{"metadata": {"mapping_version": "1.9", "attack_version": "9.0", "technology_domain": "enterprise", "author": "", "contact": "", "creation_date": "08/26/2021", "last_update": "08/26/2021", "organization": "", "mapping_framework": "veris", "mapping_framework_version": "1.3.5", "mapping_types": {"related_to": {"name": "related-to", "description": ""}}, "capability_groups": {"action.hacking": "action.hacking", "action.malware": "action.malware", "attribute.integrity": "attribute.integrity", "value_chain.development": "value_chain.development", "value_chain.distribution": "value_chain.distribution", "value_chain.non-distribution_services": "value_chain.non-distribution_services", "value_chain.targeting": "value_chain.targeting", "action.social": "action.social", "action.misuse": "action.misuse", "attribute.confidentiality": "attribute.confidentiality"}}, "mapping_objects": [{"comments": "", "attack_object_id": "T1047", "attack_object_name": "Windows Management Instrumentation", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1047", "attack_object_name": "Windows Management Instrumentation", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1047", "attack_object_name": "Windows Management Instrumentation", "references": [], "capability_description": "Directly installed or inserted by threat agent (after system access)", "capability_id": "action.malware.vector.Direct install", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1053", "attack_object_name": "Scheduled Task/Job", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1053", "attack_object_name": "Scheduled Task/Job", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1053.001", "attack_object_name": "Scheduled Task/Job: At (Linux)", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1053.002", "attack_object_name": "Scheduled Task/Job: At (Windows)", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1053.003", "attack_object_name": "Scheduled Task/Job: Cron", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1053.004", "attack_object_name": "Scheduled Task/Job: Launchd", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1053.005", "attack_object_name": "Scheduled Task/Job: Scheduled Task", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1053.006", "attack_object_name": "Scheduled Task/Job: Systemd Timers", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1053.007", "attack_object_name": "Scheduled Task/Job: Container Orchestration Job", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059", "attack_object_name": "Command and Scripting Interpreter", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059", "attack_object_name": "Command and Scripting Interpreter", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.001", "attack_object_name": "Command and Scripting Interpreter: PowerShell", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.001", "attack_object_name": "Command and Scripting Interpreter: PowerShell", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.002", "attack_object_name": "Command and Scripting Interpreter: AppleScript", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.002", "attack_object_name": "Command and Scripting Interpreter: AppleScript", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.003", "attack_object_name": "Command and Scripting Interpreter: Windows Command Shell", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.003", "attack_object_name": "Command and Scripting Interpreter: Windows Command Shell", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.004", "attack_object_name": "Command and Scripting Interpreter: Unix Shell", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.004", "attack_object_name": "Command and Scripting Interpreter: Unix Shell", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.005", "attack_object_name": "Command and Scripting Interpreter: Visual Basic", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.005", "attack_object_name": "Command and Scripting Interpreter: Visual Basic", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.005", "attack_object_name": "Command and Scripting Interpreter: Visual Basic", "references": [], "capability_description": "Email via user-executed attachment. Child of 'Email'", "capability_id": "action.malware.vector.Email attachment", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1059.006", "attack_object_name": "Command and Scripting Interpreter: Python", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.006", "attack_object_name": "Command and Scripting Interpreter: Python", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.007", "attack_object_name": "Command and Scripting Interpreter: JavaScript", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.007", "attack_object_name": "Command and Scripting Interpreter: JavaScript", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.007", "attack_object_name": "Command and Scripting Interpreter: JavaScript", "references": [], "capability_description": "Email via user-executed attachment. Child of 'Email'", "capability_id": "action.malware.vector.Email attachment", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1059.008", "attack_object_name": "Command and Scripting Interpreter: Network Device CLI", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1059.008", "attack_object_name": "Command and Scripting Interpreter: Network Device CLI", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1072", "attack_object_name": "Software Deployment Tools", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1072", "attack_object_name": "Software Deployment Tools", "references": [], "capability_description": "System or network utilities (e.g., PsTools, Netcat)", "capability_id": "action.malware.variety.Adminware", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1072", "attack_object_name": "Software Deployment Tools", "references": [], "capability_description": "Included in automated software update", "capability_id": "action.malware.vector.Software update", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1106", "attack_object_name": "Native API", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1112", "attack_object_name": "Modify Registry", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1127", "attack_object_name": "Trusted Developer Utilities Proxy Execution", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1127", "attack_object_name": "Trusted Developer Utilities Proxy Execution", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1127.001", "attack_object_name": "Tursted Developer Utilities Proxy Execution: MSBuild", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1127.001", "attack_object_name": "Tursted Developer Utilities Proxy Execution: MSBuild", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1129", "attack_object_name": "Shared Modules", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1137", "attack_object_name": "Office Application Startup", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1137", "attack_object_name": "Office Application Startup", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1137.001", "attack_object_name": "Office Application Startup: Office Template Macros", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1137.002", "attack_object_name": "Office Application Startup: Office Test", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1137.003", "attack_object_name": "Office Application Startup: Outlook Forms", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1137.004", "attack_object_name": "Office Application Startup: Outlook Home Page", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1137.005", "attack_object_name": "Office Application Startup: Outlook Rules", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1187", "attack_object_name": "Forced Authentication", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1187", "attack_object_name": "Forced Authentication", "references": [], "capability_description": "Man-in-the-middle attack. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.MitM", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1202", "attack_object_name": "Indirect Command Execution", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1216", "attack_object_name": "Signed Script Proxy Execution", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1216.001", "attack_object_name": "Signed Script Proxy Execution: PubPrn", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218", "attack_object_name": "Signed Binary Proxy Execution", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.001", "attack_object_name": "Signed Binary Proxy Execution: Compiled HTML File", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.002", "attack_object_name": "Signed Binary Proxy Execution: Control Panel", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.003", "attack_object_name": "Signed Binary Proxy Execution: CMSTP", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.004", "attack_object_name": "Signed Binary Proxy Execution: InstallUtil", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.005", "attack_object_name": "Signed Binary Proxy Execution: Mshta", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.007", "attack_object_name": "Signed Binary Proxy Execution: Msiexec", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.008", "attack_object_name": "Signed Binary Proxy Execution: Odbcconf", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.009", "attack_object_name": "Signed Binary Proxy Execution: Regsvcs/Regasm", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.010", "attack_object_name": "Signed Binary Proxy Execution: Regsvr32", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.011", "attack_object_name": "Signed Binary Proxy Execution: Rundll32", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1218.012", "attack_object_name": "Signed Binary Proxy Execution: Verclsid", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1220", "attack_object_name": "XSL Script Processing", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505.001", "attack_object_name": "Server Software Component: SQL Stored Procedures", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505.001", "attack_object_name": "Server Software Component: SQL Stored Procedures", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505.001", "attack_object_name": "Server Software Component: SQL Stored Procedures", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505.001", "attack_object_name": "Server Software Component: SQL Stored Procedures", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1505.002", "attack_object_name": "Server Software Component: Transport Agent", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505.002", "attack_object_name": "Server Software Component: Transport Agent", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505.002", "attack_object_name": "Server Software Component: Transport Agent", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505.002", "attack_object_name": "Server Software Component: Transport Agent", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1529", "attack_object_name": "System Shutdown/Reboot", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1543", "attack_object_name": "Create or Modify System Process", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1543", "attack_object_name": "Create or Modify System Process", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1543", "attack_object_name": "Create or Modify System Process", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1543", "attack_object_name": "Create or Modify System Process", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1543", "attack_object_name": "Create or Modify System Process", "references": [], "capability_description": "Rootkit (maintain local privileges and stealth)", "capability_id": "action.malware.variety.Rootkit", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1543.001", "attack_object_name": "Create or Modify System Process: Launch Agent", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1543.002", "attack_object_name": "Create or Modify System Process: Systemd Service", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1543.003", "attack_object_name": "Create or Modify System Process: Windows Service", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1543.003", "attack_object_name": "Create or Modify System Process: Windows Service", "references": [], "capability_description": "Remote Access Trojan.  Parent of 'Backdoor' and 'Trojan'", "capability_id": "action.malware.variety.RAT", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1543.004", "attack_object_name": "Create or Modify System Process: Launch Daemon", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1547", "attack_object_name": "Boot or Logon Autostart Execution", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1547", "attack_object_name": "Boot or Logon Autostart Execution", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1547", "attack_object_name": "Boot or Logon Autostart Execution", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1547", "attack_object_name": "Boot or Logon Autostart Execution", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1548", "attack_object_name": "Abuse Elevation Control Mechanism", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1548.001", "attack_object_name": "Abuse Elevation Control Mechanism: Setuid and Setgid", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1548.002", "attack_object_name": "Abuse Elevation Control Mechanism: Bypass User Account Control", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1548.002", "attack_object_name": "Abuse Elevation Control Mechanism: Bypass User Account Control", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1548.002", "attack_object_name": "Abuse Elevation Control Mechanism: Bypass User Account Control", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.malware.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1548.003", "attack_object_name": "Abuse Elevation Control Mechanism: Sudo and Sudo Caching", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1548.003", "attack_object_name": "Abuse Elevation Control Mechanism: Sudo and Sudo Caching", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1548.003", "attack_object_name": "Abuse Elevation Control Mechanism: Sudo and Sudo Caching", "references": [], "capability_description": "Client-side or browser attack (e.g., redirection, XSS, MitB)", "capability_id": "action.malware.variety.Client-side attack", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1548.004", "attack_object_name": "Abuse Elevation Control Mechanism: Elevated Execution with Prompt", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1548.004", "attack_object_name": "Abuse Elevation Control Mechanism: Elevated Execution with Prompt", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1559", "attack_object_name": "Inter-Process Communication", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1559.001", "attack_object_name": "Inter-Process Communication: Component Object Model", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1559.002", "attack_object_name": "Inter-Process Communication: Dynamic Data Exchange", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1563", "attack_object_name": "Remote Service Session Hijacking", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1563", "attack_object_name": "Remote Service Session Hijacking", "references": [], "capability_description": "Network propagation", "capability_id": "action.malware.vector.Network propagation", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1563.001", "attack_object_name": "Remote Service Session Hijacking: SSH Hijacking", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1563.001", "attack_object_name": "Remote Service Session Hijacking: SSH Hijacking", "references": [], "capability_description": "Network propagation", "capability_id": "action.malware.vector.Network propagation", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1563.002", "attack_object_name": "Remote Service Session Hijacking: RDP Hijacking", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1563.002", "attack_object_name": "Remote Service Session Hijacking: RDP Hijacking", "references": [], "capability_description": "Network propagation", "capability_id": "action.malware.vector.Network propagation", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1564", "attack_object_name": "Hide Artifacts", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1564.001", "attack_object_name": "Hide Artifacts: Hidden Files and Directories", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1564.002", "attack_object_name": "Hide Artifacts: Hidden Users", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1564.003", "attack_object_name": "Hide Artifacts: Hidden Window", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1564.004", "attack_object_name": "Hide Artifacts: NTFS File Attributes", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1564.005", "attack_object_name": "Hide Artifacts: Hidden File System", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1564.006", "attack_object_name": "Hide Artifacts: Run Virtual Instance", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1564.007", "attack_object_name": "Hide Artifacts: VBA Stomping", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1564.007", "attack_object_name": "Hide Artifacts: VBA Stomping", "references": [], "capability_description": "An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor'", "capability_id": "action.malware.variety.Trojan", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1569", "attack_object_name": "System Services", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1569.001", "attack_object_name": "System Services: Launchctl", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1569.002", "attack_object_name": "System Services: Service Execution", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1569.002", "attack_object_name": "System Services: Service Execution", "references": [], "capability_description": "Directly installed or inserted by threat agent (after system access)", "capability_id": "action.malware.vector.Direct install", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1578", "attack_object_name": "Modify Cloud Computer Infrastructure", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1578", "attack_object_name": "Modify Cloud Computer Infrastructure", "references": [], "capability_description": "Hypervisor break-out attack", "capability_id": "action.hacking.vector.Hypervisor", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1578", "attack_object_name": "Modify Cloud Computer Infrastructure", "references": [], "capability_description": "Penetration of another VM or web site on shared device or infrastructure", "capability_id": "action.hacking.vector.Inter-tenant", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1578.001", "attack_object_name": "Modify Cloud Computer Infrastructure: Create Snapshot", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1578.002", "attack_object_name": "Modify Cloud Computer Infrastructure: Create Cloud Instance", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1578.003", "attack_object_name": "Modify Cloud Computer Infrastructure: Delete Cloud Instance", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1578.004", "attack_object_name": "Modify Cloud Computer Infrastructure: Revert Cloud Instance", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1609", "attack_object_name": "Container Administration Command", "references": [], "capability_description": "Abuse of functionality", "capability_id": "action.hacking.variety.Abuse of functionality", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1110", "attack_object_name": "Brute Force", "references": [], "capability_description": "Brute force or password guessing attacks", "capability_id": "action.hacking.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1110", "attack_object_name": "Brute Force", "references": [], "capability_description": "Brute force attack", "capability_id": "action.malware.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1110.001", "attack_object_name": "Brute Force: Password Guessing", "references": [], "capability_description": "Brute force or password guessing attacks", "capability_id": "action.hacking.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1110.001", "attack_object_name": "Brute Force: Password Guessing", "references": [], "capability_description": "Brute force attack", "capability_id": "action.malware.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1110.002", "attack_object_name": "Brute Force: Password Cracking", "references": [], "capability_description": "Brute force or password guessing attacks", "capability_id": "action.hacking.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1110.002", "attack_object_name": "Brute Force: Password Cracking", "references": [], "capability_description": "Offline password or key cracking (e.g., rainbow tables, Hashcat, JtR)", "capability_id": "action.hacking.variety.Offline cracking", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1110.002", "attack_object_name": "Brute Force: Password Cracking", "references": [], "capability_description": "Brute force attack", "capability_id": "action.malware.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1110.003", "attack_object_name": "Brute Force: Password Spraying", "references": [], "capability_description": "Brute force or password guessing attacks", "capability_id": "action.hacking.