("CVE", report.get("cve")), ("CWE", report.get("cwe")), + ("MITRE ATT&CK", ", ".join(report.get("attack_techniques") or [])), ] cvss = report.get("cvss") if cvss is not None: diff --git a/strix/tools/reporting/tool.py b/strix/tools/reporting/tool.py index 3faf7fbd6..1503401e1 100644 --- a/strix/tools/reporting/tool.py +++ b/strix/tools/reporting/tool.py @@ -16,6 +16,7 @@ from typing import TYPE_CHECKING, Any from agents import RunContextWrapper, function_tool +from strix.report.attack import normalize_attack_techniques from strix.tools.nullish import clean_optional from strix.tools.proxy.tools import existing_request_ids @@ -462,6 +463,14 @@ def _collect_update_changes( # noqa: PLR0912, PLR0915 if cwe: changes["cwe"] = cwe + if fields.get("attack_techniques") is not None: + attack_techniques, attack_errors = normalize_attack_techniques( + fields.get("attack_techniques") + ) + errors.extend(attack_errors) + if not attack_errors: + changes["attack_techniques"] = attack_techniques + raw_http_exchange_ids = fields.get("http_exchange_ids") http_exchange_ids, http_exchange_errors = _normalize_http_exchange_ids(raw_http_exchange_ids) errors.extend(http_exchange_errors) @@ -803,6 +812,7 @@ async def _do_create( confidence_rationale: str | None = None, fix_verification: str | None = None, fix_pr_body: str | None = None, + attack_techniques: list[str] | None = None, agent_id: str | None = None, agent_name: str | None = None, ) -> dict[str, Any]: @@ -845,6 +855,8 @@ async def _do_create( errors.extend(_validate_fix_verification(parsed_locations, fix_verification)) cve, cwe, identifier_errors = _validate_identifiers(cve, cwe) errors.extend(identifier_errors) + normalized_attack_techniques, attack_errors = normalize_attack_techniques(attack_techniques) + errors.extend(attack_errors) normalized_http_exchange_ids, http_exchange_errors = _normalize_http_exchange_ids( http_exchange_ids ) @@ -907,6 +919,7 @@ async def _do_create( "method": method, "cve": cve, "cwe": cwe, + "attack_techniques": normalized_attack_techniques or None, "code_locations": parsed_locations, "fix_verification": fix_verification, "fix_pr_body": fix_pr_body, @@ -1000,6 +1013,7 @@ async def create_vulnerability_report( method: str | None = None, cve: str | None = None, cwe: str | None = None, + attack_techniques: list[str] | None = None, code_locations: list[dict[str, Any]] | None = None, http_exchange_ids: list[str] | None = None, confidence_rationale: str | None = None, @@ -1296,6 +1310,12 @@ async def create_vulnerability_report( method: HTTP method when relevant. cve: ``CVE-YYYY-NNNNN`` if certain, else omit. cwe: ``CWE-NNN`` (most specific child) if certain, else omit. + attack_techniques: MITRE ATT&CK Enterprise technique ids (e.g. + ``["T1190", "T1552.001"]``) for what the PoC actually did: + the entry point it exploited and each step it demonstrated + after that (credentials it read, commands it ran, data it + took). Tag only techniques the evidence shows; leave out + techniques the finding merely makes possible. Omit when unsure. code_locations: White-box findings — list of location objects. http_exchange_ids: Proxy request IDs that prove this finding. Copy these IDs from ``list_requests`` or ``view_request``. @@ -1450,6 +1470,7 @@ async def create_vulnerability_report( method=method, cve=cve, cwe=cwe, + attack_techniques=attack_techniques, code_locations=code_locations, http_exchange_ids=http_exchange_ids, fix_verification=fix_verification, @@ -1485,6 +1506,7 @@ async def update_vulnerability_report( method: str | None = None, cve: str | None = None, cwe: str | None = None, + attack_techniques: list[str] | None = None, code_locations: list[dict[str, Any]] | None = None, http_exchange_ids: list[str] | None = None, fix_verification: str | None = None, @@ -1558,6 +1580,8 @@ async def update_vulnerability_report( method: Replacement HTTP method. cve: Replacement CVE id. cwe: Replacement CWE id. + attack_techniques: Replacement MITRE ATT&CK technique ids. Same + rule as on create: only what the evidence demonstrates. code_locations: Replacement code locations. http_exchange_ids: Replacement proxy request ids. Pass an empty list to remove all linked exchanges. @@ -1604,6 +1628,7 @@ async def update_vulnerability_report( "method": method, "cve": cve, "cwe": cwe, + "attack_techniques": attack_techniques, "code_locations": code_locations, "http_exchange_ids": http_exchange_ids, "fix_verification": fix_verification, @@ -1905,6 +1930,7 @@ async def _do_create_dependency( # noqa: PLR0912, PLR0915 fix_verification: str | None = None, contextual_cvss_breakdown: dict[str, str] | None = None, contextual_cvss_reasoning: str | None = None, + attack_techniques: list[str] | None = None, agent_id: str | None = None, agent_name: str | None = None, ) -> dict[str, Any]: @@ -1935,6 +1961,9 @@ async def _do_create_dependency( # noqa: PLR0912, PLR0915 if cwe_err: errors.append(cwe_err) + normalized_attack_techniques, attack_errors = normalize_attack_techniques(attack_techniques) + errors.extend(attack_errors) + fix_effort = (fix_effort or "").strip().lower() if fix_effort not in _VALID_FIX_EFFORT: errors.append( @@ -2061,6 +2090,7 @@ async def _do_create_dependency( # noqa: PLR0912, PLR0915 cvss=cvss_score if advisory_cvss is not None else None, cve=parsed_cve, cwe=cwe, + attack_techniques=normalized_attack_techniques or None, code_locations=parsed_locations, fix_verification=fix_verification, finding_class="dependency_cve", @@ -2121,6 +2151,7 @@ async def create_dependency_report( fix_verification: str | None = None, contextual_cvss_breakdown: dict[str, str] | None = None, contextual_cvss_reasoning: str | None = None, + attack_techniques: list[str] | None = None, ) -> str: """File a known-CVE dependency (SCA) finding — one report per CVE x package. @@ -2185,6 +2216,10 @@ async def create_dependency_report( package_ecosystem: e.g. ``npm`` / ``pypi`` / ``maven`` / ``go``. fixed_version: First non-vulnerable version, if known. cwe: ``CWE-NNN`` (most specific) if certain, else omit. + attack_techniques: MITRE ATT&CK Enterprise technique ids the + reachability evidence demonstrates (e.g. ``["T1190"]`` for a + proven exploitable path from a public endpoint). Omit when the + evidence does not show one. advisory_cvss: **Required.** Published advisory base score (0.0-10.0) — read it off the advisory (trivy CVSS / NVD / GHSA). It is the published reference the finding is rated against and @@ -2310,6 +2345,7 @@ async def create_dependency_report( fix_verification=fix_verification, contextual_cvss_breakdown=contextual_cvss_breakdown, contextual_cvss_reasoning=contextual_cvss_reasoning, + attack_techniques=attack_techniques, agent_id=agent_id, agent_name=agent_name, ) @@ -2338,6 +2374,7 @@ _REPORT_SUMMARY_FIELDS = ( "finding_class", "cve", "cwe", + "attack_techniques", "target", "endpoint", "method", diff --git a/tests/test_reporting_fields.py b/tests/test_reporting_fields.py index c895847c6..c5010fdda 100644 --- a/tests/test_reporting_fields.py +++ b/tests/test_reporting_fields.py @@ -2408,3 +2408,57 @@ async def test_delete_tool_carries_the_caller_identity(report_state: ReportState assert history[0]["agent_id"] == "aaaa1111" assert history[0]["agent_name"] == "Recon Agent" assert "update_vulnerability_report" in delete_vulnerability_report.description + + +async def test_create_records_attack_techniques(report_state: ReportState) -> None: + result = await _do_create( + **_CONFIRMED_KWARGS, + attack_techniques=["t1190", "T1552.001 - Credentials In Files", "T1190"], + ) + + assert result["success"] is True + assert report_state.vulnerability_reports[0]["attack_techniques"] == ["T1190", "T1552.001"] + + +async def test_create_rejects_unknown_attack_technique(report_state: ReportState) -> None: + result = await _do_create(**_CONFIRMED_KWARGS, attack_techniques=["T9999", "exploit"]) + + assert result["success"] is False + assert any("unknown ATT&CK technique: 'T9999'" in error for error in result["errors"]) + assert any("invalid ATT&CK technique: 'exploit'" in error for error in result["errors"]) + assert report_state.vulnerability_reports == [] + + +async def test_create_without_attack_techniques_omits_the_field( + report_state: ReportState, +) -> None: + result = await _do_create(**_CONFIRMED_KWARGS) + + assert result["success"] is True + assert "attack_techniques" not in report_state.vulnerability_reports[0] + + +def test_update_replaces_attack_techniques(report_state: ReportState) -> None: + _seed_weak_report(report_state) + + result = _do_update( + report_id="vuln-0009", + update_reason="The chained PoC read cloud credentials.", + fields={"attack_techniques": ["T1190", "T1552.005"]}, + ) + + assert result["success"] is True + assert report_state.vulnerability_reports[0]["attack_techniques"] == ["T1190", "T1552.005"] + + +def test_update_rejects_revoked_attack_technique(report_state: ReportState) -> None: + _seed_weak_report(report_state) + + result = _do_update( + report_id="vuln-0009", + update_reason="Tag the technique.", + fields={"attack_techniques": ["T1086"]}, + ) + + assert result["success"] is False + assert "attack_techniques" not in report_state.vulnerability_reports[0] diff --git a/tests/test_sarif.py b/tests/test_sarif.py index 61ffc39bb..e5c763381 100644 --- a/tests/test_sarif.py +++ b/tests/test_sarif.py @@ -371,3 +371,10 @@ def test_calibration_metadata_survives_into_result_properties(tmp_path: Path) -> assert strix["confidence_rationale"] == "Reproduced once out of three attempts." assert strix["severity_change_conditions"] == "Critical if the WAF rule is removed." assert strix["fix_verification"] == "Not retested." + + +def test_write_sarif_carries_attack_techniques(tmp_path: Path) -> None: + write_sarif(tmp_path, [_finding(attack_techniques=["T1190", "T1059"])]) + result = _read(tmp_path)["runs"][0]["results"][0] + + assert result["properties"]["strix"]["attack_techniques"] == ["T1190", "T1059"]