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1110.003", "attack_object_name": "Brute Force: Password Spraying", "references": [], "capability_description": "Brute force attack", "capability_id": "action.malware.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1110.004", "attack_object_name": "Brute Force: Credential Stuffing", "references": [], "capability_description": "Brute force or password guessing attacks", "capability_id": "action.hacking.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1110.004", "attack_object_name": "Brute Force: Credential Stuffing", "references": [], "capability_description": "Brute force attack", "capability_id": "action.malware.variety.Brute force", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1203", "attack_object_name": "Exploitation for Client Execution", "references": [], "capability_description": "Buffer overflow. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Buffer overflow", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1203", "attack_object_name": "Exploitation for Client Execution", "references": [], "capability_description": "HTTP Response Splitting. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.HTTP Response Splitting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1203", "attack_object_name": "Exploitation for Client Execution", "references": [], "capability_description": "HTTP request smuggling. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.HTTP request smuggling", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1203", "attack_object_name": "Exploitation for Client Execution", "references": [], "capability_description": "HTTP request splitting. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.HTTP request splitting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1203", "attack_object_name": "Exploitation for Client Execution", "references": [], "capability_description": "HTTP response smuggling. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.HTTP response smuggling", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1203", "attack_object_name": "Exploitation for Client Execution", "references": [], "capability_description": "Client-side or browser attack (e.g., redirection, XSS, MitB)", "capability_id": "action.malware.variety.Client-side attack", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1203", "attack_object_name": "Exploitation for Client Execution", "references": [], "capability_description": "Email via user-executed attachment. Child of 'Email'", "capability_id": "action.malware.vector.Email attachment", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1600", "attack_object_name": "Weaken Encryption", "references": [], "capability_description": "Cryptanalysis. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Cryptanalysis", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1600", "attack_object_name": "Weaken Encryption", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1498", "attack_object_name": "Network Denial of Service", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1498", "attack_object_name": "Network Denial of Service", "references": [], "capability_description": "DoS attack", "capability_id": "action.malware.variety.DoS", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1498.001", "attack_object_name": "Network Denial of Service: Direct Network Flood", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1498.001", "attack_object_name": "Network Denial of Service: Direct Network Flood", "references": [], "capability_description": "DoS attack", "capability_id": "action.malware.variety.DoS", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1498.002", "attack_object_name": "Network Denial of Service: Reflection Amplification", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1498.002", "attack_object_name": "Network Denial of Service: Reflection Amplification", "references": [], "capability_description": "DoS attack", "capability_id": "action.malware.variety.DoS", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1499", "attack_object_name": "Endpoint Denial of Service", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1499", "attack_object_name": "Endpoint Denial of Service", "references": [], "capability_description": "Soap array abuse. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Soap array abuse", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1499", "attack_object_name": "Endpoint Denial of Service", "references": [], "capability_description": "XML attribute blowup. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.XML attribute blowup", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1499", "attack_object_name": "Endpoint Denial of Service", "references": [], "capability_description": "XML entity expansion. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.XML entity expansion", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1499", "attack_object_name": "Endpoint Denial of Service", "references": [], "capability_description": "XML external entities. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.XML external entities", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1499", "attack_object_name": "Endpoint Denial of Service", "references": [], "capability_description": "DoS attack", "capability_id": "action.malware.variety.DoS", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1499.001", "attack_object_name": "Endpoint Denial of Service: OS Exhaustion Flood", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1499.001", "attack_object_name": "Endpoint Denial of Service: OS Exhaustion Flood", "references": [], "capability_description": "DoS attack", "capability_id": "action.malware.variety.DoS", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1499.002", "attack_object_name": "Endpoint Denial of Service: Service Exhaustion Flood", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1499.002", "attack_object_name": "Endpoint Denial of Service: Service Exhaustion Flood", "references": [], "capability_description": "DoS attack", "capability_id": "action.malware.variety.DoS", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1499.003", "attack_object_name": "Endpoint Denial of Service: Application Exhaustion Flood", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1499.003", "attack_object_name": "Endpoint Denial of Service: Application Exhaustion Flood", "references": [], "capability_description": "DoS attack", "capability_id": "action.malware.variety.DoS", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1499.004", "attack_object_name": "Endpoint Denial of Service: Application or System Exploitation", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1499.004", "attack_object_name": "Endpoint Denial of Service: Application or System Exploitation", "references": [], "capability_description": "DoS attack", "capability_id": "action.malware.variety.DoS", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1583.005", "attack_object_name": "Acquire Infrastructure: Botnet", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.005", "attack_object_name": "Acquire Infrastructure: Botnet", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.005", "attack_object_name": "Acquire Infrastructure: Botnet", "references": [], "capability_description": "A small program that can be distributed, installed, and controlled en mass.", "capability_id": "value_chain.development.variety.Bot", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1583.005", "attack_object_name": "Acquire Infrastructure: Botnet", "references": [], "capability_description": "For content distributed from a collection of bots.", "capability_id": "value_chain.distribution.variety.Botnet", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1584.005", "attack_object_name": "Compromise Infrastructure: Botnet", "references": [], "capability_description": "Denial of service", "capability_id": "action.hacking.variety.DoS", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1584.005", "attack_object_name": "Compromise Infrastructure: Botnet", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1584.005", "attack_object_name": "Compromise Infrastructure: Botnet", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1584.005", "attack_object_name": "Compromise Infrastructure: Botnet", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1068", "attack_object_name": "Exploitation for Privilege Escalation", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1068", "attack_object_name": "Exploitation for Privilege Escalation", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.", "capability_id": "action.hacking.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1068", "attack_object_name": "Exploitation for Privilege Escalation", "references": [], "capability_description": "Format string attack. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Format string attack", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1068", "attack_object_name": "Exploitation for Privilege Escalation", "references": [], "capability_description": "Fuzz testing. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Fuzz testing", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1068", "attack_object_name": "Exploitation for Privilege Escalation", "references": [], "capability_description": "iterating over sequential or obvious values. https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Insecure deserialization", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1068", "attack_object_name": "Exploitation for Privilege Escalation", "references": [], "capability_description": "Integer overflows. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Integer overflows", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1068", "attack_object_name": "Exploitation for Privilege Escalation", "references": [], "capability_description": "LDAP injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.LDAP injection", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1068", "attack_object_name": "Exploitation for Privilege Escalation", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.malware.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1190", "attack_object_name": "Exploit Public-Facing Application", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1190", "attack_object_name": "Exploit Public-Facing Application", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.)", "capability_id": "action.malware.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1210", "attack_object_name": "Exploitation of Remote Services", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1210", "attack_object_name": "Exploitation of Remote Services", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.)", "capability_id": "action.malware.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1212", "attack_object_name": "Exploitation for Credential Access", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1212", "attack_object_name": "Exploitation for Credential Access", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.", "capability_id": "action.hacking.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1212", "attack_object_name": "Exploitation for Credential Access", "references": [], "capability_description": "Session fixation. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Session fixation", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1212", "attack_object_name": "Exploitation for Credential Access", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1212", "attack_object_name": "Exploitation for Credential Access", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.)", "capability_id": "action.malware.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1212", "attack_object_name": "Exploitation for Credential Access", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1212", "attack_object_name": "Exploitation for Credential Access", "references": [], "capability_description": "Web via auto-executed or \"drive-by\" infection. Child of 'Web application'.", "capability_id": "action.malware.vector.Web application - drive-by", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1558.004", "attack_object_name": "Steal or Forge Kerberos Tickets: AS-REP Roasting", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1558.004", "attack_object_name": "Steal or Forge Kerberos Tickets: AS-REP Roasting", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1558.004", "attack_object_name": "Steal or Forge Kerberos Tickets: AS-REP Roasting", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.malware.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1574.001", "attack_object_name": "Hijack Execution Flow: DLL Search Order Hijacking", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.001", "attack_object_name": "Hijack Execution Flow: DLL Search Order Hijacking", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.", "capability_id": "action.hacking.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.001", "attack_object_name": "Hijack Execution Flow: DLL Search Order Hijacking", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.002", "attack_object_name": "Hijack Execution Flow: DLL Side-Loading", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.002", "attack_object_name": "Hijack Execution Flow: DLL Side-Loading", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.", "capability_id": "action.hacking.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.002", "attack_object_name": "Hijack Execution Flow: DLL Side-Loading", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.005", "attack_object_name": "Hijack Execution Flow: Executable Installer File Permissions Weakness", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.005", "attack_object_name": "Hijack Execution Flow: Executable Installer File Permissions Weakness", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.010", "attack_object_name": "Hijack Execution Flow: Services File Permissions Weakness", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.011", "attack_object_name": "Hijack Execution Flow: Services Registry Permissions Weakness", "references": [], "capability_description": "Exploit a misconfiguration (vs vuln or weakness)", "capability_id": "action.hacking.variety.Exploit misconfig", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.004", "attack_object_name": "Hijack Execution Flow: Dylib Hijacking", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.", "capability_id": "action.hacking.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574.004", "attack_object_name": "Hijack Execution Flow: Dylib Hijacking", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1595.002", "attack_object_name": "Active Scanning: Vulnerability Scanning", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other hacking enumerations, (such as XSS when an XSS vuln exists.). Parent of many hacking varieties.", "capability_id": "action.hacking.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1595.002", "attack_object_name": "Active Scanning: Vulnerability Scanning", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.)", "capability_id": "action.malware.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1595.002", "attack_object_name": "Active Scanning: Vulnerability Scanning", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1595.002", "attack_object_name": "Active Scanning: Vulnerability Scanning", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1007", "attack_object_name": "System Service Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1012", "attack_object_name": "Query Registry", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1057", "attack_object_name": "Process Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1069", "attack_object_name": "Permission Groups Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1069.001", "attack_object_name": "Permission Groups Discovery: Local Groups", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1069.002", "attack_object_name": "Permission Groups Discovery: Domain Groups", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1069.003", "attack_object_name": "Permission Groups Discovery: Cloud Groups", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1082", "attack_object_name": "System Information Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1087", "attack_object_name": "Account Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1087.001", "attack_object_name": "Account Discovery: Local Account", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1087.002", "attack_object_name": "Account Discovery: Domain Account", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1087.003", "attack_object_name": "Account Discovery: Email Account", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1087.004", "attack_object_name": "Account Discovery: Cloud Account", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1119", "attack_object_name": "Automated Collection", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1119", "attack_object_name": "Automated Collection", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1120", "attack_object_name": "Peripheral Device Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1124", "attack_object_name": "System Time Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1201", "attack_object_name": "Password Policy Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1480", "attack_object_name": "Execution Guardrails", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1480.001", "attack_object_name": "Execution Guardrails: Environmental Keying", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1518", "attack_object_name": "Software Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1518.001", "attack_object_name": "Software Discovery: Security Software Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1526", "attack_object_name": "Cloud Service Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1538", "attack_object_name": "Cloud Service Dashboard", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1580", "attack_object_name": "Cloud Infrastructure Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1589", "attack_object_name": "Gather Victim Identity Information", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1589", "attack_object_name": "Gather Victim Identity Information", "references": [], "capability_description": "Information on individuals such as title, interests, physical location, etc, used to pick an organization as a target", "capability_id": "value_chain.targeting.variety.Personal Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1589.001", "attack_object_name": "Gather Victim Identity Information: Credentials", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1589.001", "attack_object_name": "Gather Victim Identity Information: Credentials", "references": [], "capability_description": "lost or stolen credentials, including credental stuffing, used to pick an organization as a target", "capability_id": "value_chain.targeting.variety.Lost or stolen credentials", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1589.001", "attack_object_name": "Gather Victim Identity Information: Credentials", "references": [], "capability_description": "Information on individuals such as title, interests, physical location, etc, used to pick an organization as a target", "capability_id": "value_chain.targeting.variety.Personal Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1589.002", "attack_object_name": "Gather Victim Identity Information: Email Addresses", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1589.002", "attack_object_name": "Gather Victim Identity Information: Email Addresses", "references": [], "capability_description": "Email addresses", "capability_id": "value_chain.targeting.variety.Email addresses", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1589.002", "attack_object_name": "Gather Victim Identity Information: Email Addresses", "references": [], "capability_description": "Information on individuals such as title, interests, physical location, etc, used to pick an organization as a target", "capability_id": "value_chain.targeting.variety.Personal Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1589.003", "attack_object_name": "Gather Victim Identity Information: Employee Names", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1589.003", "attack_object_name": "Gather Victim Identity Information: Employee Names", "references": [], "capability_description": "Information on individuals such as title, interests, physical location, etc, used to pick an organization as a target", "capability_id": "value_chain.targeting.variety.Personal Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1590", "attack_object_name": "Gather Victim Network Information", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1590", "attack_object_name": "Gather Victim Network Information", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1590.001", "attack_object_name": "Gather Victim Network Information: Domain Properties", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1590.001", "attack_object_name": "Gather Victim Network Information: Domain Properties", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1590.002", "attack_object_name": "Gather Victim Network Information: DNS", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1590.002", "attack_object_name": "Gather Victim Network Information: DNS", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1590.003", "attack_object_name": "Gather Victim Network Information: Network Trust Dependencies", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1590.003", "attack_object_name": "Gather Victim Network Information: Network Trust Dependencies", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1590.004", "attack_object_name": "Gather Victim Network Information: Network Topology", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1590.004", "attack_object_name": "Gather Victim Network Information: Network Topology", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1590.005", "attack_object_name": "Gather Victim Network Information: IP Addresses", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1590.005", "attack_object_name": "Gather Victim Network Information: IP Addresses", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1590.006", "attack_object_name": "Gather Victim Network Information: Network Security Appliances", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1590.006", "attack_object_name": "Gather Victim Network Information: Network Security Appliances", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1591", "attack_object_name": "Gather Victim Org Information", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1591", "attack_object_name": "Gather Victim Org Information", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1591.001", "attack_object_name": "Gather Victim Org Information: Determine Physical Locations", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1591.001", "attack_object_name": "Gather Victim Org Information: Determine Physical Locations", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1591.002", "attack_object_name": "Gather Victim Org Information: Business Relationships", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1591.002", "attack_object_name": "Gather Victim Org Information: Business Relationships", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1591.003", "attack_object_name": "Gather Victim Org Information: Identify Business  Tempo", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1591.003", "attack_object_name": "Gather Victim Org Information: Identify Business  Tempo", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1591.004", "attack_object_name": "Gather Victim Org Information: Identify Roles", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1591.004", "attack_object_name": "Gather Victim Org Information: Identify Roles", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1592", "attack_object_name": "Gather Victim Host Information", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1592", "attack_object_name": "Gather Victim Host Information", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1592.001", "attack_object_name": "Gather Victim Host Information: Hardware", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1592.001", "attack_object_name": "Gather Victim Host Information: Hardware", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1592.002", "attack_object_name": "Gather Victim Host Information: Software", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1592.002", "attack_object_name": "Gather Victim Host Information: Software", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1592.003", "attack_object_name": "Gather Victim Host Information: Firmware", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1592.003", "attack_object_name": "Gather Victim Host Information: Firmware", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1592.004", "attack_object_name": "Gather Victim Host Information: Client Configurations", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1592.004", "attack_object_name": "Gather Victim Host Information: Client Configurations", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1593", "attack_object_name": "Search Open Websites/Domains", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1593", "attack_object_name": "Search Open Websites/Domains", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1593.001", "attack_object_name": "Search Open Websites/Domains: Social Media", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1593.001", "attack_object_name": "Search Open Websites/Domains: Social Media", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1593.002", "attack_object_name": "Search Open Websites/Domains: Search Engines", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1593.002", "attack_object_name": "Search Open Websites/Domains: Search Engines", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1594", "attack_object_name": "Search Victim-Owned Websites", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1594", "attack_object_name": "Search Victim-Owned Websites", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1596", "attack_object_name": "Search Open Technical Databases", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1596", "attack_object_name": "Search Open Technical Databases", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1596.001", "attack_object_name": "Search Open Technical Databases: DNS/Passive DNS", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1596.001", "attack_object_name": "Search Open Technical Databases: DNS/Passive DNS", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1596.002", "attack_object_name": "Search Open Technical Databases: WHOIS", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1596.002", "attack_object_name": "Search Open Technical Databases: WHOIS", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1596.003", "attack_object_name": "Search Open Technical Databases: Digital Certificates", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1596.003", "attack_object_name": "Search Open Technical Databases: Digital Certificates", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1596.004", "attack_object_name": "Search Open Technical Databases: CDNs", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1596.004", "attack_object_name": "Search Open Technical Databases: CDNs", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1596.005", "attack_object_name": "Search Open Technical Databases: Scan Databases", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1596.005", "attack_object_name": "Search Open Technical Databases: Scan Databases", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1597", "attack_object_name": "Search Closed Sources", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1597", "attack_object_name": "Search Closed Sources", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1597.001", "attack_object_name": "Search Closed Sources: Threat Intel Vendors", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1597.001", "attack_object_name": "Search Closed Sources: Threat Intel Vendors", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1597.002", "attack_object_name": "Search Closed Sources:  Purchase Technical Data", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1597.002", "attack_object_name": "Search Closed Sources:  Purchase Technical Data", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1602", "attack_object_name": "Data from Configuration Repository", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1602", "attack_object_name": "Data from Configuration Repository", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1602.001", "attack_object_name": "Data from Configuration Repository: SNMP (MIB Dump)", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1602.002", "attack_object_name": "Data from Configuration Repository: Network Device Configuration Dump", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1613", "attack_object_name": "Container and Resource Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1614", "attack_object_name": "System Location Discovery", "references": [], "capability_description": "Footprinting and fingerprinting", "capability_id": "action.hacking.variety.Footprinting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1539", "attack_object_name": "Steal Web Session Cookie", "references": [], "capability_description": "Forced browsing or predictable resource location. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Forced browsing", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1539", "attack_object_name": "Steal Web Session Cookie", "references": [], "capability_description": "Man-in-the-middle attack. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.MitM", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1539", "attack_object_name": "Steal Web Session Cookie", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1583.003", "attack_object_name": "Acquire Infrastructure: Virtual Private Server", "references": [], "capability_description": "Forced browsing or predictable resource location. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Forced browsing", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.003", "attack_object_name": "Acquire Infrastructure: Virtual Private Server", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.003", "attack_object_name": "Acquire Infrastructure: Virtual Private Server", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1583.003", "attack_object_name": "Acquire Infrastructure: Virtual Private Server", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1583.004", "attack_object_name": "Acquire Infrastructure: Server", "references": [], "capability_description": "Forced browsing or predictable resource location. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Forced browsing", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.004", "attack_object_name": "Acquire Infrastructure: Server", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.004", "attack_object_name": "Acquire Infrastructure: Server", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1583.004", "attack_object_name": "Acquire Infrastructure: Server", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1583.006", "attack_object_name": "Acquire Infrastructure: Web Services", "references": [], "capability_description": "Forced browsing or predictable resource location. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Forced browsing", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.006", "attack_object_name": "Acquire Infrastructure: Web Services", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.006", "attack_object_name": "Acquire Infrastructure: Web Services", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1583.006", "attack_object_name": "Acquire Infrastructure: Web Services", "references": [], "capability_description": "Development of any full website controlled by the attacker", "capability_id": "value_chain.development.variety.Website", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1583.006", "attack_object_name": "Acquire Infrastructure: Web Services", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1583.006", "attack_object_name": "Acquire Infrastructure: Web Services", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1185", "attack_object_name": "Man in the Browser", "references": [], "capability_description": "HTTP Response Splitting. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.HTTP Response Splitting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1185", "attack_object_name": "Man in the Browser", "references": [], "capability_description": "HTTP request smuggling. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.HTTP request smuggling", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1185", "attack_object_name": "Man in the Browser", "references": [], "capability_description": "HTTP request splitting. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.HTTP request splitting", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1185", "attack_object_name": "Man in the Browser", "references": [], "capability_description": "HTTP response smuggling. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.HTTP response smuggling", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1185", "attack_object_name": "Man in the Browser", "references": [], "capability_description": "Man-in-the-middle attack. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.MitM", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1185", "attack_object_name": "Man in the Browser", "references": [], "capability_description": "Session fixation. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Session fixation", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1185", "attack_object_name": "Man in the Browser", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1557", "attack_object_name": "Man-in-the-Middle", "references": [], "capability_description": "Man-in-the-middle attack. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.MitM", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1557", "attack_object_name": "Man-in-the-Middle", "references": [], "capability_description": "Routing detour. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Routing detour", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1557.001", "attack_object_name": "Man-in-the-Middle: LLMNR/NBT-NS Poisoning and Relay", "references": [], "capability_description": "Man-in-the-middle attack. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.MitM", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1557.002", "attack_object_name": "Man-in-the-Middle: ARP Cache Poisoning", "references": [], "capability_description": "Man-in-the-middle attack. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.MitM", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1550.002", "attack_object_name": "Use Alternate Authentication Material: Pass the Hash", "references": [], "capability_description": "Pass-the-hash", "capability_id": "action.hacking.variety.Pass-the-hash", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1550.002", "attack_object_name": "Use Alternate Authentication Material: Pass the Hash", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1550.002", "attack_object_name": "Use Alternate Authentication Material: Pass the Hash", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1001", "attack_object_name": "Data Obfuscation", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1001", "attack_object_name": "Data Obfuscation", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1001", "attack_object_name": "Data Obfuscation", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1008", "attack_object_name": "Fallback Channels", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1008", "attack_object_name": "Fallback Channels", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1008", "attack_object_name": "Fallback Channels", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071", "attack_object_name": "Application Layer Protocol", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1071", "attack_object_name": "Application Layer Protocol", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1071", "attack_object_name": "Application Layer Protocol", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071", "attack_object_name": "Application Layer Protocol", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1078", "attack_object_name": "Valid Accounts", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1078", "attack_object_name": "Valid Accounts", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1078", "attack_object_name": "Valid Accounts", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1090", "attack_object_name": "Proxy", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1090", "attack_object_name": "Proxy", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1090", "attack_object_name": "Proxy", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1095", "attack_object_name": "Non-Application Layer Protocol", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1095", "attack_object_name": "Non-Application Layer Protocol", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1095", "attack_object_name": "Non-Application Layer Protocol", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1102", "attack_object_name": "Web Service", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1102", "attack_object_name": "Web Service", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1102", "attack_object_name": "Web Service", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1104", "attack_object_name": "Multi-Stage Channels", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1104", "attack_object_name": "Multi-Stage Channels", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1104", "attack_object_name": "Multi-Stage Channels", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1105", "attack_object_name": "Ingress Tool Transfer", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1105", "attack_object_name": "Ingress Tool Transfer", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1105", "attack_object_name": "Ingress Tool Transfer", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1132", "attack_object_name": "Data Encoding", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1132", "attack_object_name": "Data Encoding", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1132", "attack_object_name": "Data Encoding", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1133", "attack_object_name": "External Remote Services", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1133", "attack_object_name": "External Remote Services", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1133", "attack_object_name": "External Remote Services", "references": [], "capability_description": "3rd party online desktop sharing (LogMeIn, Go2Assist)", "capability_id": "action.hacking.vector.3rd party desktop", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1133", "attack_object_name": "External Remote Services", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1133", "attack_object_name": "External Remote Services", "references": [], "capability_description": "Superset of 'Desktop sharing' and '3rd party desktop'.  Please use in place of the other two", "capability_id": "action.hacking.vector.Desktop sharing software", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1133", "attack_object_name": "External Remote Services", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1133", "attack_object_name": "External Remote Services", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.)", "capability_id": "action.malware.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1133", "attack_object_name": "External Remote Services", "references": [], "capability_description": "Remotely injected by agent (i.e. via SQLi)", "capability_id": "action.malware.vector.Remote injection", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1133", "attack_object_name": "External Remote Services", "references": [], "capability_description": "Web application. Parent of 'Web application - download' and 'Web application - drive-by.", "capability_id": "action.malware.vector.Web application", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1205", "attack_object_name": "Traffic Signaling", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1205", "attack_object_name": "Traffic Signaling", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1205", "attack_object_name": "Traffic Signaling", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1505", "attack_object_name": "Server Software Component", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505", "attack_object_name": "Server Software Component", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505", "attack_object_name": "Server Software Component", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1505.003", "attack_object_name": "Server Software Component: Web Shell", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505.003", "attack_object_name": "Server Software Component: Web Shell", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1505.003", "attack_object_name": "Server Software Component: Web Shell", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1525", "attack_object_name": "Implant Container Image", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1525", "attack_object_name": "Implant Container Image", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1525", "attack_object_name": "Implant Container Image", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1525", "attack_object_name": "Implant Container Image", "references": [], "capability_description": "Remote Access Trojan.  Parent of 'Backdoor' and 'Trojan'", "capability_id": "action.malware.variety.RAT", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1525", "attack_object_name": "Implant Container Image", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1568", "attack_object_name": "Dynamic Resolution", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1568", "attack_object_name": "Dynamic Resolution", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1568", "attack_object_name": "Dynamic Resolution", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1568", "attack_object_name": "Dynamic Resolution", "references": [], "capability_description": "Downloaded and installed by local malware", "capability_id": "action.malware.vector.Download by malware", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1571", "attack_object_name": "Non-Standard Port", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1571", "attack_object_name": "Non-Standard Port", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1571", "attack_object_name": "Non-Standard Port", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1572", "attack_object_name": "Protocol Tunneling", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1572", "attack_object_name": "Protocol Tunneling", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1572", "attack_object_name": "Protocol Tunneling", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1573", "attack_object_name": "Encrypted Channels", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1573", "attack_object_name": "Encrypted Channels", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1573", "attack_object_name": "Encrypted Channels", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1573.001", "attack_object_name": "Encrypted Channels: Symmetric Cryptography", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1573.001", "attack_object_name": "Encrypted Channels: Symmetric Cryptography", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1573.002", "attack_object_name": "Encrypted Channels: Asymmetric Cryptography", "references": [], "capability_description": "Use of Backdoor or C2 channel", "capability_id": "action.hacking.variety.Use of backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1573.002", "attack_object_name": "Encrypted Channels: Asymmetric Cryptography", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1021", "attack_object_name": "Remote Services", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021", "attack_object_name": "Remote Services", "references": [], "capability_description": "Network propagation", "capability_id": "action.malware.vector.Network propagation", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1021.001", "attack_object_name": "Remote Services: Remote Desktop Protocol", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.001", "attack_object_name": "Remote Services: Remote Desktop Protocol", "references": [], "capability_description": "Superset of 'Desktop sharing' and '3rd party desktop'.  Please use in place of the other two", "capability_id": "action.hacking.vector.Desktop sharing software", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.002", "attack_object_name": "Remote Services: SMB/Windows Admin Shares", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.002", "attack_object_name": "Remote Services: SMB/Windows Admin Shares", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.003", "attack_object_name": "Remote Services: Distributed Component Object Model", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.003", "attack_object_name": "Remote Services: Distributed Component Object Model", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.004", "attack_object_name": "Remote Services: SSH", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.004", "attack_object_name": "Remote Services: SSH", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.005", "attack_object_name": "Remote Services: VNC", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.005", "attack_object_name": "Remote Services: VNC", "references": [], "capability_description": "Superset of 'Desktop sharing' and '3rd party desktop'.  Please use in place of the other two", "capability_id": "action.hacking.vector.Desktop sharing software", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.006", "attack_object_name": "Remote Services: Windows Remote Management", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1021.006", "attack_object_name": "Remote Services: Windows Remote Management", "references": [], "capability_description": "Remote shell", "capability_id": "action.hacking.vector.Command shell", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1078.001", "attack_object_name": "Valid Accounts: Default Accounts", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1078.002", "attack_object_name": "Valid Accounts: Domain Accounts", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1078.003", "attack_object_name": "Valid Accounts: Local Accounts", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1078.004", "attack_object_name": "Valid Accounts: Cloud Accounts", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1134", "attack_object_name": "Access Token Manipulation", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1134.001", "attack_object_name": "Access Token Manipulation: Token Impersonation/Theft", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1134.002", "attack_object_name": "Access Token Manipulation: Create Process with Token", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1134.003", "attack_object_name": "Access Token Manipulation: Make and Impersonate Token", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1134.004", "attack_object_name": "Access Token Manipulation: Parent PID Spoofing", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1134.005", "attack_object_name": "Access Token Manipulation: SID-History Injection", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1550", "attack_object_name": "Use Alternate Authentication Material", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1550", "attack_object_name": "Use Alternate Authentication Material", "references": [], "capability_description": "Network propagation", "capability_id": "action.malware.vector.Network propagation", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1550.001", "attack_object_name": "Use Alternate Authentication Material: Application Access Token", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1550.003", "attack_object_name": "Use Alternate Authentication Material: Pass the Ticket", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1550.004", "attack_object_name": "Use Alternate Authentication Material: Web Session Cookies", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1558", "attack_object_name": "Steal or Forge Kerberos Tickets", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1558.001", "attack_object_name": "Steal or Forge Kerberos Tickets: Golden Ticket", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1558.002", "attack_object_name": "Steal or Forge Kerberos Tickets: Silver Ticket", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1558.003", "attack_object_name": "Steal or Forge Kerberos Tickets: Kerberoasting", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1586", "attack_object_name": "Compromise Account", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1586.001", "attack_object_name": "Compromise Account: Social Media Accounts", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1586.001", "attack_object_name": "Compromise Account: Social Media Accounts", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1586.001", "attack_object_name": "Compromise Account: Social Media Accounts", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1586.002", "attack_object_name": "Compromise Account: Email Accounts", "references": [], "capability_description": "Use of stolen authentication credentials (including credential stuffing)", "capability_id": "action.hacking.variety.Use of stolen creds", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1611", "attack_object_name": "Escape to Host", "references": [], "capability_description": "Virtual machine escape. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Virtual machine escape", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1213", "attack_object_name": "Data from Information Repository", "references": [], "capability_description": "XML external entities. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.XML external entities", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1213", "attack_object_name": "Data from Information Repository", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1546", "attack_object_name": "Event Triggered Execution", "references": [], "capability_description": "XML injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.XML injection", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1546", "attack_object_name": "Event Triggered Execution", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1546", "attack_object_name": "Event Triggered Execution", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1546", "attack_object_name": "Event Triggered Execution", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1574", "attack_object_name": "Hijack Execution Flow", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574", "attack_object_name": "Hijack Execution Flow", "references": [], "capability_description": "XML injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.XML injection", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574", "attack_object_name": "Hijack Execution Flow", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1574", "attack_object_name": "Hijack Execution Flow", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1010", "attack_object_name": "Application Window Discovery", "references": [], "capability_description": "XPath injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.XPath injection", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1010", "attack_object_name": "Application Window Discovery", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1111", "attack_object_name": "Two-Factor Authentication Interception", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583", "attack_object_name": "Acquire Infrastructure", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583", "attack_object_name": "Acquire Infrastructure", "references": [], "capability_description": "Web via user-executed or downloaded content. Child of 'Web application'.", "capability_id": "action.malware.vector.Web application - download", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1583.001", "attack_object_name": "Acquire Infrastructure: Domains", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.001", "attack_object_name": "Acquire Infrastructure: Domains", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1583.001", "attack_object_name": "Acquire Infrastructure: Domains", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1583.001", "attack_object_name": "Acquire Infrastructure: Domains", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1583.002", "attack_object_name": "Acquire Infrastructure: DNS Server", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1583.002", "attack_object_name": "Acquire Infrastructure: DNS Server", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1583.002", "attack_object_name": "Acquire Infrastructure: DNS Server", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1583.002", "attack_object_name": "Acquire Infrastructure: DNS Server", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1584", "attack_object_name": "Compromise Infrastructure", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1584", "attack_object_name": "Compromise Infrastructure", "references": [], "capability_description": "Web via user-executed or downloaded content. Child of 'Web application'.", "capability_id": "action.malware.vector.Web application - download", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1584", "attack_object_name": "Compromise Infrastructure", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1584", "attack_object_name": "Compromise Infrastructure", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1584.001", "attack_object_name": "Compromise Infrastructure: Domains", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1584.001", "attack_object_name": "Compromise Infrastructure: Domains", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1584.001", "attack_object_name": "Compromise Infrastructure: Domains", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1584.001", "attack_object_name": "Compromise Infrastructure: Domains", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1584.002", "attack_object_name": "Compromise Infrastructure: DNS Server", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1584.002", "attack_object_name": "Compromise Infrastructure: DNS Server", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1584.002", "attack_object_name": "Compromise Infrastructure: DNS Server", "references": [], "capability_description": "malicious content added to a benign server, such as a webserver, by the actor, without the permission or necessarily knowledge of the server\u2019s owner", "capability_id": "value_chain.distribution.variety.Compromised server", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1584.002", "attack_object_name": "Compromise Infrastructure: DNS Server", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1584.003", "attack_object_name": "Compromise Infrastructure: Virtual Private Server", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1584.003", "attack_object_name": "Compromise Infrastructure: Virtual Private Server", "references": [], "capability_description": "malicious content added to a benign server, such as a webserver, by the actor, without the permission or necessarily knowledge of the server\u2019s owner", "capability_id": "value_chain.distribution.variety.Compromised server", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1584.003", "attack_object_name": "Compromise Infrastructure: Virtual Private Server", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1584.004", "attack_object_name": "Compromise Infrastructure: Server", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1584.004", "attack_object_name": "Compromise Infrastructure: Server", "references": [], "capability_description": "malicious content added to a benign server, such as a webserver, by the actor, without the permission or necessarily knowledge of the server\u2019s owner", "capability_id": "value_chain.distribution.variety.Compromised server", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1584.004", "attack_object_name": "Compromise Infrastructure: Server", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1584.006", "attack_object_name": "Compromise Infrastructure: Web Services", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1584.006", "attack_object_name": "Compromise Infrastructure: Web Services", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1584.006", "attack_object_name": "Compromise Infrastructure: Web Services", "references": [], "capability_description": "The variety of non-distribution service required is known, but is not listed", "capability_id": "value_chain.non-distribution services.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": "T1587", "attack_object_name": "Develop Capabilities", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1587", "attack_object_name": "Develop Capabilities", "references": [], "capability_description": "Nothing is known about the need for or type of development investment other than it was present.", "capability_id": "value_chain.development.variety.Unknown", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1587.001", "attack_object_name": "Develop Capabilities: Malware", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1587.001", "attack_object_name": "Develop Capabilities: Malware", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1587.001", "attack_object_name": "Develop Capabilities: Malware", "references": [], "capability_description": "A small program that can be distributed, installed, and controlled en mass.", "capability_id": "value_chain.development.variety.Bot", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1587.001", "attack_object_name": "Develop Capabilities: Malware", "references": [], "capability_description": "The portion a program that causes a negative effect.", "capability_id": "value_chain.development.variety.Payload", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1587.001", "attack_object_name": "Develop Capabilities: Malware", "references": [], "capability_description": "Ransomware (encrypt or seize stored data)", "capability_id": "value_chain.development.variety.Ransomware", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1587.001", "attack_object_name": "Develop Capabilities: Malware", "references": [], "capability_description": "A program which masquerades as another program to get a target to execute malicious content", "capability_id": "value_chain.development.variety.Trojan", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1587.002", "attack_object_name": "Develop Capabilities: Code Signing Certificates", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1587.002", "attack_object_name": "Develop Capabilities: Code Signing Certificates", "references": [], "capability_description": "The variety of development required is known, but is not listed.", "capability_id": "value_chain.development.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1587.003", "attack_object_name": "Develop Capabilities: Digital Certificates", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1587.003", "attack_object_name": "Develop Capabilities: Digital Certificates", "references": [], "capability_description": "The variety of development required is known, but is not listed.", "capability_id": "value_chain.development.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1587.004", "attack_object_name": "Develop Capabilities: Exploits", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1587.004", "attack_object_name": "Develop Capabilities: Exploits", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1587.004", "attack_object_name": "Develop Capabilities: Exploits", "references": [], "capability_description": "Code to exploit a vulnerability, including web injects.", "capability_id": "value_chain.development.variety.Exploit", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1587.004", "attack_object_name": "Develop Capabilities: Exploits", "references": [], "capability_description": "Code sets capable of selecting and trying multiple exploits against a target.", "capability_id": "value_chain.development.variety.Exploit Kits", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588", "attack_object_name": "Obtain Capabilities", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1588", "attack_object_name": "Obtain Capabilities", "references": [], "capability_description": "Nothing is known about the need for or type of development investment other than it was present.", "capability_id": "value_chain.development.variety.Unknown", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588.001", "attack_object_name": "Obtain Capabilities: Malware", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1588.001", "attack_object_name": "Obtain Capabilities: Malware", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1588.001", "attack_object_name": "Obtain Capabilities: Malware", "references": [], "capability_description": "A small program that can be distributed, installed, and controlled en mass.", "capability_id": "value_chain.development.variety.Bot", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588.001", "attack_object_name": "Obtain Capabilities: Malware", "references": [], "capability_description": "The portion a program that causes a negative effect.", "capability_id": "value_chain.development.variety.Payload", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588.001", "attack_object_name": "Obtain Capabilities: Malware", "references": [], "capability_description": "Ransomware (encrypt or seize stored data)", "capability_id": "value_chain.development.variety.Ransomware", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588.001", "attack_object_name": "Obtain Capabilities: Malware", "references": [], "capability_description": "A program which masquerades as another program to get a target to execute malicious content", "capability_id": "value_chain.development.variety.Trojan", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588.002", "attack_object_name": "Obtain Capabilities: Tool", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1588.003", "attack_object_name": "Obtain Capabilities: Code Signing Certificates", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1588.003", "attack_object_name": "Obtain Capabilities: Code Signing Certificates", "references": [], "capability_description": "The variety of development required is known, but is not listed.", "capability_id": "value_chain.development.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588.004", "attack_object_name": "Obtain Capabilities: Digital Certificates", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1588.004", "attack_object_name": "Obtain Capabilities: Digital Certificates", "references": [], "capability_description": "The variety of development required is known, but is not listed.", "capability_id": "value_chain.development.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588.005", "attack_object_name": "Obtain Capabilities: Exploits", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1588.005", "attack_object_name": "Obtain Capabilities: Exploits", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1588.005", "attack_object_name": "Obtain Capabilities: Exploits", "references": [], "capability_description": "Code to exploit a vulnerability, including web injects.", "capability_id": "value_chain.development.variety.Exploit", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588.005", "attack_object_name": "Obtain Capabilities: Exploits", "references": [], "capability_description": "Code sets capable of selecting and trying multiple exploits against a target.", "capability_id": "value_chain.development.variety.Exploit Kits", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1588.006", "attack_object_name": "Obtain Capabilities: Vulnerabilities", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1588.006", "attack_object_name": "Obtain Capabilities: Vulnerabilities", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1599", "attack_object_name": "Network Boundry Bridging", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1599.001", "attack_object_name": "Network Boundry Bridging: Network Address Translation Traversal", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1606", "attack_object_name": "Forge Web Credentials", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1606.001", "attack_object_name": "Forge Web Credentials: Web Cookies", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1606.002", "attack_object_name": "Forge Web Credentials: SAML Tokens", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1531", "attack_object_name": "Account Access Removal", "references": [], "capability_description": "Unknown", "capability_id": "action.hacking.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1531", "attack_object_name": "Account Access Removal", "references": [], "capability_description": "Unknown", "capability_id": "attribute.integrity.variety.Unknown", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1037", "attack_object_name": "Boot or Logon Initialization Script", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1037", "attack_object_name": "Boot or Logon Initialization Script", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1037", "attack_object_name": "Boot or Logon Initialization Script", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1098", "attack_object_name": "Account Manipulation", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1098", "attack_object_name": "Account Manipulation", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1098", "attack_object_name": "Account Manipulation", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1136", "attack_object_name": "Create Account", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1136", "attack_object_name": "Create Account", "references": [], "capability_description": "Malware which compromises a legitimate file rather than creating new filess", "capability_id": "action.malware.variety.Modify data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1136", "attack_object_name": "Create Account", "references": [], "capability_description": "Created new user account", "capability_id": "attribute.integrity.variety.Created account", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1197", "attack_object_name": "BITS Jobs", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1197", "attack_object_name": "BITS Jobs", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1542", "attack_object_name": "Pre-OS Boot", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1542", "attack_object_name": "Pre-OS Boot", "references": [], "capability_description": "Rootkit (maintain local privileges and stealth)", "capability_id": "action.malware.variety.Rootkit", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1554", "attack_object_name": "Compromise Client Software Binary", "references": [], "capability_description": "Backdoor or command and control channel", "capability_id": "action.hacking.vector.Backdoor or C2", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1554", "attack_object_name": "Compromise Client Software Binary", "references": [], "capability_description": "System or network utilities (e.g., PsTools, Netcat)", "capability_id": "action.malware.variety.Adminware", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1554", "attack_object_name": "Compromise Client Software Binary", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1554", "attack_object_name": "Compromise Client Software Binary", "references": [], "capability_description": "An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor'", "capability_id": "action.malware.variety.Trojan", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1219", "attack_object_name": "Remote Access Software", "references": [], "capability_description": "Superset of 'Desktop sharing' and '3rd party desktop'.  Please use in place of the other two", "capability_id": "action.hacking.vector.Desktop sharing software", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1219", "attack_object_name": "Remote Access Software", "references": [], "capability_description": "System or network utilities (e.g., PsTools, Netcat)", "capability_id": "action.malware.variety.Adminware", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1497", "attack_object_name": "Virtualization/Sandbox Evasion", "references": [], "capability_description": "Hypervisor break-out attack", "capability_id": "action.hacking.vector.Hypervisor", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1497", "attack_object_name": "Virtualization/Sandbox Evasion", "references": [], "capability_description": "Penetration of another VM or web site on shared device or infrastructure", "capability_id": "action.hacking.vector.Inter-tenant", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1497", "attack_object_name": "Virtualization/Sandbox Evasion", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1199", "attack_object_name": "Trusted Relationship", "references": [], "capability_description": "Partner connection or credential", "capability_id": "action.hacking.vector.Partner", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1199", "attack_object_name": "Trusted Relationship", "references": [], "capability_description": "Adware", "capability_id": "action.malware.variety.Adware", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1195", "attack_object_name": "Supply Chain Compromise", "references": [], "capability_description": "Partner connection or credential", "capability_id": "action.hacking.vector.Partner", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1195", "attack_object_name": "Supply Chain Compromise", "references": [], "capability_description": "Included in automated software update", "capability_id": "action.malware.vector.Software update", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1195.001", "attack_object_name": "Supply Chain Compromise: Compromise Software Dependencies and Development Tools", "references": [], "capability_description": "Partner connection or credential", "capability_id": "action.hacking.vector.Partner", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1195.002", "attack_object_name": "Supply Chain Compromise: Compromise Software Supply Chain", "references": [], "capability_description": "Partner connection or credential", "capability_id": "action.hacking.vector.Partner", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1195.003", "attack_object_name": "Supply Chain Compromise: Compromise Hardware Supply Chain", "references": [], "capability_description": "Partner connection or credential", "capability_id": "action.hacking.vector.Partner", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1200", "attack_object_name": "Hardware Additions", "references": [], "capability_description": "Physical access or connection (i.e., at keyboard or via cable)", "capability_id": "action.hacking.vector.Physical access", "mapping_type": "related_to", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": "T1205.001", "attack_object_name": "Traffic Signaling: Port Knocking", "references": [], "capability_description": "Backdoor (enable remote access). Child of 'RAT' when combined with 'Trojan'", "capability_id": "action.malware.variety.Backdoor", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1205.001", "attack_object_name": "Traffic Signaling: Port Knocking", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1001.001", "attack_object_name": "Data Obfuscation: Junk Data", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1001.001", "attack_object_name": "Data Obfuscation: Junk Data", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071.001", "attack_object_name": "Application Layer Protocol: Web Protocols", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071.001", "attack_object_name": "Application Layer Protocol: Web Protocols", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071.002", "attack_object_name": "Application Layer Protocol: File Transfer Protocol", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071.002", "attack_object_name": "Application Layer Protocol: File Transfer Protocol", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071.003", "attack_object_name": "Application Layer Protocol: Mail Protocols", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071.003", "attack_object_name": "Application Layer Protocol: Mail Protocols", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071.004", "attack_object_name": "Application Layer Protocol: DNS", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1071.004", "attack_object_name": "Application Layer Protocol: DNS", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1090.001", "attack_object_name": "Proxy: Internal Proxy", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1090.002", "attack_object_name": "Proxy: External Proxy", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1090.003", "attack_object_name": "Proxy: Multi-hop Proxy", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1090.004", "attack_object_name": "Proxy: Domain Fronting", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1102.001", "attack_object_name": "Web Service: Dead Drop Resolver", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1102.002", "attack_object_name": "Web Service: Bidirectional Communication", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1102.003", "attack_object_name": "Web Service: One-Way Communication", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1132.001", "attack_object_name": "Data Encoding: Standard Encoding", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1132.002", "attack_object_name": "Data Encoding: Non-Standard Encoding", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1568.001", "attack_object_name": "Dynamic Resolution: Fast Flux DNS", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1568.002", "attack_object_name": "Dynamic Resolution: Domain Generation Algorithms", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1568.003", "attack_object_name": "Dynamic Resolution: DNS Calculation", "references": [], "capability_description": "Command and control (C2)", "capability_id": "action.malware.variety.C2", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1056", "attack_object_name": "Input Capture", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1056.001", "attack_object_name": "Input Capture: Keylogging", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1056.002", "attack_object_name": "Input Capture: GUI Input Capture", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1056.003", "attack_object_name": "Input Capture: Web Portal Capture", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1056.004", "attack_object_name": "Input Capture: Credential API Hooking", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1056.004", "attack_object_name": "Input Capture: Credential API Hooking", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1056.004", "attack_object_name": "Input Capture: Credential API Hooking", "references": [], "capability_description": "Spyware, keylogger or form-grabber (capture user input or activity)", "capability_id": "action.malware.variety.Spyware/Keylogger", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1113", "attack_object_name": "Screen Capture", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1114", "attack_object_name": "Email Collection", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1114.001", "attack_object_name": "Email Collection: Local Email Collection", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1114.002", "attack_object_name": "Email Collection: Remote Email Collection", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1114.003", "attack_object_name": "Email Collection: Email Forwarding Rule", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1114.003", "attack_object_name": "Email Collection: Email Forwarding Rule", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1123", "attack_object_name": "Audio Capture", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1125", "attack_object_name": "Video Capture", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1176", "attack_object_name": "Browser Extensions", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1176", "attack_object_name": "Browser Extensions", "references": [], "capability_description": "Web via auto-executed or \"drive-by\" infection. Child of 'Web application'.", "capability_id": "action.malware.vector.Web application - drive-by", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1207", "attack_object_name": "Rogue Domain Controller", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1217", "attack_object_name": "Browser Bookmark Discovery", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1528", "attack_object_name": "Steal Application Access Token", "references": [], "capability_description": "Capture data from application or system process", "capability_id": "action.malware.variety.Capture app data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.002", "attack_object_name": "OS Credential Dumping: Security Account Manager", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.002", "attack_object_name": "OS Credential Dumping: Security Account Manager", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.002", "attack_object_name": "OS Credential Dumping: Security Account Manager", "references": [], "capability_description": "RAM scraper or memory parser (capture data from volatile memory)", "capability_id": "action.malware.variety.RAM scraper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.003", "attack_object_name": "OS Credential Dumping: NTDS", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.003", "attack_object_name": "OS Credential Dumping: NTDS", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.006", "attack_object_name": "OS Credential Dumping: DCSync", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.006", "attack_object_name": "OS Credential Dumping: DCSync", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.006", "attack_object_name": "OS Credential Dumping: DCSync", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.008", "attack_object_name": "OS Credential Dumping: /etc/passwd and /etc/shadow", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.008", "attack_object_name": "OS Credential Dumping: /etc/passwd and /etc/shadow", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1005", "attack_object_name": "Data from Local System", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1025", "attack_object_name": "Data from Removable Media", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1033", "attack_object_name": "System Owner/User Discovery", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1039", "attack_object_name": "Data from Network Shared Drive", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1083", "attack_object_name": "File and Directory Discovery", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1213.001", "attack_object_name": "Data from Information Repositories: Confluence", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1213.002", "attack_object_name": "Data from Information Repositories: Sharepoint", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1530", "attack_object_name": "Data from Cloud Storage Object", "references": [], "capability_description": "Capture data stored on system disk", "capability_id": "action.malware.variety.Capture stored data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1496", "attack_object_name": "Resource Hijacking", "references": [], "capability_description": "Click fraud, whether or not cryptocurrency mining.  Also mark 'Click fraud or cryptocurrency mining'. Child of 'Click fraud and cryptocurrency mining'.", "capability_id": "action.malware.variety.Click fraud", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1496", "attack_object_name": "Resource Hijacking", "references": [], "capability_description": "Click fraud or cryptocurrency mining. Parent of 'Click fraud' and 'Cryptocurrency mining'.", "capability_id": "action.malware.variety.Click fraud and cryptocurrency mining", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1496", "attack_object_name": "Resource Hijacking", "references": [], "capability_description": "Cryptocurrency mining, whether or not click fraud. Child of 'Click fraud and cryptocurrency mining'.", "capability_id": "action.malware.variety.Cryptocurrency mining", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1221", "attack_object_name": "Template Injection", "references": [], "capability_description": "Client-side or browser attack (e.g., redirection, XSS, MitB)", "capability_id": "action.malware.variety.Client-side attack", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1070", "attack_object_name": "Indicator Removal on Host", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1070.001", "attack_object_name": "Indicator Removal on Host: Clear Windows Event Logs", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1070.001", "attack_object_name": "Indicator Removal on Host: Clear Windows Event Logs", "references": [], "capability_description": "Log tampering or modification", "capability_id": "attribute.integrity.variety.Log tampering", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1070.002", "attack_object_name": "Indicator Removal on Host: Clear Linux or Mac System Logs", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1070.002", "attack_object_name": "Indicator Removal on Host: Clear Linux or Mac System Logs", "references": [], "capability_description": "Log tampering or modification", "capability_id": "attribute.integrity.variety.Log tampering", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1070.003", "attack_object_name": "Indicator Removal on Host: Clear Command History", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1070.004", "attack_object_name": "Indicator Removal on Host: File Deletion", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1070.005", "attack_object_name": "Indicator Removal on Host: Network Share Connection Removal", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1070.006", "attack_object_name": "Indicator Removal on Host: Timestomp", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1485", "attack_object_name": "Data Destruction", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1495", "attack_object_name": "Firmware Corruption", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1561", "attack_object_name": "Disk Wipe", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1561.001", "attack_object_name": "Disk Wipe: Disk Content Wipe", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1561.002", "attack_object_name": "Disk Wipe: Disk Structure Wipe", "references": [], "capability_description": "Destroy or corrupt stored data", "capability_id": "action.malware.variety.Destroy data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1006", "attack_object_name": "Direct Volume Access", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1027", "attack_object_name": "Obfuscated Files or Information", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1027.001", "attack_object_name": "Obfuscated Files or Information: Binary Padding", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1027.002", "attack_object_name": "Obfuscated Files or Information: Software Packaging", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1027.003", "attack_object_name": "Obfuscated Files or Information: Steganography", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1027.004", "attack_object_name": "Obfuscated Files or Information: Compile After Dilevery", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1027.005", "attack_object_name": "Obfuscated Files or Information: Indicator Removal from Tools", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1036", "attack_object_name": "Masquerading", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1036", "attack_object_name": "Masquerading", "references": [], "capability_description": "Email via user-executed attachment. Child of 'Email'", "capability_id": "action.malware.vector.Email attachment", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1036.001", "attack_object_name": "Masquerading: Invalid Code Signature", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1036.002", "attack_object_name": "Masquerading: Right-to-Left Override", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1036.002", "attack_object_name": "Masquerading: Right-to-Left Override", "references": [], "capability_description": "Forgery or counterfeiting (fake hardware, software, documents, etc)", "capability_id": "action.social.variety.Forgery", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1036.002", "attack_object_name": "Masquerading: Right-to-Left Override", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1036.003", "attack_object_name": "Masquerading: Rename System Utilities", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1036.003", "attack_object_name": "Masquerading: Rename System Utilities", "references": [], "capability_description": "Rootkit (maintain local privileges and stealth)", "capability_id": "action.malware.variety.Rootkit", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1036.004", "attack_object_name": "Masquerading: Masquerade Task or Service", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1036.005", "attack_object_name": "Masquerading: Match Legitimate Name or Location", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1036.006", "attack_object_name": "Masquerading: Space after Filename", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1222", "attack_object_name": "File and Directory Permissions Modification", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1222.001", "attack_object_name": "File and Directory Permissions Modification: Windows File and Directory Permissions Modification", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1222.002", "attack_object_name": "File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1490", "attack_object_name": "Inhibit System Recovery", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1490", "attack_object_name": "Inhibit System Recovery", "references": [], "capability_description": "Ransomware (encrypt or seize stored data)", "capability_id": "action.malware.variety.Ransomware", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1497.001", "attack_object_name": "Virtualization/Sandbox Evasion: System Checks", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1497.002", "attack_object_name": "Virtualization/Sandbox Evasion: User Activity Based Checks", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1497.003", "attack_object_name": "Virtualization/Sandbox Evasion: Time Based Evasion", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1553", "attack_object_name": "Subvert Trust Contols", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1553.001", "attack_object_name": "Subvert Trust Contols: Gatekeeper Bypass", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1553.002", "attack_object_name": "Subvert Trust Contols: Code Signing", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1553.003", "attack_object_name": "Subvert Trust Contols: SIP and Trust Provider Hijacking", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1553.004", "attack_object_name": "Subvert Trust Contols: Install Root Certificate", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1553.005", "attack_object_name": "Subvert Trust Contols: Mark-of-the-Web Bypass", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1553.006", "attack_object_name": "Subvert Trust Contols: Code Signing Policy Modification", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1562", "attack_object_name": "Impair Defenses", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1562", "attack_object_name": "Impair Defenses", "references": [], "capability_description": "Malware which compromises a legitimate file rather than creating new filess", "capability_id": "action.malware.variety.Modify data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1562.001", "attack_object_name": "Impair Defenses: Disable or Modify Tools", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1562.002", "attack_object_name": "Impair Defenses: Disable Windows Event Logging", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1562.003", "attack_object_name": "Impair Defenses: Impair Command History Logging", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1562.004", "attack_object_name": "Impair Defenses: Disable or Modify System Firewall", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1562.006", "attack_object_name": "Impair Defenses: Indicator Blocking", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1562.007", "attack_object_name": "Impair Defenses: Disable or Modify Cloud Firewall", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1562.008", "attack_object_name": "Impair Defenses: Disable Cloud Logs", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1574.012", "attack_object_name": "Hijack Execution Flow: COR_PROFILER", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1600.001", "attack_object_name": "Weaken Encryption: Reduce Key Space", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1600.002", "attack_object_name": "Weaken Encryption: Disable Crypto Hardware", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1601", "attack_object_name": "Modify System Image", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1601.001", "attack_object_name": "Modify System Image: Patch System Image", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1601.002", "attack_object_name": "Modify System Image: Downgrade System Image", "references": [], "capability_description": "Disable or interfere with security controls", "capability_id": "action.malware.variety.Disable controls", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1489", "attack_object_name": "Service Stop", "references": [], "capability_description": "DoS attack", "capability_id": "action.malware.variety.DoS", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1211", "attack_object_name": "Exploitation for Defense Evasion", "references": [], "capability_description": "Exploit vulnerability in code (vs misconfig or weakness). This can be used with other malware enumerations, (such as Remote injection when a Remote injection vuln exists.)", "capability_id": "action.malware.variety.Exploit vuln", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1011", "attack_object_name": "Exfiltration Over Other Network Medium", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1011.001", "attack_object_name": "Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1020", "attack_object_name": "Automated Exfiltration", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1020.001", "attack_object_name": "Automated Exfiltration: Traffic Duplication", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1029", "attack_object_name": "Scheduled Transfer", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1030", "attack_object_name": "Data Transfer Size Limits", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1041", "attack_object_name": "Exfiltration Over C2 Channels", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1048", "attack_object_name": "Exfiltration Over Alternative Protocol", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1048.001", "attack_object_name": "Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocol", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1048.002", "attack_object_name": "Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1048.003", "attack_object_name": "Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protcol", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1052", "attack_object_name": "Exfiltration Over Physical Medium", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1052.001", "attack_object_name": "Exfiltration Over Physical Medium: Exfiltration over USB", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1074", "attack_object_name": "Data Staged", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1074.001", "attack_object_name": "Data Staged: Local Data Staging", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1074.002", "attack_object_name": "Data Staged: Remote Data Staging", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1537", "attack_object_name": "Transfer Data to Cloud Account", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1560", "attack_object_name": "Archive Collected Data", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1560.001", "attack_object_name": "Archive Collected Data: Archive via Utility", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1560.002", "attack_object_name": "Archive Collected Data: Archive via Library", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1560.003", "attack_object_name": "Archive Collected Data: Archive via Custom Method", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1567", "attack_object_name": "Exfiltration Over Web Service", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1567.001", "attack_object_name": "Exfiltration Over Web Service: Exfiltration to Code Repository", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1567.002", "attack_object_name": "Exfiltration Over Web Service: Exfiltration to Cloud Storage", "references": [], "capability_description": "Export data to another site or system", "capability_id": "action.malware.variety.Export data", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.007", "attack_object_name": "OS Credential Dumping: Proc Filesystem", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.007", "attack_object_name": "OS Credential Dumping: Proc Filesystem", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055", "attack_object_name": "Process Injection", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.001", "attack_object_name": "Process Injection: Dynamic-link Library Injection", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.002", "attack_object_name": "Process Injection: Portable Executable Injection", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.003", "attack_object_name": "Process Injection: Thread Execution Hijacking", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.004", "attack_object_name": "Process Injection: Asynchronous Procedure Call", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.005", "attack_object_name": "Process Injection: Thread Local Storage", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.008", "attack_object_name": "Process Injection: Ptrace System Calls", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.009", "attack_object_name": "Process Injection: Proc Memory", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.011", "attack_object_name": "Process Injection: Extra Window Memory Injection", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.012", "attack_object_name": "Process Injection: Process Hollowing", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.013", "attack_object_name": "Process Injection: Process Doppelganging", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1055.014", "attack_object_name": "Process Injection: VDSO Hijacking", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1115", "attack_object_name": "Clipboard Data", "references": [], "capability_description": "(malware never stored to persistent storage)", "capability_id": "action.malware.variety.In-memory", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1040", "attack_object_name": "Network Sniffing", "references": [], "capability_description": "Packet sniffer (capture data from network)", "capability_id": "action.malware.variety.Packet sniffer", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1040", "attack_object_name": "Network Sniffing", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003", "attack_object_name": "OS Credential Dumping", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.001", "attack_object_name": "OS Credential Dumping: LSASS Memory", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.001", "attack_object_name": "OS Credential Dumping: LSASS Memory", "references": [], "capability_description": "RAM scraper or memory parser (capture data from volatile memory)", "capability_id": "action.malware.variety.RAM scraper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.004", "attack_object_name": "OS Credential Dumping: LSA Secrets", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.004", "attack_object_name": "OS Credential Dumping: LSA Secrets", "references": [], "capability_description": "RAM scraper or memory parser (capture data from volatile memory)", "capability_id": "action.malware.variety.RAM scraper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.005", "attack_object_name": "OS Credential Dumping: Cached Domain Credentials", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.005", "attack_object_name": "OS Credential Dumping: Cached Domain Credentials", "references": [], "capability_description": "RAM scraper or memory parser (capture data from volatile memory)", "capability_id": "action.malware.variety.RAM scraper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1003.005", "attack_object_name": "OS Credential Dumping: Cached Domain Credentials", "references": [], "capability_description": "Email via embedded link. Child of 'Email'", "capability_id": "action.malware.vector.Email link", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1552.001", "attack_object_name": "Unsecured Credentials: Credentials in Files", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1552.002", "attack_object_name": "Unsecured Credentials: Credentials in Registry", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1552.003", "attack_object_name": "Unsecured Credentials: Bash History", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1552.004", "attack_object_name": "Unsecured Credentials: Private Keys", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1552.005", "attack_object_name": "Unsecured Credentials: Cloud Instance Metadata API", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1552.006", "attack_object_name": "Unsecured Credentials: Group Policy Preferences", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1555", "attack_object_name": "Credentials from Password Stores", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1555.001", "attack_object_name": "Credentials from Password Stores: Keychain", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1555.002", "attack_object_name": "Credentials from Password Stores: Securityd Memory", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1555.002", "attack_object_name": "Credentials from Password Stores: Securityd Memory", "references": [], "capability_description": "RAM scraper or memory parser (capture data from volatile memory)", "capability_id": "action.malware.variety.RAM scraper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1555.003", "attack_object_name": "Credentials from Password Stores: Credentials from Web Browser", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1555.004", "attack_object_name": "Credentials from Password Stores: Windows Credential Manager", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1555.005", "attack_object_name": "Credentials from Password Stores: Password Managers", "references": [], "capability_description": "Password dumper (extract credential hashes)", "capability_id": "action.malware.variety.Password dumper", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1486", "attack_object_name": "Data Encrypted for Impact", "references": [], "capability_description": "Ransomware (encrypt or seize stored data)", "capability_id": "action.malware.variety.Ransomware", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1014", "attack_object_name": "Rootkit", "references": [], "capability_description": "Rootkit (maintain local privileges and stealth)", "capability_id": "action.malware.variety.Rootkit", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1542.001", "attack_object_name": "Pre-OS Boot: System Firmware", "references": [], "capability_description": "Rootkit (maintain local privileges and stealth)", "capability_id": "action.malware.variety.Rootkit", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1542.002", "attack_object_name": "Pre-OS Boot: Component Firmware", "references": [], "capability_description": "Rootkit (maintain local privileges and stealth)", "capability_id": "action.malware.variety.Rootkit", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1542.003", "attack_object_name": "Pre-OS Boot: Bootkit", "references": [], "capability_description": "Rootkit (maintain local privileges and stealth)", "capability_id": "action.malware.variety.Rootkit", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1542.004", "attack_object_name": "Pre-OS Boot: ROMMONkit", "references": [], "capability_description": "Rootkit (maintain local privileges and stealth)", "capability_id": "action.malware.variety.Rootkit", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1542.005", "attack_object_name": "Pre-OS Boot: TFTP Boot", "references": [], "capability_description": "Rootkit (maintain local privileges and stealth)", "capability_id": "action.malware.variety.Rootkit", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1016", "attack_object_name": "System Network Configuration Discovery", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1016.001", "attack_object_name": "System Network Configuration Discovery: Internet Connection Discovery", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1018", "attack_object_name": "Remote System Discovery", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1046", "attack_object_name": "Network Service Scanning", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1049", "attack_object_name": "System Network Connections Discovery", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1135", "attack_object_name": "Network Share Discovery", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1482", "attack_object_name": "Domain Trust Discovery", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1595", "attack_object_name": "Active Scanning", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1595", "attack_object_name": "Active Scanning", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1595.001", "attack_object_name": "Active Scanning: Scanning IP Blocks", "references": [], "capability_description": "Scan or footprint network", "capability_id": "action.malware.variety.Scan network", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1595.001", "attack_object_name": "Active Scanning: Scanning IP Blocks", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1204.003", "attack_object_name": "User Execution: Malicious Image", "references": [], "capability_description": "An application which appears legitimate but hides malicious functionality. Child of 'RAT' when combined with 'Backdoor'", "capability_id": "action.malware.variety.Trojan", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1204.003", "attack_object_name": "User Execution: Malicious Image", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1204.003", "attack_object_name": "User Execution: Malicious Image", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1204.003", "attack_object_name": "User Execution: Malicious Image", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1080", "attack_object_name": "Taint Shared Content", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1080", "attack_object_name": "Taint Shared Content", "references": [], "capability_description": "Worm (propagate to other systems or devices)", "capability_id": "action.malware.variety.Worm", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1091", "attack_object_name": "Replication Through Removable Media", "references": [], "capability_description": "Worm (propagate to other systems or devices)", "capability_id": "action.malware.variety.Worm", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1091", "attack_object_name": "Replication Through Removable Media", "references": [], "capability_description": "Removable storage media or devices", "capability_id": "action.malware.vector.Removable media", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1001.002", "attack_object_name": "Data Obfuscation: Steganography", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1001.003", "attack_object_name": "Data Obfuscation: Protocol Impersonation", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1140", "attack_object_name": "Deobfuscate/Decode Files or Information", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1204", "attack_object_name": "User Execution", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1204", "attack_object_name": "User Execution", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1204.001", "attack_object_name": "User Execution: Malicious Link", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1204.001", "attack_object_name": "User Execution: Malicious Link", "references": [], "capability_description": "Email via embedded link. Child of 'Email'", "capability_id": "action.malware.vector.Email link", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1204.001", "attack_object_name": "User Execution: Malicious Link", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1204.002", "attack_object_name": "User Execution: Malicious File", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1204.002", "attack_object_name": "User Execution: Malicious File", "references": [], "capability_description": "Email via user-executed attachment. Child of 'Email'", "capability_id": "action.malware.vector.Email attachment", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1204.002", "attack_object_name": "User Execution: Malicious File", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1608", "attack_object_name": "Stage Capabilities", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1608", "attack_object_name": "Stage Capabilities", "references": [], "capability_description": "Nothing is known about the need for or type of distribution investment other than it was present.", "capability_id": "value_chain.distribution.variety.Unknown", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1608.001", "attack_object_name": "Stage Capabilities: Upload Malware", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1608.001", "attack_object_name": "Stage Capabilities: Upload Malware", "references": [], "capability_description": "Malicious content shared intentionally, including bullet-proof hosting", "capability_id": "value_chain.distribution.variety.Website", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1608.002", "attack_object_name": "Stage Capabilities: Upload Tools", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1608.002", "attack_object_name": "Stage Capabilities: Upload Tools", "references": [], "capability_description": "Malicious content shared intentionally, including bullet-proof hosting", "capability_id": "value_chain.distribution.variety.Website", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1608.003", "attack_object_name": "Stage Capabilities: Install Digital Certificate", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1608.003", "attack_object_name": "Stage Capabilities: Install Digital Certificate", "references": [], "capability_description": "The variety of distribution was known, but is not listed", "capability_id": "value_chain.distribution.variety.Other", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1608.004", "attack_object_name": "Stage Capabilities: Drive-by Target", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1608.004", "attack_object_name": "Stage Capabilities: Drive-by Target", "references": [], "capability_description": "Malicious content shared intentionally, including bullet-proof hosting", "capability_id": "value_chain.distribution.variety.Website", "mapping_type": "related_to", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": "T1608.005", "attack_object_name": "Stage Capabilities: Link Target", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1610", "attack_object_name": "Deploy Container", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1612", "attack_object_name": "Build Image on Host", "references": [], "capability_description": "Unknown", "capability_id": "action.malware.variety.Unknown", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1566.001", "attack_object_name": "Phishing: Spearphishing Attachment", "references": [], "capability_description": "Email via user-executed attachment. Child of 'Email'", "capability_id": "action.malware.vector.Email attachment", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1566.001", "attack_object_name": "Phishing: Spearphishing Attachment", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1566.001", "attack_object_name": "Phishing: Spearphishing Attachment", "references": [], "capability_description": "Email", "capability_id": "action.social.vector.Email", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598.002", "attack_object_name": "Phishing for Information: Spearphishing Attachment", "references": [], "capability_description": "Email via user-executed attachment. Child of 'Email'", "capability_id": "action.malware.vector.Email attachment", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1598.002", "attack_object_name": "Phishing for Information: Spearphishing Attachment", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598.002", "attack_object_name": "Phishing for Information: Spearphishing Attachment", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598.002", "attack_object_name": "Phishing for Information: Spearphishing Attachment", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1556.002", "attack_object_name": "Phishing: Spearphishing Link", "references": [], "capability_description": "Email via embedded link. Child of 'Email'", "capability_id": "action.malware.vector.Email link", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1556.002", "attack_object_name": "Phishing: Spearphishing Link", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1556.002", "attack_object_name": "Phishing: Spearphishing Link", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1598.003", "attack_object_name": "Phishing for Information: Spearphishing Link", "references": [], "capability_description": "Email via embedded link. Child of 'Email'", "capability_id": "action.malware.vector.Email link", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1598.003", "attack_object_name": "Phishing for Information: Spearphishing Link", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598.003", "attack_object_name": "Phishing for Information: Spearphishing Link", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598.003", "attack_object_name": "Phishing for Information: Spearphishing Link", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1566", "attack_object_name": "Phishing", "references": [], "capability_description": "Instant Messaging", "capability_id": "action.malware.vector.Instant messaging", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1566", "attack_object_name": "Phishing", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1570", "attack_object_name": "Lateral Tool Transfer", "references": [], "capability_description": "Network propagation", "capability_id": "action.malware.vector.Network propagation", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1092", "attack_object_name": "Communication Through Removable Media", "references": [], "capability_description": "Removable storage media or devices", "capability_id": "action.malware.vector.Removable media", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1189", "attack_object_name": "Drive-by Compromise", "references": [], "capability_description": "Web via auto-executed or \"drive-by\" infection. Child of 'Web application'.", "capability_id": "action.malware.vector.Web application - drive-by", "mapping_type": "related_to", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": "T1566.002", "attack_object_name": "Phishing: Spearphishing Link", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1566.002", "attack_object_name": "Phishing: Spearphishing Link", "references": [], "capability_description": "Email", "capability_id": "action.social.vector.Email", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1566.003", "attack_object_name": "Phishing: Spearphishing via Service", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1566.003", "attack_object_name": "Phishing: Spearphishing via Service", "references": [], "capability_description": "Email", "capability_id": "action.social.vector.Email", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598", "attack_object_name": "Phishing for Information", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598", "attack_object_name": "Phishing for Information", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598", "attack_object_name": "Phishing for Information", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1598.001", "attack_object_name": "Phishing for Information: Spearphishing Service", "references": [], "capability_description": "Phishing (or any type of *ishing)", "capability_id": "action.social.variety.Phishing", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598.001", "attack_object_name": "Phishing for Information: Spearphishing Service", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1598.001", "attack_object_name": "Phishing for Information: Spearphishing Service", "references": [], "capability_description": "Information on an organization such as org chart, technologies in use, financial assets, etc, used to pick them as a target", "capability_id": "value_chain.targeting.variety.Organizational Information", "mapping_type": "related_to", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": "T1534", "attack_object_name": "Internal Spearphishing", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1534", "attack_object_name": "Internal Spearphishing", "references": [], "capability_description": "compromise of authenticity (e.g. masquerading as the legitimate owner of an account)", "capability_id": "attribute.integrity.variety.Misrepresentation", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1585", "attack_object_name": "Establish Accounts", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1585", "attack_object_name": "Establish Accounts", "references": [], "capability_description": "A fake representation of a person, such as fake social media profiles", "capability_id": "value_chain.development.variety.Persona", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1585.001", "attack_object_name": "Establish Accounts: Social Media Accounts", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1585.001", "attack_object_name": "Establish Accounts: Social Media Accounts", "references": [], "capability_description": "A fake representation of a person, such as fake social media profiles", "capability_id": "value_chain.development.variety.Persona", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1585.002", "attack_object_name": "Establish Accounts: Email Account", "references": [], "capability_description": "Pretexting (dialogue leveraging invented scenario)", "capability_id": "action.social.variety.Pretexting", "mapping_type": "related_to", "capability_group": "action.social"}, {"comments": "", "attack_object_id": "T1585.002", "attack_object_name": "Establish Accounts: Email Account", "references": [], "capability_description": "A fake representation of a person, such as fake social media profiles", "capability_id": "value_chain.development.variety.Persona", "mapping_type": "related_to", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": "T1546.001", "attack_object_name": "Event Triggered Execution: Change Default File Association", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.002", "attack_object_name": "Event Triggered Execution Screensaver", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.003", "attack_object_name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.004", "attack_object_name": "Event Triggered Execution: Unix Shell Configuration Modification", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.005", "attack_object_name": "Event Triggered Execution: Trap", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.006", "attack_object_name": "Event Triggered Execution: LC_LOAD_DYLIB Addition", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.007", "attack_object_name": "Event Triggered Execution: Netsh Helper DLL", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.008", "attack_object_name": "Event Triggered Execution: Accessibility Features", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.009", "attack_object_name": "Event Triggered Execution: AppCert DLLs", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.010", "attack_object_name": "Event Triggered Execution: AppInit DLLs", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.011", "attack_object_name": "Event Triggered Execution: Application Shimming", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.012", "attack_object_name": "Event Triggered Execution: Image File Execution Options Injection", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.013", "attack_object_name": "Event Triggered Execution: PowerShell Profile", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.014", "attack_object_name": "Event Triggered Execution: Emond", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1546.015", "attack_object_name": "Event Triggered Execution: Component Object Model Hijacking", "references": [], "capability_description": "Influence or alter human behavior", "capability_id": "attribute.integrity.variety.Alter behavior", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1136.001", "attack_object_name": "Create Account: Local Account", "references": [], "capability_description": "Created new user account", "capability_id": "attribute.integrity.variety.Created account", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1136.002", "attack_object_name": "Create Account: Domain Account", "references": [], "capability_description": "Created new user account", "capability_id": "attribute.integrity.variety.Created account", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1136.003", "attack_object_name": "Create Account: Cloud Account", "references": [], "capability_description": "Created new user account", "capability_id": "attribute.integrity.variety.Created account", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1491", "attack_object_name": "Defacement", "references": [], "capability_description": "Deface content", "capability_id": "attribute.integrity.variety.Defacement", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1491.001", "attack_object_name": "Defacement: Internal Defacement", "references": [], "capability_description": "Deface content", "capability_id": "attribute.integrity.variety.Defacement", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1491.002", "attack_object_name": "Defacement: External Defacement", "references": [], "capability_description": "Deface content", "capability_id": "attribute.integrity.variety.Defacement", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1037.001", "attack_object_name": "Boot or Logon Initialization Scripts: Logon Script (Windows)", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1037.002", "attack_object_name": "Boot or Logon Initialization Scripts: Logon Script (Mac)", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1037.003", "attack_object_name": "Boot or Logon Initialization Scripts: Network Logon Script", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1037.004", "attack_object_name": "Boot or Logon Initialization Scripts: RC Scripts", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1037.005", "attack_object_name": "Boot or Logon Initialization Scripts: Startup Items", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1484", "attack_object_name": "Domain Policy Modification", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1484.001", "attack_object_name": "Domain Policy Modification: Group Policy Modification", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1484.002", "attack_object_name": "Domain Policy Modification: Domain Trust Modification", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.001", "attack_object_name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.002", "attack_object_name": "Boot or Logon Autostart Execution: Authentication Package", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.003", "attack_object_name": "Boot or Logon Autostart Execution: Time Providers", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.004", "attack_object_name": "Boot or Logon Autostart Execution: Winlogon Helper DLL", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.005", "attack_object_name": "Boot or Logon Autostart Execution: Security Support Provider", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.006", "attack_object_name": "Boot or Logon Autostart Execution: Kernel Modules and Extensions", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.007", "attack_object_name": "Boot or Logon Autostart Execution: Re-opened Applications", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.008", "attack_object_name": "Boot or Logon Autostart Execution: LSASS Driver", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.009", "attack_object_name": "Boot or Logon Autostart Execution: Shortcut Modification", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.010", "attack_object_name": "Boot or Logon Autostart Execution: Port Monitors", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.011", "attack_object_name": "Boot or Logon Autostart Execution: Plist Modification", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.012", "attack_object_name": "Boot or Logon Autostart Execution: Print Processors", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.013", "attack_object_name": "Boot or Logon Autostart Execution: XDG Autostart Entries", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1556", "attack_object_name": "Modify Authentication Process", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1556", "attack_object_name": "Modify Authentication Process", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1556.001", "attack_object_name": "Modify Authentication Process: Domain Controller Authentication", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1556.001", "attack_object_name": "Modify Authentication Process: Domain Controller Authentication", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1556.003", "attack_object_name": "Modify Authentication Process: Pluggable Authentication Modules", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1556.003", "attack_object_name": "Modify Authentication Process: Pluggable Authentication Modules", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1556.004", "attack_object_name": "Modify Authentication Process: Network Device Authentication", "references": [], "capability_description": "Modified configuration or services", "capability_id": "attribute.integrity.variety.Modify configuration", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1556.004", "attack_object_name": "Modify Authentication Process: Network Device Authentication", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1565", "attack_object_name": "Data Manipulation", "references": [], "capability_description": "Modified stored data or content", "capability_id": "attribute.integrity.variety.Modify data", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1565.001", "attack_object_name": "Data Manipulation: Stored Data Manipulation", "references": [], "capability_description": "Modified stored data or content", "capability_id": "attribute.integrity.variety.Modify data", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1565.002", "attack_object_name": "Data Manipulation: Transmitted Data Manipulation", "references": [], "capability_description": "Modified stored data or content", "capability_id": "attribute.integrity.variety.Modify data", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1565.003", "attack_object_name": "Data Manipulation: Runtime Data Manipulation", "references": [], "capability_description": "Modified stored data or content", "capability_id": "attribute.integrity.variety.Modify data", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1098.001", "attack_object_name": "Account Manipulation: Additional Cloud Credentials", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1098.002", "attack_object_name": "Account Manipulation: Exchange Email Delegate Permissions", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1098.003", "attack_object_name": "Account Manipulation: Add Office 365 Global Administrator Role", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1098.004", "attack_object_name": "Account Manipulation: SSH Authorized Keys", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1547.014", "attack_object_name": "Boot or Logon Autostart Execution: Active Setup", "references": [], "capability_description": "Modified privileges or permissions", "capability_id": "attribute.integrity.variety.Modify privileges", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": "T1535", "attack_object_name": "Unused/Unsupported Cloud Regions", "references": [], "capability_description": "Repurposed asset for unauthorized function", "capability_id": "attribute.integrity.variety.Repurpose", "mapping_type": "related_to", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Cache poisoning. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Cache poisoning", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Cross-site request forgery. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.CSRF", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Mail command injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Mail command injection", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Null byte injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Null byte injection", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "OS commanding. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.OS commanding", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Path traversal. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Path traversal", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Reverse engineering. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Reverse engineering", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Remote file inclusion. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.RFI", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Credential or session prediction. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Session prediction", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Session replay. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Session replay", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Special element injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.Special element injection", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "SQL injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.SQLi", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "SSI injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.SSI injection", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "URL redirector abuse. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.URL redirector abuse", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Elevation of privilege by another customer in shared environment. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.User breakout", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "XQuery injection. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.XQuery injection", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Cross-site scripting. Child of 'Exploit vuln'.", "capability_id": "action.hacking.variety.XSS", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "action.hacking.variety.Other", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Graphical desktop sharing (RDP, VNC, PCAnywhere, Citrix)", "capability_id": "action.hacking.vector.Desktop sharing", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "action.hacking.vector.Other", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "VPN", "capability_id": "action.hacking.vector.VPN", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Web application", "capability_id": "action.hacking.vector.Web application", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Unknown", "capability_id": "action.hacking.vector.Unknown", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The hacking action resulted in additional security access", "capability_id": "action.hacking.result.Infiltrate", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The hacking action exfiltrated data from the victim", "capability_id": "action.hacking.result.Exfiltrate", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The hacking action resulted in additional security permissions", "capability_id": "action.hacking.result.Elevate", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The hacking action used security access or permissions already acuired", "capability_id": "action.hacking.result.Lateral movement", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "e.g. cryptomining, ransomware, etc", "capability_id": "action.hacking.result.Deploy payload", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The result of the hacking action is not listed", "capability_id": "action.hacking.result.Other", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The result of the hacking action is unknown", "capability_id": "action.hacking.result.Unknown", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The hacking action did not have a result", "capability_id": "action.hacking.result.NA", "mapping_type": "non_mappable", "capability_group": "action.hacking"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Downloader (pull updates or other malware)", "capability_id": "action.malware.variety.Downloader", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Send spam", "capability_id": "action.malware.variety.Spam", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "SQL injection attack", "capability_id": "action.malware.variety.SQL injection", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "action.malware.variety.Other", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Email. Parent to 'Email attachment', 'Email autoexecute', 'Email link', 'Email unknown'", "capability_id": "action.malware.vector.Email", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Email via automatic execution. Child of 'Email'", "capability_id": "action.malware.vector.Email autoexecute", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Email but sub-variety (attachment, autoexecute, link, etc) not known. Child of 'Email'", "capability_id": "action.malware.vector.Email unknown", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Email sub-variety known, but not one of those listed (attachment, link, autoexecute, etc). Child of 'Email'", "capability_id": "action.malware.vector.Email other", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "action.malware.vector.Other", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Unknown", "capability_id": "action.malware.vector.Unknown", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The malware action resulted in additional security access", "capability_id": "action.malware.result.Infiltrate", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The malware action exfiltrated data from the victim", "capability_id": "action.malware.result.Exfiltrate", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The malware action resulted in additional security permissions", "capability_id": "action.malware.result.Elevate", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The malware action used security access or permissions already acuired", "capability_id": "action.malware.result.Lateral movement", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "e.g. cryptomining, ransomware, etc", "capability_id": "action.malware.result.Deploy payload", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The result of the malware action is not listed", "capability_id": "action.malware.result.Other", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The result of the malware action is unknown", "capability_id": "action.malware.result.Unknown", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The malware action did not have a result", "capability_id": "action.malware.result.NA", "mapping_type": "non_mappable", "capability_group": "action.malware"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Handling of data in an unapproved manner", "capability_id": "action.misuse.variety.Data mishandling", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Inappropriate use of email or IM", "capability_id": "action.misuse.variety.Email misuse", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Storage or distribution of illicit content", "capability_id": "action.misuse.variety.Illicit content", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Abuse of private or entrusted knowledge", "capability_id": "action.misuse.variety.Knowledge abuse", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Inappropriate use of network or Web access including cloud services", "capability_id": "action.misuse.variety.Net misuse", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Abuse of physical access to asset", "capability_id": "action.misuse.variety.Possession abuse", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Abuse of system access privileges", "capability_id": "action.misuse.variety.Privilege abuse", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Actor photographs the confidentiality data variety.", "capability_id": "action.misuse.variety.Snap picture", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Use of unapproved hardware or devices", "capability_id": "action.misuse.variety.Unapproved hardware", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Use of unapproved software or services", "capability_id": "action.misuse.variety.Unapproved software", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Unapproved workaround or shortcut", "capability_id": "action.misuse.variety.Unapproved workaround", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "action.misuse.variety.Other", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Unknown", "capability_id": "action.misuse.variety.Unknown", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Local network access within corporate facility", "capability_id": "action.misuse.vector.LAN access", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Non-corporate facilities or networks", "capability_id": "action.misuse.vector.Non-corporate", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Physical access within corporate facility", "capability_id": "action.misuse.vector.Physical access", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Remote access connection to corporate network (i.e. VPN)", "capability_id": "action.misuse.vector.Remote access", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Web application", "capability_id": "action.misuse.vector.Web application", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "action.misuse.vector.Other", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Unknown", "capability_id": "action.misuse.vector.Unknown", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Do not use. Misuse inherently implies having permission so none can be gained.", "capability_id": "action.misuse.result.Infiltrate", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The misuse action exfiltrated data from the victim", "capability_id": "action.misuse.result.Exfiltrate", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Do not use. Misuse inherently implies having permission so none can be elevated.", "capability_id": "action.misuse.result.Elevate", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The misuse action used security access or permissions already acuired", "capability_id": "action.misuse.result.Lateral movement", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "e.g. cryptomining, ransomware, etc", "capability_id": "action.misuse.result.Deploy payload", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The result of the misuse action is not listed", "capability_id": "action.misuse.result.Other", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The result of the misuse action is unknown", "capability_id": "action.misuse.result.Unknown", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The misuse action did not have a result", "capability_id": "action.misuse.result.NA", "mapping_type": "non_mappable", "capability_group": "action.misuse"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Baiting (planting infected media)", "capability_id": "action.social.variety.Baiting", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Bribery or solicitation", "capability_id": "action.social.variety.Bribery", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Elicitation (subtle extraction of info through conversation)", "capability_id": "action.social.variety.Elicitation", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Extortion or blackmail", "capability_id": "action.social.variety.Extortion", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Influence tactics (Leveraging authority or obligation, framing, etc)", "capability_id": "action.social.variety.Influence", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Propaganda or disinformation", "capability_id": "action.social.variety.Propaganda", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Online scam or hoax (e.g., scareware, 419 scam, auction fraud)", "capability_id": "action.social.variety.Scam", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Spam (unsolicited or undesired email and advertisements)", "capability_id": "action.social.variety.Spam", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "action.social.variety.Other", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Unknown", "capability_id": "action.social.variety.Unknown", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Documents", "capability_id": "action.social.vector.Documents", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Instant messaging", "capability_id": "action.social.vector.IM", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "In-person", "capability_id": "action.social.vector.In-person", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Phone", "capability_id": "action.social.vector.Phone", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Removable storage media", "capability_id": "action.social.vector.Removable media", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "SMS or texting", "capability_id": "action.social.vector.SMS", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Social media or networking", "capability_id": "action.social.vector.Social media", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Software", "capability_id": "action.social.vector.Software", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Website", "capability_id": "action.social.vector.Website", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "action.social.vector.Other", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Unknown", "capability_id": "action.social.vector.Unknown", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Auditor", "capability_id": "action.social.target.Auditor", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Call center staff", "capability_id": "action.social.target.Call center", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Cashier, teller or waiter", "capability_id": "action.social.target.Cashier", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Customer (B2C)", "capability_id": "action.social.target.Customer", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Software developer", "capability_id": "action.social.target.Developer", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "End-user of the victim's products and/or services. Child of 'End-user or employee'", "capability_id": "action.social.target.End-user", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "End-user or regular employee not otherwise listed. Parent of 'End-user' or 'Other employee'", "capability_id": "action.social.target.End-user or employee", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Senior staff with legal responsibility such as board members and corporate officers", "capability_id": "action.social.target.Executive", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Finance or accounting staff", "capability_id": "action.social.target.Finance", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Former employee", "capability_id": "action.social.target.Former employee", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Security guard", "capability_id": "action.social.target.Guard", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Helpdesk staff", "capability_id": "action.social.target.Helpdesk", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Human resources staff", "capability_id": "action.social.target.Human resources", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Maintenance or janitorial staff", "capability_id": "action.social.target.Maintenance", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Manager or supervisor", "capability_id": "action.social.target.Manager", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Regular employee not otherwise listed. Child of 'End-user or employee'", "capability_id": "action.social.target.Other employee", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Partner (B2B)", "capability_id": "action.social.target.Partner", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "System or network administrator", "capability_id": "action.social.target.System admin", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "action.social.target.Other", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Unknown", "capability_id": "action.social.target.Unknown", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The social action resulted in additional security access", "capability_id": "action.social.result.Infiltrate", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The social action exfiltrated data from the victim", "capability_id": "action.social.result.Exfiltrate", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The social action resulted in additional security permissions", "capability_id": "action.social.result.Elevate", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The social action used security access or permissions already acuired", "capability_id": "action.social.result.Lateral movement", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "e.g. cryptomining, ransomware, etc", "capability_id": "action.social.result.Deploy payload", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The result of the social action is not listed", "capability_id": "action.social.result.Other", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The result of the social action is unknown", "capability_id": "action.social.result.Unknown", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The social action did not have a result", "capability_id": "action.social.result.NA", "mapping_type": "non_mappable", "capability_group": "action.social"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Initiate fraudulent transaction", "capability_id": "attribute.integrity.variety.Fraudulent transaction", "mapping_type": "non_mappable", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Hardware tampering or physical alteration", "capability_id": "attribute.integrity.variety.Hardware tampering", "mapping_type": "non_mappable", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Software installation or code modification", "capability_id": "attribute.integrity.variety.Software installation", "mapping_type": "non_mappable", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Other", "capability_id": "attribute.integrity.variety.Other", "mapping_type": "non_mappable", "capability_group": "attribute.integrity"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "No type of development was necessary", "capability_id": "value_chain.development.variety.NA", "mapping_type": "non_mappable", "capability_group": "value_chain.development"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Command and control. Separate from distribution of mawlare or bots, this is how they are maintained", "capability_id": "value_chain.non-distribution services.variety.C2", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Services for testing if malware is detected by anti-virus", "capability_id": "value_chain.non-distribution services.variety.Counter AV", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "DNS services including fast flux", "capability_id": "value_chain.non-distribution services.variety.DNS", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Something kept in the custody of a third party until a condition has been fulfilled.", "capability_id": "value_chain.non-distribution services.variety.Escrow", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "i.e. converting hashes into the text that produce them", "capability_id": "value_chain.non-distribution services.variety.Hashcracking", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Use of a marketplace was required as part of this incident.", "capability_id": "value_chain.non-distribution services.variety.Marketplace", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "A proxy service (either formally or informally hosted) is used by the actor to obscure their source", "capability_id": "value_chain.non-distribution services.variety.Proxy", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "A VPN service (either formally or informally hosted) is used by the actor to obscure their source", "capability_id": "value_chain.non-distribution services.variety.VPN", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "No type of non-distribution service was necessary", "capability_id": "value_chain.non-distribution services.variety.NA", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Nothing is known about the need for or type of non-distribution service investment other than it was present.", "capability_id": "value_chain.non-distribution services.variety.Unknown", "mapping_type": "non_mappable", "capability_group": "value_chain.non-distribution_services"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Credentials the system came with", "capability_id": "value_chain.targeting.variety.Default credentials", "mapping_type": "non_mappable", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Knowledge of system misconfigurations used to pick an organization as a target", "capability_id": "value_chain.targeting.variety.Misconfigurations", "mapping_type": "non_mappable", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The actor used access to a partner to target the victim.", "capability_id": "value_chain.targeting.variety.Partner", "mapping_type": "non_mappable", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Knowledge of software vulnerabilities, both at an organization or associated with a specific vendor's product, used to pick them as a target.", "capability_id": "value_chain.targeting.variety.Vulnerabilities", "mapping_type": "non_mappable", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Knowledge of weaknesses other than vulnerability and misconfigurations used to pick an organization as a target", "capability_id": "value_chain.targeting.variety.Weaknesses", "mapping_type": "non_mappable", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "No type of targeting was necessary. (This includes targeted.Targeted since the victim was chosen without targeting.", "capability_id": "value_chain.targeting.variety.NA", "mapping_type": "non_mappable", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The variety of targeting was known, but is not listed", "capability_id": "value_chain.targeting.variety.Other", "mapping_type": "non_mappable", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Nothing is known about the need for or type of targeting investment other than it was present.", "capability_id": "value_chain.targeting.variety.Unknown", "mapping_type": "non_mappable", "capability_group": "value_chain.targeting"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Distributed directly from the actor's computer", "capability_id": "value_chain.distribution.variety.Direct", "mapping_type": "non_mappable", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Distribution by email including anonymous/one time and spam", "capability_id": "value_chain.distribution.variety.Email", "mapping_type": "non_mappable", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "malware that loads other malware", "capability_id": "value_chain.distribution.variety.Loader", "mapping_type": "non_mappable", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "The actor distributed the attack to the victim through a partner, (i.e. supply chain attack).", "capability_id": "value_chain.distribution.variety.Partner", "mapping_type": "non_mappable", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "Distribution over the Plain Old Telephone System (POTS).", "capability_id": "value_chain.distribution.variety.Phone", "mapping_type": "non_mappable", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "No type of distribution was necessary", "capability_id": "value_chain.distribution.variety.NA", "mapping_type": "non_mappable", "capability_group": "value_chain.distribution"}, {"comments": "", "attack_object_id": null, "attack_object_name": null, "references": null, "capability_description": "", "capability_id": "attribute.confidentiality.data_disclosure", "mapping_type": "non_mappable", "capability_group": "attribute.confidentiality"}]}